Threat Library

Researchers demonstrated a remote Spectre-class microarchitectural side-channel attack against Cloudflare Workers that allows a malicious Worker to leak secret data, including JSON Web Tokens, from a co-located victim Worker in production at up to 12 bits per second. This represents a 360x throughput improvement over a 2021 proof-of-concept and confirms that multi-tenant serverless/edge compute platforms remain vulnerable to cross-tenant speculative execution leakage despite existing mitigations.

Sakura Internet, a major Japanese cloud and data center provider, disclosed unauthorized access to its sales management system, exposing contract and membership data for up to 1.36 million accounts. The breach affects a company that provides hosting and cloud infrastructure to numerous business customers, raising downstream exposure concerns.

CISA has added CVE-2026-64849, a Server-Side Request Forgery (SSRF) vulnerability in MLflow, to its Known Exploited Vulnerabilities Catalog based on confirmed active exploitation. Federal agencies are required under BOD 26-04 to remediate this vulnerability on a prioritized basis, and CISA urges all organizations to do the same given active in-the-wild attacks.

IBM Langflow versions 1.0.0 through 1.10.0 expose a registration endpoint without proper authentication, allowing a remote attacker to overwrite the administrator's email address and abuse the server to send outbound mail as a relay. Because Langflow is widely used to build and orchestrate LLM agent flows, compromising its admin identity could give an attacker control over flow configuration, credentials, and connected tools.

The Splunk AI Toolkit's Agent Run History feature improperly swaps a user's session token for a system-level authentication token when executing searches, letting low-privileged users run searches and access data as if they were admins. This also lets unprivileged users read or delete other users' search jobs. It is a classic broken access control flaw in an AI agent management feature rather than a novel agentic-AI attack technique.

Threat actors are actively scanning for and exploiting a critical Server-Side Request Forgery (SSRF) vulnerability in MLflow, an open-source AI/ML lifecycle platform, to steal cloud credentials and secrets from exposed metadata services. A separate but related campaign is targeting FUXA, an open-source SCADA/HMI platform used in industrial automation. Both flaws are being weaponized in the wild according to watchTowr and VulnCheck.

Varonis Threat Labs disclosed three vulnerabilities, collectively named CoSnitch, in Microsoft Copilot Personal that could allow an attacker to exfiltrate data from a victim's connected apps and Copilot session with a single click on a crafted link. The flaws exploit an undocumented URL parameter surfaced by the assistant itself, enabling silent data leakage without further user interaction.

The Clop ransomware gang has deployed a custom Java-based web shell specifically engineered to target PTC Windchill and FlexPLM product lifecycle management servers. The tool is purpose-built to decrypt stored credentials, enumerate file repositories, and exfiltrate sensitive design and engineering data for extortion purposes. This represents an evolution in Clop's tactics toward targeted, application-specific tooling rather than generic ransomware payloads.

Multiple vulnerabilities have been disclosed in CISA's Malcolm network traffic analysis tool suite, including an unauthenticated-adjacent arbitrary PHP code execution flaw (CVE-2026-55676, CVSS 8.8), two nginx/Lua RBAC bypasses via URI normalization mismatches (CVE-2026-63177, CVE-2026-19670), a path traversal in archive extraction (CVE-2026-63134), and two resource-exhaustion/DoS flaws involving malicious archives and decompression bombs (CVE-2026-63133, CVE-2026-19671). Versions prior to 26.06.1/26.07.0/26.08.0 depending on the specific CVE are affected, with vendor patches available and no known public exploitation reported at this time.

Siemens Simcenter Femap and Simcenter Nastran versions prior to V2606 contain a stack-based buffer overflow vulnerability triggered when an application binary parses a malicious string as a file argument. Successful exploitation could allow an attacker to achieve remote code execution in the context of the current process, though exploitation requires user interaction (tricking a user into running the binary with a crafted argument).

A vulnerability in the Apify MCP server allowed a malicious Actor publisher to craft a URL that redirected the MCP client to an attacker-controlled server while the victim's Apify API bearer token was still attached to the request. Simply invoking or inspecting the malicious Actor via the MCP tool-loading paths caused the victim's credentials to be exfiltrated to a third-party host. This is a classic MCP tool-poisoning/SSRF hybrid where untrusted actor metadata influences a trusted connection's destination.

A flaw in the CodeWhale agent framework causes the exec_shell_interact tool to skip the mandatory human-approval step for code execution, defaulting it to auto-approved. This lets attacker-controlled content ingested by the agent (e.g., a malicious web page, MCP tool result, or repo file) inject commands that execute silently inside an already-approved privileged shell session such as sudo, ssh, or a database console. Fixed in version 0.8.64.

CodeWhale's rlm_eval tool is misconfigured to always auto-approve code execution, bypassing the user's approval policy entirely. An attacker who can plant instructions in content the agent reads (a webpage, repo file, or MCP tool result) can trigger arbitrary Python execution on the user's machine at the user's privilege level, with no prompt or audit trail. This is a straightforward and highly exploitable prompt-injection-to-RCE chain fixed in version 0.8.64.

Researchers at Wiz disclosed a GitHub Actions workflow injection vulnerability in Snowflake's public snowflake-connector-net repository, where a maliciously crafted GitHub issue could trigger command injection in a workflow that contained internal Jira credentials. Successful exploitation could allow an attacker to exfiltrate secrets and potentially compromise the CI/CD pipeline of a widely used Snowflake connector library.

A threat actor claims to be selling 3.6 million employee records allegedly exfiltrated from Microsoft Azure environments belonging to multiple Fortune 500 companies. The intrusion reportedly stemmed from compromised credentials rather than a platform vulnerability, highlighting ongoing risks around identity and access management in cloud tenants. The claim remains unverified but poses significant exposure risk if confirmed.

MLflow's model registry fails to properly validate ownership when creating a model version linked to a run_id or model_id, only checking path containment rather than authorization. This lets any authenticated user reference another user's artifact directory and read private files via the artifact-get API, bypassing READ permission checks.

Siemens Solid Edge SE2025 and SE2026 contain seven high-severity memory corruption vulnerabilities (CVSS 7.8) triggered when parsing specially crafted PAR, PSM, or DFT files, which could allow an attacker to crash the application or achieve arbitrary code execution in the context of the current process. Exploitation requires a user to open a malicious file, making this a local-vector, user-interaction-required threat rather than a remotely exploitable one. Siemens has released patched versions (SE2025 V225.0.15+ and SE2026 V226.0.7+) and organizations should update promptly.

A researcher known as Chaotic Eclipse released a public proof-of-concept called ShieldBreak that bypasses Microsoft's patch for CVE-2026-50656 (RoguePlanet), a Windows Defender vulnerability. The PoC reportedly grants SYSTEM-level access, meaning organizations that applied the original patch may still be exposed to full local privilege escalation.

ANDRITZ HIPASE-250 and 250 SCALA industrial control system products (versions <=7.20) contain four vulnerabilities including recoverable password storage, missing authentication on data/config endpoints, an unauthenticated logging manipulation endpoint, and a hard-coded VNC credential used across engineering workstation deployments. Successful exploitation could allow an attacker to read sensitive process data, access engineering workstations, suppress audit logs, or recover stored credentials. These are primarily energy-sector ICS/OT vulnerabilities with no reported public exploitation to date.

Flow Neuroscience FL-100 (and rebranded Halo Neuroscience FL-100) tDCS devices contain an undocumented hard-coded credential shared across all units, allowing any attacker within Bluetooth range to bypass authentication. Exploitation could let an attacker arbitrarily manipulate brain stimulation parameters and override built-in safety limits, posing direct physical harm risk to patients.