GitLab’s Claude Agent Read User-Controlled Configuration. Developer Access Reached Arbitrary CI Commands.
GitLab patched a Duo Claude flaw that let a Developer turn user-controlled configuration into arbitrary commands inside a CI job.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
McKesson Confirmed the Data Left. ShinyHunters Claims 284 Million Patient-Data Rows.
McKesson confirmed unauthorised access to third-party applications and data exfiltration. ShinyHunters claims 284 million patient-related data rows, but the scale and data types remain unverified.
$20,000 Humanoid Robot, $0 Authentication: Bluetooth to Root
Two independent flaws let network-adjacent or Bluetooth-range attackers reach root on a Unitree G1 EDU robot.
TeamSystem Attackers Stole the Data That Makes Fake Invoices Look Real
TeamSystem attackers reportedly stole IBANs and accounting records, giving criminals the context needed to make invoice fraud look routine.
WordPress Registration Was Disabled. GiveWP Still Created the Account and Reached Server Commands.
GiveWP CVE-2026-82222 chains plugin-specific account creation, stored PHP objects and a shipped gadget chain into unauthenticated server command execution. Version 4.16.7.2 fixes it.
130 Tech Companies Say We Have Months to Prepare. Their Letter Includes No Deadlines
More than 130 organisations warn that defenders have only months to prepare, but their voluntary pledge includes no deadlines.
The Bug Was Three Years Old. Attackers Could Still Treat ownCloud as Their File System.
CISA says attackers are exploiting a critical ownCloud WebDAV authentication bypass first disclosed in 2023. A known username and a missing signing key can expose a user's files without authentication.
A Local IPv6 Packet Became a Route From an Unprivileged Container to the Linux Host.
CISA confirms active exploitation of Linux kernel CVE-2026-53362. A public IPv6 fragmentation exploit can turn local access into root and, under specific conditions, escape an unprivileged container.
Your ‘American’ AI Model May Still Have Chinese DNA
Cisco warns that model publishers and country labels can hide inherited weights, training data and upstream dependencies.
Veeam ONE Fixed a CVSS 10 RCE. Another Flaw Can Coerce SMB Authentication
Veeam ONE patches close a CVSS 10 unauthenticated RCE, arbitrary file read, SQL injection and a 9.3 flaw that can coerce SMB authentication.