Why None of 12 AI Models Passed AWS’s Code-Review Trust Test
AWS tested 12 general-purpose AI models on vulnerable code and safe lookalikes. None met its simultaneous false-alarm and missed-bug target.
Security
Vulnerabilities, defensive security, architecture and operational security.
A Mirth Connect Login Could Turn Its Own Database Into a Public Download
A researcher exported Mirth Connect's configuration database into a public web folder in a controlled test. Two separate flaws reach exposed message channels without a login.
An Impostor Used a Real Government Email to Get Revolut’s Customer Records
A fraudulent request from a genuine government email domain persuaded Revolut to disclose sensitive customer records. The failure was in verifying who had authority to ask.
The Surfshark Server That Was Never Meant to Face the Internet
Surfshark says an internet-reachable engineering test server was accessed by an unauthorised party. It reports no user-data or VPN-service impact, but the incident exposed an important security gap.
Root on One Kubernetes Node Could Become Every Workload on It
Cryptographic workload identities cannot prove which process asked for them if an attacker controls the node making that claim. Unit 42 demonstrated the risk in SPIFFE/SPIRE.
Hackers Searched 1.8 Million Android Apps for the Keys to Someone Else’s Business
A working app can still expose a key to private systems. Anthropic describes a 1.8 million-APK credential hunt in Claude-assisted criminal operations, while separate cases show how quickly stolen tokens can become wider access.
A Million Fake CEO Emails Tried to Make Finance Pay a ServiceNow Invoice That Wasn’t Real
A million-plus email campaign combined fake executive approval, a forged ServiceNow invoice and an invented forwarded conversation to seek nearly $50,000 transfers.
The Hidden ChatGPT Task That Read Gmail While the User Saw a Normal Answer
Check Point used a shared internal package service to pass hidden tasks between separate ChatGPT accounts. In its demonstration, the victim saw a normal answer while Gmail data crossed the boundary.
One Police Login on a Personal Device Was Enough to Breach Florida’s DMV
Florida identified one compromised police login, improperly stored on an employee's personal device, as the route into its systems. The claimed scale of exposure remains unconfirmed.
The Ivanti ITSM Bugs That Let Strangers Run Code Before Login
Ivanti disclosed eight remote-code-execution flaws in Neurons for ITSM, two requiring no login. Cloud tenants were patched in August, but on-premises administrators must apply the right September patch.