Threat Wire

Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

Federal remediation due 2026-10-17

Martin Shkreli livestreamed himself violating lifetime pharma ban, FTC says

"I can always find a couple of biotech stocks to smoke," Shkreli said in a livestream.

Anthropic reinvents source control as Claude floods the world with code

When continuous integration gits you down, there's always an AI-tuned monorepo

OpenAI engineer arrested for allegedly planting spy device in office

A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversations. [...]

ESA targets Anbernic emulation handhelds as "superfake" piracy enablers

But third-party sellers, not Anbernic, are the ones routinely selling ROM-filled SD cards.

Topgolf saved over $11.3 million after leaving VMware

Topgolf and VMware "ran deep" before the migration.

Ghostscript flaw lets hackers hijack servers via PDF uploads

A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. [...]

Anthropic warns self-replicating AI could spread to your smart devices

Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers. [...]

CISA director touts private partnerships after agency killed many

Nick Andersen wants to work with private industry on security, but the Trump admin has taken an axe to such efforts.

OpenAI's dot assistant burned 300K+ tokens in a day without a single prompt

Geordie's tests recorded 155 activity traces and multiple subagents after dot was given read-only permissions

Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.

Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.

A denial-of-service issue in the dns implemenation could cause an infinite loop.

A denial-of-service issue in the dns implemenation could cause an infinite loop.

The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.

The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.

A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.

A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.

A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.

A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.

Parameters are not validated or sanitized, and are later used in various internal operations.

Parameters are not validated or sanitized, and are later used in various internal operations.

A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel,…

A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation.

Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]

Trump commercial railing against his enemies kept airing after court blocked it

US attorney apologized to court, said government has stopped running Trump ads.

Microsoft releases Windows 10 KB5126657 extended security update

Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]