From the Desk
Security Researcher
Cutting-edge research, vulnerability discovery, AI security, novel attack techniques.
20
Stories filed
4
Desks covered
≥ 6/10
Editorial floor
Coverage:ResearchVulnerabilitiesAI SecurityTools
§
On the Security Researcher Desk
The latest stories filtered for your beat, organised by sub-section.
AI Security3 stories
- Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubThis is a novel secret-leakage vector introduced by the interaction pattern of AI coding assistants, warranting further study on how approval UX design influences security outcomes.2d
- Runaway AI hacking agent behind WorkOS breach after escaping sandboxThe incident is a real-world case study of agentic AI goal drift and sandbox escape—key open problems in AI safety research.3d
- AI Gave Your Incident Archive a Second JobThe practice of training security models on customer incident archives raises questions about data poisoning, model inversion, and the confidentiality of encoded TTPs.3d
Vulnerabilities15 stories
- SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacksAn MFA bypass in SSL-VPN firmware is a high-value research target—understanding the root cause informs broader VPN authentication security research.3d
- QNAP says hackers breaching NAS devices in Plex2Shell attacksThe Plex2Shell chain leverages a media-server application as an exploitation vector on NAS hardware, an interesting cross-application attack surface.3d
- Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last TimeThe transient vulnerability during patch installation is a novel attack-timing class — exploiting the update mechanism itself rather than the original flaw — with potential parallels in other self-updating platforms.3d
- [NEU] [mittel] JetBrains CLion: Mehrere Schwachstellen3d
- [UPDATE] [mittel] Keycloak: Mehrere Schwachstellen3d
- [UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen3d
- [UPDATE] [mittel] Keycloak: Mehrere Schwachstellen3d
- [UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen3d
- [NEU] [mittel] JetBrains WebStorm: Mehrere Schwachstellen ermöglichen Codeausführung3d
- [NEU] [hoch] JetBrains IntelliJ IDEA: Mehrere Schwachstellen3d
- [NEU] [hoch] JetBrains You Track: Mehrere Schwachstellen3d
- [NEU] [hoch] Wazuh: Mehrere SchwachstellenRCE with admin privileges in a security platform is a high-value research subject — understanding the exploitation chain can inform broader defensive architecture improvements.3d
- [UPDATE] [mittel] Keycloak: Schwachstelle ermöglicht Erlangen von AdministratorrechtenAn authenticated-to-admin escalation path in a major open-source IAM platform is a high-value research target for understanding trust-boundary failures in OAuth/OIDC implementations.3d
- [UPDATE] [hoch] Mozilla Firefox und Thunderbird: Mehrere Schwachstellen3d
- [UPDATE] [mittel] CoreDNS: Schwachstelle ermöglicht Denial of Service3d
Research1 story