OpenAI Patches Two Codex Sandbox Escapes, Including Host Command Execution
Researchers disclosed two patched OpenAI Codex sandbox escapes, including a flaw that could let a malicious repository trigger commands on a developer’s host from the strictest sandbox mode.
[MEDIUM] – OpenAI Publishes Model Misalignment Reporting Framework
OpenAI introduced a framework and six reports covering observed unexpected or concerning model behavior.
[HIGH] – Mandiant Details AI Coding Session Compromise
Mandiant describes a compromised AI coding session that led to a supply-chain worm spreading across repositories.
[CRITICAL] – Issabel Framework JWT Flaw Under Active Exploitation
A hard-coded JWT key in Issabel Framework can enable unauthenticated remote command execution.
[CRITICAL] – Cisco ISE Authentication Bypass Under Active Exploitation
Cisco urges immediate updates for an actively exploited ISE and ISE-PIC authentication-bypass vulnerability.
[HIGH] – UK and Allies Detail Iranian CHOSEN BRICK Spyware Campaign
UK, U.S., and Dutch agencies detailed Iranian spyware targeting dissidents, activists, and journalists.
[HIGH] – CenterPoint Energy Confirms Customer Data Theft
CenterPoint Energy confirmed an unauthorized party obtained some customer personal information through an external-facing system.
[HIGH] – Twitch Extension With 30,000 Installs Exposes OAuth Tokens
A Twitch browser extension with over 30,000 installs exposed OAuth tokens through proxy requests.
[HIGH] – Oracle Releases September Critical Security Patch Update
Oracle's September Critical Security Patch Update delivers 673 security fixes across product families.
[HIGH] – Parallels Desktop Root Escalation Exposes macOS Hosts
JFrog disclosed a local Parallels Desktop flaw allowing unprivileged macOS users to execute code as root.