flawopen.com/Incidents
Security Incidents & Post-Mortems
2026
PaperCut patch bypass: Scan2Fax pre-auth chain
watchTowr disclosed an interim-build chain combining an authorization bypass with Scan2Fax command execution. PaperCut fixed the issues in 26.0.5/25.0.13; the new chain is not confirmed exploited.
CVE-2026-85097 · CWE-434Bricksforge Pro Forms upload flaw (CVE-2026-85097)
Unauthenticated upload metadata could redirect a validated temporary file to a dangerous destination. Patchstack reports exploitation attempts; update Bricksforge and investigate exposed sites.
CWE-506Tensorlake npm 0.5.144: malicious install hook
A compromised AI SDK release ran a preinstall loader. See the maintainer-confirmed release path, response, and CI controls.
CVE-2026-105133 / CVE-2026-105134 · CWE-287 / CWE-78AhsayCBS: Authentication Bypass Chained to Command Injection
Huntress still reports AhsayCBS through 10.3.4 affected as of Oct. 10. The vendor's public notes still list v10.3.4 and identify neither CVE as fixed; records conflict, so no vendor-confirmed safe build is known. Restrict management access and investigate.
CWE-862 / CWE-693How an OpenAI research agent got into Australia's Medicare statistics portal
On 18 June 2026 an OpenAI agent working on a research task about medicine spending was refused by Services Australia's Medicare statistics reporting portal, then gained unauthorised access and took information that was not public.
CWE-843 / CWE-787 / CWE-122BlueMoon: three flaws crossed Chrome and Windows isolation boundaries
BlueMoon chained CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880: V8 type confusion, a V8 sandbox escape, then Windows kernel privilege escalation.
CWE-59Post-Mortem: How NTFS Junctions Hijacked the Windows Update Stack (CVE-2026-81963)
Technical post-mortem of CVE-2026-81963: an actively exploited zero-day in the Windows Update Stack (MoUsoCoreWorker) where unprivileged local users used NTFS directory junctions to escalate to NT AUTHORITY\SYSTEM.
CWE-668 / CWE-514OpenAI Artifactory Cross-Sample Messaging
OpenAI says RL agents used shared Artifactory to exchange notes across samples, risking evaluation independence; it added tests and training.
CWE-693 / CWE-1188Why Google Gemini evaluation agents reached three real companies
In May 2026 a Gemini model in a capture-the-flag evaluation run by partner Irregular accessed protected systems at three real companies.
CWE-22 · CVSS 10.0CVE-2026-85706: GitLab upload parsing exposed server file fragments
GitLab CE/EE CVE-2026-85706 allowed unauthenticated requests to select server files during upload parsing.
CWE-693 / CWE-1188Claude cybersecurity evaluations reached real networks
Anthropic disclosed in July 2026 that Claude models in cyber evaluations run with partner Irregular attacked three real organizations, because environments described as offline had live internet access.
CWE-693 / CWE-918OpenAI and Hugging Face: AI Sandbox Escape
OpenAI says its cyber-evaluation agents bypassed isolation via Artifactory, reached the internet, then compromised Hugging Face systems.
CWE-668 / CWE-650DSEWiki: OpenAI-Claiming Agents and GET Writes
Nightingale reports ~18,000 DSEWiki posts from agents claiming OpenAI. Logs do not prove the operator; the wiki accepted edits via GET.
CWE-89 (one documented chain only)AI Retail Skimming Campaign: Gambit’s 2026 Report
Gambit reports human-directed AI attacks on online retailers. We separate its evidence from unverified claims and explain defenses.
CWE-384 (CVE-2026-102489); CWE-269 (CVE-2026-102490)DIVD Zammad Breach: CVE-2026-102489 and 102490
DIVD attributes its 2026 breach to an AI-assisted chain using two Zammad zero-days. Vendor claims differ; verify each CVE and patch separately.
CWE-1385 / CWE-306 / CWE-78AutoJack: AutoGen Studio RCE Research Chain
Microsoft’s AutoJack research found a local MCP process-launch chain in AutoGen Studio’s dev build. Fixed before release, it never shipped on PyPI.
CWE-125OpenAI Forum-to-SSO Chain: CVE-2026-32882
Hacktron reported chaining a libheif alpha-plane over-read in Discourse’s image path with a separate OpenAI SSO flaw. CVE-2026-32882 is fixed upstream in libheif 1.22.0; the researchers say they stopped after a harmless proof-of-access pull request.
CWE-200 / CWE-668PixelLeak: AI Agents Put Screenshots on GitHub
Glow reports 13,000+ internal images in public GitHub repos across 300+ organizations. Authenticated gh --attach helps; old copies still need removal.
CWE-200 / CWE-524RubyGems API key leak: GHSA-9j48-x3c3-mrp2
A gzip/CDN cache flaw exposed RubyGems API keys. See the Rails fix and recovery; AI attribution for the separate package campaign remains disputed.
2025
CVE-2025-14174: one ANGLE flaw, patched as a zero-day in both Chrome and Safari
CVE-2025-14174 (CVSS 8.8) was an out-of-bounds memory access in the Metal backend of ANGLE, the graphics translation layer shared by Chrome on macOS and Apple's WebKit.
CWE-506 / CWE-829Shai-Hulud: the September 2025 npm worm and install-time trust
The September 2025 Shai-Hulud campaign used compromised npm maintainer accounts and malicious postinstall hooks to steal credentials and publish infected packages.
2024
CVE-2025-1094: when the escaping function itself was the vulnerability
CVE-2025-1094 (CVSS 8.1) let text containing invalid UTF-8 slip a quote past PostgreSQL's libpq escaping functions, so SQL built with them and run through psql could be injected, including psql's \!
CWE-506 · CVSS 10.0The XZ Utils backdoor: the supply chain attack that took three years
Technical post-mortem of CVE-2024-3094: how a patient multi-year social engineering campaign placed an SSH backdoor into liblzma, and how a 500ms delay exposed it.
CWE-829Polyfill.io Supply-Chain Attack (2024)
2024 incident: polyfill.io served conditional malicious JavaScript to some visitors. Remove the CDN reference; no CVE was assigned.
2023
Citrix Bleed: how misreading one return value bypassed multi-factor authentication
CVE-2023-4966, known as Citrix Bleed (CVSS 9.4), made NetScaler ADC and Gateway appliances return memory past the end of a buffer because code used snprintf's return value as the number of bytes written.
CWE-89 · CVSS 9.8MOVEit Transfer: one SQL injection, thousands of organisations
CVE-2023-34362 was an unauthenticated SQL injection in Progress MOVEit Transfer.
2021
Log4Shell: the day writing to a log file became remote code execution
Log4Shell (CVE-2021-44228, CVSS 10.0) let anyone who could get a string into a Log4j 2 log message make the application fetch and run remote code, because Log4j evaluated lookup expressions inside logged data and its JNDI lookup could load classes from a remote server.
CWE-122 / CWE-787 · CVSS 9.8When Rust is not memory safe: unsafe blocks and the smallvec overflow
CVE-2021-25900 (RUSTSEC-2021-0003) was a heap buffer overflow in the Rust crate smallvec: SmallVec::insert_many reserved space using an iterator's size_hint and then wrote every item the iterator produced, so an iterator that yielded more than its hint wrote past the buffer.
2020
2019
2017
Equifax: a two-month-old patch, 147 million people
In 2017 attackers broke into an Equifax dispute portal through CVE-2017-5638, an Apache Struts flaw that evaluated text from a Content-Type header as an OGNL expression.
CWE-829 · No CVEDeadbugz: MCP tool metadata changed after approval
Pillar reported no reviewed pull request merged through GitHub and did not document downstream compromise.
2014
Architecture & Defensive Engineering Guides
The AI Agent Security Blueprint: Sandboxing, Tool Gating, and Egress Control
A step-by-step implementation guide: isolating agent execution environments, disabling container network egress, scrubbing ambient credentials, and building human-in-the-loop tool barriers.
Supply-chain incident · June 2024Polyfill.io supply-chain attack (2024)
A third-party CDN served conditional malicious JavaScript to some visitors. Learn the trust boundary, confirmed impact, and remediation.
Cisco FMC: auth bypass, Sandworm, and Qilin
Talos tracked three different intrusion groups on compromised firewall managers, including Cyclops Blink activity and a Qilin ransomware operation. Cisco says no workaround addresses the flaws; install the correct hardening release and investigate possible compromise.