Tag: 2026-q3

All the articles with the tag "2026-q3".

• A $25 Subscription Found the First Pre-Auth WordPress Core RCE in a Decade

  20 Jul, 2026

  Searchlight Cyber pointed GPT5.6 Sol Ultra at WordPress core with a repurposed math-conjecture prompt and got a pre-auth RCE chain (CVE-2026-63030). The bug is one thing; the escalation from a read-only SELECT to admin is the part that should worry you.

• The Attacker Had No Usage Policy. The Defenders' Model Did.

  19 Jul, 2026

  Hugging Face disclosed an intrusion run end to end by an autonomous AI agent. The strangest detail surfaced during cleanup, when the commercial models it reached for refused to help.

• Weekly Roundup: One Adverb, One Agent, and Twelve Hosted Runtimes

  10 Jul, 2026

  GitHub's injection scanner fell to the word 'Additionally', a single-agent red-teaming harness beat the swarm it shipped with, and the managed-agent market got mapped.

• Abnormal AI Is Transforming in Public. So Is Its Attack Surface.

  9 Jul, 2026

  Abnormal AI turned its internal AI-adoption experiments into a public content stream. It's a clever recruiting play, and a reconnaissance gift to the exact attackers Abnormal sells protection against.