https://www.pk-sharma.com/briefing/synology-warns-of-ransomware-on-outdated-dsm-nas-c3rb3r-patched-in-2024-no-cve-named P.K. Sharma en 2026-11-02T11:59:30Z Synology warns of ransomware attacks on outdated DSM through a flaw patched in 2024, and names no CVE https://www.pk-sharma.com/briefing/deepseek-dsh-superagent-coding-agent-takes-work-from-team-chat-who-can-ask-and-who-merges P.K. Sharma en 2026-11-02T10:28:43Z DeepSeek's repository says lists decide who can ask its coding agent, and its workers run with full access https://www.pk-sharma.com/briefing/aur0ra-ransomware-gold-ogre-ai-agents-mapped-networks-and-hunted-credentials-what-sophos-found P.K. Sharma en 2026-11-02T10:28:39Z Sophos says Aur0ra ransomware operators let AI agents do the network work after a red team cover story https://www.pk-sharma.com/briefing/wso2-cve-2025-11969-system-rest-apis-let-lower-privilege-users-run-administrative-actions P.K. Sharma en 2026-11-02T10:21:11Z WSO2 says low privilege users could run admin actions on its System REST APIs; its advisory is 280 days old https://www.pk-sharma.com/briefing/beta9-three-cvss-9-9-flaws-let-one-tenant-reach-the-worker-as-root-and-its-service-account-token P.K. Sharma en 2026-11-01T21:53:05Z Beta9's three CVSS 9.9 flaws let a workspace token reach the shared worker as root, the CVE records say https://www.pk-sharma.com/briefing/prefab-ui-cve-2026-120338-generative-ui-sandbox-let-llm-written-code-write-files-on-the-host P.K. Sharma en 2026-11-01T21:49:30Z Prefab UI's sandbox for model written code let FastMCP tool callers write host files, CVE-2026-120338 says https://www.pk-sharma.com/briefing/thales-sentinel-keys-server-cve-2026-78403-one-http-request-to-system-on-windows P.K. Sharma en 2026-11-01T14:42:34Z One HTTP request with no login may run code as SYSTEM on Thales Sentinel Keys Server, the CVE record says https://www.pk-sharma.com/briefing/pgadmin-4-9-19-fixes-15-cves-database-role-could-run-commands-on-the-pgadmin-host P.K. Sharma en 2026-11-01T14:41:33Z pgAdmin 4 9.19 fixes 15 CVEs; the worst let an ordinary user's query export run commands on the pgAdmin host https://www.pk-sharma.com/briefing/lxd-microcloud-cve-2026-112816-cvss-10-trusted-client-impersonation-public-certificate-in-chain P.K. Sharma en 2026-11-01T11:06:11Z LXD and MicroCloud trusted any certificate in a client's chain, so a public certificate could log in as it https://www.pk-sharma.com/briefing/fbi-attributes-binance-6-billion-theft-to-north-korea-tradertraitor-laundering-addresses-published P.K. Sharma en 2026-11-01T11:01:18Z FBI says North Korea stole more than $6 billion from Binance and lists 628 addresses to block https://www.pk-sharma.com/briefing/northflank-says-assume-all-environment-variables-decrypted-customers-report-ai-api-key-misuse-no-route-or-count-stated P.K. Sharma en 2026-10-31T20:16:59Z Northflank says assume all environment variables were decrypted; AI key misuse reported, no route or count https://www.pk-sharma.com/briefing/android-sms-of-death-zero-click-wap-push-crash-fix-in-october-source-not-in-bulletin-android-12-13-none-cve-reserved P.K. Sharma en 2026-10-31T20:08:34Z Android 'SMS of Death' exploit is public: fix is in October's code, not Google's bulletin; CVE only reserved