https://www.pk-sharma.com/briefing/beta9-three-cvss-9-9-flaws-let-one-tenant-reach-the-worker-as-root-and-its-service-account-token P.K. Sharma en 2026-11-01T21:53:05Z Beta9's three CVSS 9.9 flaws let a workspace token reach the shared worker as root, the CVE records say https://www.pk-sharma.com/briefing/prefab-ui-cve-2026-120338-generative-ui-sandbox-let-llm-written-code-write-files-on-the-host P.K. Sharma en 2026-11-01T21:49:30Z Prefab UI's sandbox for model written code let FastMCP tool callers write host files, CVE-2026-120338 says https://www.pk-sharma.com/briefing/thales-sentinel-keys-server-cve-2026-78403-one-http-request-to-system-on-windows P.K. Sharma en 2026-11-01T14:42:34Z One HTTP request with no login may run code as SYSTEM on Thales Sentinel Keys Server, the CVE record says https://www.pk-sharma.com/briefing/pgadmin-4-9-19-fixes-15-cves-database-role-could-run-commands-on-the-pgadmin-host P.K. Sharma en 2026-11-01T14:41:33Z pgAdmin 4 9.19 fixes 15 CVEs; the worst let an ordinary user's query export run commands on the pgAdmin host https://www.pk-sharma.com/briefing/lxd-microcloud-cve-2026-112816-cvss-10-trusted-client-impersonation-public-certificate-in-chain P.K. Sharma en 2026-11-01T11:06:11Z LXD and MicroCloud trusted any certificate in a client's chain, so a public certificate could log in as it https://www.pk-sharma.com/briefing/fbi-attributes-binance-6-billion-theft-to-north-korea-tradertraitor-laundering-addresses-published P.K. Sharma en 2026-11-01T11:01:18Z FBI says North Korea stole more than $6 billion from Binance and lists 628 addresses to block https://www.pk-sharma.com/briefing/northflank-says-assume-all-environment-variables-decrypted-customers-report-ai-api-key-misuse-no-route-or-count-stated P.K. Sharma en 2026-10-31T20:16:59Z Northflank says assume all environment variables were decrypted; AI key misuse reported, no route or count https://www.pk-sharma.com/briefing/android-sms-of-death-zero-click-wap-push-crash-fix-in-october-source-not-in-bulletin-android-12-13-none-cve-reserved P.K. Sharma en 2026-10-31T20:08:34Z Android 'SMS of Death' exploit is public: fix is in October's code, not Google's bulletin; CVE only reserved https://www.pk-sharma.com/briefing/talos-volta-infostealer-sends-stolen-data-to-an-llm-to-rank-victim-assets-three-model-fallback-what-talos-found P.K. Sharma en 2026-10-31T14:59:48Z Talos says VOLTA stealer has an LLM rank victims' assets and falls back across 3 models; one sample listed https://www.pk-sharma.com/briefing/chainalysis-intrusion-offensive-agentic-techniques-names-emails-role-labels-accessed-no-route-or-count-stated P.K. Sharma en 2026-10-31T14:57:19Z Chainalysis says an actor using "offensive agentic techniques" accessed customer names, emails and role labels https://www.pk-sharma.com/briefing/cloudflare-says-no-interception-seen-from-emudhra-weak-keys-over-half-of-large-network-probes-trust-them P.K. Sharma en 2026-10-31T11:43:09Z Cloudflare: no interception seen from eMudhra's weak keys, yet over half of large network probes trust them https://www.pk-sharma.com/briefing/cloudflare-ddos-threat-report-2026-q3-8200-attacks-per-hour-swarms-fewer-giants-what-the-report-says P.K. Sharma en 2026-10-31T11:42:00Z Cloudflare's Q3 DDoS report counts 18.2 million network layer attacks, 96% under 10 minutes: what it measures https://www.pk-sharma.com/briefing/parameter-labs-chatgpt-shared-link-attacker-code-mathlive-postmessage-openai-fixed-p1-what-the-writeup-says P.K. Sharma en 2026-10-31T11:40:44Z Parameter Labs says a shared ChatGPT link could run attacker code via MathLive postMessage; OpenAI fixed, P1