Topic · 60 stories · page 3 of 3
60 stories tagged security on AI Tamer, newest first.
When AI agents send each other messages, the old queueing problems come back with new twists: a message delivered but never read, a duplicate that repeats an action, and a relayed yes that nobody actually gave.
Agent logs are tempting to fill with everything: prompts, tool calls, environment, full requests. A short list of what must never land in them, and why scrubbing has to happen before the write.
JVN#22475874 (2026-09-29): seven Pgpool-II CVEs; lead CVE-2026-92867 authenticated OOB write (CVSS 4.0 8.7 / 3.0 8.8)—process termination and arbitrary code execution. Fixed in 4.7.3, 4.6.8, 4.5.13, 4.4.18, 4.3.21.
Redis advisory CVE-2026-81934 (Aug 28, 2026): authenticated TLS pending-data use-after-free; public CVSS revised 9.8→7.5 High. Upgrade OSS/Software builds; Cloud Essentials patched, Pro underway.
A practical review order for AI-generated code: check the diff, test the behavior, verify APIs and errors, then inspect security-sensitive paths.
Redis operator 7.22.2-45 (Sep 2026) fixes a high-severity Active-Active bug: GitOps/config updates could send an empty password—DB stayed healthy while accepting unauthenticated clients. No CVE for this bug.
Weaviate v1.39.3 (Oct 1, 2026) fixes a High CVSS 7.1 credential disclosure in text2vec-google, multi2vec-google, and generative-google. Impacted: < v1.39.3. CVE pending MITRE assignment.
Threat Signals GA free for every Cloudflare account (blog Sep 29, 2026): 1 RSS feed on free tier, private dataset up to 30 days, Threat Events access. RSS→Browser Run→IOC→Threat Events→WAF as CF describes—no latency/accuracy SLAs; review before block.
PgBouncer 1.26.0 (Sep 23, 2026) fixes CVE-2026-19888, CVE-2026-6668, and CVE-2026-6669 (DoS only: crash, infinite loop, unbounded login work; no RCE or CVSS). Also: pool_idle_timeout and query_wait_timeout; -R removed.
OpenAI says it disrupted a July 2026 adversarial distillation campaign that sought protected reasoning via ToS-violating interaction patterns—not a crypto/DB breach. Core cluster attributed to individuals associated with Moonshot AI (Kimi); volumes are attempted extractions.
A vector index has no row-level security by default, and a missing filter leaks data without an error. The isolation levels, what each engine offers, and how to lay out collections, namespaces and metadata.
At DevDay 2026 OpenAI turned Codex cloud from one throwaway sandbox per task into published setups with saved per-task state. What changed, what it costs you, and what it still cannot do.
