-
About HexStrike AI : exploit the unvalidated subprocess[.]Popen command injection vulnerability (CVE-2026-90690 / CVE-2026-90619)
Source: Mitre, NVD – Published: 2026-09-13 Preface: HexStrike AI MCP Server is a popular and well-regarded open-source platform in the fields of cybersecurity and AI-assisted penetration testing. However, security researchers point out that while the platform is popular in lab environments and red team research, it also poses serious risks (e.g., improper configuration could lead…
-
CVE-2026-90648: A sandbox escape vulnerability exists in wasm2c of WebAssembly wabt (version 1.0.41 and earlier), which affects a wide range of technical fields.
Source: Mitre, NVD – Published: 2026-09-12 Preface: Automotive & Safety-Critical SystemsIn industries where software must comply with rigid safety certifications (such as ISO 26262 for automotive or DO-178C for aerospace), executing arbitrary code at runtime using a Just-In-Time (JIT) compiler is completely forbidden. The wasm2c Advantage: Since wasm2c acts entirely as an Ahead-Of-Time (AOT) translator…
-
CVE-2026-25281: CWE-770 within Qualcomm’s Out-of-Band Management (OOBM) technology area.
This article was published on September 14, 2026. Preface: The consumer-grade Snapdragon 8 Gen 3 processor is sometimes adapted for automotive smart cockpits. An automotive smart cockpit is an advanced in-vehicle digital system that combines hardware, software, artificial intelligence, and human-machine interfaces to connect drivers, passengers, and digital services. Yes, the Qualcomm FastConnect 7800 connectivity…
-
CVE-2026-43603: A NULL pointer dereference in the Linux GPU driver – AMD ID: AMD-SB-6034 (11th Sep 2026)
Preface: Linux GPU Driver NULL Pointer Dereference – AMD. This is not a vulnerability caused by a user passing in a malicious memory pointer (as mentioned in the previous question, it is not a direct error in the copy_from_user stage), but a standard kernel panic caused by “internal state lookup failure (Lookup Returns NULL), but…
-
About NVIDIA Triton Inference Server: When CVE-2026-47625 occurs, its impact is amplified when combined with CVE-2026-16497. (10th Sep 2026)
Preface: In many enterprise environments, an internal Certificate Authority (CA) issues certificates for hundreds of different internal services. If any unauthorized service holding a certificate issued by that CA connects to Triton’s gRPC port, the gRPC transport layer deems it “legitimate,” thereby granting it access to all of Triton’s core APIs. Impact of CVE-2026-47625: According…
-
CVE-2026-25278: shared-buffer architecture is the classic prerequisite for a Double-Fetch/TOCTOU race condition
September 2026 Qualcomm Security Bulletin – Published: 09/07/2026 Preface: The Qualcomm Snapdragon SA9000P is a highly capable, leading-edge AI accelerator designed for Advanced Driver Assistance Systems (ADAS) and autonomous driving, frequently used in combination with the SA8540P SoC as part of the Snapdragon Ride platform. Background: The Qualcomm SA9000P itself is a SoC (System on…
-
CVE-2026-9317: Versions of Nango prior to 0.71.6 have a design weakness (8th Sep 2026)
Preface: Nango, an open-source integration platform, follows a core architectural roadmap centered around a code-first, AI-native framework for building SaaS product integrations. While Nango iterates continuously across minor tags (with current production versions moving past 0.70.x and 0.71.x), the platform’s fundamental design objectives pivot around solving the systemic problems of traditional unified APIs. Companies use…
-
CVE-2026-82404: About Token-Oriented Object Notation (TOON)
This article was published on September 7, 2026. Preface: To this day, cyber security in AI/LLM environments still relies on traditional client applications, software (especially Linux libraries), and code. Artificial intelligence has not replaced humans. In fact, humans have long understood the capabilities of AI. But it seems that humanity’s insatiable desires and ambitions have…
-
Optical Side-Channel Probing of the Internal Configuration Access Port (ICAP) on AMD 7-Series FPGAs from different perspectives.
Ref – AMD ID: AMD-SB-8034 Preface: AMD’s original EPYC naming convention used the second digit of the model number to indicate the product generation. For example: EPYC 7001 Series: 1st Gen (Naples) EPYC 7002 Series: 2nd Gen (Rome) EPYC 7003 Series: 3rd Gen (Milan) However, starting with the 4th Generation (Genoa/Bergamo), AMD changed the prefix…
-
“CVE-2026-61750, CVE-2026-61751, CVE-2026-61752 and 25 Identical description of CVEs (from CVE-2026-61754 to CVE-2026-61779) : NVIDIA Megatron Bridge…”
First release date: 2nd Sep 2026 (official) Preface: Because installing these tightly coupled dependencies (like CUDA, PyTorch, NCCL, and cuDNN) manually can be error-prone, NVIDIA recommends deploying Megatron Bridge via their pre-configured Docker containers, which ship with the exact pinned CUDA and driver environments required out of the box. Background: The NVIDIA Megatron Bridge belongs…