Page Header

Anthropic reportedly left almost 3,000 CMS assets exposed, including material linked to an unreleased model called Claude Mythos; researcher Alexandre Pauwels found the cache.

CVE-2026-25099: Bludit API plugin allowed authenticated users to upload and execute any file; fix available in 3.18.4, rated HIGH.

Small HTTP Server 3.06.36 has an unquoted service path (C:\Program Files (x86)\shttps_mg\http.exe service) that allows local code execution, severity 8.5 HIGH; quote paths, restrict writes and monitor process launches now.

TeamPCP backdoored LiteLLM 1.82.7–1.82.8, likely through a Trivy CI/CD compromise; attackers reportedly stole credentials and gained Kubernetes persistence.