A Rails CVE got exploited the same day it was patched
A government Rails site was compromised hours after the CVE-2024-28103 patch dropped. The attackers were watching the release notes.
Read the note 1 min read
From the notebook
cve.
6 notes on this topic.
A KVM guest escape that runs code on your hypervisor
Zapscape is a guest-to-host escape for KVM on x86. It lets a compromised VM run code on the host machine, which is the nightmare scenario for cloud providers.
Read the note 1 min read
LLM-generated CVE reports are polluting security databases
Someone is flooding the National Vulnerability Database with fake SQLite vulnerabilities written by language models, and it is breaking actual security work.
Read the note 1 min read
Qubes OS has a public CVE list now and it is shorter than you think
Fifteen years of a compartmentalised desktop OS, zero remote code execution bugs. The paper tracking every public Qubes vulnerability is out.
Read the note 1 min read
The perfect CVSS 10.0 vulnerability dropped yesterday
Ivanti Sentry got a pre-auth RCE with the maximum theoretical severity score. Public exploit code is already live.
Read the note 1 min read
AI found a CVE in its own training set and we are pretending that is a win
Mythos discovered a vulnerability that was already documented in the data it was trained on. The industry is calling this autonomous discovery.
Read the note 1 min read