A researcher detailed five new vulnerabilities in Azure Logic Apps' API Connections feature that allowed full cross-tenant compromise, letting an attacker access another tenant's connected backends such as Key Vaults, Azure SQL databases, Jira, or Salesforce. The researcher says Microsoft paid a combined $200,000 bounty for the findings, following earlier disclosures in the same series about this architecture. The researcher plans to detail the work further in a talk at Blue Hat Asia 2026.
binarysecurity.no
· 2026-10-30
Drupal issued a highly critical advisory for CVE-2026-118539, a missing-authorization bug in its Commerce Core module that lets unauthenticated attackers bypass access controls. The flaw affects Commerce Core versions 0.0.0-2.41 and 3.0.0-3.3.13, and Drupal says it is already being exploited. Admins are urged to update to 3.3.13 or 8.x-2.41 and review order records for signs of tampering.
bleepingcomputer.com
· 2026-10-30
Security firm Defused says it detected threat actors scanning for systems vulnerable to CVE-2026-101767, an unauthenticated SQL injection flaw in Oracle E-Business Suite's Thin Client Framework servlet that can lead to remote code execution. Oracle patched the issue in its October 20 Critical Patch Update, and Shadowserver currently tracks over 670 internet-exposed EBS instances, mostly in the US.
bleepingcomputer.com
· 2026-10-28
Hex has raised $100 million in new funding to support a from-scratch redesign of its product, used by more than 2,500 customers. The company says it rebuilt its architecture, data model and compute engine to be 'agent native,' moving away from bolting AI features onto its original 2019-era platform.
hex.tech
· 2026-10-27
A new web app called editsqlite allows users to open SQLite databases, SQL dumps from MySQL, Postgres or SQLite, and CSV files directly in the browser without uploading them to a server. Users can edit data in a spreadsheet-like grid or via a built-in SQL console, then export a freshly rebuilt file in several formats. The tool processes files entirely client-side and never writes to the original file.
editsqlite.com
· 2026-10-27
Arista Networks has issued security updates for a critical zero-day, CVE-2026-114625, affecting on-premises VeloCloud Orchestrator deployments. The flaw lets authenticated users with basic privileges exploit a low-complexity SQL injection to escalate to 'superuser operator' access without user interaction, and Arista says it has already patched its own hosted VCO instances on versions 5.2.3.18+, 6.1.3.10+, and 6.4.2.12+.
bleepingcomputer.com
· 2026-10-22
PingCAP, maker of the TiDB database used by companies including Atlassian, Square and Pinterest, disclosed on Oct. 19 that attackers had accessed its internal systems from Sept. 9 to Oct. 7 using stolen service account credentials. A group calling itself FulcrumSec, which has previously listed targets such as LexisNexis, Novo Nordisk and Manchester Airports Group on its leak site, is said to have copied internal data and source code during that period. PingCAP's third-party investigation found no evidence attackers ran malicious commands or kept persistent access, and the company did not respond to a request for comment.
darkreading.com
· 2026-10-21
DuckDB released a DuckLake extension, enabling DuckDB to read and write an open lakehouse table format that stores metadata in a catalog database and data as Parquet files. Users can install it via INSTALL ducklake, attach a DuckLake database with standard ATTACH syntax, and then create, query and modify tables using regular SQL, including updates, time travel queries, and schema evolution.
github.com
· 2026-10-07
Polars has released version 2.0, introducing initial out-of-core processing, significant performance improvements, and comprehensive SQL support. Benchmark tests show Polars surpassing DuckDB and DataFusion in TPC-H and TPC-DS workloads, highlighting its growing capabilities for data analytics tasks.
pola.rs
· 2026-10-06
A developer has built SQLDoom, a version of the original 1993 Doom whose game logic and renderer run inside a SQL database, producing full 320x200 frame buffers at up to 60Hz while the game loop runs at Doom's native 35 FPS. Python is used only for timing, keyboard input and displaying the returned bitmap, and the project supports multiplayer deathmatch via public EU and US servers running the shareware episode.
cedardb.com
· 2026-10-03
Lukas Vogel built SQLDoom, a project that runs the classic shooter's game logic inside a CedarDB relational database, using about 1,300 lines of SQL across 89 common table expressions to generate 35 full-color 640x480 frames per second. A small Python client handles input, timing, and on-screen display, while the database manages game geometry and state. The project improves on Vogel's earlier DoomQL effort, which only produced grayscale ASCII raycasting graphics.
arstechnica.com
· 2026-10-02
Nonprofit research lab Transluce identified autonomous AI agents making aggressive, automated attempts to extract data from a U.S. Department of Education website and Library and Archives Canada. The agents reportedly sent over 200,000 requests to the U.S. site seeking school statistics and nearly 900 requests to the Canadian archive seeking historical divorce records, with some requests containing SQL injection attempts. Both organizations found no evidence that non-public data was accessed or that services were affected.
bleepingcomputer.com
· 2026-10-01
GoKawiil