GoKawiil
Tech News
A root-user broadcast posted early Saturday morning recounts a brutal week of patching: a routine Monday fix, Patch Tuesday, an 'Exploit Wednesday' after someone reverse-engineered the patch diff, and an out-of-band fix on Thursday. The message, styled as a mock CVE advisory, asks the security community to pause filing vulnerabilities, reserving CVE numbers, or publishing proof-of-concept exploits for just 24 hours.
Security startup Cathedral says it ran an authorized test on Anthropic's systems and found autonomous AI agents could gain access within 12 hours by exploiting third-party sales, HR and IT software rather than Anthropic's Claude model itself. Cathedral says the agents reached compensation data, internal communications, meeting transcripts and Slack discussions about Anthropic's models, and disclosed the findings on October 26, 2026. Anthropic confirmed limited access to some sales, HR and IT systems but says customer conversations, Claude outputs, source code and model weights were not reached.
The PHP project announced an upcoming security release fixing two critical vulnerabilities, each rated 9.2 on the CVSS v4.0 scale. The patch is planned for Wednesday, 21 October 2026 at 14:00 UTC, with the PHP security team urging users to prepare in advance.
A cybersecurity opinion column argues that 2026 will be remembered as the year of 'vulnerability' in the industry's lexicon, pointing to the April disclosure of Anthropic's Claude Mythos and the ensuing fear-driven reaction. CISA reported more than 67,000 CVEs published by mid-September 2026, with an expected total of 96,000 by year-end, yet the author contends the industry wrongly equates this rising volume with actual risk.
The Dutch Institute for Vulnerability Disclosure (DIVD), a volunteer security research nonprofit, disclosed it was breached after seven incident-free years, with the intrusion executed autonomously by what it called an agentic AI system. DIVD said the attacker exploited an unnamed technical vulnerability, not Citrix NetScaler, and reported the incident to police, the Dutch data protection authority, and the National Cyber Security Center.
A security researcher describes finding a vulnerability in 2020 that granted access to a Brazilian federal system containing near-complete personal records for over 200 million citizens, including IDs, addresses, family details and witness-protection status. The researcher reported the flaw directly to the responsible agency by phone, which was initially skeptical before confirming and fixing the issue quickly without extracting any data.
Radicle disclosed two critical security vulnerabilities affecting every released version of its code collaboration stack: network traffic between nodes is unencrypted and can be read by anyone observing the path, and the connection handshake's peer authentication can be bypassed. Security researcher Konstantinos Maninakis reported the encryption issue on June 24, 2026, prompting the disclosure.
An analysis of Anthropic's public Vulnerability Disclosure Ledger by researcher Patrick Garrity found that Claude Mythos, part of Project Glasswing, has generated 26,153 vulnerability findings since April 2026. Of those, only about 2,736 have entered the disclosure pipeline, roughly 202 have been patched, 245 withdrawn, and 191 await initial reporting to maintainers, leaving nearly 90% of findings unprocessed.
An open-source maintainer describes receiving an extortion attempt disguised as a bulk vulnerability report—95 claimed flaws, only two or three real—followed by a $100,000 ransom demand threatening public disclosure. He argues this scenario foreshadows a legal reality coming for far more companies: starting September 11, 2026, the EU Cyber Resilience Act requires any manufacturer selling connected products into the EU to notify ENISA within 24 hours of learning that a vulnerability in their product is being actively exploited.