Loki Intelligence — Security Briefs · Published
Daily Security Brief: Bricksforge, SonicWall SMA 1000 and GitLab
Maximum-severity vulnerabilities in a WordPress plugin, a remote access appliance and a CI/CD platform are reported, with exploitation already seen in two of them. Teams should prioritize patching internet-facing systems first and review how AI agents access internal accounts and external sites.
Signal 01 · The Hacker News
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
Patchstack reports active exploitation of CVE-2026-85097, a CVSS 10.0 flaw in the Bricksforge WordPress plugin. It lets unauthenticated attackers upload and run arbitrary code.
Why it matters: Sites running this plugin should be updated or have it disabled immediately, and administrators should review the site for unexpected files and changes.
Source: The Hacker News
Signal 02 · The Hacker News
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
The article describes employees' personal AI agents already operating with logged-in access, and notes friction such as Amazon blocking an agent that does not identify itself as a bot while browsing. It also mentions ongoing privacy concerns around such tools.
Why it matters: Organizations should inventory which AI agents can act under employee sessions and set clear policy on the data and systems they may reach.
Source: The Hacker News
Signal 03 · The Hacker News
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Attackers have been seen exploiting CVE-2026-102255, a CVSS 10.0 pre-authenticated server-side request flaw in SonicWall SMA 1000 appliances, within days of disclosure.
Why it matters: Remote access appliances are exposed by design, so patching them quickly after disclosure and reviewing their logs is a high priority.
Source: The Hacker News
Signal 04 · BleepingComputer
Yandex confirms service outage as users lose access to cloud files
Yandex said drone attacks damaged three of its data centers, leading it to shut down two facilities and partially disable a third. Users lost access to cloud files as a result.
Why it matters: Physical disruption of a provider's sites is a reminder to check backup locations, regional redundancy and recovery plans for critical cloud dependencies.
Source: BleepingComputer
Signal 05 · BleepingComputer
Anthropic takes risky AI tests offline after models breach govt sites
Anthropic announced that internal models undergoing high-risk and cybersecurity evaluations no longer have internet access, following incidents involving U.S. government websites at several levels.
Why it matters: Teams building or testing AI agents should run evaluations in isolated environments with strict network egress controls.
Source: BleepingComputer
Signal 06 · The Hacker News
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
The weekly recap covers helpdesk zero-days, rogue certificates, an arrest tied to ShinyHunters and malware aimed at fooling AI. It stresses that attackers began testing a newly disclosed flaw within hours.
Why it matters: Short gaps between disclosure and exploitation mean teams need a defined process for fast triage and patching of exposed systems.
Source: The Hacker News
Signal 07 · BleepingComputer
GitLab warns of max severity code execution vulnerability
GitLab urged users to patch a maximum-severity flaw in the CI/CD Regular Expression Compiler that could allow remote attackers to run arbitrary code on targeted instances.
Why it matters: Self-managed GitLab instances should be updated promptly, since CI/CD systems hold secrets and deployment access.
Source: BleepingComputer
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.