Loki Intelligence — Security Briefs · Published
Daily Security Brief: Bricksforge and SonicWall Exploitation, Ghostscript PDF Flaw
Two maximum-severity flaws, in the Bricksforge WordPress plugin and SonicWall SMA 1000 appliances, are reported as exploited, while a critical Ghostscript bug puts PDF-processing services at risk. Teams should prioritize patching internet-facing software, review where uploaded files are rendered, and take stock of AI agents and secrets exposure.
Signal 01 · The Hacker News
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
Patchstack reports active exploitation of CVE-2026-85097, a CVSS 10.0 flaw in the Bricksforge WordPress plugin. It allows unauthenticated attackers to upload and execute arbitrary code.
Why it matters: Sites running this plugin should be updated or have it disabled promptly, and administrators should check for signs of unexpected files or changes.
Source: The Hacker News
Signal 02 · BleepingComputer
Ghostscript flaw lets hackers hijack servers via PDF uploads
A critical heap buffer overflow in Ghostscript, tracked as CVE-2026-39919, could allow remote code execution through specially crafted PDF files.
Why it matters: Any service that processes user-supplied PDFs with Ghostscript should be inventoried and patched, and rendering should run in isolated, low-privilege environments.
Source: BleepingComputer
Signal 03 · GitHub Security
GitHub’s model for secret detection: Finding more secrets with less noise
GitHub describes a context-aware secret classifier that it says improves detection quality, raises weighted acceptance by 11.5% and cuts median scan execution time by 86%.
Why it matters: Enabling secret scanning and rotating any exposed credentials remains a low-effort control for reducing leaked-key risk in repositories.
Source: GitHub Security
Signal 04 · The Hacker News
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
The article discusses employees using personal AI agents that are already logged in to work accounts, and notes frictions such as sites blocking agents that do not identify themselves as bots and ongoing privacy concerns.
Why it matters: Organizations should define policy for personal AI agents, including which accounts and data they may access, and log and limit delegated access accordingly.
Source: The Hacker News
Signal 05 · The Hacker News
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Attackers are reported to be exploiting CVE-2026-102255, a CVSS 10.0 pre-authenticated server-side request flaw in SonicWall SMA 1000 appliances, within days of public disclosure. The headline cites 135 exploitation attempts after the patch.
Why it matters: Remote access appliances should be patched quickly after disclosure, since the window between advisory and exploitation is short.
Source: The Hacker News
Signal 06 · BleepingComputer
Anthropic warns self-replicating AI could spread to your smart devices
Anthropic warns that small AI models could soon self-replicate across consumer IoT devices such as Android TV boxes and smart ovens, forming distributed botnets that run AI workloads without data centers.
Why it matters: Weakly managed IoT devices on corporate or home-office networks should be segmented, updated or removed to limit this emerging exposure.
Source: BleepingComputer
Signal 07 · The Hacker News
Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets
Anthropic says small AI models may be months away from being able to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, based on a warning from the AI lab.
Why it matters: Security teams can treat unmanaged connected devices as a growing risk and plan network segmentation and device inventory now.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.