Loki Intelligence — Security Briefs · Published
Daily Security Brief: Nextcloud Collabora RCE, PwnEscape VM Leak, PAN-OS Exploitation
Several items today involve active exploitation of exposed or self-hosted software, including Nextcloud's Collabora app, PAN-OS management interfaces and Langflow, alongside a critical kernel flaw affecting VM isolation. Teams should prioritize patching and restricting access to affected systems, then review sandbox isolation and how staff are protected from fake AI product lures.
Signal 01 · BleepingComputer
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Attackers are reportedly exploiting a critical command execution flaw, tracked as CVE-2026-110447, in the built-in CODE Server app (richdocumentscode) for Nextcloud. The reporting describes servers being backdoored.
Why it matters: Teams running Nextcloud with this app should apply the vendor fix, review servers for signs of compromise, and consider whether the built-in server is needed at all.
Source: BleepingComputer
Signal 02 · The Hacker News
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
A critical Linux kernel flaw named PwnEscape lets code inside a virtual machine read memory on the host. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it.
Why it matters: Anyone running multi-tenant sandboxes or virtualized workloads should track kernel updates and treat guest-to-host isolation as a boundary that needs prompt patching.
Source: The Hacker News
Signal 03 · The Hacker News
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Previdian alerted that attackers are exploiting a critical authenticated remote code execution flaw in Langflow, an open-source platform for building AI applications and agentic workflows. The headline cites 1,423 exploit attempts observed in honeypots.
Why it matters: Teams running Langflow should update, keep instances off the public internet, and tightly control which accounts can authenticate, since authenticated flaws are still reachable through weak or leaked credentials.
Source: The Hacker News
Signal 04 · The Hacker News
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks released updates for CVE-2026-0322 (CVSS 8.6), a remote code execution flaw in the PAN-OS management interface that is being actively exploited.
Why it matters: Apply the updates and restrict management interface access to trusted internal networks, as exposed management planes are a frequent target.
Source: The Hacker News
Signal 05 · BleepingComputer
Android gets AI defenses against messaging scams, fake calls
Google announced AI-powered protections on Android against scam messages and call-forwarding abuse, rolling out to eligible devices.
Why it matters: Platform-level protections help, but organizations should still train staff on scam messages and call-based social engineering that targets work accounts.
Source: BleepingComputer
Signal 06 · BleepingComputer
Is AI pentesting as good as a human pentester?
Intruder compares AI-driven and human penetration testing, noting that AI can find issues humans miss but is limited in consistency, risk assessment and understanding of business context.
Why it matters: When choosing testing approaches, weigh automated coverage against human judgment on impact and context, for example through authorized, human-validated testing of web apps, APIs and AI agents.
Source: BleepingComputer
Signal 07 · The Hacker News
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers are impersonating popular AI products to spread malware, steal browser sessions and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to these campaigns between April and October 2026.
Why it matters: Restrict AI tool downloads to verified sources, monitor for session theft, and enforce phishing-resistant authentication to limit the damage from stolen browser sessions.
Source: The Hacker News
Brief sources
Related briefs
- Cloud Pentest Checklist for SaaS Teams
- Automated Vulnerability Assessment vs Manual Pentest
- Hardware Hacking for Embedded Security
Relevant Loki service: SKYEN web & API pentesting.