Loki Intelligence — Security Briefs · Published
Daily Security Brief: CISA KEV adds PHP flaws, Workers AI KV cache exposure
Today's picture combines actively exploited flaws in widely deployed software with a reminder that shared AI inference infrastructure can leak data between requests. Teams should prioritize patching the KEV-listed PHP, Collabora Online and Arista VeloCloud issues and review how multi-tenant AI serving configurations are validated.
Signal 01 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog, CVE-2026-109618 (memory corruption) and CVE-2026-109619 (stale internal request state), and updated its PHP alert calling for immediate patching.
Why it matters: Inventory every PHP runtime in your stack, including containers and managed hosting, and apply the vendor fixes on an accelerated schedule since exploitation is already confirmed.
Source: CISA
Signal 02 · Cloudflare Security
Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
Cloudflare described how a configuration mismatch for the GLM 5.3 model on Workers AI triggered a bug in SGLang, exposing KV cache pages across requests. The post covers how the company addressed the issue.
Why it matters: Teams running or consuming shared inference infrastructure should verify isolation between requests, test configuration changes against data-leakage scenarios, and avoid sending secrets in prompts without understanding the provider's isolation model.
Source: Cloudflare Security
Signal 03 · The Hacker News
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
CISA added vulnerabilities in Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator to the KEV catalog, citing reports of active exploitation in the wild. The flaws are rated critical severity.
Why it matters: Check whether either product is deployed, apply available updates, and limit management and document-server interfaces to trusted networks while patching is underway.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.