Loki Intelligence — Security Briefs · Published
Daily Security Brief: Ivanti and GitLab Exploitation, Northflank AI Key Abuse
Actively exploited edge and developer infrastructure flaws, plus a hosting platform breach that exposed AI API keys, define today's risk picture. Teams should prioritize patching Ivanti and GitLab, rotating secrets stored on Northflank, and confirming Android patch levels.
Signal 01 · BleepingComputer
New Android SMS of Death exploit can remotely crash unpatched phones
A researcher published a proof-of-concept for a recently patched Android flaw, called SMS of Death and tracked as CVE-2026-58882. It is reported to let an attacker disrupt cellular service or crash phones through a crafted text message.
Why it matters: Public proof-of-concept code raises the chance of misuse, so confirm that managed Android devices have the latest security patch level applied.
Source: BleepingComputer
Signal 02 · BleepingComputer
Northflank security breach leads to abuse of customers' AI API keys
Northflank, a cloud application hosting platform, told customers to rotate all credentials and secrets stored on it after a breach. The incident led to unauthorized use of customers' AI API keys.
Why it matters: Rotate secrets held on the platform, review AI provider usage and billing for anomalies, and set spend limits and scoped keys to reduce the impact of leaked credentials.
Source: BleepingComputer
Signal 03 · BleepingComputer
From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era.
The article, a TryHackMe piece, discusses how AI-generated vulnerability reports are overwhelming some bug bounty programs. It outlines how beginners can build practical skills, use AI responsibly and produce reproducible findings.
Why it matters: Programs receiving report floods benefit from clear submission standards that favor reproducible, validated findings over unverified automated output.
Source: BleepingComputer
Signal 04 · The Hacker News
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog after active exploitation in the wild. The report's title says attackers chained three flaws to gain unauthenticated root access.
Why it matters: Internet-facing VPN appliances are high-value targets, so apply vendor fixes promptly and review appliances for signs of compromise.
Source: The Hacker News
Signal 05 · The Hacker News
Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
CrowdStrike attributed attacks on high-value targets to a China-based intrusion adversary using ARTEX, a Go-based AI-powered penetration testing framework. The report's title says over 200 organizations were targeted.
Why it matters: Automated, AI-assisted tooling can speed up reconnaissance and exploitation, which makes fast patching and attack surface reduction more important.
Source: The Hacker News
Signal 06 · BleepingComputer
SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone
The article explains that weaknesses in the SS7 and Diameter signaling protocols can allow location tracking, call and SMS interception, and subscriber impersonation without compromising the device. It describes how these attacks abuse trust between networks.
Why it matters: SMS verification codes can be intercepted at the network level, so prefer app-based or hardware-backed authentication over SMS for sensitive accounts.
Source: BleepingComputer
Signal 07 · BleepingComputer
CISA says max severity GitLab flaw now exploited in the wild
CISA reports that attackers have begun exploiting a maximum-severity GitLab vulnerability that was patched earlier this month.
Why it matters: Self-hosted GitLab instances that have not applied the October fix should be updated immediately and reviewed for unexpected activity, since source code and CI secrets are at stake.
Source: BleepingComputer
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.