Loki Intelligence — Security Briefs · Published
Daily Security Brief: Ivanti Connect Secure KEV, Northflank AI Key Abuse, GitLab
Today's risk picture centers on actively exploited edge infrastructure, stolen cloud-hosted secrets and attempts against self-hosted development tooling. Teams should prioritize patching exposed Ivanti and GitLab systems, rotating stored credentials including AI API keys, and reviewing how secrets are held on third-party platforms.
Signal 01 · BleepingComputer
New Android SMS of Death exploit can remotely crash unpatched phones
A researcher published a proof-of-concept for a recently patched Android flaw tracked as CVE-2026-58882, nicknamed SMS of Death. It is reported to allow remote disruption of cellular service or phone crashes through a crafted text message.
Why it matters: Organizations managing mobile fleets should confirm the Android patch is deployed, since public proof-of-concept code raises the chance of abuse against unpatched devices.
Source: BleepingComputer
Signal 02 · BleepingComputer
Alpine Linux rebuilds GitLab after attempted RCE attack
Alpine Linux reported that attackers tried to exploit a critical GitLab vulnerability in its development infrastructure on October 20-21. The project rebuilt its GitLab server and reset all passwords out of concern for a possible compromise.
Why it matters: Self-hosted GitLab instances should be patched promptly, and teams should have a rehearsed rebuild and credential-reset plan for source-control infrastructure.
Source: BleepingComputer
Signal 03 · BleepingComputer
Northflank security breach leads to abuse of customers' AI API keys
Hosting platform Northflank told customers to rotate all credentials and secrets stored on the platform after a breach led to unauthorized use of customers' AI API keys.
Why it matters: Rotate stored secrets, set spending limits and usage alerts on AI provider accounts, and scope keys narrowly so a platform-side breach has limited impact.
Source: BleepingComputer
Signal 04 · BleepingComputer
From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era.
A sponsored-style piece from TryHackMe discusses how AI-generated vulnerability reports are straining some bug bounty programs. It outlines how beginners can build practical skills, use AI responsibly and produce reproducible findings.
Why it matters: Teams running disclosure or bounty programs may want clear reporting requirements that favor reproducible, validated findings over unverified automated output.
Source: BleepingComputer
Signal 05 · The Hacker News
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
CISA added two Ivanti Connect Secure flaws, including CVE-2026-111357, to its Known Exploited Vulnerabilities catalog after active exploitation in the wild. The report's title describes attackers chaining three flaws to reach unauthenticated root access.
Why it matters: Internet-facing VPN appliances are high-value targets, so apply Ivanti's fixes, review appliance integrity and logs, and treat KEV listings as urgent patch deadlines.
Source: The Hacker News
Signal 06 · BleepingComputer
FBI links $6.3 billion Binance crypto heist to North Korean hackers
The FBI confirmed that the North Korean state-sponsored group known as TraderTraitor was behind a $6.3 billion crypto-theft attack on Binance, described as the largest cryptocurrency heist on record.
Why it matters: Organizations holding high-value digital assets should reassess key custody, transaction approval controls and the security of the systems their staff use to access them.
Source: BleepingComputer
Signal 07 · BleepingComputer
OpenAI says it's doubling Pro usage limits and bringing Work features to Chat
OpenAI is bringing ChatGPT Work capabilities into regular Chat and combining usage allowances across ChatGPT and Codex. The report is a product update rather than a security incident.
Why it matters: As AI assistants gain broader work features, security teams should review what company data and connected tools employees and agents can reach through them.
Source: BleepingComputer
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.