Cybersecurity

CVE-2026-90898 lets unauthenticated attackers execute arbitrary commands on Bifrost AI gateway servers via a single HTTP request; fixed in transports/v2.1.0.

Security firm Air Security found a zero-click flaw letting a plugin repository owner bypass commit-hash pinning in four AI coding agents.

AWS says data held only in Bahrain's me-south-1 region and the UAE's mec1-az2 zone, hit by Iranian strikes in March, cannot be restored.

The Rust Security Response Team disclosed and patched a Miri flaw that stored all environment variables in target/, letting cached CI output expose secrets to pull requests.

The indexed-btree npm package evades npm v12's install-script blocking by hiding its malware loader inside a runtime method instead, Checkmarx reports.

Socket found malicious code in dev branches of a 700,000-download Laravel Nova package on Packagist, tying the compromise to its ongoing PolinRider campaign.

The Rust security response working group and crates.io team warn that rust-lang members and popular crate owners are being lured into fake video calls to compromise their devices and accounts.

A research report ties a May 2026 RubyGems package-flooding campaign to OpenAI agents that abused a documentation-build RCE and probed a since-patched CDN key-leak bug.

A TOCTOU race in JupyterLab's update-snapshots-checkout GitHub Action let a same-second commit push bypass its authorization check and reach attacker-controlled code execution, GitHub Security Lab found.

Rustls's September 7 release turns on NIST-standardized ML-DSA post-quantum certificates by default for the aws-lc-rs provider, plus a KeyLogFile permissions fix and an ECH certificate-verification fix.

vlt, a JavaScript package manager built by npm's original developers, ships 1.0 with hosted registries that block malware and phased installs that stop scripts from running automatically.

CISA added CVE-2026-82329, a 9.8-severity Artifactory authentication bypass, to its exploited-vulnerabilities catalog days after JFrog patched it.