Wazafak — AI Security

A critical vulnerability in the Cursor AI-assisted development environment has been exposed after 7 months of silence from the company. The vulnerability allows for arbitrary code execution with no user interaction required.

A security camera shipped with a GitHub admin token in its login page, exposing hundreds of repositories to potential security risks. The token was found in the camera's firmware, which was downloaded from the manufacturer's website.

A take-home interview project was revealed to be a malicious operation, designed to infect candidates' systems with malware. The project, disguised as a legitimate coding assignment, contained hidden directories and scripts that could compromise a user's system.

TP-Link Kasa cameras have been found to leak home GPS data via unauthenticated UDP requests, exposing user locations. Firmware updates are available to patch the vulnerability.

A massive data breach has exposed nearly one million passports and photo IDs from multiple countries, leaving individuals vulnerable to identity theft and document fraud. The breach occurred due to a fundamental failure in data security practices, with the documents being hosted on unprotected public URLs.

A new wave of AI-powered voice fraud is sweeping the nation, leaving law enforcement and financial institutions struggling to keep up. With just three seconds of audio, scammers can create a convincing clone of a person's voice, allowing them to trick victims into handing over sensitive information or money.

The Los Angeles Police Department has ended its contract with Flock Safety, a surveillance company, due to concerns over civil liberties and privacy. The decision comes after the LAPD cited 'serious concerns' around the data being collected from Flock's license plate cameras.

A dormant stack‑use‑after‑free in the rtmutex implementation lets an unprivileged process hijack kernel control flow, affecting every Linux distro released since 2011.

A hidden authentication backdoor in Tenda router firmware grants admin access, potentially allowing attackers to gain control over devices. The issue, tracked as CVE-2026-11405, affects multiple firmware versions and can be exploited to bypass normal login checks.

Noma Labs discovered a critical prompt injection vulnerability within GitHub's new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories. The vulnerability, named GitLost, highlights the security challenges of agentic AI systems.

A use-after-free vulnerability in OpenBSD allows local privilege escalation to root, posing a significant security risk. The vulnerability, identified as CVE-2026-57589, affects OpenBSD versions through 7.9.

A vulnerability in Linux's LUKS suspend feature has been discovered, allowing encryption keys to remain in memory after suspension, potentially exposing sensitive data. Since Linux 6.9, the tool that locks the laptop's drive on suspend had been silently failing to wipe disk-encryption keys from memory.

An anonymous GitHub account is mass-dropping exploit PoCs framed as undisclosed 0-days, with a note telling readers to report them and take credit for the CVE themselves. This raises concerns about coordinated disclosure and the potential impact on defenders.

Paradigm Shift’s usbliter8 exploit shows how a design flaw in the Synopsys DWC2 USB controller lets attackers overwrite SRAM and gain code execution in Apple’s A12/A13 SecureROM.

LLMs have leveled the playing field, turning the once‑sacred vulnerability report into just another issue ticket.