JEDI-SEC | Security Research & Digital Defense https://validator.w3.org/feed/docs/rss2.html Weekly Update 529: Kids Social Media Bans (and Everything Else) ISC Stormcast For Tuesday, November 10th, 2026 https://isc.sans.edu/podcastdetail/10172, (Tue, Nov 10th) Ransomware claim: Vertex Pharmaceuticals Incorporated (n0n) Ransomware claim: fhiworks (iah647) Anthropic’s super bug-finding Mythos model is going into Cisco and IBM products Vanderbilt University hit in BYOD ransomware attack, data theft claimed GHSA-g3qx-frcg-j979: Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses GHSA-r4mx-2gr2-8277: Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server GHSA-gcwf-c25f-p9rv: Kiwi TCMS account confirmation open redirect through protocol-relative URLs iPhone Bug Let Apps Record After You Tapped “Don’t Allow”, With No Orange Dot GHSA-ghgh-57qv-h687: Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines France blames Iran for supermarket hack meltdowns GHSA-f7vj-6669-qvv4: Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation GHSA-2xwh-426q-42c5: Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user) GHSA-5xjx-9qx6-jcrv: Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace GHSA-x89h-7h96-v88f: croc: Overwrite-confirmation bypass via a crafted “croc-stdin-” filename on receive GHSA-9hq4-hm3j-jmph: DDEV incomplete tar symlink traversal fix allows host file overwrite – Incomplete fix of CVE-2026-32885 CISA Announces Enhanced Reporting Form for Cyber Incidents GHSA-h89v-g948-47vp: Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser GHSA-9qq5-422f-33c2: Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin GHSA-rjr3-43j3-4q8g: Kubeflow Pipelines API server lacks authorization for shared pipeline uploads GHSA-44r8-3p76-84mw: FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files How to Identify Ransomware Data Exposure Using Leaked File Trees GHSA-f74m-x83r-c4v4: FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user’s archive GHSA-85gg-2gfq-q95m: Code Graph RAG structural tools follow out-of-root symlinks GHSA-gj9m-f8ph-pmhr: GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin GHSA-rm8c-2cv8-jwf6: Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing SEGA newsletter data breach exposes 2.2 million email addresses GHSA-cp25-j9x5-p5xm: Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS) GHSA-g3c2-rjq2-c763: esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal GHSA-9vhv-g5hf-m7m7: fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with –shell this is unauthenticated remote command execution Ransomware claim: BOZZUTO (vortex) Ransomware claim: SAMTEC (vortex) Ransomware claim: ARTHREX – 700+ GB (vortex) Ransomware claim: SOLENIS – 1.65tb (vortex) Ransomware claim: El Camino Health – 350+ GB (vortex) Ransomware claim: SimonMed – 45+ GB (vortex) Ransomware claim: Andersen Construction – 200+ GB (vortex) Ransomware claim: Karlstorz – 500 GB (vortex) Ransomware claim: Air Communities (vortex) Ransomware claim: Storage Mart (vortex) Ransomware claim: Scripps (vortex) CISA Announces Enhanced Reporting Form for Cyber Incidents N-able takes cloud platform offline after 30+ “zero-days” published Ransomware claim: Wilentz, Goldman & Spitzer (leakeddata) York University breach exposed personal information dating to 2007 Dad Asked 6-Year-Old Daughter if ‘She Had the Gun’ Before He Left Her in Line for Pokémon Cards Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion Home Research & Field Notes