JEDI-SEC | Security Research & Digital Defense https://validator.w3.org/feed/docs/rss2.html On the Ground in the Final Days Before Trump’s Midterm Debacle GHSA-47w9-6r3f-938g: LXD has restricted project bypass leading to arbitrary command execution GHSA-7mr3-28h5-m5vx: LXD has project restriction bypass for custom volume copy across projects GHSA-qx75-2p3r-pwm5: LXD has project restriction bypass in instance copy across projects GHSA-r4hm-p9f9-fj9v: GeoNode has Stored XSS in Documents metadata abstract field GHSA-fqpv-mq26-pr4j: GeoNode has Unrestricted File Upload GHSA-9fpx-fr6j-2vh6: GeoNode has OS command injection via uploaded file layer name GHSA-j93m-3j9p-m5m8: LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at GHSA-pjff-c2wc-f6jm: LXD has arbitrary file write on client due to trusted image hash GHSA-fmc8-p6q7-75cc: LXD has argument injection in backup compression algorithm leading to AFW and ACE GHSA-vghh-5rfx-xhq8: LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image Ransomware claim: Wachtell, Lipton, Rosen & Katz (leakeddata) Ransomware claim: Tucker Ellis (leakeddata) Behind the Blog: Dam’s Bursting Medical services company settles with 4 states over 2023 hack of sensitive patient records Certificate authority DigiCert reports data breach involving business customer info Fake security tools on GitHub push backdoors and infostealers Free Chinese AI Models Are Getting Scary Good at Hacking Japan Announces Emergency Cybersecurity Package Following a Wave of Attacks AI Gave Your Incident Archive a Second Job Is There a Left Candidate for President? GHSA-xgjr-7j9q-2h4r: listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials GHSA-5w5g-j6hw-6p8f: OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy GHSA-92r3-p8c2-3fpx: Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration Android is getting my favorite iOS tracking feature – what to expect Ransomware claim: B… law (leakeddata) Authorities accuse trio of using AI deepfakes to defraud $129M from businesses 7 Best Vulnerability Scanning Tools for Security Teams in 2026 Thinking Machines’ new model takes the lead in western open-weight AI QNAP says hackers breaching NAS devices in Plex2Shell attacks FBI agent pleads guilty to stealing $2.4 million in crypto from nation-state hackers Apple will monitor your public iCloud links now, starting with iOS 27.3 Ransomware claim: Houston Machine and Thread (akira) Ransomware claim: Ligne Roset (akira) You Might Be Someone Else’s AI Test Environment UK Sex Workers Wake Up to Sites Purging Their Content Follow UK Porn Ban Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time Gnosis Pay Data Breach Exposes Crypto Card Users’ Personal Data Ransomware claim: Conecuh Sausage Company Inc (interlock) Ransomware claim: Algonomy (direwolf) Veeam warns of Software Appliance boot failures on AMD EPYC hosts Attacks on supermarket and blood storage systems prompt US warning Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Railway Engineer Admits Running AI Agents Against Rival Cloud Platform Big Tech sues over California plan to limit kids’ scrolling IMSI vs IMEI: What Your Phone Broadcasts and Who Can Read It OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits Pinpointing Location of Videos from Background Airplane Sounds Home Research & Field Notes