JEDI-SEC | Security Research & Digital Defense https://validator.w3.org/feed/docs/rss2.html Kalshi Is Cozy With Trump — But It’s Ramping Up Dem Hires and Campaign Spending Arizona Town’s Probe on Sex Abuse Claims Could Block Prison Firm Building New ICE Camp Debunking Pete Hegseth’s Bullshit Impeachment Defense A Natural Gas Project Off Alaska’s Coast May Be a Russian Ploy for Intel on the Arctic New Windows 11 update fixes File Explorer menu mess – and patches an exploited flaw Need more AI in Creator Studio? Apple may charge you for it EV Charger Maker Ohme Drops Its “Never Sell Your Data” Promise GHSA-gg4r-jv3p-qx3c: Mongoose: Connection-level sanitizeFilter not applied GHSA-pcrw-h46h-c93h: Mongoose: sanitizeFilter not applied on countDocuments GHSA-5v64-555j-wjxm: Rack: Multipart parsing allows DoS via unbounded scan buffer growth GHSA-p8x9-v4hv-2w4g: Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass GHSA-wrr5-j383-f7h2: NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe Before you buy an advent calendar, check these warning signs Update Chrome now to fix a flaw attackers are exploiting GHSA-2j8w-xcrc-x985: Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835 Microsoft Patch Tuesday November 2027 , (Tue, Nov 10th) GHSA-wvg4-6p58-3gh3: Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch GHSA-r7j4-crjv-h467: compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0’s output Adobe Patches 110 Vulnerabilities Across 9 Products Firefox free VPN drops its 50GB launch cap until January 31 Vanderbilt University reels following ransomware attack claimed by BYOD group I found a hidden Android tool that solves all my tiny text troubles Ransomware claim: JTK Solutions (morpheus) OSINT of Thailand CISA Expands Incident Reporting Form While CIRCIA Mandate Waits All your Apple devices need to be patched ASAP – here’s why Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code Google’s new AI tool just proved Signal encryption really works – here’s how Ransomware claim: Karlstorz (vortex) Ransomware claim: Andersen Construction (vortex) Ransomware claim: SimonMed (vortex) Ransomware claim: El Camino Health (vortex) Ransomware claim: SOLENIS (vortex) Ransomware claim: ARTHREX (vortex) Ransomware claim: CRESA (vortex) Ransomware claim: ALEXION (vortex) Ransomware claim: PYRAMID HEALTHCARE (vortex) Dark Web Profile: CyberXero CVE-2026-109469: CVSS 10 Entra Device Registration Flaw Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers X.Org patches eight server vulnerabilities a month after fixing 12 others Trump taps Palantir security chief to run battered US cyber defense agency AI company Fireworks says hackers stole data, billing info during October breaches Iranian hackers turned up the heat on French supermarket freezers, says France Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor Binance warns of iOS flaw that could leak crypto wallet secrets Home Research & Field Notes