Blog
Blog
Governing AI at Gartner UK: Only 5% Say They’re Ready. Here’s Where to Start.
During one AI governance session at the Gartner Security & Risk Management Summit in London, a well-known authority in the GRC world shared a number that stopped the…
Blog
One Person, Five AI Tools, a Country’s Banks: Inside South Korea’s AI-Run Breach
A financially motivated hacker used a stack of AI tools to hit South Korean banks at the speed of a whole team. The tooling was new. The way…
Threat Research
CVE-2026-101894: Symlink-Chain Path Traversal in @xhmikosr/decompress
1. Introduction The @xhmikosr/decompress package extracts tar, tar.gz, tar.bz2, and ZIP archives in Node.js applications. CVE-2026-101894 is a symlink-chain path traversal in its default decompress(input, output) API: crafted…
Threat Research
CVE-2026-41948 Dify ≤ 1.14.1 – Unauthenticated Plugin Daemon Internal API Exposure via Path Traversal in the Console Icon Proxy
1. Introduction This document illustrates a relative path traversal vulnerability in Dify, the open-source large language model (LLM) application development platform used by more than 50,000 organisations to…
Threat Research
CVE-2026-45332 Automad Flat-File CMS Unauthenticated Admin Password Hash Disclosure via Broken Setup Endpoint — Offline Hash Cracking
1. Introduction This document illustrates an unauthenticated sensitive data exposure vulnerability in Automad — a modern flat-file content management system. The vulnerability, tracked as CVE-2026-45332, allows any unauthenticated…
Threat Research
CVE-2026-48611 phpBB Forum Software Unauthenticated Authentication Bypass via OAuth Login-Link Flow — Full Admin Takeover
1. Introduction This document illustrates a critical authentication bypass vulnerability in phpBB — the most widely deployed open-source forum software in the world, powering over 500,000 active forum…