The web platform, browsers, AI and security, taken apart: news, analysis and research from the FuriaHub team.
CISA says CVE-2026-60004 is being exploited on self-hosted Gitea: a critical code injection in the diffpatch API. Default open registration lets an unauthenticated visitor create an account and repository, then run commands as the gitea user.
CVE-2026-73570 is unauthenticated command injection in SNMP notification processing as the zimbra user. CERT Polska saw it in the wild. Federal agencies had to patch by August 24.
OpenAI’s August 10 Daybreak post said the purpose-trained cyber model found two unknown V8 issues that chained to a heap-sandbox escape. Google patched Chrome 150.0.7871.128. Daybreak accounts need hardware keys by September 1.
FuriaHub