CriticalExploitation unknown
Cua computer-server: authentication is skipped when one environment variable is unset
Fix Patched in 0.3.42
The Week · Aug 31 to Sep 6
The model stopped being the variable.
85 stories across 6 briefings. The headline is from Sat, the busiest day.
Day by day
All weeks →Deadlines that week · 1
All deadlines →62days ago
2026-09-05
GitHub CLI Linux APT/RPM signing key expires; repo metadata and new RPMs signed with the replacement key only
Re-install the dual-key keyring per GitHub's announcement. Homebrew, Conda, .deb files, archives, source builds, Windows and macOS are unaffected
In the digestSecurity · 4
All security →CriticalExploitation unknown
AutoAgent runs an unauthenticated root shell on TCP, and there is no patch
Fix Patched in: no patch available — affected up to commit 16c12b0
HighExploitation unknown
AWS Labs postgres-mcp-server: "read-only" is a denylist, and the denylist is incomplete
Fix Patched in 1.1.7
HighExploitation unknown
MindsDB's crawler ships an empty URL allowlist that it reads as "allow everything"
Fix Patched in: no patch available — affected through 26.1.0