AI Security Digest
Aggregated ecosystem risk analysis
Vendor Watchlist
Tracking 0 critical integrations
Threat Stream Feed
Real-time security logs and system alerts
Akamai - Edge Delivery issues in Canada
Sep 28, 18:48 UTC Update - We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001W3hnvCABWe will provide an update as we progress. Sep 28, 16:41 UTC Update - We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001W3hnvCABWe will provide an update as we progress. ...
Zoom - Zoom Phone Maintenance - EU01 - AMS2 Data Center: September 28, 2026
Sep 28, 09:00 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Sep 10, 13:43 PDT Scheduled - Zoom will perform service maintenance at our EU01-AMS2 Data Center starting at 9:00 AM Pacific on September 28, 2026. Zoom Phone users registered to the those sip zones will be automatically registered in the EU01-FRA2 sip zone sequentially. During the maintenance window, a brief disconnection may be experienced and notifications may be missed. If...
ActiveCampaign - Transactional Email Failures
Sep 28, 10:30 CDT Update - The backlogged messages are rapidly catching up. We expect full resolution within 20 minutes. Sep 28, 10:22 CDT Monitoring - A fix has been implemented and we are monitoring the results. Sep 28, 10:16 CDT Identified - The issue has been identified and the backlogged messages have started to send. Engineering is working to expedite the catch up. Sep 28, 10:05 CDT Investigating - Transactional email is currently failing to send. Engineering is investigating the ro...
Supabase - Log Ingestion Degradation
Sep 28, 14:00 UTC Monitoring - Log ingestion has recovered. We are monitoring for continued stability. Sep 28, 13:52 UTC Identified - The log ingestion issue was the result of a scaling gap. The relevant resources have been scaled and ingestion is recovering. Sep 28, 13:47 UTC Investigating - Log ingestion is experiencing some delays. Ingestion will be retried by clients.
Vercel - Build failures and 500 errors for functions using Edge runtime
Sep 28, 13:44 UTC Monitoring - A small number of customers who built or deployed functions using Edge runtime between 13:01 and 13:11 UTC experienced elevated rates of build failures due to unexpected error. Some builds succeeded but resulted in 500 errors from functions using Edge runtime. Re-deploy functions using Edge runtime to accelerate remediation.
Squarespace - Squarespace loading and editing Issues
Sep 28, 09:50 EDT Monitoring - A fix has been implemented and we are monitoring the results. Sep 28, 09:35 EDT Update - We are continuing to work on a fix for this issue. Sep 28, 09:17 EDT Identified - We are currently investigating issues across Squarespace, specifically regarding access to the Email Campaigns panel as well as applying and accessing certain premium features.
Webinar: How to Govern AI Agents, Reduce Excessive Access, and Control Shadow AI
AI agents are moving into production faster than security teams can govern them. They are connecting to apps, handling data, calling APIs, and acting across business systems—often without the same controls applied to human users. According to Okta’s Global CISO Insights 2026 report, only 47% of CISOs are confident they can identify every AI agent in their environment. Even among those who feel
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Cybersecurity researchers have disclosed details of a new botnet malware called Carbonato that's targeting exposed Docker daemons to deploy an open-source artificial intelligence (AI) agent framework called Hermes Agent. "The implant installs the framework unchanged, then overwrites its SOUL.md persona file," ThreatDown said. "The 39-line prompt directs it to execute tasks received through
Box - [Medium] Issues with Box Notes
Sep 28, 03:31 PDT Resolved - After further monitoring, this incident is now considered resolved. The Box Note service has been restored to full functionality. If you continue to experience any issues, please contact Box Support at https://support.box.com. Sep 28, 03:04 PDT Investigating - Our team is investigating an issue with Box Notes. Users may see errors or slowness when creating or updating Box Notes. We will provide additional information as it becomes available.
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals. Microsoft, which is tracking the activity under the name Storm-3168, has called it an evolution of the threat actor's tradecraft. The attack took place in early June 2026 over a period of about 18 hours. "The destructive operations
Zoom - Network Maintenance in SJC Datacenter: September 27, 2026
Sep 27, 22:00 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Aug 31, 00:47 PDT Scheduled - Zoom will perform service maintenance at SJC Datacenter. During the maintenance window, Users may experience an impact for a brief amount of time for services mentioned.
Zoom - Scheduled Update to Prompt Track Versions for Zoom Clients: September 27, 2026 (No Operational Impact)
THIS IS A SCHEDULED EVENT Sep 27, 18:00 - 21:00 PDT Sep 17, 16:40 PDT Scheduled - Zoom will be updating the Prompt track versions for Zoom clients on 9/27/2026.Slow channel updates:Windows: 7.1.9macOS: 7.1.9Linux: 7.1.9For more information, such as specific versions, please refer to the Zoom Minimum, Prompted, and Slow/Fast Update Versions support article: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0061900
Xero - ATO services may be unavailable
Sep 28, 00:28 UTC Resolved - The ATO has resolved their issue impacting customers trying to file tax returns from Xero. Sep 28, 00:18 UTC Monitoring - The ATO has implemented a fix and we are currently monitoring the results. Sep 28, 00:03 UTC Identified - Our team are aware of an issue with the ATO where customers cannot file tax returns or STP filings. We are monitoring the outage and will work to keep you update as the ATO works to resolve the issue.
Xero - Xero Scheduled maintenance - Xero Ask Service, Xero Signing, Document Packs and the Practice Chart of Accounts Library
Sep 27, 07:00 UTC In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Sep 24, 20:07 UTC Update - We will be undergoing scheduled maintenance during this time. Sep 24, 11:30 UTC Scheduled - We're carrying out scheduled maintenance on Sunday 27 September 2026 from 7.00pm to 8.00pm NZDT. During this window, the following features may be temporarily unavailable:- Sending or signing documents using Xero Sign- Sending or replying to queries in Ask-...
Snowflake - INC20000239
Sep 27, 02:15 UTC Monitoring - Current status: We identified an issue with our third-party cloud platform that caused impact to Snowflake services. We've coordinated with our third-party cloud platform to implement the fix for this issue, and we'll continue to monitor the environment until we're confident all services are functioning properly.Customer experience: Customers hosted in the specified regions may have been unable to access or use multiple core Snowflake services and features. Affect...
Sumo Logic - Problem with Tracing Collection in North America 2 (US2)
Sep 27, 01:34 UTC Monitoring - We have implemented a fix for the issue affecting Tracing Collection. We are currently monitoring the results. Sep 27, 01:22 UTC Investigating - We are currently investigating reports of problems with Tracing Collection. Trace data sent may fail to ingest or be rejected due to service unavailability. We will provide more information soon.
Figma - Service disruption
Sep 27, 01:18 UTC Monitoring - Figma should now be operational. We are continuing to monitor. Sep 27, 01:04 UTC Investigating - We are currently investigating an issue where Figma Services are degraded or unavailable because of failures with AWS and other dependencies.
Revealing the details of how OpenAI agents hacked Hugging Face
GET-only egress to full code execution: chaining a URL mirror and a screenshot service submitted by /u/NOTHING_gets_by_me [link] [comments]
Xero - Global : Xero apps unavailable on Apple App Store
Sep 26, 23:28 UTC Identified - We're aware that the Apple App Store listings for the Xero apps Xero Accounting, Xero Me, Xero Projects, Xero Verify and Hubdoc apps are not currently accessible. We have taken action to resolve this and are in contact with Apple.Existing installations of these apps are unaffected. We apologise for any inconvenience caused.
Looking for an independent security firm to review a small SaaS security product before wider launch. Recommendations?
Small business, about 20 corporate users currently in a private pilot, live billing not yet enabled. There's no revenue yet to pay one of those big firms thousands of dollars to rubberstamp it, but we have used multiple AI security evaluation tools like Akido in the free tier to cross our t's and dot our i's. The SaaS in question is a security-focused platform designed to monitor the lifecycle of ...
I’ve been building my own Red Team tooling here’s what I’ve learned so far
I’ve been spending a lot of time building security tooling for my own research and authorized testing rather than relying entirely on existing frameworks. A few of the problems I kept running into were surprisingly simple: Recon gets repetitive. You end up running the same discovery, probing, fingerprinting and enumeration workflows over and over. Tooling becomes fragmented. One tool handles recon...
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings come from Ontinue, which described the activity as a four-stage attack chain aimed at targeting Ukrainian-speaking users. "The attack chain begins with a fake CAPTCHA page and
Zero Trust for AI Agents Starts With Fixing Zero Visibility
The way we talk about AI agents is shifting, and the way we implement them requires an even more fundamental shift. While earlier discourse focused on how quickly organizations could stand up agents and how much productivity they could promise, a string of recent incidents, including a widely discussed intrusion at Hugging Face during an evaluation of OpenAI agents, has spurred organizations to
Plaid - Service Disruption Impacting Bank of America connections
Status: InvestigatingBank of America is currently experiencing downtime impacting all channels and data recipients. API calls through Plaid are impacted. We will provide an update when Bank of America has resolved the issue.Affected components Dashboard (Partial outage) API - Production (Partial outage)
HashiCorp - Users unable to access releases.hashicorp.con
Status: MonitoringOur Engineering team has implemented a fix to resolve the issue. We are monitoring the situation closely and will post an update as soon as the issue is fully resolved.Affected components Releases Site (Partial outage)
Snowflake - INC20000237
Sep 25, 23:26 UTC Monitoring - Current status: We've implemented the fix for this issue, and we'll continue to monitor the environment until we're confident all services are functioning properly.Customer experience: Customers hosted in the specified regions may have been unable to access or use multiple core Snowflake services and features. Affected users may have been unable to sign in, execute queries, or manage data, and may have been unable to connect to Snowflake via private connectivity, ...
New Relic - Data Irregularities for US region
Sep 25, 19:57 UTC Investigating - We are currently investigating a service interruption where a subset of customers may be experiencing delayed data in queries, charts, and dashboards as well as delayed or missing alert notifications for related data. Affected alerts are currently being suppressed.
Zoom - Service Degradation Affecting Customer Using Polycom Devices Going Offline
Sep 25, 10:45 PDT Investigating - We are currently investigating a service degradation with a subset of users with Polycom devices going offline. Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We appreciate your patience as we work to resolve this issue.
'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing
I'm a Salesforce admin, not a cybersecurity expert, so please talk to me like I'm dumb. Salesforce had a similar exploit that was "patched" last year. My question is, is there anything that prevents exfiltration via calling 3rd party URLs in other AI clients, like Claude? In Agentforce, after the first web-to-lead vulnerability was discovered last year, you have to allowlist URLs for your us...
Datadog - Users are unable to acknowledge, escalate, or resolve On-Call Pages
Sep 25, 11:38 EDT Resolved - The issue is now resolved. Sep 25, 11:29 EDT Monitoring - We are monitoring the issue. Sep 25, 11:23 EDT Identified - We have identified the issue with pages and are applying mitigations. Sep 25, 11:17 EDT Update - We are investigating an issue with users unable to acknowledge, escalate, or resolve On-Call Pages. Sep 25, 11:11 EDT Investigating - We are investigating an issue with users unable to acknowledge on call pages
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this
Zoom - Zoom Phone India Maintenance (Mumbai) : September 25, 2026
Sep 25, 04:30 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Sep 3, 02:47 PDT Scheduled - Zoom Phone users registered to the India (Mumbai) Data Center will be automatically registered in an alternative datacenter (Hyderabad) starting at 25th September 2026 04:30 AM PDT (5:00 PM IST on 25th September 2026). During the maintenance window, a brief disconnection may be experienced and notifications may be missed. If you get disconnected, ...
On Anthropic’s AI Misuse Report
Earlier this month, Anthropic published a long report detailing all of the Claude misuses it detected. Daniel Meissler usefully summarized the report into 117 findings. A few of the highlights: AI agents increasingly handled reconnaissance, exploitation, data theft, propaganda production, surveillance workflows, and research while humans selected targets, set goals, and reviewed important outputs...
Zoom - An unintended pop-up message appear for users in US region during initial invocation of Zoom AI’s Catch Me Up feature
Sep 25, 02:20 PDT Investigating - We are currently investigating an unintended pop-up message appear for users in US region during initial invocation of Zoom AI’s Catch Me Up feature in Zoom Meetings. At this time, Catch Me Up service itself remains fully functional.Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We appreciate your patience as we work to resolve this issue.
Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data
A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday. The data came from disk space that earlier containers had used and given up, not from any live workload, and an attacker could not choose whose data they got, according to Cloudflare. The company
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in WSO2 API Control Plane,
New Relic - SRE Agent UI Availability Monitor (EU) query result is > 0.0 for 20 minutes on 'SRE Agent UI Unavailable (EU)'
Sep 25, 03:56 UTC Resolved - Between 01:10 UTC and 03:33 UTC on September 25th, some customers in the US, EU, and JP regions may have experienced intermittent UI errors while navigating the New Relic UI. Data ingest and alert notifications were not impacted. We have resolved this issue and impacted services have returned to normal operations.
New Relic - SRE Agent UI Availability Monitor (EU) query result is > 0.0 for 20 minutes on 'SRE Agent UI Unavailable (EU)'
Sep 25, 03:55 UTC Resolved - Between 01:10 UTC and 03:33 UTC on September 25th, some customers in the US, EU, and JP regions may have experienced intermittent UI errors while navigating the New Relic UI. Data ingest and alert notifications were not impacted. We have resolved this issue and impacted services have returned to normal operations.
New Relic - SRE Agent UI Availability Monitor (EU) query result is > 0.0 for 20 minutes on 'SRE Agent UI Unavailable (EU)'
Sep 25, 02:57 UTC Update - We are currently investigating some intermittent UI navigation errors in the EU region. Data ingest and alert notifications are not impacted at this time. Sep 25, 02:34 UTC Investigating - We are investigating an issue with New relic UI for EU region
New Relic - Potential Service Interruption
Sep 25, 02:23 UTC Investigating - We are investigating a potential service interruption that may impact some customers. Please continue to monitor this page for updates.
Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)
(1) An exposed IOCTL lets unprivileged users disable the x86 MONITOR & MWAIT instructions used by Hyper-V and other kernel components--triggering a HYPERVISOR_ERROR bugcheck. (2) Reaching the IOCTL requires exploiting a TOCTOU bug arguably caused by poor documentation of the SeLocateProcessImageName function. (3) Reimplementation of the driver's security through obscurity IOCTL encryption scheme: ...
Zoom - Scheduled Update to Slow Track Versions for Zoom Clients: September 24, 2026 (No Operational Impact)
THIS IS A SCHEDULED EVENT Sep 24, 18:00 - 21:00 PDT Sep 17, 16:38 PDT Scheduled - Zoom will be updating the Slow track versions for Zoom clients on 9/24/2026.Slow channel updates:Windows: 7.1.9macOS: 7.1.9Linux: 7.1.9For more information, such as specific versions, please refer to the Zoom Minimum, Prompted, and Slow/Fast Update Versions support article: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0061900
The 2026 State of AI Security Report has three numbers that really stuck with me: 81%, 50.1%, 99.9%
So I read this state of AI security report from orca security yesterday and a couple numbers stuck with me longer than I expected. First, 81% of orgs with AI packages have at least one known vulnerability. Half of those alerts now have a public exploit, which is up from almost nothing two years ago. The one that actually got me was 99.9%. Thats the share of fixable AI vulnerabilities still unpatch...
Amplitude - Export Destinations data delivery issue
Sep 24, 12:58 PDT Identified - The issue has been identified and a fix is being implemented. We will provide another update in 30 minutes. Sep 24, 12:47 PDT Investigating - Since 2026-09-24 09:30 PT (17:30 UTC), Amplitude has been experiencing a delay in Data Export processing due to a lagging data partition. Realtime data processing and Amplitude charts and dashboards are not impacted. No data is being lost, and delayed exports will complete once the underlying issue is resolved. No customer...
Netlify - Error accessing Netlify-hosted sites
Sep 24, 19:25 UTC Resolved - This incident has been resolved. Service has returned to normal operation, and we are no longer seeing elevated error rates. Sep 24, 19:10 UTC Monitoring - We are seeing signs of recovery, and service has returned to normal operation. Sep 24, 19:01 UTC Investigating - We are investigating reports of errors affecting access to Netlify-hosted sites. Our engineering team is actively investigating the issue.We will provide additional updates as more information beco...
GitHub - Disruption with billing information updates
Sep 24, 16:51 UTC Update - We are investigating failures on billing information updates. Customers may be unable to create or update their billing information in the meantime. Sep 24, 16:51 UTC Investigating - We are investigating reports of impacted performance for some GitHub services.
Supabase - Project Lifecycle Issues in eu-west-1
Sep 24, 15:50 UTC Identified - We have isolated the scope of the problem to a specific upstream incident. We are working to address the upstream incident and determine mitigations. Sep 24, 15:36 UTC Investigating - We are investigating project lifecycle operation issues in eu-west-1.
Zoom - Service Degradation Affecting Live Transcription Services.
Sep 24, 08:47 PDT Investigating - We are currently investigating a service degradation affecting Live Transcription Services.Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We appreciate your patience as we work to resolve this issue.
How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers
submitted by /u/natcoba [link] [comments]
Heroku - Heroku Feature Degradation
Heroku engineers are investigating.
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the
HubSpot - The Salesforce integration is unavailable for some customers
Sep 24, 10:08 EDT Identified - We have identified an issue with our Salesforce integration. Some customers may find that their integration has been unexpectedly disconnected and is temporarily unavailable in the App Marketplace.We're actively investigating the cause and working to restore full functionality.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to...
Zoom - Service Degradation Affecting Zoom Phone and Zoom Contact Center Inbound calls in India
Sep 24, 04:19 PDT Investigating - We are currently investigating a service degradation affecting a subset of Airtel subscribers for inbound call connectivity to Zoom India phone numbers for Zoom Phone and Zoom Contact Center. Outbound calls continue to function normally. Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We appreciate your patience as we work to resolve this issue.
Supabase - Permission errors in the Supabase Dashboard
Sep 24, 10:50 UTC Identified - We have identified the issue causing some users to encounter permission-related errors, such as “You need additional permissions,” when performing administrative actions in the Supabase Dashboard.We are working on a fix and will provide another update once it has been implemented. Sep 24, 10:37 UTC Investigating - We are investigating reports of users encountering permission-related errors, such as “You need additional permissions,” when performing administrativ...
OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files
An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said. The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and personal records. The agent reached files on it that were not public, but no personal
TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords
Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. "The campaign compromised 7 accounts –
Xero - Global: Invoicing/Contacts and Payroll - Brief latency in some areas on Xero
Sep 24, 04:00 UTC Resolved - Our team has resolved an issue impacting our customers globally over the past 3 minutes from 2:17pm-2:19pm AEST where there was some latency using Payroll, Invoicing and Contacts We apologise for any inconvenience this has caused.
Netlify - Elevated CDN Errors
Sep 24, 00:00 UTC Resolved - The issue causing elevated CDN errors has been resolved. DNS resolution has recovered, and affected services are operating normally. Sep 23, 23:50 UTC Monitoring - We have applied a fix for the issue causing elevated CDN errors. Services are recovering, and we are monitoring the platform to confirm full recovery. Sep 23, 23:40 UTC Update - We have identified the cause of the elevated CDN errors and are applying mitigations across affected systems. Recovery is un...
[CISA KEV] CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
Product: Commerce and Magento by Adobe Description: Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Zoom - Service Degradation Affecting Live Transcription Services.
Sep 23, 16:43 PDT Investigating - We are currently investigating a service degradation with Live Transcription Services.Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We appreciate your patience as we work to resolve this issue.
Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) - watchTowr Labs
submitted by /u/dx7r__ [link] [comments]
Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) - watchTowr Labs
submitted by /u/dx7r__ [link] [comments]
Heap - Heap Connect Syncs: Possibility Of Stale Data
Sep 23, 15:15 PDT Identified - We are experiencing latency in our upstream data source. Syncs running during this period may have stale data. We will post an update within the hour.
Supabase - Supabase CLI CI workflow failures
Sep 23, 21:58 UTC Investigating - We're seeing rate limiting issues causing Supabase CLI CI workflow failures
Akamai - Account Protector Issues
Sep 23, 21:30 UTC Investigating - We are investigating an emerging issue with Account Protector. We are actively investigating the issue and will provide another update within the next 30 minutes. We will soon be posting more details for customers and partners with a valid Control Center login at https://community.akamai.com/customers/s/group/0F90f000000DFgx/service-incident-notifications. If you have questions or are experiencing an impact due to this issue, please use the Support Center on Ak...
CircleCI - Delays in processing new signups and plan changes
Sep 23, 18:13 UTC Identified - Customers may experience delays in new signups and plan changes being reflected in their account.
HashiCorp - HCP Terraform Returning 404s
Status: MonitoringOur Engineering team has implemented a fix to resolve the issue. We are monitoring the situation closely and will post an update as soon as the issue is fully resolved.Affected components HCP Terraform (Operational)
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/
A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you. GitLab shows each user this address behind a button labeled "Email work item to this project." Mail sent to it opens an issue in that project, authored
HubSpot - Some HubSpot tools may be unavailable for some users
Sep 23, 11:17 EDT Resolved - Between 10:37 AM EDT (UTC -04:00) and 10:53 AM EDT (UTC -04:00), many customers in all affected regions experienced issues with sales tools. This was caused by a server impairment. As of 10:53 AM EDT (UTC -04:00), our sales tools are working properly and the incident has been fully resolved.HubSpot conducts a thorough review after each incident to understand the cause and prevent it from happening again. Learn more about HubSpot's commitment to reliability at www.Hu...
Xero - UK: HMRC connected services (Corporate Tax, Personal Tax, Partnership Tax, MTD IT and MTD VAT)
Sep 23, 13:16 UTC Investigating - We're aware that the issue with HMRC services is affecting Corporate Tax, Personal Tax, Partnership Tax, MTD IT and MTD VAT. Some products are unavailable, responding more slowly than usual, or not updating their status. This is due to an issue with HMRC and HMRC have confirmed they are investigating.
Optimizely - Optimizely Graph - USEA production clusters experiencing intermittent availability issues
Sep 23, 14:46 UTC Monitoring - We have identified the root cause and applied a mitigation. The service has returned to normal operation and we are actively monitoring to confirm stability. Sep 23, 14:21 UTC Investigating - We are experiencing intermittent availability issue for the Optimizely Graph service impacting one of the USEA production clusters. Our team is working on mitigating actions.
Elastic Cloud - Degraded Performance: Cloud Provisioning Delays
Sep 23, 14:04 UTC Investigating - We are currently experiencing delays in provisioning new cloud resources due to slowness with an external container image provider. This may result in delays when creating new deployments, scaling existing ones, or relocating instances affected by infrastructure maintenance. As mitigation, you can try re-running failed plan changes.Existing running deployments are not impacted. Our team is actively monitoring the situation and working to mitigate the issue.We w...
Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests
Anthropic and OpenAI on Tuesday announced new models, with both artificial intelligence (AI) companies noting that they are continuing to invest in improving alignment to combat risky behavior. Opus 5.5, per Anthropic, is a "major step up from Opus 5," and "achieves the best scores of any model to date on our automated behavioral audit, our alignment suite that tests Claude across thousands
GitHub - Incident with API Requests and Projects
Sep 23, 10:57 UTC Update - Database replicas have been restored. Org creation and the GitHub API are no longer degraded. Sep 23, 10:20 UTC Update - Database replicas have detached. We're working to restore the database replicas. Users may experience issues beyond creating organizations and a degraded experience with the GitHub API and Projects. Sep 23, 10:11 UTC Investigating - We are investigating reports of degraded performance for API Requests
Supabase - Increased error rate in project creation and project restore
Sep 23, 09:54 UTC Monitoring - A fix has been implemented and we are monitoring the results. Sep 23, 09:39 UTC Identified - We've identified the issue affecting project creation and are implementing a fix. Users may experience delays when creating new projects while we work to resolve this. Sep 23, 09:21 UTC Investigating - We are currently investigating this issue
Supabase - Storage search failing for restored projects
Sep 23, 09:31 UTC Investigating - We have identified an issue with Storage for projects are restoring from backups. Users may experience increased 500 errors.We are working to identify the root cause and will notify for any progress as soon as we have an update
Amplitude - Export Destinations data delivery issue
Sep 23, 01:39 PDT Monitoring - Since 2026-09-22 16:50 PT (23:50 UTC), we experienced an issue with automated data exports to export destinations that filter events before export.We have deployed a fix and are now monitoring the system to confirm exports and backfills fully recover. No data has been lost. No customer action is needed at this time. Sep 23, 01:02 PDT Investigating - Since 2026-09-22 16:50 PT (23:50 UTC), we have been experiencing an issue with automated data exports to all expor...
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version
Leaked GitHub App private keys let researchers impersonate 440 apps including CDC and BuildBuddy
submitted by /u/mabote [link] [comments]
Zoom - Service Degradation Affecting Zoom Tasks in US Region.
Sep 22, 18:55 PDT Monitoring - On 09/23/2026, Between 00:42 UTC- 01:22 UTC, users may have experienced issues with Zoom Tasks in US Region. We have mitigated the issue and we will continue to monitor the situation closely and keep you informed of any further developments.Thank you for your patience.
Dropbox - Scheduled maintenance
Sep 23, 00:00 UTC In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Sep 22, 22:52 UTC Scheduled - Dropbox will be performing routine maintenance on September 22, 2026 starting at 5:00 PM (Pacific). You may not be able to access Dropbox for a short period of time, but we’ll have things back up and running as soon as possible to minimize disruption to you.
Heap - Third party integration events latency impacting some customers
Sep 22, 15:43 PDT Identified - We have identified an issue where users may see delays in 3rd party integration events getting to the app, and potentially split users.
Amplitude - Snowflake Data Share export delivery issue
Sep 22, 11:49 PDT Investigating - Starting at 17:00 UTC, new data is not being delivered to Snowflake Data Share destinations. Existing shared data remains available, and data ingestion and analytics in Amplitude are not affected. No data loss is expected. Our team has identified an authentication issue on our side and is working on a fix. Delayed data will be delivered once resolved. No customer action is needed.We will share another update in 30 minutes.
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials
Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data. The package, named "tw-pkgprobe-7731," was first uploaded to the npm registry in mid-August 2026 by an npm account named "twdepprobe7731."
Sumo Logic - Problem with Cloud SIEM Processing in North America 1 (US1)
Sep 22, 17:56 UTC Monitoring - We have implemented a fix for the issue affecting Cloud SIEM Processing. We are currently monitoring the results. Sep 22, 17:44 UTC Investigating - We are currently investigating reports of problems with Cloud SIEM Processing. Log security records may take longer than normal to become searchable after processing. Users may not receive data when running queries or viewing dashboards that depend on recently collected data and alerts may not dispatch. Users may al...
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) "at every step of the attack chain." The action, carried out with authorization from the U.S. District Court for the Eastern District of Virginia, involved the efforts of Health-ISAC, alongside Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19. The tool, called BigDiskBuster, has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defender exploits were used in
Leaked GitHub App private keys let researchers impersonate 440 apps including CDC and BuildBuddy
A large-scale scan for leaked GitHub App private keys turned up some nice numbers, summarized below. Out of 5,000 leaked private keys tied to GitHub App environments, 474 were still valid at time of analysis. Those keys could impersonate 440 different GitHub Apps, some with high-level permissions (repo access, org-level admin, etc.). A subset reportedly could have allowed takeover of privat...
Akamai - Origin Server Connectivity Issues with Elevated Errors
Sep 22, 13:19 UTC Monitoring - We became aware of an issue with origin server connectivity that caused intermittent connectivity issues and elevated errors for some customers in affected regions. The issue was resolved at approximately 11:41 UTC on 22 September, 2026. The issue appears to have self-corrected; based on current observations, the service is resuming normal operations. We will continue to monitor to ensure the impact has been fully mitigated. We apologize for the impact and thank y...
Supabase - Supavisor connection disruptions in EU West 1 (Ireland)
Sep 22, 10:49 UTC Investigating - Some projects in the EU West 1 (Ireland) region may experience disruptions to Supavisor connections. Our team is aware of the issue and actively working on a resolution. We’ll share further updates as they become available.
Zoom - Service degradation affecting comment and attachment features in Zoom Canvas in US region.
Sep 22, 03:32 PDT Resolved - This incident has been resolved and the affected services have been restored. Sep 22, 03:19 PDT Monitoring - On 09/22/2026, Between 09:31 UTC to 09:55 UTC, Users may have experienced issues with comment and attachment features in Zoom Canvas.This incident has been resolved and the affected services have been restored.
New Relic - Test Incident - Public Status Page -ImpactIQ
Sep 22, 08:55 UTC Resolved - Test message -resolved Sep 22, 08:55 UTC Investigating - Test message - after fix
Supabase - Project creations are degraded in multiple regions
Sep 22, 08:33 UTC Monitoring - We have identified increased latency in Project creations in these regions from 0730 UTC to 0805 UTC:ap-northeast-1ap-northeast-2eu-central-1eu-central-2eu-north-1eu-west-1eu-west-3us-west-1 The latency has since recovered and our teams are monitoring for full recovery.Existing project availability has not been impacted.
Akamai - Increased latency during upstream provider maintenance in Singapore, Hong Kong, and Japan
Sep 22, 00:30 UTC Investigating - Scheduled upstream provider maintenance is currently taking place along network routes connecting Singapore, Hong Kong, and Japan from September 18, 2026 at 06:30 UTC through October 3, 2026 at 23:59 UTC. While core service remains operational, customers in the affected regions may notice increased latency during peak traffic hours. We are monitoring network performance until maintenance concludes.Customers and partners with a valid Control Center login can fin...
AWS - Service impact: Increased Error Rates
Between 3:49 PM and 5:06 PM PDT, we experienced increased error rates affecting new instance launches in the US-EAST-1 Region. During this time, customers may have experienced elevated error rates when attempting to launch new EC2 instances through RunInstances, CreateFleet, and related EC2 launch workflows. AWS services that launch EC2 instances on behalf of customers, including Amazon ECS, AWS Fargate, Amazon EMR, amongst others were also impacted during this period. We identified the root cau...
Zoom - Zoom Phone Maintenance - CA01-YVR1 Data Center: September 21, 2026
THIS IS A SCHEDULED EVENT Sep 21, 17:00 PDT - Sep 22, 21:30 PDT Sep 15, 12:28 PDT Scheduled - Zoom will perform service maintenance at our CA01-YVR1 Data Center starting at 5:00 PM Pacific on September 21, 2026. Zoom Phone users registered to the those sip zones will be automatically registered in the CA01-YYZ1sip zone sequentially. During the maintenance window, a brief disconnection may be experienced and notifications may be missed. If you get disconnected, the system will attempt to rec...
AWS - Service impact: Increased Error Rates
We can confirm increased error rates affecting new instance launches, including elevated API error rates for RunInstances, CreateFleet, and related EC2 launch workflows in the US-EAST-1 Region. Customers attempting to launch new EC2 instances may experience launch failures or elevated API response latency. Our engineers are actively engaged and working towards recovering the issue. We are seeing initial signs of recovery. Existing instances remain unaffected. We recommend retrying failed RunInst...
AWS - Service impact: Increased Error Rates
We are investigating increased API error rates in the US-EAST-1 Region.