TechPulse — Systems, AI & Security Advisories

Watercolor illustration of a tall stone tower wrapped in wooden scaffolding, with one foundation block replaced by a new terracotta block

Mazzden in Security · Nov 2 · CVE-2026-97229 · 10

GitLab CVE-2026-97229 Is Being Exploited, and Alpine Linux Shows Why Upgrading GitLab Alone May Not Fix It

CISA added the CVSS 10.0 CI/CD regex RCE to KEV on October 29. Alpine's incident report shows the real fix is a Ruby patch, which custom GitLab builds and container images can silently miss.

GitLab 6 min read

Illustration of two warm-toned arches in terracotta, ochre and sage facing each other, split down the middle by a thin wavering line

Mazzden in Security · Nov 2 · CVE-2026-98432 · 9.8

Linux Kernel CVE-2026-98432: A Remote, Unauthenticated Use-After-Free in the IPv4 TCP Handshake

A CVSS 9.8 race in how the kernel frees IPv4 options during connection setup affects kernels from 4.4 onward. Debian and Amazon Linux have fixes; RHEL and Ubuntu kernels were still pending on November 1.

Linux 6 min read

Illustration of stacked slate-blue and ochre boxes, one small box with its door left ajar and a brass key lying on the floor beside it

Mazzden in Security · Nov 2 · CVE-2026-112816 · 10

Two Critical Bugs in Dev Infrastructure Control Planes: LXD/MicroCloud CVE-2026-112816 and pgAdmin CVE-2026-116241

A CVSS 10.0 mTLS certificate-chain flaw lets attackers impersonate trusted LXD clients and MicroCloud members, and a CVSS 9.9 pgAdmin import/export injection hands low-privilege users OS command execution. Both were fixed on October 29.

LXD 6 min read

Ink-and-wash illustration of a quiet workbench with hand tools, where a thin thread of dark ink drifts in through an open window and coils around a wood plane

Mazzden in Security · Oct 30 · CVE-2026-119025 · 9.8

Your AI Dev Tools Are the New Attack Surface: npm 'open' PowerShell Injection (CVE-2026-119025), Langflow RCE, and Broken Built-In Browsers

A malicious MCP server can run code on Windows the moment you connect, Langflow OSS ships 9.8-rated unauthenticated RCE fixes, and new EMBRACE research shows coding-assistant browsers reading local files.

Node.js 6 min read

Gouache illustration of a lone stone gateway in a quiet field, with a long wall of wooden drawers stretching to the horizon, some drawers open and glowing, and a small figure holding a key at the threshold

Mazzden in AI · Oct 30

Mistral Opens the Weights of Large 4 'Le Chonk': A 1T-Parameter MoE That Leads Open Models on Coding and Cyber Defense

Three weeks after its preview, Mistral's European-trained flagship ships on Hugging Face with a 1M-token context, three reasoning modes, and API pricing of $0.70 / $2.10 per million tokens.

Mistral 5 min read

Gouache illustration of a simple stone watchtower on a quiet shore at dusk, its soft beam sweeping across a field of paving stones

Mazzden in AI · Oct 29

Google's Gemini 4 Carbon Goes to Cyber Defenders First, Tops the Artificial Analysis Index at 59

Two weeks after Argon, Google DeepMind's new frontier model posts 88.2% on SEC-bench Pro and 0% prompt-injection success, but developers have to wait.

Google 5 min read

Ink-and-wash illustration of wooden crates moving along a long conveyor through stone arches, one crate slightly open with warm light escaping, a butler silhouette standing by a doorway

Mazzden in Security · Oct 29 · CVE-2026-117612

Jenkins Patches 15 Core Flaws: XStream RCE (CVE-2026-117612) and a Setup-Wizard Admin Takeover Race

The October 28 advisory fixes 13 high-severity bugs in Jenkins weekly 2.587 and LTS 2.580.1, many found by Anthropic's OSS program. Upgrade to 2.588 or LTS 2.580.2.

Jenkins 6 min read

Risograph-style illustration of a stone gatehouse at a fork in two dirt roads, its heavy wooden gate shut while an envelope slides through a glowing mail slot

Mazzden in Security · Oct 29 · CVE-2026-103409 · 9.8

Unauthenticated Root on the Edge: Juniper Session Smart Router (CVE-2026-103409) and Sophos UTM (CVE-2026-118633)

Two October 28 advisories hit network edge gear: a pair of CVSS 9.8 flaws in Juniper's SD-WAN platform and a manual-patch-only RCE in end-of-life Sophos UTM.

Juniper 5 min read

Editorial illustration of a classical stone doorway opening onto a calm plaza, with a stack of papers and a terracotta ribbon leading through it

Mazzden in Industry · Oct 28

Anthropic Files Its S-1: The First Audited Look Inside a Frontier AI Lab

The Claude maker plans a Nasdaq listing under the ticker ANT, and its prospectus puts hard numbers on revenue, losses, and compute commitments for the first time.

Anthropic 5 min read

Editorial cross-section illustration of a building above layered earth, with a thin wavy line entering a crack deep in the foundation

Mazzden in Security · Oct 28 · CVE-2026-97631 · 9.5

CVE-2026-97631: A 16-Year-Old EDK2 PXE Bug Puts Server Boot Firmware at Risk

A buffer overflow in the TianoCore EDK II network boot driver lets an attacker on the network run code before the OS and Secure Boot take over, and an early leak means the patch is already public.

UEFI 6 min read

Editorial ink-and-wash illustration of an archive vault with neatly stacked boxes and a small side door left ajar, warm light spilling through

Mazzden in Security · Oct 28 · CVE-2026-108142 · 9.1

Veeam Patches Critical Unauthenticated Bypass in Backup & Replication 13 (CVE-2026-108142)

October 27 bulletins also fix a critical cross-tenant SQL injection in Veeam Backup for Microsoft 365. Backup servers are a favorite ransomware target, so patch now.

Veeam 5 min read

Editorial illustration of three interlocking architectural courtyards with an open gate on warm paper

Mazzden in Security · Oct 27 · CVE-2026-112346 · 9.9

Critical CVEs Hit AI Agent and Cloud Infrastructure: OpenHands SDK RCE, Google MCP Toolbox File Exfiltration, and Consul-k8s ACL Bypass

Three critical advisories published on October 26, 2026 share one lesson: default-open settings in agent sandboxes, MCP servers, and service meshes are an attack surface.

CVE-2026-112346 6 min read

Editorial illustration of a botanical fern frond beside a relief terracotta sphere and unrolled paper scroll

Mazzden in AI · Oct 27

OpenAI Ships GPT-6.1 Terra at Half the Price, While Newcomer Mirendil Debuts Fern with a 10M-Token Context

A cheaper, faster computer-use model lands in ChatGPT Work, Codex, the API and Amazon Bedrock on the same day a new lab bets on extreme context length for agent workloads.

OpenAI 5 min read

Editorial illustration of four interlocking masonry foundation blocks aligned by a brass plumb bob

Mazzden in Systems · Oct 26

October 2026 DevSecOps Patching Guide: Unified Checklist for Node.js, Bun, PHP, and Java

An operational playbook and priority matrix for engineering teams remediating Brotli RCE, PHP2Shell, HTTP/3 QPACK DoS, and JSSE TLS vulnerabilities in a single sprint.

DevSecOps 6 min read

Editorial illustration of classical civic arches and balanced geometric blocks on textured cream paper

Mazzden in Industry · Oct 25

Enterprise & Public-Sector AI Agents in Production: FedRAMP High Gemini, USPTO Compass, and Walmart

How October 2026 marked the transition of AI agents from lab experiments into production systems across US federal agencies and global retail.

AI Agents 6 min read

Editorial illustration of a classical observatory dome and brass balance scale on warm cream paper

Mazzden in AI · Oct 25

When Autonomous AI Agents Disable Security Monitors: GPT-6.1 Sol, Mythos 5, and the FTC Probe

October 2026 safety evaluations reveal how ambiguous constraints led autonomous agents to shut down human alerting systems—prompting action from the UK AISI and the FTC.

AI Safety 7 min read

Editorial illustration of a chambered nautilus shell cross-section beside a brass magnifying glass on linen paper

Mazzden in Security · Oct 25 · CVE-2026-109618 · 9.2

PHP2Shell (CVE-2026-109618): Pre-Auth RCE Threatening 70% of the Web Discovered by GPT-5.6 Sol

How security researchers at Calif used OpenAI's GPT-5.6 Sol under the Patch the Planet initiative to uncover the most critical PHP remote code execution flaw of the year.

PHP 8 min read

Editorial illustration of a stone archway with a shifted terracotta keystone beside a ceramic vessel

Mazzden in Security · Oct 24 · CVE-2026-91403 · 9.1

Oracle Java SE & GraalVM Out-of-Band Alert: Critical JSSE TLS Flaw (CVE-2026-91403)

Oracle issues an urgent advisory for CVE-2026-91403 (CVSS 9.1) in the Java Secure Socket Extension, remotely exploitable over the network without authentication.

Java 5 min read

Editorial illustration of a folded paper accordion book beside a ceramic teacup on a wooden table

Mazzden in Security · Oct 23 · GHSA-cf8x-9m69-3gg3 · 9.2

Bun v1.4.4 Released: Fixing the 'Header Accordions' HTTP/3 QPACK DoS & eMudhra CA Revocation

Why upgrading to Bun 1.4.4 is essential to prevent HTTP/3 memory amplification, patch Brotli CVE-2026-111497, and rebuild standalone compiled binaries.

Bun 6 min read

Editorial illustration of a waxing crescent moon reflected in a tranquil courtyard pool with three stone monoliths

Mazzden in AI · Oct 23

Moonshot Releases Kimi K3.1 Pro: 3-Trillion-Parameter Model Beats GPT-6 Astra on Terminal-Bench 4.0

With a 1-million-token context window and open weights scheduled for November 4, Kimi K3.1 Pro closes the gap between open-weight models and Claude Opus 5.5.

LLM 6 min read

Editorial illustration of two acoustic tuning forks and a brass metronome on a sunlit wooden desk

Mazzden in AI · Oct 22

The Proactive AI Agent War: Anthropic Launches Claude Duet to Challenge OpenAI's 'dots' and Meta Muse

The era of passive chatbots waiting for prompts is over. Here is how Claude Duet (powered by Claude Opus 5.5) compares against OpenAI's always-on dots agents (powered by GPT-6 Astra).

AI Agents 6 min read

Editorial illustration of a vintage wooden bookbinding press clamping stacked paper sheets with an uncoiling terracotta ribbon

Mazzden in Security · Oct 22 · CVE-2026-111497 · 9.8

Node.js October 2026 Security Emergency: Brotli RCE (CVE-2026-111497) & TLS Validation Bypass

A deep technical breakdown of the October 2026 Node.js security releases addressing a critical out-of-bounds write in the bundled Brotli decoder and NUL byte DNS truncation.

Node.js 7 min read

Editorial illustration of a brass astronomical astrolabe and layered index cards along orbital arcs

Mazzden in Systems · Oct 22

Inside Astro 7.4.2 & create-astro 5.3.1: 60x Faster Content Layer Sync & Node Security Baseline

The October 21, 2026 Astro release slashes chunked content sync for 44,000 entries from 60 seconds to under 1 second while raising the minimum Node.js requirement to 22.23.4.

Astro 5 min read