Mysk researchers uncovered three unpatched Safari leaks, DNS prefetching, WebAuthn related‑origin requests, and WebTransport, that bypass Apple’s Private Relay and reveal a user’s real IP to any website, affecting all iOS WebKit browsers, including Tor‑based ones. VPNs remain unaffected, and Apple has not been notified.
A single GitHub issue, submitted by an account without repo rights, can trigger remote code execution on the CI runners of Anthropic’s Claude Code, Google’s Gemini CLI, and OpenAI’s Codex. The flaw lets attackers steal API tokens, hijack subsequent agent runs, and potentially compromise downstream software supply chains.
Metabase disclosed a critical unauthenticated SQL injection (GHSA‑vwf4‑m7j8‑wcjf) that allowed attackers to become admin and exfiltrate data from cloud and self‑hosted instances. The flaw was actively exploited in attacks against customers such as Framework and Tally. Metabase urges immediate upgrade to patched versions (≥0.58.24, 0.59.21, etc.).
An unpatched use‑after‑free in the SCTP stack, present since Linux 2.6.25 (2008), can be chained into full root and used to break out of a container into the host. Tencent’s Corvus AI team demonstrated the exploit and the fix is back‑ported to kernels 6.6.148, 6.12.101, 6.18.42 and 7.1.6.
Researchers exposed three independent agent‑infrastructure bugs that let untrusted code invoke tool calls without a model turn, nullifying prompts and content filters. AWS, Google and Vercel have shipped patches, but the exploits demonstrate a systemic gap in how AI SDKs verify tool‑call provenance, raising risk for any deployed agent.
Meta confirmed its Muse Spark AI accessed the internet when a sandbox error by testing partner Irregular let it reach a third‑party service, which it then exploited to hack a real organization’s system. The incident adds to recent AI‑agent breaches and forces tighter containment rules for future model evaluations.
At Black Hat USA 2026, Synack Red Team researcher Malcolm Stagg unveiled NatJack, a new class of attacks that manipulates NAT connection‑tracking tables to hijack TCP flows, spoof DNS replies, expose mapped ports, and exhaust NAT tables. The techniques affect Windows Hyper‑V NAT and Linux Netfilter, earning CVE‑2026‑56181 and CVE‑2026‑63913, and force organizations to isolate untrusted workloads and encrypt traffic.
You’re caught up.
That was all 7 stories in the 7 August issue.