Archive / 2026-10-03
Saturday, October 3, 2026
4 briefs filed.
Vulnerabilities8 min read
Ten advisories, no patched version: LightLLM's internal services are open by default
Ten CVEs now list ModelTC's LightLLM inference server as affected, nine of them through 1.2.0 — its newest release. Six are unauthenticated remote code execution. There is no version to upgrade to.
LightLLMModelTCCVE-2026-103395
Policy & Regulation14 min read
Europe's threat landscape counted 8,257 incidents and could not say how many involved AI
ENISA's Threat Landscape 2026 analysed 8,257 incidents from 2025, 73% at NIS2 entities, with no count of AI involvement — and its two named AI cases rest on inference, one on an AI-detector verdict.
AnalysisENISANIS2
Vulnerabilities8 min read
Mooncake, the KV cache layer under vLLM and SGLang, has two unauthenticated flaws — one unfixed
Two CVEs published October 1, 2026 in Mooncake's transfer engine. One lets anyone on the network read and write process memory; the other has no released fix.
CVE-2026-103764CVE-2026-103765Mooncake
AI Threats7 min read
An AI agent breached a Dutch security non-profit via two Zammad zero-days — one is still unpatched
An AI agent chained two Zammad zero-days to break into DIVD's helpdesk. Both are now on CISA's exploited list, and the root flaw is still unpatched.
Agentic AIAutonomous AttacksZammad