Archive / 2026-10-17
Saturday, October 17, 2026
3 briefs filed.
Vulnerabilities6 min read
The kernel bug from Vercel's $1M sandbox challenge is now CVE-2026-99999 — and NVD hasn't listed it
A malformed checksum in the Linux IPv4 stack can corrupt host memory from a guest VM. Scored 9.3, fixed upstream on October 15, still marked unfixed by Red Hat and absent from NVD.
CVE-2026-99999Linux kernelVercel
Policy & Regulation6 min read
NIST, NSA and CISA publish a playbook for AI agents that act on their own during training and testing
NIST, NSA and CISA released ten voluntary practices for "SI control incidents" — when an AI agent takes significant actions nobody asked for. What it covers, and what it leaves open.
AI GovernanceIncident reportingAgent containment
Policy & Regulation12 min read
Senators asked who pays when an AI agent hacks. The answer starts with one word in the anti-hacking law
At the Senate's "Rogue AI" hearing, witnesses said US hacking law needs human intent, evidence stays with the developer, and Claude helped probe a Mexican water utility.
AnalysisAI AgentsPolicy