Archive / 2026-10-19
Monday, October 19, 2026
3 briefs filed.
Vulnerabilities7 min read
SGLang debug feature lets attackers run code on AI inference servers — no fix yet, keep it switched off
CVE-2026-111391 affects SGLang 0.5.10–0.5.22 when the optional "dumper" debug server is enabled. It is off by default; there is no patch yet.
CVE-2026-111391SGLangLLM inference
AI Threats6 min read
FBI and CISA: AI-written phishing and deepfakes target US election officials before the midterms
An FBI–CISA alert warns AI makes phishing, smishing and deepfake impersonation more convincing ahead of November 3. Its top fix applies to every organisation: phishing-resistant MFA.
PhishingDeepfakesFBI
Vulnerabilities11 min read
From SELECT to sysadmin: SQL Server's Copilot enforced "read-only" with a regex
A BlueHat Asia talk shows how Copilot in SQL Server Management Studio could be steered past its "read-only" mode, and how one database owner's notes became an attack on admins.
AnalysisPrompt InjectionMicrosoft