CVE-2025-57852 Openshift-ai: privilege escalation via excessive /etc/passwd permissions

A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a...

CVE-2025-57852

A CVE is reported for KServe ModelMesh container images: a build-time /etc/passwd file created with group-writable permissions allows a non-root container user, if they are in the root group, to modify /etc/passwd and add a user with any UID (including 0), enabling full container root access. Thi...

The State of Enterprise AI: Why Edge Native Is the Fastest Path to ROI

...

This Week in Spring: September 30th, 2025

Hi, Spring fans! As I write this I am about to board a flight for Colorado for the amazing Dev2Next conference! I'll be in Antwerp, Beglium for the amazing Devoxx event next week, and I'll be speaking at the Amsterdam JUG with James Ward on the Thursday after that, too! If you're around, be sure ...

Securing MCP Servers with Spring AI

Model Context Protocol, or MCP for short, has taken over the AI world. If you've been following our blog, you've probably read the introduction to the topic, Connect Your AI to Everything: Spring AI's MCP Boot Starters. The security aspects of MCP have been evolving fast, and the latest version o...

PT-2025-40011

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift AI versions 2.19 through 2.21 Description A critical flaw exists in Red Hat OpenShift AI Service that allows a low-privileged authenticated user, such as a data scientist using a Jupyter notebook, to escalate their privileges...

Red Hat OpenShift AI 安全漏洞

Red Hat OpenShift AI is an AI-oriented lifecycle management platform from Red Hat USA. A security vulnerability exists in Red Hat OpenShift AI that stems from a low-privilege attacker being able to elevate privileges through an authenticated account, potentially leading to complete control of the...

Important: Red Hat Bug Fix Advisory: RHOAI 2.19.0 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.19.0 provides these changes:...

Important: Red Hat Security Advisory: RHOAI 2.19.3 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.19.3 provides these changes:...

Important: Red Hat Security Advisory: RHOAI 2.22.2 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.22.2 provides these changes:...

Important: Red Hat Bug Fix Advisory: RHOAI 2.21.0 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.21.0 provides these changes:...

Important: Red Hat Security Advisory: RHOAI 2.21.1 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.21.1 provides these changes:...

Important: Red Hat Security Advisory: RHOAI 2.16.3 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.16.3 provides these changes:...

Abusing Notion’s AI Agent for Data Theft

Notion just released version 3.0, complete with AI agents. Because the system contains Simon Willson's lethal trifecta, it's vulnerable to data theft though prompt injection. First, the trifecta: The lethal trifecta of capabilities is: Access to your private data --one of the most common purposes...

The emerging use of malware invoking AI

A closer look at LameHug, the Amazon Q Developer Extension compromise, s1ngularity, and PromptLock...

Malicious code in sendbird-ai-agent-samples (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47726 Malicious code in sendbird-ai-agent-samples (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47610 Malicious code in ai-communication-app (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in ai-communication-app (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-59402

Flock Safety Bravo Edge AI Compute Device BRAVO00.00local20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls...