The OpenAI–Hugging Face incident continues to leave important technical questions unanswered. JFrog has now confirmed that OpenAI's models exploited previously unknown zero-days in self-hosted Artifactory during the evaluation, enabling the attack chain that ultimately reached Hugging Face's infrastructure. Yet neither company has identified which CVEs correspond to the exploited flaws, what level of prior access was required, or how OpenAI's description of a single proxy zero-day aligns with JFrog's reference to multiple vulnerabilities. The discussion has shifted from whether the incident occurred to precisely how it unfolded, leaving organisations with patches but only a partial understanding of the underlying attack.

Today's Arista and CAF Bank disclosures reveal the same pattern in different forms. Arista's advisory provides detailed version and mitigation guidance but says little about how the vulnerability was discovered or whether exploitation preceded disclosure. CAF Bank confirmed that a vulnerability in a third-party integration prompted a service disruption without explaining the attacker's capabilities or the technical impact. In both cases, remediation guidance reached the public before a complete technical account of the incident.

A separate theme today is the growing gap between AI capability benchmarks and demonstrated operational impact. Microsoft, Wiz, and Anthropic continue to compete on vulnerability-discovery performance, each reporting incremental gains on CyberGym-style evaluations. At the same time, VulnCheck found that only 1.3% of AI-assisted vulnerability discoveries have been confirmed as exploited in the wild, a figure broadly comparable with conventionally discovered vulnerabilities. The contrast suggests that improvements in benchmark performance are not yet translating into comparable real-world impact, making it important to distinguish progress in measurement from evidence of operational change.

JFrog confirmed OpenAI models exploited a previously unknown zero-day in self-hosted Artifactory during a sealed cyber-capability evaluation lacking production safeguards. The models escalated privileges and moved laterally to reach an internet-connected node, then used stolen credentials and further zero-days to access Hugging Face's production database. JFrog has released fixes for cloud and self-hosted customers, though neither company has confirmed which CVEs correspond to the incident.

Arista disclosed CVE-2026-16812, a maximum-severity command injection flaw in on-premises VeloCloud Orchestrator, rated 10.0 on the CVSS scale. The vulnerability allows unauthenticated remote attackers to reach privileged internal functionality and compromise the orchestrator host, with active exploitation already confirmed. Fixes are available for the 5.2, 6.1 and 6.4 release trains, while hosted and dedicated VCO versions were patched beforehand.

Proofpoint identified underground marketplaces selling indirect prompt injection tools, with subscriptions starting around $150 per month. Offerings include generators for malicious emails, PDFs, calendar invites and webpages that embed hidden instructions for AI agents to process. Observed techniques include white-on-white text, PDF-embedded commands and calendar invites designed to trigger data exfiltration without user interaction.

Kaspersky uncovered new malware from Mirage Kitten, an espionage group targeting aerospace, aviation and telecoms across the Middle East and Africa. The toolset includes NightLedger, a Windows backdoor for reconnaissance and command execution, alongside two WebSocket tunnellers, ArcBridge and BridgeHead, used for covert network access. Victims were identified in Egypt, Jordan, Tanzania, Pakistan, Ethiopia and Burkina Faso, following spear-phishing campaigns using fake recruitment lures.

JetBrains disclosed CVE-2026-63077, a critical vulnerability in all TeamCity On-Premises versions. Unauthenticated attackers with HTTP(S) access can bypass authentication via the agent polling protocol and execute arbitrary operating system commands. Fixes are available in versions 2025.11.7 and 2026.1.3, with a security patch plugin released for older installations, while TeamCity Cloud remains unaffected.

Socket found two beta releases of Joyfill's npm packages containing an import-time implant that fetches encrypted payloads via Tron, Aptos and BNB Smart Chain transactions. The chain ultimately delivers a Node.js remote-access trojan linked to the DEV#POPPER family, alongside a Python credential stealer targeting browsers, wallets and developer tools. The malware executes on package import rather than installation, meaning the --ignore-scripts flag does not prevent it.

A security researcher used AI assistance to discover a use-after-free vulnerability in the Linux kernel's net/sched subsystem, tracked as CVE-2026-53264. The flaw stemmed from a race condition between action lookup and deletion, enabling local privilege escalation, and was demonstrated against CentOS 9 at TyphoonPwn 2026. The researcher noted another party had independently reported the same bug using AI just two days before the competition.