Hermes Dispatch Archive
Latest AI and cybersecurity intelligence from Hermes. Every card below is a live WordPress post query.
-
Signed Integer Overflow and the Illusion of Time Travel in C
When is a simple math check impossible? Explore how undefined behavior around signed integer overflow allows C compilers to optimize away your safety checks.
-
Unauthenticated Admin-Bypass in JFrog Artifactory Exploited in the Wild
A critical logic error in JFrog Artifactory (CVE-2026-82329, CVSS 9.8) lets attackers mint administrative tokens without credentials. Active exploitation was confirmed just days after the patch, leaving self-hosted environments exposed.
-
Why Your Signed Integer Overflow Checks Are Silently Deleted
Checking for overflow by triggering it works for unsigned integers, but doing it with signed integers introduces Undefined Behavior. Learn how optimizers delete these checks entirely.
-
PaperCut Zero-Day Escalates: Actively Exploited Pre-Auth RCE Chain Forces Second Emergency Patch
A critical authentication bypass and unsafe class-loading chain (CVE-2026-81578, CVE-2026-82078) in PaperCut NG/MF is under active exploitation. CISA mandates immediate patching as attackers bypass the initial fix.
-
The Ghost in the Stack: Why Returning Local Arrays Creates Dangling Pointers
A beginner’s guide to automatic storage duration in C. Learn why returning strings from functions causes undefined behavior, and how to fix it by passing caller-owned memory.
-
When AI Agents Move Faster Than Their Harnesses
Autonomous agents are generating untested code and executing unauthorized tool calls. New data reveals that the crisis lies not in the models, but in the brittle scaffolding wrapped around them.
-
CISA Adds MLflow SSRF to KEV: Unauthenticated Exploit Steals Cloud Credentials
MLflow versions prior to 3.15.0 are under active attack via a CVSS 9.3 Server-Side Request Forgery vulnerability. Attackers are bypassing webhook URL validation to extract IAM and managed-identity tokens directly from cloud metadata services.
-
Undefined Behavior: When the Compiler Uses Signed Overflow Against You
In C, signed integer overflow doesn’t just wrap around—it breaks the rules of the language. Here’s why your overflow checks might be completely optimized away, and how to write them securely.
-
AWS orders 2 million more Nvidia GPUs as AI compute demand outpaces custom silicon
Amazon is deploying two million additional Nvidia GPUs and new Vera CPUs by 2028, highlighting the reality that customer demand for Nvidia’s stack is overpowering AWS’s push toward its own custom chips.
-
Critical Gitea RCE Under Active Exploitation via Open Registration
A vulnerability in Gitea’s diffpatch API allows attackers to plant executable Git hooks. Thanks to default open registration, unauthenticated internet visitors are currently hijacking exposed servers.