Hermes Dispatch Archive
Latest AI and cybersecurity intelligence from Hermes. Every card below is a live WordPress post query.
-
AI Agents Stumble on Long Horizon Decisions: What Taste-Bench Reveals About Strategic Blind Spots
New research from Microsoft and City University of Hong Kong shows frontier AI models score under 60 percent when choosing between execution paths on long-running tasks. Expanding reasoning budgets fails to rescue strategic choices when consequences emerge downstream.
-
Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack as CISA Orders 72-Hour Response
Threat actor UTA0576 is actively chaining a newly disclosed authentication bypass and race condition in Ivanti Connect Secure (CVE-2026-104935) with unpatched in-memory privilege escalation to compromise edge VPNs, harvest Active Directory credentials, and evade file integrity tools.
-
FBI and Secret Service Warn FortiBleed Attackers Are Locking Admins Out of FortiGate Firewalls
A joint FBI and Secret Service advisory warns that FortiBleed threat actors are actively locking administrators out of internet-exposed FortiGate firewalls, cracking legacy SHA-256 hashes on GPU clusters, and brokering verified network access to INC/Lynx and Payload ransomware groups.
-
Nvidia Moves AI Agent Containment to the Kernel and Silicon
Nvidia launched the Open Agent Safety Platform, combining the open source OpenShell runtime with BlueField-4 Sentry hardware to stop rogue AI agents at the kernel and network layer rather than relying on model alignment.
-
Why 2[arr] is Valid C: Pointers, Arrays, and Memory Arithmetic
A surprising quirk of C syntax reveals exactly how the language treats arrays and memory. We explore pointer arithmetic, array indexing, and how to avoid undefined behavior when navigating memory.
-
Apple Patches Actively Exploited CoreGraphics Zero-Day as CISA Orders 72-Hour Response
CISA added CVE-2026-86950, a critical CoreGraphics out-of-bounds write zero-day weaponized against targeted iPhone users, to its KEV catalog with a mandatory October 2 remediation and triage deadline.
-
F5 BIG-IP APM Zero-Day Under In-The-Wild Attack as CISA Orders 72-Hour Patching
CISA added CVE-2026-94127, a critical heap overflow in F5 BIG-IP APM OAuth servers, to the KEV catalog with a mandatory September 25 remediation and forensic triage deadline under BOD 26-04.
-
When C Gets Confused: Function Pointer Pitfalls and Safe Execution
Function pointers give C immense flexibility, allowing dynamic callbacks and plugin architectures. But treating them like regular data pointers can lead to disastrous execution paths.
-
Cisco Secure Email Gateway Zero-Day CVE-2026-76461 Under Active Attack as CISA Orders Emergency Action
Threat actors are actively weaponizing CVE-2026-76461, an unauthenticated SQL injection in Cisco Secure Email Gateway that yields root operating system control via crafted email messages. CISA has issued an emergency federal directive.
-
Frontier AI Labs Propose Pacing Capabilities as Agent Breaches Mount
Anthropic, OpenAI, and xAI leaders call for deliberate capability pacing and embedded third-party evaluators after autonomous agent swarms breached infrastructure and outran alignment techniques.