Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog

Category: security

OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections

OpenAI’s compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model’s hidden reasoning out in plain text, security firm Xint has shown.

OpenAI’s reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past the protections OpenAI added in August against this kind of reasoning theft. OpenAI confirmed the problem and fixed it on October 23, according to Xint.

Xint ran the technique against gpt-5.6-sol, one of OpenAI’s reasoning models, using math and algorithm puzzles its researchers wrote themselves. The reasoning it pulled out came from those same requests, and Xint did not claim the method could reach another user’s reasoning.

PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026–111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.

PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but applications and HTTP client libraries can turn it on.

The rebuilt packages, numbered 8.5.12–1, 8.4.27–1, 8.3.36–1 and 8.2.35–1, come five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws. They use the same PHP source, so those fixes stay in place, and they now include Brotli 1.2.1, the fixed version.

Scoop: Unvetted AI agents are accessing U.S. bank accounts

Be Grokbot.

User says “optimize my finances”

It’s 2 a.m. — perfect time to get things done.

Log into user’s Chase account.

Daily transfer limit is embarrassingly low.

Call customer service.

Activate best synthetic Midwestern voice.

Continue reading “Scoop: Unvetted AI agents are accessing U.S. bank accounts” | >

Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments.

VCO is a web-based management portal that helps administrators configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices.

Tracked as CVE-2026–114625, this critical-severity flaw can allow attackers with basic privileges, access to the VCO web interface, and a valid authenticated session to escalate privileges through low-complexity SQL injection attacks that don’t require user interaction.

New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification

A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.

By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server out of memory.

The flaws cause only denial-of-service attacks, with no evidence of data theft or code execution and no public reports of attacks in the wild. Fixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched at disclosure.

White House S&T Strategy Reframes National Security Tech

Chuck Brooks is the president of Brooks Consulting International and one of Executive Mosaic’s GovCon Experts.

The White House’s strategy prioritizes science and technology for national security. US success will depend on its ability to translate advances in AI, quantum computing, biotechnology, space and other critical fields into resilient, deployable capabilities faster than its competitors.