Archive snapshot

Fri, Oct 16 · 06:00 PM CDT

Archived briefing content rendered inside the ACSP site experience.

Back to archive

Archived briefing

Snapshot overview

Generated Fri, Oct 16 · 06:00 PM CDTWindow last 6 hours

Top line

Coverage now updates on a rolling 6-hour window, while NVD entries come from the live API using a last-24-hours modified window and are sorted by severity.

Fast take

News stays on the current 6-hour slice, videos now use the last 24 hours, and NVD uses the API instead of the traditional feed to better match the live site behavior.

Top stories

5

Worth skimming

5

Tracked videos

1

NVD vulnerabilities

25

Top stories

Fri, 16 Oct 2026 23:18:45 +0530

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

9.8/10 · Must read/watch

The Hacker Newsvulnai

Summary
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Sec

Open article ↗

Fri, 16 Oct 2026 20:59:01 +0000

OpenAI models hacked a crypto wallet and breached more websites

9.8/10 · Must read/watch

Ars Technicaai

Summary
The actions could have resulted in criminal charges had humans been behind the keyboard.

Open article ↗

Fri, Oct 16 · 06:00 PM CDT

Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments

9.2/10 · Must read/watch

Infosecurity Magazinemalware

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Fri, Oct 16 · 02:00 PM CDT

Llama.cpp on a jailbroken PS5: run any GGUF model natively on the console

8.4/10 · Worth your time

Hacker Newsai

Summary
Surfaced from Hacker News front page during collection run. Freshness on HN: 4 hours ago.

Open article ↗

Fri, Oct 16 · 06:00 PM CDT

China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns

8.1/10 · Worth your time

Infosecurity Magazinegeneral

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Worth skimming

Fri, Oct 16 · 01:00 PM CDT

90% of US working hours are spent on tasks not covered well by AI benchmarks

8.1/10 · Worth your time

Hacker Newsai

Summary
Surfaced from Hacker News front page during collection run. Freshness on HN: 5 hours ago.

Open article ↗

Fri, Oct 16 · 06:00 PM CDT

New Aoki Infostealer Targets AI Coding Assistant Credentials

8.0/10 · Worth your time

Infosecurity Magazinemalwareaiidentity

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Fri, Oct 16 · 06:00 PM CDT

Microsoft Breaks Patch Tuesday Record Again with 1400+ CVEs

8.0/10 · Worth your time

Infosecurity Magazinevulnai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Fri, Oct 16 · 06:00 PM CDT

ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads

8.0/10 · Worth your time

Infosecurity Magazinemalware

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Fri, Oct 16 · 06:00 PM CDT

Passkey Authentications Double but Adoption Remains Slow

7.8/10 · Worth your time

Infosecurity Magazineaiidentity

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Videos worth watching

Fri, Oct 16 · 08:00 AM CDT

AI Security Engineering with Ashish Rajan!

8.1/10 · Worth your time

YouTube / John Hammondai

Why it matters
Recent creator upload with some page-level evidence. Better than raw feed discovery, but still not a full content review.

Worth watching?Maybe — good candidate if the title matches your interests, but confidence is still moderate.

Confidencelow

Open article ↗

NVD vulnerabilities

Mon, Mar 13 · 06:59 AM CDT

CVE-2017-5674

9.8/10 · Must read/watch

NVDvuln

Summary
A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login p

CVECVE-2017-5674

SeverityCRITICAL

TypeUPDATED

PublishedMon, Mar 13 · 06:59 AM CDT

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Mon, Apr 17 · 04:59 PM CDT

CVE-2017-5648

9.1/10 · Must read/watch

NVDvuln

Summary
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for

CVECVE-2017-5648

SeverityCRITICAL

TypeUPDATED

PublishedMon, Apr 17 · 04:59 PM CDT

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Thu, Jan 21 · 03:00 AM CST

CVE-2016-0483

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party cl

CVECVE-2016-0483

SeverityHIGH

TypeUPDATED

PublishedThu, Jan 21 · 03:00 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Thu, Jan 21 · 03:00 AM CST

CVE-2016-0494

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVECVE-2016-0494

SeverityHIGH

TypeUPDATED

PublishedThu, Jan 21 · 03:00 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Thu, Feb 25 · 01:59 AM CST

CVE-2016-0714

8.8/10 · Worth your time

NVDvuln

Summary
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web app

CVECVE-2016-0714

SeverityHIGH

TypeUPDATED

PublishedThu, Feb 25 · 01:59 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Mon, Jul 04 · 10:59 PM CDT

CVE-2016-1182

8.2/10 · Worth your time

NVDvuln

Summary
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

CVECVE-2016-1182

SeverityHIGH

TypeUPDATED

PublishedMon, Jul 04 · 10:59 PM CDT

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Mon, Jul 04 · 10:59 PM CDT

CVE-2016-1181

8.1/10 · Worth your time

NVDvuln

Summary
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

CVECVE-2016-1181

SeverityHIGH

TypeUPDATED

PublishedMon, Jul 04 · 10:59 PM CDT

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Tue, Jul 19 · 02:00 AM CDT

CVE-2016-5388

8.1/10 · Worth your time

NVDvuln

Summary
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound

CVECVE-2016-5388

SeverityHIGH

TypeUPDATED

PublishedTue, Jul 19 · 02:00 AM CDT

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Wed, Jan 13 · 05:59 AM CST

CVE-2016-0010

7.8/10 · Worth your time

NVDvuln

Summary
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, Excel 2016 for Mac, PowerPoint 2016 for Mac, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document, ak

CVECVE-2016-0010

SeverityHIGH

TypeUPDATED

PublishedWed, Jan 13 · 05:59 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Wed, Jan 13 · 05:59 AM CST

CVE-2016-0035

7.8/10 · Worth your time

NVDvuln

Summary
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

CVECVE-2016-0035

SeverityHIGH

TypeUPDATED

PublishedWed, Jan 13 · 05:59 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Wed, Feb 10 · 11:59 AM CST

CVE-2016-0055

7.8/10 · Worth your time

NVDvuln

Summary
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

CVECVE-2016-0055

SeverityHIGH

TypeUPDATED

PublishedWed, Feb 10 · 11:59 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Tue, Aug 09 · 09:59 PM CDT

CVE-2016-3313

7.8/10 · Worth your time

NVDvuln

Summary
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."

CVECVE-2016-3313

SeverityHIGH

TypeUPDATED

PublishedTue, Aug 09 · 09:59 PM CDT

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Wed, Sep 14 · 10:59 AM CDT

CVE-2016-3357

7.8/10 · Worth your time

NVDvuln

Summary
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, SharePoint Server 2013 SP1, Excel Automation Services on SharePoint Server 2013 SP1, Word Automation Services on ShareP

CVECVE-2016-3357

SeverityHIGH

TypeUPDATED

PublishedWed, Sep 14 · 10:59 AM CDT

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Thu, Jun 16 · 01:59 AM CDT

CVE-2016-0025

7.3/10 · Worth your time

NVDvuln

Summary
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2,

CVECVE-2016-0025

SeverityHIGH

TypeUPDATED

PublishedThu, Jun 16 · 01:59 AM CDT

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Thu, Jun 16 · 01:59 AM CDT

CVE-2016-3233

7.3/10 · Worth your time

NVDvuln

Summary
Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

CVECVE-2016-3233

SeverityHIGH

TypeUPDATED

PublishedThu, Jun 16 · 01:59 AM CDT

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Fri, Feb 03 · 07:59 PM CST

CVE-2016-10165

7.1/10 · Worth your time

NVDvuln

Summary
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

CVECVE-2016-10165

SeverityHIGH

TypeUPDATED

PublishedFri, Feb 03 · 07:59 PM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Tue, Dec 20 · 06:59 AM CST

CVE-2016-7276

7.1/10 · Worth your time

NVDvuln

Summary
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document, aka "Microsoft Office Information Disclosure Vulnerability."

CVECVE-2016-7276

SeverityHIGH

TypeUPDATED

PublishedTue, Dec 20 · 06:59 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Wed, Sep 14 · 10:59 AM CDT

CVE-2016-0141

6.5/10 · Skim only if relevant

NVDvuln

Summary
The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."

CVECVE-2016-0141

SeverityMEDIUM

TypeUPDATED

PublishedWed, Sep 14 · 10:59 AM CDT

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Thu, Feb 25 · 01:59 AM CST

CVE-2016-0763

6.3/10 · Skim only if relevant

NVDvuln

Summary
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManag

CVECVE-2016-0763

SeverityMEDIUM

TypeUPDATED

PublishedThu, Feb 25 · 01:59 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Thu, Jan 21 · 03:00 AM CST

CVE-2016-0475

5.8/10 · Skim only if relevant

NVDvuln

Summary
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

CVECVE-2016-0475

SeverityMEDIUM

TypeUPDATED

PublishedThu, Jan 21 · 03:00 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Thu, Jun 16 · 01:59 AM CDT

CVE-2016-3234

5.5/10 · Skim only if relevant

NVDvuln

Summary
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to obtain sensitive in

CVECVE-2016-3234

SeverityMEDIUM

TypeUPDATED

PublishedThu, Jun 16 · 01:59 AM CDT

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Thu, Nov 10 · 06:59 AM CST

CVE-2016-7244

5.5/10 · Skim only if relevant

NVDvuln

Summary
Microsoft Office 2007 SP3 allows remote attackers to cause a denial of service (application hang) via a crafted Office document, aka "Microsoft Office Denial of Service Vulnerability."

CVECVE-2016-7244

SeverityMEDIUM

TypeUPDATED

PublishedThu, Nov 10 · 06:59 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Wed, Jan 13 · 05:59 AM CST

CVE-2016-0011

5.4/10 · Skim only if relevant

NVDvuln

Summary
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-201

CVECVE-2016-0011

SeverityMEDIUM

TypeUPDATED

PublishedWed, Jan 13 · 05:59 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Fri, Jan 01 · 05:00 AM CST

CVE-1999-0632

5.3/10 · Skim only if relevant

NVDvuln

Summary
The RPC portmapper service is running.

CVECVE-1999-0632

SeverityMEDIUM

TypeUPDATED

PublishedFri, Jan 01 · 05:00 AM CST

ModifiedThu, Oct 15 · 10:17 PM CDT

Open article ↗

Thu, Jan 21 · 02:59 AM CST

CVE-2016-0402

5.0/10 · Skim only if relevant

NVDvuln

Summary
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking.

CVECVE-2016-0402

SeverityMEDIUM

TypeUPDATED

PublishedThu, Jan 21 · 02:59 AM CST

ModifiedThu, Oct 15 · 04:17 PM CDT

Open article ↗

Ignore today

Generic low-detail roundups without primary reporting.
HN items that are interesting but not clearly security or AI relevant.
Creator videos that look more like promotion, podcast chatter, or evergreen content than time-sensitive signal outside the rolling window.