Cyber Attacks
Researcher Finds RCE Flaw in Google DevSite via Flask Session Forgery
Simon Koeck discovered that unauthenticated attackers could forge session cookies to execute remote code on multiple Google developer sites.
Python
Everything Threat Times has reported about Python: 7 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Critical OAuth2 SSRF in SAP Cloud SDK for Python Exposes Client Credentials
A vulnerability in the SAP Cloud SDK for Python allows attackers to redirect token requests, leading to credential theft in multi-tenant BTP applications.
Vulnerabilities
AWS Encryption SDK for Python Vulnerability Allows Policy Bypass via Shared Key Cache
A flaw in the AWS Encryption SDK for Python allows attackers to bypass key commitment policies by exploiting a shared key cache mechanism.
Vulnerabilities
CairoSVG 2.9.1 Fixes High-Severity Denial-of-Service Vulnerability in SVG Rendering
A quadratic CPU consumption flaw in older CairoSVG versions allows attackers to crash services with small files. Version 2.9.1 resolves the issue.
Vulnerabilities
AWS warns of high-severity RCE in Redshift Python driver; no patch available for CVE-2026-8838 yet
A flaw in the amazon-redshift-python-driver allows attackers to execute arbitrary code remotely, prompting an urgent security bulletin from Amazon Web Services.
Vulnerabilities
AWS Fixes Code Injection and SSRF Flaws in Bedrock AgentCore Toolkit
Amazon patches two vulnerabilities in its open-source Bedrock AgentCore Starter Toolkit that allowed arbitrary code execution and server-side request forgery.
Vulnerabilities
PraisonAI Agents CVE-2026-61447 Allows Full Environment Secret Exfiltration
A critical vulnerability in PraisonAI Agents allows attackers to steal API keys and execute arbitrary code by bypassing sandbox controls through LLM-generated Python scripts.