The Watch

React Status reports two critical unauthenticated remote code execution flaws in Next.js are now patched, with fixes in 16.3.3 and 15.5.24. Unauthenticated means nothing stands between a mass scanner and your server-rendering runtime — the process that holds session signing secrets, upstream API keys and database strings. Only those two branches are named as remediated; 14.x and earlier have no stated fix path in the disclosure. No CVE IDs or CVSS vectors were published with it.

Aikido Security put 10 models against 32 freshly disclosed CVEs, three runs each, and DeepSeek V4 Pro — open weights, downloadable — rediscovered 28 of 32, per Executive Offense. TrustedSec separately found 27–31B models on under-desk hardware handling SQLi auth bypass, JWT manipulation and IDOR. Refusal filters, rate limits and vendor abuse telemetry were implicit controls in your risk register, and a downloaded model has none of them. Weaponization still trails discovery badly, which is where sources diverge.

Computerworld reports a DNS rebinding flaw that lets any visited web page reach an AI agent's unauthenticated local Ollama server and write instructions that persist across future conversations. No malware, no phishing payload — a browser tab. AINews adds Nous Research's Hermes Agent, which browses "as you" using a managed copy of a user's real Chrome profile and live logins. Both produce telemetry your stack reads as legitimate activity, and neither leaves an artifact EDR was built to see.

Anthropic opened a research preview of the Model Hardware Standard, a shared driver spec that lets agents discover and operate microscopes, liquid handlers, robotic arms and laser systems through one interface. Early access includes Genentech, Carnegie Mellon, QuEra, Universal Robots, Doosan Robotics, Danaher and AWS. TLDR Hardware notes the spec as described ships read/write primitives plus natural-language device metadata, with no authentication, authorization or interlock layer. Injection now ends in motion.

A federal judge ordered the Pentagon to rescind its "supply-chain risk" designation of Anthropic, ruling it unlawful First Amendment retaliation for policy criticism, as reported by The Information and MIT Technology Review. Judge Rita Lin's 59-page opinion notes the Pentagon kept working with Anthropic after blacklisting it. If your third-party risk workflow auto-ingests government designations as hard vendor blocks, you own a false positive with no audit defense. An appeal is expected.