{
  "schema_version": 3,
  "report_contract_version": 5,
  "report_plan": {
    "control_implications": [
      {
        "control_id": "access_management",
        "evidence_excerpt": "Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week…",
        "evidence_origin": "summary",
        "focus": "customer environment variables",
        "priority": "high",
        "source_ids": [
          1
        ]
      },
      {
        "control_id": "third_party_risk",
        "evidence_excerpt": "The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.",
        "evidence_origin": "summary",
        "focus": "AI-enabled penetration-testing tool",
        "priority": "high",
        "source_ids": [
          2
        ]
      },
      {
        "control_id": "data_protection",
        "evidence_excerpt": "Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information…",
        "evidence_origin": "summary",
        "focus": "customer email addresses",
        "priority": "high",
        "source_ids": [
          4
        ]
      },
      {
        "control_id": "vulnerability_management",
        "evidence_excerpt": "Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation.",
        "evidence_origin": "summary",
        "focus": "micrologiciel OT obsolète",
        "priority": "medium",
        "source_ids": [
          5
        ]
      },
      {
        "control_id": "third_party_risk",
        "evidence_excerpt": "Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables…",
        "evidence_origin": "summary",
        "focus": "LiteLLM project's PyPI package",
        "priority": "high",
        "source_ids": [
          6
        ]
      },
      {
        "control_id": "vulnerability_management",
        "evidence_excerpt": "Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.",
        "evidence_origin": "summary",
        "focus": "VeloCloud Orchestrator (VCO)",
        "priority": "high",
        "source_ids": [
          8
        ]
      }
    ],
    "executive_brief": {
      "decision_frame": "separate",
      "source_ids": [
        1,
        2,
        4
      ]
    },
    "industry_impacts": [],
    "regulatory_changes": []
  },
  "generated_at": "2026-10-23T06:41:44.428372Z",
  "feed_url": "https://ricomanifesto.github.io/SentryDigest/feed.xml",
  "feed_home_url": "https://ricomanifesto.github.io/SentryDigest/",
  "digest_issue_date": "2026-10-23",
  "digest_issue_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/",
  "requested_model": "openrouter/nvidia/nemotron-3-ultra-550b-a55b:free",
  "resolved_model": "nvidia/nemotron-3-ultra-550b-a55b:free",
  "sources": [
    {
      "title": "Railway warns devs to rotate secrets after potential breach",
      "url": "https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-ea40ccd76acf",
      "cves": [],
      "snippet": "Railway warns devs to rotate secrets after potential breach Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week… Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week…",
          "text": "Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week…",
          "text": "Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack",
      "url": "https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-c8b85a504961",
      "cves": [],
      "snippet": "Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants. The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.",
          "text": "The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants."
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.",
          "text": "The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants."
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "What We Missed: Feds Lasso Texas Laptop Farms",
      "url": "https://www.darkreading.com/insider-threats/texas-laptop-farms-north-korean-it-workers",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-714df2670eae",
      "cves": [],
      "snippet": "What We Missed: Feds Lasso Texas Laptop Farms In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in \"Operation Lonestar Justice\" to Staples' gift card bonanza. In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in \"Operation Lonestar Justice\" to Staples' gift card bonanza.",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in \"Operation Lonestar Justice\" to Staples' gift card bonanza.",
          "text": "In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in \"Operation Lonestar Justice\" to Staples' gift card bonanza."
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in \"Operation Lonestar Justice\" to Staples' gift card bonanza.",
          "text": "In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in \"Operation Lonestar Justice\" to Staples' gift card bonanza."
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Capcom confirms data breach affecting 11.7 million accounts",
      "url": "https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-1e6095c6e828",
      "cves": [],
      "snippet": "Capcom confirms data breach affecting 11.7 million accounts Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information… Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information…",
          "text": "Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information…",
          "text": "Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour",
      "url": "https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware-french",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-507bd11e2057",
      "cves": [],
      "snippet": "Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation. Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation.",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation.",
          "text": "Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation."
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation.",
          "text": "Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation."
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "LiteLLM release pipeline hacked to distribute info-stealer malware",
      "url": "https://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-37f56369e2ff",
      "cves": [],
      "snippet": "LiteLLM release pipeline hacked to distribute info-stealer malware Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables… Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables…",
          "text": "Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables…",
          "text": "Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat",
      "url": "https://thehackernews.com/2026/10/the-ai-agent-nobody-owns-watch-expert.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-63d6bc3687b5",
      "cves": [],
      "snippet": "The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool? Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool?",
          "text": "Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool?"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool?",
          "text": "Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool?"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks",
      "url": "https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-5a3446099074",
      "cves": [],
      "snippet": "Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For… Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orches",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For…",
          "text": "Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For…",
          "text": "Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable",
      "url": "https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-23aef87bc264",
      "cves": [],
      "snippet": "eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its… eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of it",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its…",
          "text": "eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its…",
          "text": "eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More",
      "url": "https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-d99ba89c8964",
      "cves": [],
      "snippet": "ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed… This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds ",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed…",
          "text": "This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed…",
          "text": "This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Arista patches new VeloCloud Orchestrator zero-day exploited in attacks",
      "url": "https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-1ed4b6e940ba",
      "cves": [],
      "snippet": "Arista patches new VeloCloud Orchestrator zero-day exploited in attacks Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments… Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments…",
          "text": "Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments…",
          "text": "Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes",
      "url": "https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-23/#reporting-7c53f743c082",
      "cves": [],
      "snippet": "Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network… Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of the",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network…",
          "text": "Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network…",
          "text": "Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network…"
        }
      ],
      "effective_date_evidence": null
    }
  ]
}