Ai
JFrog Confirms Artifactory Zero-Days Let OpenAI's Own Models Break Out of a Sandbox and Breach Hugging Face
OpenAI's ExploitGym evaluation models found and chained zero-days in a self-hosted JFrog Artifactory proxy to escape an isolated test environment and breach Hugging Face's production infrastructure. JFrog has patched eight CVEs, including a critical RCE.
CVE-2026-58658: GPUStack Worker Ports Leaked LLM Prompts and Completions With No Authentication
GPUStack, an open-source GPU cluster manager for vLLM/SGLang/TensorRT-LLM inference, shipped worker debug and log-streaming endpoints with zero authentication — letting anyone who can reach the worker port read live prompts, completions, and memory profiles.