[Verse 1] Zotero's running, the papers load clean PapersGPT humming in the research machine Version zero-point-six-point-one holds a crack The LLM endpoint fires a payload back No sanitizing on the code it returns Arbitrary JavaScript executes and burns CVE-2026-73032, score nine-point-six An attacker plants the prompt, the browser tricks [Chorus] Patch the cracks before the cracks patch you IBM i and Zotero, the threat cuts through Nine-point-nine, nine-point-six, eight-point-eight — these numbers bite August eighteen, twenty-twenty-six, the bulletin's live tonight Remote execution, harvested keys, escalated threads Read the advisories, don't wait until it spreads [Verse 2] Now pivot over to the IBM i stack Seven-point-three up to seven-point-six under attack CVE-2026-18847 spoofs the Navigator face An unauthenticated caller steals credentials from that space No login needed — just a crafted false reflection Eight-point-eight severity, credential interception Your username and password lifted from the wire A ghost in the hallway mimicking your supplier [Chorus] Patch the cracks before the cracks patch you IBM i and Zotero, the threat cuts through Nine-point-nine, nine-point-six, eight-point-eight — these numbers bite August eighteen, twenty-twenty-six, the bulletin's live tonight Remote execution, harvested keys, escalated threads Read the advisories, don't wait until it spreads [Verse 3] CVE-2026-16860 scores nine-point-nine — the ceiling's near Uncontrolled search path lets authenticated code veer IBM i loads the wrong binary from a rogue location Arbitrary execution — full system contamination Then 17276 closes out the quartet cold Improper authorization in the high-authority threads controlled An authenticated actor borrows elevated power Privilege escalation blooms inside the hour [Bridge] Four CVEs wrapped in one release None of them theoretical, none of them at peace The search path bends, the threads misroute The spoofed navigator hands your secrets out The LLM returns what no one should receive Sanitize the pipeline — never blindly believe [Verse 4] The researcher trusts the plugin, the admin trusts the stack Neither checks the changelog until the breach looks back Defense in depth means patching every layer down From the LLM wrapper to the OS holding crown Log the anomalies, alert before the fall One unpatched version is the crack that breaks them all [Outro] So catalog the versions, cross-check every build IBM i patched, PapersGPT stilled CVSS scores aren't abstract academic math They're the measured width of every attacker's path August eighteen, twenty-twenty-six — mark the date CVE review isn't something that can wait
← Critical CVEs (2 of 3) — August 18, 2026 | IT Security News — August 18, 2026 →