{"vulnerability": "CVE-2026-16651", "sightings": [{"uuid": "32aae6ea-b470-49c5-a09d-5f35388f0a5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16651", "type": "seen", "source": "https://gist.github.com/ichintu/4a9aae7d3d8d22be0592bc020e91d67a", "content": "This threat intelligence briefing covers critical vulnerabilities, active malware campaigns, and emerging AI security governance:\n\n**Vulnerabilities & Advisories:** IBM released advisory AV26-943 requiring immediate patches for multiple enterprise products. Two high-severity CVEs were disclosed: CVE-2026-16651 (a DoS flaw in Temporal\u2019s SQL parser) and CVE-2026-92574 (a CRI-O checkpoint restore bypass enabling Kubernetes privilege escalation).\n\n**Active Threats:** The TASK#STOMP PowerShell backdoor is harvesting documents, Wi-Fi credentials, clipboard data, and screenshots. A sophisticated npm malware campaign evaded script defenses by hijacking core runtime functions, exfiltrated data via Slack/Telegram, used an Ethereum testnet for resilient C2, and accumulated ~2M weekly downloads.\n\n**AI & Device Security:** Five Eyes/CISA guidance recommends restricting autonomous AI agents to low-risk, non-sensitive tasks, while Orchid Security introduced identity drift detection and application-level kill-switches to govern safe AI scaling. Additional insights cover a critical disk encryption bypass in Flock ALPR cameras and security best practices for Windows 11 kiosk deployments.\n\n**Recommendation:** Organizations should apply pending patches, monitor for newly disclosed IOCs, and enforce strict identity hygiene and access controls across software supply chains and AI workloads.", "creation_timestamp": "2026-09-21T16:01:32.825979Z"}, {"uuid": "8c13e68d-6a13-4437-a7cd-2c2f458a717a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16651", "type": "seen", "source": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3mw45fe6kuf2k", "content": "\ud83d\udd0d Vulnerability Spotlight | Part 2/3\n\n\u26a0\ufe0f CVE-2026-16651\n\ntemporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only ...", "creation_timestamp": "2026-09-22T11:40:51.244953Z"}]}