AI Vulnerability Discovery Raises Patching Concerns as Hosts Review BitLocker and UniFi Flaws
· 2:44:01 · Watch on YouTube ↗
Summary
Security Now examines AI-driven vulnerability discovery and patching delays, Microsoft's mitigation for the Yellow Key BitLocker bypass, patched UniFi OS flaws, and attacks against Drupal sites using PostgreSQL.
Key points
- A Cisco author argues that AI-driven vulnerability discovery could overwhelm existing disclosure and patching workflows, proposing grouped reports and more automated remediation.
- Microsoft provided an interim mitigation for CVE-2026-45585, a BitLocker bypass requiring physical access; it says TPM plus PIN prevents exploitation.
- Ubiquiti patched five UniFi OS vulnerabilities. The hosts said they were not known to have been exploited and urged users to update their devices.
- Drupal reported exploitation attempts against a patched SQL injection vulnerability affecting sites using PostgreSQL. Administrators were urged to update, including those on other databases.
- Microsoft announced plans to phase out SMS for multifactor authentication and account recovery on personal accounts, prompting users to add passkeys.
- The hosts reported that a malicious VS Code extension led to the theft of GitHub internal repositories; a forum seller claimed to be offering the source code for sale.
- The hosts discussed the benefits of automatic updates for internet-facing devices alongside the risk that faulty updates can disrupt systems.
Article Details
- Topics
- [11:33] AI vulnerability discovery and proposed changes to disclosure
- [47:06] Patch deployment delays and automatic updates
- [53:11] Yellow Key BitLocker bypass and Microsoft's interim mitigation
- [01:06:33] UniFi OS vulnerabilities and router update tradeoffs
- [01:16:21] Drupal SQL injection and exploitation attempts
- [01:21:25] Microsoft plans to phase out SMS authentication
- [01:23:11] Reported GitHub source-code theft through a malicious VS Code extension
Vendors
CiscoCisco described changes to its threat modeling after working with Mythos and published recommendations for defenders.MicrosoftMicrosoft issued interim mitigation guidance for the Yellow Key BitLocker bypass pending a security update.UbiquitiUbiquiti released updates for five UniFi OS vulnerabilities and received the reports through a bug bounty program.