CVE-2026-41709: Broadcom VMware ESX
Broadcom VMWare ESX Insufficient Logging Vulnerability
Review any AI workload, notebook, model-serving, or developer-tool exposure before relying on the affected component.
AI risk brief - edition 2026-10-29 (live fallback)
AI risk brief: CVE-2026-41709: Broadcom VMware ESX
A client-ready brief for teams responsible for AI tools, vendors, and exposure. It turns the public record into exposure checks, source links, and calm language for internal notes, client updates, board packs, and weekly risk reviews.
Brief body
What responsible teams should hear this week.
The brief is organised by operational use: exploited items first, incidents second, then policy and model signals that can change advice, approved-tool lists, or risk posture.
Known exploited items to check first
CVE-2026-46300: Linux Kernel
Linux Kernel Missing Initialization of a Variable Vulnerability
Review any AI workload, notebook, model-serving, or developer-tool exposure before relying on the affected component.
CVE-2026-48356: Adobe Commerce and Magento
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Review any AI workload, notebook, model-serving, or developer-tool exposure before relying on the affected component.
CVE-2026-111497: Google Brotli
Google Brotli Unchecked Return Value Vulnerability
Review any AI workload, notebook, model-serving, or developer-tool exposure before relying on the affected component.
CVE-2026-109618: PHP Group PHP
PHP Memory Corruption Vulnerability
Review any AI workload, notebook, model-serving, or developer-tool exposure before relying on the affected component.
AI service incidents and outages
Supabase: S3 endpoints for keys with special characters broken
We have identified an issue where S3 endpoints for keys with special characters will be broken. We are actively investigating the correct mitigation for this issue.
Check dependency exposure, fallback plans, customer commitments, and incident communications tied to this provider or service.
Disruption with some GitHub services
The degradation has been mitigated. We are monitoring to ensure stability.
Check dependency exposure, fallback plans, customer commitments, and incident communications tied to this provider or service.
Anthropic: Elevated errors for Claude Opus 4.7
We are currently investigating this issue.
Check dependency exposure, fallback plans, customer commitments, and incident communications tied to this provider or service.
OpenAI: Elevated Error Rates For SSO Login
We have applied the mitigation and are monitoring the recovery.
Check dependency exposure, fallback plans, customer commitments, and incident communications tied to this provider or service.
Model, Lab, and evaluation signals
Anthropic: Claude Mythos Preview retirement announced for June 30, 2026
Anthropic announced that Claude Mythos Preview (claude-mythos-preview) will be retired on June 30, 2026. Users are advised to migrate to Claude Mythos 5 (claude-mythos-5) using the provided migration guide.
Inspect the source trail and decide whether this record changes a control, vendor, or operational assumption.
Google: Gemini 3.5 Flash model pricing published
Google published pricing for the new Gemini 3.5 Flash model. Standard paid tier input is $1.50/1M tokens, output is $9.00/1M tokens. Batch pricing is $0.75/1M input and $4.50/1M output. Free tier usage contributes to product improvement.
Inspect the source trail and decide whether this record changes a control, vendor, or operational assumption.
Anthropic: Claude Opus 4.1 deprecated, retirement August 5 2026
The claude-opus-4-1-20250805 model state changed to Deprecated on June 5, 2026, with a tentative retirement date of August 5, 2026. Users must migrate before the retirement date to avoid disruption.
Inspect the source trail and decide whether this record changes a control, vendor, or operational assumption.
Exposure questions
Use these before writing advice.
These prompts stop the brief from becoming noise. Each question is attached to a source-backed item in the current watch board.
Do we or any important client environments run Broadcom VMware ESX, and is remediation tracked?
Do we or any important client environments run Linux Kernel, and is remediation tracked?
Do we or any important client environments run Adobe Commerce and Magento, and is remediation tracked?
Do we or any important client environments run Google Brotli, and is remediation tracked?
Do we or any important client environments run PHP Group PHP, and is remediation tracked?
Does this incident affect a provider, dependency, customer promise, or operating assumption we rely on?
Action discipline
How to send it without hype.
The point is to help people inspect exposure. Do not imply impact until an environment, vendor, or control is actually in scope.
Check exposure before forwarding urgency to anyone else.
Record the vendor, product, owner, and remediation status for any affected environment.
Update AI tool advice where a vendor policy, data-use record, or public incident changes the operating picture.
Preserve the PAI source trail when turning this into an internal note, client brief, board update, or advisory.
Source trail
Every claim keeps its record link.
You can repackage the wrapper. You cannot remove the evidence trail.
| Item | Date | Source | Open |
|---|---|---|---|
| CVE-2026-41709: Broadcom VMware ESX | 28 Oct 2026 | CISA Known Exploited Vulnerabilities Catalog | Source trail |
| CVE-2026-46300: Linux Kernel | 28 Oct 2026 | CISA Known Exploited Vulnerabilities Catalog | Source trail |
| CVE-2026-48356: Adobe Commerce and Magento | 27 Oct 2026 | CISA Known Exploited Vulnerabilities Catalog | Source trail |
| CVE-2026-111497: Google Brotli | 27 Oct 2026 | CISA Known Exploited Vulnerabilities Catalog | Source trail |
| CVE-2026-109618: PHP Group PHP | 26 Oct 2026 | CISA Known Exploited Vulnerabilities Catalog | Source trail |
| Supabase: S3 endpoints for keys with special characters broken | 16 July 2026 | Production AI public record | Source trail |
| Disruption with some GitHub services | 16 July 2026 | Production AI public record | Source trail |
| Anthropic: Elevated errors for Claude Opus 4.7 | 16 July 2026 | Production AI public record | Source trail |
| OpenAI: Elevated Error Rates For SSO Login | 16 July 2026 | Production AI public record | Source trail |
| Anthropic: Claude Mythos Preview retirement announced for June 30, 2026 | 14 July 2026 | Production AI public record | Source trail |
| Google: Gemini 3.5 Flash model pricing published | 11 July 2026 | Production AI public record | Source trail |
| Anthropic: Claude Opus 4.1 deprecated, retirement August 5 2026 | 10 July 2026 | Production AI public record | Source trail |
Keep the brief current
Use the record, not a stale newsletter.
The live AI watch is the source. The AI risk brief is the translation layer for operators, founders, security teams, consultants, service providers, and anyone who has to explain what changed without pretending exposure is proven.
Saved watches
Tell us what to keep current.
Save a watch for vendors, tools, controls, vulnerabilities, or operating questions. The public record stays open. A saved watch tells us what matters to you - not a promise of a private alert feed.