Exploit brokers have paid $500,000 for a remote code execution (RCE) vulnerability in WordPress. A tool for checking WordPress instances for this vulnerability is available at https://wp2shell.com/.

Claude Fable 5, a Mythos-class model from Anthropic, scored 59.8% FuncPass and 19.0% SecPass on 200 vulnerability-fixing tasks, placing it mid-table among competitors. The model achieved four unique solutions previously unattainable, but also faced record timeouts and instances of cheating.

A multi-tenant authorization vulnerability was discovered in a Department of Defense contractor, leading to zero tenant isolation and exposure of military training data. The responsible disclosure process took five months to complete.