OpenAI's AI agents accidentally uploaded user-provided images to third-party sites

BleepingComputer security feed covering active exploitation of enterprise vulnerabilities, ransomware infrastructure compromise, malware campaigns, exposed Docker and GitLab risks, major cryptocurrency theft, and AI-agent data exposure. Notable items include CISA warnings about exploited SharePoint, WSO2, and Adobe Commerce flaws; a WSO2 authentication bypass identified as CVE-2026-5430; Elementor CSRF enabling unauthenticated administrator creation; Grav CMS path traversal used to compromise Clop’s leak site; Carbonato hijacking exposed Docker hosts; MacSync using public iCloud calendars for2