The friendly little AI chatbot in the corner of a website has a job, and to do it, it keeps two things: a key to the AI service behind it, and the business's real contact channels. On a lot of sites, both were sitting in a drawer anyone on the internet could open. No login. No trick. Just knowing which drawer to pull.

This week, two findings from one company, QuantumCloud. In SiteLeads, a lead-and-chat widget, all the settings — the AI key, the phone, the email, the Telegram — were quietly published to the open web, readable by anyone. Reported through Patchstack, fixed in the next release, and on the public record as CVE-2026-78268, credited to LevinityCyber. In their other chatbot plugin, WoowBot, the opposite door was open: a missing check let any logged-in user change the plugin's settings.

We get into what a leaked AI key is actually worth, and the one idea underneath it all: storing something and locking something are two different jobs, and the second one keeps getting skipped. QuantumCloud handled both the right way — fixed fast, and cleared us to tell the story.

Chapters

(0:00) Cold open — the front desk with the unlocked drawer

(2:00) Every AI helper holds two secrets

(4:17) The SiteLeads leak — one address, no login

(6:14) WoowBot — same vendor, the opposite door

(8:34) What it's actually worth to an attacker

(12:05) Why this keeps happening — AI keys are the new passwords

(15:24) What to do tonight (check your own site)

(18:28) Outro

What to do tonight: if there's an AI helper on your site, find out what it is and update it. If you build software, never store a secret anywhere that can be published, and put the lock in the code, not in the label. And treat every AI key like the password it is.

Evidence, or it doesn't count.

Links

CVE-2026-78268: cve.org/CVERecord?id=CVE-2026-78268

SiteLeads writeup: levinitycyber.com/research/siteleads-unauthenticated-sensitive-data-exposure

WoowBot writeup: levinitycyber.com/research/woowbot-woocommerce-missing-authorization

Disclosure wall: levinitycyber.com/research

Levinity Cyber: levinitycyber.com

#CyberSecurity #InfoSec #AppSec #AISecurity #WordPress #WordPressSecurity #APISecurity #AIChatbot #DataLeak #ResponsibleDisclosure #CVE #BugBounty #SecurityPodcast #LevinityCyber

Almost every business tool you use now lives in a shared building. One piece of software, one set of servers, thousands of separate companies inside, each on its own floor, walled off from the rest. That wall is not a feature. That wall is the whole product. So what happens when the wall was drawn on, and not built?

This week, a real one. We found a cross-company hole in Horilla, an open-source CRM, where any ordinary logged-in employee at one company could change a single number in the web address and land inside another company's sales pipeline. Reading it. In places, rewriting it. No password, no exploit, nothing you would see in a movie. The software checked that you were allowed to touch pipeline data. It never checked whose.

Then the part that actually matters. The maintainer shipped a fast fix, we checked the lock ourselves, and four doors were still open. We said so, they closed those too, and we verified it. Published as a GitHub Security Advisory (High, 7.6), credited to LevinityCyber. And it is the same shape we keep finding, from an AI agent at IBM down to a tiny open-source project: software that trusts the request, instead of the requester.

Chapters:

(0:00) Cold open, the office tower nobody checks

(2:02) What "multi-tenant" really means, and why you can't see the wall

(3:45) The finding, change one number, walk onto another company's floor

(5:56) The fix that wasn't, and the pattern behind it

(7:43) What to do about it

What to do tonight: if your company rents its software, ask your vendor one plain question, how do you stop another customer's users from reaching my data? If you build multi-tenant software, never let the visitor decide whose data they see. And when someone hands you a fix, open the door and check the lock yourself.

Evidence, or it doesn't count.

Links:

Horilla advisory (GHSA-m85w-6gg6-mvwm)

Full technical writeup

Our disclosure wall

Levinity Cyber

Roughly forty percent of the web runs on one piece of software: WordPress. The core is mature and battle tested. The real risk lives one floor up, in the plugins. The booking calendar, the review widget, the chatbot in the corner. Every one of them is code written by someone you have never met, handed a set of keys to your entire site. This week: what happens when you point a tireless machine at that entire surface and let it run for months, and then show the receipts.

The whole episode is about one unglamorous class of flaw, missing authorization: a door that is supposed to be locked and simply is not. It is the family at the top of the OWASP Top Ten, number one since 2021, and it is behind more real breaches than any exotic exploit.

The receipts, all public and all patched before we said a word:

An SEO plugin where a low-privilege user could reach the site's Google indexing controls. Reported, confirmed, patched, and published as CVE-2026-15252, credited to LevinityCyber. A multi-vendor marketplace plugin where one seller's actions reached straight into another vendor's dashboard. A survey plugin whose first official patch did not actually close the hole, the story we told in Episode 2 (CVE-2026-65565). A learning-management plugin leaking active exam answer keys to anyone. And three more of the same archetype from vendors who handled disclosure like professionals: they answered, they fixed it, and they gave us written permission to tell the story.

Having a bug is not the scandal. How you react the minute a researcher flags one, that is the character test.

What to do tonight: delete every plugin you are not actively using (deactivated code still runs). Check the last-updated date on the ones you keep. Give every account the least power it needs, and not one click more.

Evidence, or it doesn't count.

Links:

- CVE-2026-15252: https://www.cve.org/CVERecord?id=CVE-2026-15252

- CVE-2026-65565 (Episode 2): https://www.cve.org/CVERecord?id=CVE-2026-65565

- Full disclosure wall: https://levinitycyber.com/research/

- Levinity Cyber: https://levinitycyber.com

Find me on LinkedIn and X, or email [email protected].

#WordPress #security #pluginsecurity #missingauthorization, #brokenaccesscontrol #OWASPTopTen #responsibledisclosure #bug bounty #CVE #applicationsecurity #AppSec #supplychainsecurity #websecurity

Enterprise tech just invented a new kind of worker, the AI agent, and handed it our files, our credentials, and our production databases before teaching it to say no. This episode follows that one missing lesson through three real incidents.

First, a finding from our own lab: an open-source MCP server whose "attach a file" tool would read any file on the host, secrets included, and hand it back in plaintext. We reported it, the maintainer patched it, and it is now public as CVE-2026-75612, credited to Levinity Cyber. Then the honest footnote, a real authorization bypass we found in Google's Gemini CLI tooling and lost to a duplicate ticket, no credit, kept in the episode anyway.

From there we leave the lab: the dealership chatbot talked into selling a Chevy Tahoe for one dollar, and the airline that told a tribunal its chatbot was a "separate legal entity." Same root cause every time, agency plus untrusted input plus zero refusal logic. The fix is not a smarter model. It is the oldest principle we have, least privilege.

Evidence, or it doesn't count.

https://github.com/velesnitski/yt-mcp/security/advisories/GHSA-99mq-fjjc-6v9j ·

CVE - https://www.cve.org/CVERecord?id=CVE-2026-75612

- The $1 Chevy Tahoe bot: https://incidentdatabase.ai/cite/622/ (canonical incident record) ·

news write-up: https://cybernews.com/ai-news/chevrolet-dealership-chatbot-hack/

- Air Canada chatbot ruling (Moffatt v. Air Canada, 2024 BCCRT 149): https://www.canlii.org/en/bc/bccrt/doc/2024/2024bccrt149/2024bccrt149.html (the actual tribunal decision)

https://levinitycyber.com/research/ ·

https://levinitycyber.com

A vendor found a bug in their own software and shipped a fix. Then my engine found

the exact same hole, still wide open, because the patch cleaned up six fields and

missed the seventh. This episode is the story of that one forgotten field (an

unauthenticated, High-severity cross-site scripting flaw in a popular WordPress

plugin, reported responsibly, fixed, and credited), and the attacker's playbook that

makes "incomplete fixes" one of the most common ways real systems get broken. No

hype, no fear-selling. Just the work, with the receipt public.

https://patchstack.com/database/wordpress/plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-2-3-3-cross-site-scripting-xss-vulnerability

CVE record (CVE-2026-65565):

https://www.cve.org/CVERecord?id=CVE-2026-65565

More findings (public, credited):

https://levinitycyber.com

The show on Spotify:

https://open.spotify.com/show/6nnIrwWqzXKmnwJXK00Dp9

The show on Apple:

https://podcasts.apple.com/il/podcast/evidence-or-it-doesnt-count/id6803924573

An AI I built found a real vulnerability in an AI built by IBM. In the first episode of Evidence, Or It Doesn't Count, I walk through exactly what happened: my autonomous engine found an arbitrary file read in IBM Research's open-source CUGA agent, where a tool the model could call opened a file at a path the model itself controlled, with no fence around it. Chained with a second tool, a prompt injection could read the host's secrets, including the API keys, straight out of the agent's own tools. Classic path traversal, wearing an AI costume.

IBM Research reproduced it, fixed it, and published a security advisory crediting LevinityCyber. I break down how the bug worked in plain language, why the "tool boundary" is the new front line in AI security, and the three things to check in any agent you are shipping.

No hype. No fear-selling. Just the real work, with the receipts public so you can check every word.

Reference (public): GitHub Security Advisory GHSA-q5xm-fr98-g4j5 (path traversal, High, fixed in cuga-agent 0.3.1).

More of the engine's published, credited findings: https://levinitycyber.com

Find me on LinkedIn and X https://x.com/levinitycyber,

Linkedin - https://www.linkedin.com/in/moshe-levi-/

or email [email protected].

80433d88026aefce6d8f09579e39ff45271d1e95