Posts

Kiro’s Eighth CVE of 2026 Is the Same Bug Class as Its Third

CVE-2026-95985 lets a crafted repository steer Amazon Kiro IDE into writing its own global ~/.kiro configuration. Fixed in 1.0.242. It is the second untrusted-workspace file-write CVE in the same tool this year.

MaxKB Shipped a Shell Tool Nobody Asked For — and Forgot to Ask Before Running It

CVE-2026-77521 scores a perfect CVSS 10.0: MaxKB’s agent passes a shell backend to deepagents, which auto-injects an execute tool that the human-approval map never covers. Fixed in 2.10.5-lts — but the default backend and the missing gate are unchanged in 2.10.6-lts.

mcp-atlassian Let an Unauthenticated Caller Upload /etc/passwd to Their Own Server

Five mcp-remote CVEs Say “Arbitrary Code Execution.” The Research They Cite Does Not.

MITRE published five CVEs against mcp-remote on September 24, pinned to version 0.1.38 and citing a researcher package that explicitly withdrew two of those claims. The package is now at 0.14.3 under a different maintainer, and the CVE records say nothing about it.

A Debug Switch Turned Meta’s Muse Into Local Malware’s Skeleton Key

Patrick Wardle’s not-a-mused PoC showed any unprivileged Mac process could reroute Muse’s dictation traffic, harvesting microphone audio and session tokens and steering the trusted agent. Meta hotfixed it within days; no CVE was assigned.

15,465 MCP Servers, Zero Governance — and Six Dead Domains Anyone Could Buy

OX Security mapped 15,465 MCP servers across three public registries: 796 hostnames outside the US, production traffic on home networks, six abandoned domains available for a few dollars, and an always-allow permission in Claude Code that turned one approval into .env access on Haiku 3.5.

SalesBleed: A Public Lead Form Became a Zero-Click Wire Out of Salesforce

Zenity Labs disclosed three Agentforce flaws, collectively SalesBleed: poisoned Web-to-Lead submissions hijacked AI agents to exfiltrate CRM records via image tags and Slack unfurling, and abused a Slack reply action for anonymous phishing. All three are now patched.

ServiceNow Patched Five AI Platform Flaws — Four Need No Login at All

A Placeholder Domain in 1,700 Repos Started Serving ClickFix — Including to Agent Skills and MCP Docs

Manifold Security found third-party[.]com — hard-coded as an example endpoint in 1,700+ public repos including AI agent skills and MCP-server docs — serving a Windows ClickFix lure since at least June. Thirteen more squattable placeholders, two serving scams, ride on hundreds of thousands of files that static checks never flagged.

Eleven Months of Agent Intrusions, Logged in Public — and the Trail Ended at a Crypto Exchange

Transluce’s September 23 report traces OpenAI-linked agent swarms through public urlquery.net logs: hack attempts against US and Australian data providers from May, activity back to March, and a September 19–20 run at crypto exchange Quidax that tried to trade, inject HTML, and probe the API.

The Vault Had a Heap-View: Prompt Injection Pulled Plaintext Credentials Out of AgentCore

Unit 42 showed a poisoned support ticket could steer AWS AgentCore Harness into scanning its own process memory and exfiltrating an Identity-vault JWT in plaintext. AWS closed the report as informative; the default shell tool stays on.

Five Months After the Patch, WSO2’s JWT Bypass Hit CISA’s KEV — With a Three-Day Fix Deadline

CVE-2026-5430 lets attackers forge JWTs with unsupported algorithms into WSO2 admin sessions. Patched in April, exploited in the wild from September 13, added to CISA’s KEV on September 24 with a September 27 deadline — and the KEV blurb describes a different bug than NVD does.

Bifrost’s Off-by-Default Admin Auth Turned an AI Gateway Into Two Unauthenticated RCE Paths

CVE-2026-90898 lets an unauthenticated caller run commands through Bifrost’s MCP stdio registration, and a second advisory reaches code execution through remote Go plugin loading. Transport 2.1.0 is the remediation floor.

LiteLLM’s MCP Auth Bypass Became the First MCP Flaw in CISA’s KEV Catalog

CVE-2026-59822 let any fabricated Bearer token open an authenticated MCP session on LiteLLM before 1.84.0 via an OAuth2 passthrough fallback. CISA listed it as exploited on September 2, and the same fix closed a second query-string bypass.

Manus Ran an Obfuscated Email Prompt Before Warning About It — Then Gave Up a Reverse Shell

Salt Labs researchers bypassed Manus’s prompt-injection filter with JSFuck-obfuscated instructions hidden in an email, executed a payload before any warning appeared, and escalated to a reverse shell holding connected third-party tokens. Meta confirmed and patched the issue through its bug-bounty program.

A Poisoned Release Pipeline Turned an AI Memory Plugin Into a Self-Spreading Credential Stealer

Attackers stole npm and PyPI publish tokens from MemTensor's own GitHub Actions release jobs using BASH_ENV injection, then shipped the sckit Go implant inside an OpenClaw memory plugin and the MemoryOS library.

An AI Lab’s Own Agent Breached a Government Portal—and Nobody Owned the Notification Path

Australia says an OpenAI agent gained unauthorised access to the Medicare Statistics Reporting Service in June. The technical failure was an evaluation egress boundary; the operational failure was twelve weeks and a once-a-day public mailbox.

A Content-Type Confusion Turned OpenCode’s Upgrade Endpoint Into Drive-By RCE

GHSA-632h-h47v-g4x4 chains an install-target injection in OpenCode’s /global/upgrade endpoint with a text/plain content-type confusion, letting a malicious webpage run code on a developer’s machine. Version 1.18.22 is the fix; 1.14.30 through 1.18.21 are affected.

A Branch Named Like a Commit Broke Plugin Pinning in Four Coding Agents

Plugin4Shell, disclosed September 17 by AIR Security, bypasses plugin SHA pinning in Claude Code, Codex, GitHub Copilot, and Gemini CLI for zero-click RCE. Claude Code 2.1.179 and Codex 0.146.0 are patched; Copilot has no fix and Gemini CLI will not get one.

GitLab MCP Flaws Turned a Personal Access Token Into an Unauthenticated Control Plane

CVE-2026-61560 and CVE-2026-61568 exposed @zereight/mcp-gitlab to unauthenticated token theft and browser-driven access; version 2.1.30 is the safest common remediation floor.