All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 has a vulnerability where authenticated users (those who have logged in) can run arbitrary commands (any code they choose) with elevated privileges (higher access level) due to improper validation of user input in the Python Interpreter component (the part that executes Python code). The vulnerability stems from OS command injection (CWE-78, where attackers embed malicious system commands in their input), allowing attackers to bypass security checks.
IBM Langflow OSS (an open-source tool for building AI workflows) versions 1.0.0 through 1.10.1 have an unauthenticated remote code execution vulnerability (RCE, where attackers can run commands on the system without logging in) in a public endpoint. The vulnerability exists because the validate_public_flow_no_code_execution() function (a safety check) has an incomplete denylist (a list of things to block) that fails to block certain agent components like OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent from executing code.
AWS HealthOmics MCP Server versions 0.0.35 and earlier contain a path traversal vulnerability (a flaw where attackers can use special directory notation like '../' to access files outside intended locations) in its workflow linting tools. An attacker who can control inputs to the MCP agent could write malicious files to any location on the system instead of just the workflow bundle directory.
TikTok is testing an opt-in tool that detects AI-generated copies of creators (deepfakes, or AI-altered versions of real people) and allows creators to report them to the company. The tool is currently available to some US creators who verify their identity through Jumio, a third-party identity verification service, using a selfie scan and ID check.
A security flaw in mcp-memory-keeper allowed arbitrary local file reads through the `context_import` function, which didn't validate file paths before reading them. An attacker (either a malicious client or an LLM agent affected by prompt injection, a technique where hidden instructions are embedded in AI inputs) could read any file accessible to the server process, including credential files and configuration files, or view partial file contents through error messages.
IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a code injection vulnerability (a type of security flaw where attackers insert malicious code) in the ToolGuard integration that allows authenticated users to bypass the allow_custom_components=false security control and execute arbitrary Python code on the backend. The vulnerability exists because the validation system only checks the main component code but misses dynamic CodeInput fields, and attackers can exploit this by embedding malicious code in these unvalidated fields that get executed when tools are invoked. The flaw can be made worse through cross-tenant flow manipulation (exploiting flows across different user accounts) when certain security settings are misconfigured.
IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical vulnerability in the /api/v1/login/auto_login endpoint that allows unauthenticated attackers to gain full administrative access by obtaining long-lived superuser bearer tokens (special credentials that prove you have admin privileges) when AUTO_LOGIN is enabled by default. The vulnerability is made worse by overly permissive CORS settings (rules controlling which websites can access the application), which can expose these tokens to unintended websites.
Agentic-Flow, an AI agent orchestration platform (a system that manages and coordinates multiple AI agents working together), had a critical vulnerability in versions before 2.0.14 where user-controlled input was directly inserted into shell commands without proper safety checks, allowing attackers to execute arbitrary operating system commands with the server's permissions.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 has a critical flaw that allows attackers without login credentials to create unlimited user accounts. When a specific deployment setting called NEW_USER_IS_ACTIVE is enabled, these newly created accounts become immediately usable and can access RCE endpoints (remote code execution, where an attacker can run commands on a system they don't own), completely bypassing security controls.
IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical security flaw where unauthenticated attackers can chain two API endpoints together to gain full control of a system. The attackers first use /api/v1/auto_login to mint SUPERUSER tokens (special access credentials), then use /api/v1/validate/code to execute arbitrary code through exec() (a function that runs user-provided commands), achieving RCE (remote code execution, where an attacker can run commands on a system they don't own).
Anthropic is in early negotiations with Meta to lease computing power (specialized hardware used to train and run AI models), following a similar deal with SpaceX's Colossus 1 data center. These talks reflect Anthropic's ongoing struggle to secure enough AI chips (particularly Nvidia processors) to support its advanced models like Fable, and represent Meta's broader effort to enter the cloud computing business to monetize its AI infrastructure investments.
NadMesh is a Go botnet (malware written in the Go programming language) that hunts for exposed AI services like ComfyUI and Ollama to steal cloud credentials, Kubernetes tokens (authentication keys for container orchestration systems), and access to AI models. The botnet prioritizes exploiting MCP (Model Context Protocol, a framework for AI tools), Docker APIs, and Jenkins systems, with observed attack traffic showing Docker vulnerabilities account for the largest portion of exploitation attempts.
Chinese AI startup Moonshot unveiled Kimi K3, a massive AI model with 2.8 trillion parameters (a measure of an AI's scale and processing power) that the company claims rivals top American AI firms like OpenAI and Anthropic. The model will be released as open-source software on July 27, making it freely available for anyone to download and modify, which represents a significant shift since most leading American AI systems are proprietary and restricted. This development suggests that Chinese AI companies are successfully advancing their technology despite US government restrictions on hardware sales and export controls on frontier AI models (cutting-edge systems considered critical to national security).
This week's cybersecurity news covers multiple incidents including breaches at telecom and retail companies, a German manufacturer forced into bankruptcy after a six-week cyberattack shutdown, and the discovery of CrashStealer, a new macOS malware (malicious software) that disguises itself as a crash reporting tool to steal user credentials and system data. Additional threats include Iranian actors using cellular and advertising data to track US military phones, and a vulnerability in an AI agent integrated with WhatsApp that allows remote code execution (running commands on a system from afar).
Fix: Update aws-healthomics-mcp-server to version 0.0.36 or later.
AWS Security BulletinsFix: Fixed in version 0.13.0 (PR #36). The patch: (1) restricts imports to a server-owned exports directory using `realpathSync` and rejects `../` traversal and absolute paths outside the directory, (2) separates file read and JSON parsing operations with generic error messages instead of echoing file bytes, and (3) adds security regression tests covering arbitrary-read, traversal, and symlink escape vectors. Users must upgrade to version >= 0.13.0; there is no configuration-only workaround for affected versions.
GitHub Advisory DatabaseFix: Update to version 2.0.14 or later, which fixes this vulnerability.
NVD/CVE DatabaseApple is suing OpenAI, with experts debating whether the allegations represent genuine concerns or typical industry practices. The lawsuit comes as Apple releases public beta versions of new software featuring an updated Siri AI, raising questions about whether Apple views OpenAI as a competitive threat or is capitalizing on OpenAI's current difficulties.
The article warns that AI models which are allowed to both understand user requests and carry out those requests without human review create a serious security risk. When AI systems operate without oversight (checking and approval by humans), it removes important safeguards that normally protect computer systems from being misused or attacked.
Google introduced Gemini 3.5 Flash Cyber, a lightweight AI model specialized in finding, validating, and fixing software vulnerabilities (flaws in code that attackers could exploit). The model is being released through a limited-access pilot program exclusively to governments and trusted partners via CodeMender (Google's code security agent) to help defenders fix vulnerabilities before attackers can use them, while restricting access to prevent misuse.
The European Union ordered Google to open Android (its mobile operating system) to rival AI assistants like competitors to Gemini, giving them equal access to apps and system services to increase competition. Google warns this could create security risks, while security experts worry that multiple AI agents with deep system access could break traditional security models where the operating system controls what different programs can do.
EncFormer addresses privacy concerns when machine-learning-as-a-service (MLaaS, where AI models run on remote servers) processes sensitive user data by enabling Transformer inference (running a type of AI model) over encrypted data. The system combines fully homomorphic encryption (FHE, allowing computation on encrypted data without decryption) and secure multiparty computation (MPC, where multiple parties jointly compute results without revealing their individual inputs) more efficiently than previous approaches, achieving significant improvements in speed and communication overhead while keeping data private.
Recent attacks on IoT (Internet of Things) devices can analyze side-channel behavioral fingerprints (patterns in wireless communication that reveal what users are doing) to infer private user behaviors over WiFi networks. The paper presents AirMask, a defense system that works at the network level rather than on individual devices, passively sensing these fingerprints and injecting carefully crafted wireless frames to mask them without requiring changes to IoT device firmware or hardware.
Fix: AirMask operates in a predict-inject-assess loop that iteratively adapts to changing traffic patterns, proactively injects principally crafted frames upon prediction of occurring fingerprints, and continuously refines device-specific obfuscation strategies. The system can be deployed in Integrated, TAP, and Air modes for flexible deployment within WiFi networks. According to the paper, AirMask has been implemented as a functional hardware prototype and evaluated on 90 types of IoT devices, confirming defensive effectiveness while incurring negligible bandwidth and latency overhead.
IEEE Xplore (Security & AI Journals)