All items
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
12,081 items
praktor, a multi-agent Claude Code orchestrator with Telegram input, has a path traversal flaw in both Telegram upload sites in `internal/telegram/bot.go` before 0.9.1. The attacker-controlled document filename is concatenated into the destination path without sanitization, and `path.Join` collapses parent-directory traversal, so a remote Telegram user can write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. With `allow_from: []`, which permits all senders by default, no authentication is needed, and the attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook or configuration files that the agent reads on later runs. The demonstrated write scope is the workspace volume, not the unrestricted host filesystem.
Fix: Fixed in version 0.9.1.
NVD/CVE DatabaseGoogle says its AI chip-equipped satellite generated its first response from space after it booted up the satellite's Tensor Processing Units. The on-board Gemma 4 model wrote a haiku about being in space, part of Google's experimental Project Suncatcher, which could eventually place AI data centers in orbit.
Flowise through 3.1.4 has a sandbox escape (CVE-2026-119978) that lets authenticated users run OS commands when ALLOW_BUILTIN_DEP=true. Attackers submit JavaScript to /api/v1/node-custom-function that uses LocalFileStore to write a file into the mammoth package and then require it, escaping vm2 as the Flowise process user.
DBHub, a database MCP server, versions prior to 0.22.6 contain a flaw where read-only SQL validation can be bypassed on its MySQL and MariaDB connectors. The `scanSingleLineComment` function in `src/utils/sql-parser.ts` treats any double dash as a comment, while MySQL and MariaDB require following whitespace, so a hidden write or DDL statement evades `isReadOnlySQL` and still executes with `multipleStatements` enabled. An attacker who can influence the assistant's SQL, including via prompt injection, can modify or drop data within the database account's privileges. PostgreSQL is not affected.
Identity governance has become an executive concern as employees, contractors, service accounts, machine identities and AI agents all access business systems. Regulators and boards now expect security leaders to show who or what holds access to critical systems and how that access is governed. The source argues that continuous identity security, rather than quarterly or annual access reviews, is needed to produce that proof.
The article argues that continuous identity governance should replace periodic reviews such as quarterly certifications and annual audits. It says the shift is needed because employees, contractors, service accounts, machine identities and AI agents change access faster than review cycles can track.
A Civic owner bought a cheap aftermarket head unit from Amazon and used Claude to reverse-engineer it. The reported findings included pre-installed bloatware: a voice assistant built on WebView that reportedly used about a third of processing power even while idle, Baidu location services, a call recorder, a DAB radio client, and Adobe Acrobat.
Prior to version 0.1.77, SOCFortress CoPilot's Velociraptor Sigma exclusion endpoints in backend/app/incidents/routes/incident_alert.py lack role and tenant authorization, and POST /api/incidents/alerts/create/velo-sigma/exclusion does not validate credentials. Because return_username_for_logging passes invalid, expired or forged token strings through instead of rejecting them, an attacker can create suppression rules that drop matching alerts before incident creation, including platform-wide rules when customer_code is null. Low-privilege customer_user accounts can also read, modify, disable or delete any exclusion.
SOCFortress CoPilot versions before 0.1.77 contain a path traversal flaw in POST /api/scoutsuite/generate-gcp-report, reachable by admin and analyst users. The route passes the raw multipart file.filename to save_file_to_directory, which joins it with scoutsuite-report without sanitization or a containment check. A traversal filename writes the uploaded JSON outside the intended directory, which allowed a researcher to write root-owned files into the application source directory. The primitive permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt operation, but it does not establish unrestricted executable content.
SOCFortress CoPilot exposes its `scoutsuite-report` directory through an unauthenticated `/scoutsuite-report` StaticFiles mount in `backend/copilot.py`, even though normal /api routes require JWT authentication. The directory holds generated AWS, Azure and GCP reports and `scoutsuite-results/scoutsuite_results_<name>.js` files that disclose IAM principals, resource inventories and findings. During a GCP scan, the uploaded Google service-account JSON key is saved into that same web-served directory and removed only after the scan finishes, so an anonymous client can retrieve it and use the service account's cloud permissions.
SOCFortress CoPilot versions before 0.1.76 authenticate Graylog and Velociraptor webhooks against the same publicly hardcoded fallback header value, which is also shipped in `.env.example`. Deployments that leave these header secrets unset or unchanged let an anonymous caller bypass JWT authentication and reach `POST /api/graylog/invoke`, which forwards attacker-selected commands to the configured Wazuh manager, and the alert creation endpoints, which accept forged alerts for arbitrary `customer_code` values. Active-response delivery requires a reachable Wazuh manager.
SOCFortress CoPilot versions before the 0.1.70 and 0.1.76 sink repairs let portal users, including customer_user, store markup through POST /api/incidents/db_operations/alert/comment. The comment is rendered with v-html in AlertComment.vue without escaping or sanitization, so stored script runs for any user who views the alert, and the same pattern affects several SOC case, asset and health-check components. Because the auth store keeps access and refresh tokens in JavaScript-readable storage, an injected script can steal them and impersonate analysts or administrators.
Prior to version 0.1.76, SOCFortress CoPilot's `POST /api/agent_data_store/upload` endpoint in `backend/app/data_store/data_store_routes.py` let `customer_user` callers choose `bucket_name` and `object_name` with no allowlist, tenant prefix, ownership check or content restriction, so existing objects of any tenant could be overwritten. Targets include Sysmon configs distributed to Windows endpoints, server-rendered case report templates, and case and Velociraptor forensic artifacts, letting a lowest-privilege user tamper with cross-tenant evidence, blind endpoint telemetry or poison report templates. Sibling list, download and delete routes stay restricted to admin and analyst roles.
Ghost hunters Amy Waine and Jarrad Cutting have built an app called GhostTube Seer, which they call "the world's first AI Ghost Hunting tool". The app maps phone sensor signals to words in a database and requires a paid monthly subscription, with more than 1m downloads according to its Google Play listing. Other ghost hunters see AI-generated ghost stories and images as unwelcome, and the r/Nosleep subreddit has banned AI-generated material.
US officials suspect Iran-linked hackers caused freezer malfunctions that spoiled food at about six military base commissaries from late August, with Cyber Command and Defense Department units investigating alongside French authorities. Hackers also overrode refrigeration controls at roughly 350 French establishments. A critical 16-year-old buffer overflow (CVE-2026-97631) in TianoCore EDK II, used by most server firmware suppliers, lets an attacker with local network access exploit machines during network (PXE) boot.
A malicious version 2.1.313 of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for about 11 hours on October 29, potentially exposing up to 5,000 developers. The extension prepended a malicious JavaScript loader to extension.js that ran on load and attempted to install a persistent SSH backdoor, though coding errors likely prevented remote access on many Windows and macOS systems. Cursor says Anthropic did not develop the extension and has not explained how the package was distributed under its name.
Fix: Fixed in version 0.22.6.
The SecPO paper addresses prompt injection, where instructions in untrusted data manipulate an AI agent. It argues that Meta-SecAlign's DPO-based training anchors to an insecure reference model and uses weak simulated attacks, and proposes a SecPO loss plus an adversarial training pipeline that synthesizes strong injections (best@240). On Qwen3.6-27B, the authors report AgentDojo ASR@800 of 8.8% versus 78.8% for Meta-SecAlign under AttackerMovesSecond, with no noticeable benign utility loss across nine benchmarks.
Fix: The proposed defense is the SecPO loss combined with adversarial training (AT) on synthesized injected inputs; the authors release code, training data and a model at the linked GitHub and Hugging Face locations.
Arxiv (cs.CR + cs.CL + cs.LG)Researchers study whether observers can infer user attributes from MCP tool-call traces alone, without access to user conversations. They introduce PrivacyTrace, a benchmark of 1,000 synthetic user profiles and 4,000 agent trajectories across four domains, built with real MCP tools from 25 servers. Four LLM attackers reach a 26.25% attack success rate for profile inference, compared with 17.97% from prior-based guessing, with tool arguments and returned results as the main evidence and cross-session trace linking amplifying the risk.
Fix: Fixed in 0.1.77.
NVD/CVE DatabaseFix: Fixed in 0.1.77, which removes caller-controlled filenames from the affected route.
NVD/CVE DatabaseFix: Credential isolation is released in version 0.1.77; a release fully remediating the report-disclosure component has not been established.
Fix: Fixed in 0.1.76. Deployments with independently changed header secrets are not subject to this default-secret bypass.
Fix: The health-check sink repair is first contained in version 0.1.70, and the comment and other SOC sink repairs are first contained in version 0.1.76.
Fix: Fixed in version 0.1.76.
NVD/CVE DatabaseFix: Cursor removed the malicious extension and temporarily shut down its entire marketplace to audit other extensions.
BleepingComputerThis research audits eleven evaluations of detectors that flag hijacked LLM agents from their tool-call traces and finds attack rates of 16% to 86% with no variation tested. On AgentDrift and AgentDojo, a detector with AUROC 0.879 reaches precision 0.076 at a 2% attack rate, and detector rankings reverse as tool coverage falls below about 50%. Detectors trained on AgentDrift rank AgentDojo traces at chance, while the AlignmentCheck monitor reaches AUROC 0.930 but would still mostly raise false alerts at that attack rate.
Fix: The authors turn their findings into a checklist for evaluating trace detectors, but the source text does not state any specific fix or workaround. Dropout on tool inputs is reported to largely remove the ranking reversal, which is a finding rather than a recommendation.
Arxiv (cs.CR + cs.CL + cs.LG)