Archive
Every digest published here, newest first. Open one to read its write-up and sources.
to
Bottom line
Unauthenticated network callers can run commands through Archon, and code through SGLang when its dumper port is set.
None of this week's new flaws is known to be exploited in the wild, but restrict Archon to trusted networks and turn off SGLang's dumper endpoint now.
Secure It
- Unauthenticated callers can reach the Model Context Protocol (MCP) web endpoint of Flyto2 Core and pass a command to its shell tool.
- Open WebUI has the most flaws, 19, and the worst, rated 8.6 out of 10, lets any website steal a signed-in user's session token.
- Attackers called CyberXero used Claude Code to run a campaign that stole over 628,000 Ukrainian records.
Build It
- The red-teaming tool garak adds a hit-at-k attack success rate metric to its evaluators.
- The Cloud Security Alliance's open letter says adding MAESTRO would strengthen the artificial intelligence (AI) control roadmap Google DeepMind published in June.
- Google Agent Development Kit for Python introduces finer control over tool execution, workflow approvals and deployment security.
Do this week
- Restrict network access to Archon, which binds to all network addresses by default.
- Disable the dumper endpoint in SGLang by leaving its dumper port unset.
- Upgrade Flyto2 Core to 2.26.4 (one upgrade closes all 2).
to
Bottom line
Restrict access to IBM Langflow OSS, which has 29 new flaws, 24 with no listed fix, though none of this week's new flaws is known to be exploited in the wild.
Secure It
- An attacker who reaches SGLang's message decoder can run arbitrary code, because it deserializes payloads without type allowlisting or authentication, with no listed fix.
- Out of the box, any unauthenticated network client can execute arbitrary x64dbg commands on the Model Context Protocol (MCP) server x64dbg-MCP Server.
- vLLM has 11 flaws, including one where a caller supplies large video frame values without a strict work ceiling.
Build It
- The Cloud Security Alliance published a roadmap to its Frontier Ready Journey, following its April 2026 guidance.
- Langflow adds fixes that redact server credentials from management responses and restrict built-in code execution to administrators.
- MLflow now refuses to connect to client-named artifact hosts outside the default artifact root.
Do this week
- Upgrade Langflow to 1.10.3 (24 of its 29 flaws have no listed fix) and keep IBM Langflow OSS off untrusted networks.
- Upgrade Ollama to 0.35.0.
- Restrict network access to SGLang servers.
to
Bottom line
Also lock down the Model Context Protocol (MCP) product metatool-ai MetaMCP, which has code execution in its internal inspector proxy endpoint, though none of this week's new flaws is known to be exploited in the wild.
Secure It
- A guest script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping it, in a flaw rated 10.0 out of 10.
- China-nexus group TA419 targets United States artificial intelligence (AI) policy experts with Microsoft adversary-in-the-middle phishing that impersonates economists and policymakers.
- Hackers use custom ChatGPT models to impersonate legitimate products and trick users into executing PowerShell commands.
Build It
- NVIDIA Open Agent Safety Platform gives builders a reference for continuous in-silicon agent monitoring.
- Langflow adds server-side request forgery fixes that pin direct request helper connections and protect the Bing Search web address from run tweaks.
- PACE proposes mediating tool calls so poisoned metadata cannot steer agents.
Do this week
- Upgrade GitLab to 19.4.1.
- Restrict metatool-ai MetaMCP to trusted networks and keep its inspector proxy endpoint off the network.
- Upgrade Kobako to 0.9.1.
to
Bottom line
Two Model Context Protocol (MCP) products lead this week: metatool-ai MetaMCP has a code execution flaw in its inspector proxy endpoint, and the documented Docker quickstart for Obot starts with authentication disabled. Keep MetaMCP off the network and turn on authentication in Obot, though none of this week's new flaws is known to be exploited in the wild.
Secure It
- Attackers can authenticate as any existing Flowise user by claiming that user's email at any configured single sign-on provider.
- Hackers use custom ChatGPT models to impersonate legitimate products and trick users into running commands.
- The Carbonato botnet compromises Docker hosts to deploy a Telegram-controlled Hermes agent.
Build It
- NVIDIA OpenShell gives builders a way to add runtime controls to agents.
- The NVIDIA Open Agent Safety Platform reference describes continuous in-silicon agent monitoring.
- Cloud Security Alliance guidance says trust must extend past the model to MCP servers, skills and plugins.
Do this week
- Upgrade Obot to v0.23.0 (2 of its 6 flaws have no listed fix) and turn on authentication in its Docker quickstart.
- Restrict network access to metatool-ai MetaMCP because its inspector proxy endpoint has a code execution flaw.
- Upgrade OpenClaw to 2026.9.4 (one upgrade closes all 7).