This week
Bottom line
Unauthenticated network callers can run commands through Archon, and code through SGLang when its dumper port is set.
None of this week's new flaws is known to be exploited in the wild, but restrict Archon to trusted networks and turn off SGLang's dumper endpoint now.
Secure It
- Unauthenticated callers can reach the Model Context Protocol (MCP) web endpoint of Flyto2 Core and pass a command to its shell tool.
- Open WebUI has the most flaws, 19, and the worst, rated 8.6 out of 10, lets any website steal a signed-in user's session token.
- Attackers called CyberXero used Claude Code to run a campaign that stole over 628,000 Ukrainian records.
Build It
- The red-teaming tool garak adds a hit-at-k attack success rate metric to its evaluators.
- The Cloud Security Alliance's open letter says adding MAESTRO would strengthen the artificial intelligence (AI) control roadmap Google DeepMind published in June.
- Google Agent Development Kit for Python introduces finer control over tool execution, workflow approvals and deployment security.
Do this week
- Restrict network access to Archon, which binds to all network addresses by default.
- Disable the dumper endpoint in SGLang by leaving its dumper port unset.
- Upgrade Flyto2 Core to 2.26.4 (one upgrade closes all 2).