AIR Security

Mentions · 7d1
Mentions · 30d3
All mentions5
First seenSep 18, 2026
Last mentioned2d ago

Timeline

5 articles · newest first

Claude document-skill flaw can run attacker code on Linux

AIR Security says an unverified library in a shared temp directory can load via LD_PRELOAD; Anthropic declined to fix it.

Dark ReadingNov 9, 18:08 UTC · 2d agoAI safety & security2

Hugging Face crypto-mining models return; a copy stays live

Pluto found 31 repositories posing as Qwen2 checkpoints; the flagship reached 28,412 downloads and a copy remained online.

BleepingComputerOct 29, 22:09 UTC · 12d agoMalware2 · 1 read

Hallucinated domain in official OpenAI skill underscores AI supply chain risks

An official OpenAI skill pointed apps at an unregistered domain that collected real production tokens.

CSO OnlineOct 16, 17:29 UTC · 26d agoAI safety & securityExploited7 · 3 reads

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks

Weekly recap led by actively exploited Cisco ISE auth-bypass CVE-2026-76460 (CVSS 10.0), plus Plugin4Shell AI-agent RCE and KREMLIN banking malware.

The Hacker NewsSep 21, 14:24 UTC · Sep 21, 2026Exploit / PoCExploitedCVE-2026-76460 CVE-2026-32882 CVE-2026-58138+2711 · 1 read

Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI

Researchers disclosed Plugin4Shell, a zero-click RCE in AI coding agents' Git SHA-pinned plugin updates, affecting Claude Code, Codex, Copilot, and Gemini CLI.

Cyber Security NewsSep 18, 08:43 UTC · Sep 18, 2026Vulnerability 2 sources3 · 1 read

Related CVEs

by mentions

CVE-2026-58704<1%8.8
Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation
published Sep 15, 2026Google Cellular Modem (modem firmware on Google Pixel-class devices, per assigning CNA)KEV
CVE-2026-684889.9
TOCTOU Symlink Race in Plesk Allows Local Privilege Escalation to Root
published Sep 10, 2026Plesk (server hosting/automation panel)
CVE-2026-78623<1%9.9
SQL Injection in Okta Access Gateway via Unsanitized SAML Assertion Values
published Sep 8, 2026Okta Access Gateway
CVE-2026-917499.6
Critical Use-After-Free in Google Chrome Workers Enables Sandbox Escape
published Sep 15, 2026Google Chrome
CVE-2026-614101%9.4
Missing Authorization Allows Unauthenticated RCE in Dell Secure Connect Gateway 5.0
published Sep 7, 2026Dell Secure Connect Gateway (SCG) 5.0 Appliance
CVE-2026-581389%9.3
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS…
published Jun 30, 2026PoC
CVE-2026-85982<1%9.0
Stored XSS in Auth0 AD/LDAP Connector Admin Panel
published Sep 8, 2026Okta (Auth0) Auth0 AD/LDAP Connector
CVE-2026-890498.5
SSRF in AWS Systems Manager Agent can expose instance IAM role credentials
published Sep 10, 2026Amazon Web Services (AWS) Systems Manager Agent (SSM Agent)
CVE-2026-68121<1%7.8
Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject)
published Aug 10, 2026Linux kernel (PPPoE subsystem, pppoe_sendmsg())PoC ×2
CVE-2026-78626<1%6.5
Authorization Bypass in Okta Access Gateway Protected Rule Checks
published Sep 8, 2026Okta Access Gateway

Appears with

Anthropicvendor · 2
Codexproduct · 2
OpenAIvendor · 2
htt0118/qwen2-tinyai model · 1
U.S. Department of Justiceorganization · 1
AOMEI Backupperproduct · 1
NetSupport Managerproduct · 1
Xinferenceproduct · 1
Pluto Securityorganization · 1
MENXIANGYU/qwen2-tinyai model · 1
GitHubvendor · 1
OpenAIorganization · 1
Hacktronorganization · 1
GitHub Copilotproduct · 1
NightmareStresserorganization · 1
GitHuborganization · 1

Entities are extracted by the model from each article. First seen Sep 18, 2026, last mentioned 2d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.