Bitbucket

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenSep 18, 2026
Last mentionedSep 18, 2026

Timeline

1 articles · newest first

Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched

Researchers disclosed Plugin4Shell, a zero-click RCE SHA-pinning bypass in Claude Code, Codex, GitHub Copilot, and Gemini CLI; two remain unpatched.

Help Net SecuritySep 18, 08:49 UTC · Sep 18, 2026Vulnerability 2 sources7 · 3 reads

Appears with

GitHub Copilotproduct · 1
Microsoftvendor · 1
Claude Codeproduct · 1
Googlevendor · 1
OpenAIvendor · 1
AIRorganization · 1
Anthropicvendor · 1
Gemini CLIproduct · 1
Antigravityproduct · 1
GitHubvendor · 1
Codexproduct · 1

Entities are extracted by the model from each article. First seen Sep 18, 2026, last mentioned Sep 18, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.