⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
Weekly recap led by actively exploited Cisco ISE auth-bypass CVE-2026-76460 (CVSS 10.0), plus Plugin4Shell AI-agent RCE and KREMLIN banking malware.
Stories per day · 30 days
2 RSS
5 stories, newest first · one card per story
Stories tagged #plugin4shell
A zero-click RCE flaw in AI coding agents could have exposed enterprise systems
Researchers disclosed Plugin4Shell, a zero-click RCE in Claude Code, Codex, Gemini CLI, and Copilot caused by unverified Git plugin checkouts.
3
Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI
Plugin4Shell flaw lets attackers swap SHA-pinned plugins for malicious code, enabling zero-click RCE in Claude Code, Codex, Copilot, and Gemini CLI.
5
Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched
Researchers disclosed Plugin4Shell, a zero-click RCE SHA-pinning bypass in Claude Code, Codex, GitHub Copilot, and Gemini CLI; two remain unpatched.
7
AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom
Researchers disclosed Plugin4Shell, a zero-click RCE in major AI coding agents' plugin SHA-pinning; Anthropic and OpenAI patched, Microsoft and Google did not.
6