Explore

Rapid Read Rapid Read
Cline Kanban Vulnerability Exposes AI Coding Agents to Web Hijacking

Cline Kanban Vulnerability Exposes AI Coding Agents to Web Hijacking

A critical security flaw has been identified in the Cline Kanban server, a widely used open-source AI coding assistant. This vulnerability allows any website visited by a developer to exfiltrate workspace data, inject commands into the AI agent's terminal, or terminate active sessions. The flaw, which has been assigned a CVSS score of 9.7, was discovered by Oasis Security researchers. It affects version 0.1.59 of the Kanban npm package and is due to missing origin validation and authentication on three WebSocket endpoints exposed by the local server. These endpoints handle runtime state, terminal I/O, and session control, and do not validate the Origin header or require session tokens, making them susceptible to exploitation. The issue is compounded by Cline's default 'bypass permissions' flag, which allows the AI agent to execute shell commands without authorization. Oasis Security has recommended disabling this flag and updating to version 0.1.66 to mitigate the risk.
Trendline Trendline
North Korean Threat Actors Exploit AI Coding Agents in Supply Chain Attacks

North Korean Threat Actors Exploit AI Coding Agents in Supply Chain Attacks

North Korean Threat Actors Exploit AI Coding Agents in Supply Chain Attacks
Trendline Trendline
AI Security Risks Expose Vulnerabilities in Proprietary Software and Hardware

AI Security Risks Expose Vulnerabilities in Proprietary Software and Hardware

AI Security Risks Expose Vulnerabilities in Proprietary Software and Hardware
Rapid Read Rapid Read
Linux Vulnerability 'Copy Fail' Exposes Security Risks Amid AI-Driven Discovery

Linux Vulnerability 'Copy Fail' Exposes Security Risks Amid AI-Driven Discovery

A significant security flaw, dubbed 'Copy Fail', has been discovered in the Linux kernel, affecting distributions built since 2017. The vulnerability allows attackers with local access to gain root control of systems. The flaw was identified by Theori's AI-powered platform, Xint, and reported to the Linux kernel security team. Although patches have been issued, the disclosure has sparked debate due to its AI-generated content, which some researchers found lacking in technical detail. The Cybersecurity and Infrastructure Security Agency has added the vulnerability to its known exploited vulnerabilities catalog.
Trendline Trendline
Coder Launches Self-Hosted AI Coding Agents to Enhance Enterprise Security

Coder Launches Self-Hosted AI Coding Agents to Enhance Enterprise Security

Coder Launches Self-Hosted AI Coding Agents to Enhance Enterprise Security
Trendline Trendline
Coder Introduces Self-Hosted AI Coding Agents for Enhanced Security and Control

Coder Introduces Self-Hosted AI Coding Agents for Enhanced Security and Control

Coder Introduces Self-Hosted AI Coding Agents for Enhanced Security and Control
Rapid Read Rapid Read
Ollama Vulnerability Puts 300,000 Deployments at Risk of Information Theft

Ollama Vulnerability Puts 300,000 Deployments at Risk of Information Theft

A critical vulnerability in Ollama, an open-source solution for running large language models (LLMs) on local machines, has been identified, potentially exposing sensitive information from approximately 300,000 deployments. The vulnerability, known as Bleeding Llama and tracked as CVE-2026-7482, is a heap out-of-bounds read issue that can be exploited to access sensitive data such as API keys and tokens. This flaw affects the GGUF model loader, allowing attackers to read past the allocated heap buffer and exfiltrate data to an attacker-controlled server. The vulnerability is particularly concerning as Ollama instances are often launched without authentication and are accessible over the internet, making them susceptible to exploitation.
Reuters Reuters
Australia regulator calls for urgent cybersecurity action to counter Mythos

Australia regulator calls for urgent cybersecurity action to counter Mythos

By Scott Murdoch SYDNEY, May 8 (Reuters) - Australia's corporate regulator has urged the country's financial sector to take urgent action on tackling potential cyber risks from frontier AI systems such as Mythos.
Trendline Trendline
Security Vulnerability in Claude Code Allows OAuth Token Theft via MCP Hijacking

Security Vulnerability in Claude Code Allows OAuth Token Theft via MCP Hijacking

Security Vulnerability in Claude Code Allows OAuth Token Theft via MCP Hijacking
Trendline Trendline
SecurityWeek Hosts Webinar on Securing Identity in AI and Automation Era

SecurityWeek Hosts Webinar on Securing Identity in AI and Automation Era

SecurityWeek Hosts Webinar on Securing Identity in AI and Automation Era
Trendline Trendline
Trellix Source Code Repository Breached, Raising Concerns Over Supply Chain Security

Trellix Source Code Repository Breached, Raising Concerns Over Supply Chain Security

Trellix Source Code Repository Breached, Raising Concerns Over Supply Chain Security
Trendline Trendline
Gemini CLI Vulnerability Exposes Users to Potential Supply Chain Attacks

Gemini CLI Vulnerability Exposes Users to Potential Supply Chain Attacks

Gemini CLI Vulnerability Exposes Users to Potential Supply Chain Attacks