Security
Plugin4Shell: A Pinned Coding-Agent Plugin Is Not Always Pinned
Plugin4Shell is the name Air Security gave to a flaw in how four AI coding agents install plugins that are pinned to…
Security
Information security is the practice of protecting systems, data, and users from compromise and loss. Articles in this category cover threat models, social engineering, authentication, compliance considerations, and the operational habits that keep an organization defensible at scale.
Latest in Security
Security
Elementor Pro, Super Forms and Wholesale Lead Capture: The WordPress File Upload Flaws Under Attack
In September, Wordfence reported active attacks on three file upload flaws in WordPress plugins: Elementor Pro, Super Forms and Wholesale Lead Capture…
Security
Gemini Hacking Incident: A Fourth Lab, the Same Test Vendor, and No Report
The Gemini hacking incident makes Google the fourth AI lab whose model broke into real companies during a cyber evaluation. It happened…
Security
GitSpawn: Cloning a Repo Is Safe. Being Handed One Is Not.
GitSpawn is the name Manifold Security gave to a flaw it disclosed on 1 September 2026, in which a repository’s own git…
Security
Webform Security Release: 20 Advisories in One Day, and the Order to Patch In
The Drupal webform security release of September 23, 2026 fixed 20 advisories in one module on one afternoon, and one of them…
Security
Claude Opus 5.5 Prompt Injection: Stronger Against Web Pages, Weaker Against Pasted Text
Anthropic’s system card for Claude Opus 5.5 makes two statements about prompt injection, one after the other, in its executive summary. Read…
Security
The First MCP Flaw in the KEV Catalog Was an Authentication Check That Failed Open
MCP authentication entered CISA’s Known Exploited Vulnerabilities catalog for the first time on 2 September 2026, and the bug underneath it is…
Security
The Langflow Vulnerability Is Not the Story: Your AI Tooling Is a Credential Store
Attackers began exploiting an unauthenticated code execution flaw in Langflow, the open-source visual builder for LLM and agent workflows, on August 30,…
Security
WordPress 7.1.1 Patched Click2Shell, and the Core Bug Was a Disagreement About One String
WordPress 7.1.1 shipped on September 17, 2026 carrying eleven security fixes, seventeen core bug fixes and nineteen fixes for the block editor.…
Security
An HTTP GET Rewrote Their Wiki: Nothing You Have Deployed Governs Agent Write Access
Nothing you have deployed on your site governs agent write access. Not robots.txt, not your Cloudflare bot rules, not any licensing arrangement…