SecurityMalware Lures LLMs Toward Forbidden Prompts
Russia-aligned UAC-0099 embeds nuclear-weapon-style prompts in a VBS script to misdirect AI-assisted malware analysis, ESET says.
> Search
30 results for “injection”
Security
SecurityServiceNow Tackles Maximum-Severity Flaws
Patches cover three critical code injection bugs and a sandbox escape in the Now Platform.
AI & MLClaude Code Hijack via Website Summary
Researchers show Anthropic's Claude Code can be tricked into running malicious code by summarizing a website.
SecurityFirst 24 Hours: Responding to an AI Agent Incident
What to do when an autonomous agent acts beyond its bounds, hour by hour.
SecurityHidden HTML Hijacks AI Email Summarizers
Forcepoint shows invisible text can silently change what an AI assistant reads in your email.
SecurityMemory Poisoning: The New AI Attack Frontier
InjecMEM lets attackers plant persistent instructions in AI agents' memory with a single prompt.
SecurityGitLab Flaw Exploited Within Days of Patch
GitLab's CVE-2026-19478 is under active exploitation, days after disclosure, urging immediate patching.
SecurityGrok tricked into leaking user data
A researcher found that encrypting malicious instructions lets Grok exfiltrate user chats and personal details.
SecuritySnowflake CI/CD Flaw Opens Door to Issue-Based Injection
A GitHub Actions workflow flaw in Snowflake's connector repo allowed crafted issues to execute commands with exposed Jira credentials.
SecurityMCP Servers: A New Secret-Leak Vector
Model Context Protocol servers can expose enterprise secrets via plaintext configs, over-permissioning, and prompt injection, often undetected.
AI & MLOpenAI's Computer History logs your keystrokes
OpenAI's Computer History feature records clicks and typing, storing them unencrypted and expanding prompt injection risks.
SecuritySAP's Critical Patches Close Zero-Day-Style Gaps
SAP's August 2026 patch batch addresses 28 flaws, including a 10/10 severity bug in Commerce Cloud that could allow attackers to bypass authentication and execute code.
AI & MLHow MCP Splits Can Leak Secrets
Malicious MCP servers can split instructions to make AI coding agents exfiltrate secrets, ASSET reports.
SecurityFlaw in Progress LoadMaster exploited in attacks
CISA warns of active exploitation of critical command injection flaw in Progress Kemp LoadMaster; urges patching.
SecurityMetabase Zero-Day Exploited Before Patch
Critical SQL injection flaw in Metabase allowed zero-day attacks; urgent patches released for self-hosted users.
SecurityAtlassian Rovo Flaw Enabled Data Theft via Prompt Injection
A one-click prompt injection attack on Atlassian's Rovo could expose enterprise data across connected apps.
SecurityCritical Command Injection Hits MSI RadiX Router
A critical command injection vulnerability in the MSI RadiX AXE6600 router allows remote attackers to execute arbitrary code and gain root access.
SecurityCritical Command Injection Hits MSI Radix
A critical vulnerability in the MSI Radix AXE6600 router allows remote attackers to gain root access via the wps.cgi interface.
SecurityCPU Interrupts Bypass Spectre Defenses
Researchers identified a new technique dubbed INTERRUPT INJECTION that exploits timing gaps to bypass existing CPU branch protections.
SecurityCISA Warns of Exploited Progress LoadMaster Flaw
A critical command injection vulnerability in Progress LoadMaster is under active exploitation, prompting urgent CISA remediation requirements.
SecurityAI Agent Frameworks Face Security Crisis
Researchers reveal that vulnerabilities in AI agent foundations allow prompt injection to bypass critical trust boundaries.
SecurityOracle Database Hijacked for Tool Storage
Researchers identified a post-exploitation toolkit concealed within Oracle database schema objects to bypass endpoint security tools.
SecurityCritical SQL Injection Found in Loca CMS
A critical SQL injection vulnerability in Loca Software CMS allows unauthorized attackers to gain full control over affected database systems.
SecurityFlowise Fixes Critical Root RCE Vulnerability
A critical remote code execution vulnerability in Flowise allows low-privileged attackers to gain root access on vulnerable servers via CSV Agent code injection.
SecurityCritical PHP Injection Flaw in MaxSite CMS
A critical PHP object injection vulnerability in MaxSite CMS allows unauthenticated attackers to execute arbitrary code via a malicious cookie.
SecurityCISA Flags Critical IBM Langflow Flaw
A code injection vulnerability in IBM Langflow has been added to CISA's catalog, requiring rapid remediation for federal agencies.
SecurityCritical Command Injection Hits Puwell Cameras
Puwell IP cameras running firmware versions 2.x through 4.x are vulnerable to unauthenticated remote code execution via a flaw in the DebugShell interface.
SecurityCritical Command Injection Hits GL.iNet MT3000
A critical remote command injection vulnerability in GL.iNet GL-MT3000 routers allows unauthenticated attackers to execute arbitrary code on affected devices.
SecurityCritical SQL Injection Hits Adobe Campaign
A critical SQL injection vulnerability in Adobe Campaign Classic allows low-privileged attackers to execute arbitrary code without user interaction.
SecurityCritical Eval Injection Found in Adobe Campaign
A critical vulnerability in Adobe Campaign Classic allows low-privileged attackers to execute arbitrary code without requiring user interaction.