First reported securityonline.info
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported cisa.gov
Defending Against an Active Threat to Siemens S7 Series PLCs
CISA, NSA, FBI, DOE and EPA issued advisory AA26-231A warning of an active threat targeting Siemens S7 Series PLCs in U.S. critical infrastructure using AI-generated exploitation scripts disguised as legitimate monitoring tools. The actors use internet scanning services like Censys and ZoomEye to find exposed, outdated or poorly protected PLCs, and the broader targeting extends beyond Siemens devices. Details →First reported · updated · 3 reports cisa.gov
CISA Adds One Known Exploited Vulnerability to Catalog
CISA warned that threat actors are actively exploiting CVE-2026-64849, a critical DNS-rebinding SSRF bypass in MLflow's outbound webhook delivery, and added it to its Known Exploited Vulnerabilities catalog. MLflow is a widely used open-source AI engineering platform for LLMs and agents; the flaw lets unauthenticated attackers reach the tracking server and make it issue requests to internal/loopback/cloud-metadata endpoints, enabling theft of cloud credentials such as AWS IMDS IAM credentials. The vulnerability was patched in MLflow 3.15.0. Details →First reported cisa.gov
Defending Against an Active Threat to Siemens S7 Series PLCs
Five US federal agencies (NSA, CISA, FBI, DOE, EPA) issued advisory AA26-231A warning of an active threat in which attackers use AI coding assistants together with open source industrial libraries (snap7.dll/python-snap7) to generate custom exploitation scripts disguised as legitimate OT monitoring tools against internet-exposed Siemens S7 Series PLCs at water, energy, manufacturing, and other critical facilities. The AI-generated tools provide read/write access to PLC memory, configuration, and ladder logic via the S7comm protocol, and the activity is suspected to be linked to Iran-affiliated operatives. Details →First reported · updated · 2 reports cisa.gov
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2025-62593 (CVSS 9.4), a critical flaw in Ray — the open-source, Python-native distributed computing framework used to scale AI/ML workloads — to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The bug can result in remote code execution through web browsers such as Firefox and Safari, and CISA gave federal agencies a short remediation deadline. Details →First reported · updated · 4 reports cve.org
IBM's agentic AI platform is under active attack - patch now
A critical vulnerability, CVE-2026-9198, in IBM-owned low-code AI agent builder Langflow lets unauthenticated attackers achieve remote code execution on default deployments by chaining an auto-login endpoint that mints superuser tokens with a code-validation endpoint that runs arbitrary Python. CISA added it to its Known Exploited Vulnerabilities catalog after confirming active exploitation; IBM says Langflow OSS 1.0.0 through 1.10.0 are affected and urges upgrading to 1.10.1 or later. Sysdig telemetry documents in-the-wild attack chains (including related CVE-2026-33017 RCE and CVE-2026-55255 IDOR) that probe /api/v1/auto_login, enumerate flows, and deliver second-stage loaders. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector