Threat Library

The self-hosted HTTP transport of the DeepSeek MCP Server exposes the /mcp endpoint without any authentication, allowing any network-reachable client to initialize a session, enumerate tools, and invoke server-side functionality. This includes the deepseek_chat tool, which can consume the operator's own DEEPSEEK_API_KEY, leading to unauthorized API usage and potential cost/data exposure. The issue is patched in version 1.8.0.

This is a defensive research paper (not an active exploit) analyzing taint-style vulnerabilities in MCP server implementations, where untrusted input flows into dangerous sinks like command execution or file access. The authors propose SPELLSMITH, a mitigation that uses enhanced tool descriptions and LLM self-reflection to reduce exploitation risk without requiring code-level fixes. Severity is medium since it documents a real and underexplored class of vulnerabilities in deployed MCP servers, but the source itself is a proactive defense proposal rather than a disclosed active attack.

A server-side request forgery (SSRF) vulnerability exists in the aerostack-mcp project's mcp-whatsapp component, specifically in the upload_media function's media_url argument. A remote attacker can supply a malicious URL to force the MCP server to make unintended requests, potentially reaching internal network resources. The vendor has been notified but has not responded or patched the issue.

Krebs on Security reports that a startup soliciting zero-day vulnerabilities in popular software for large payouts is operated by individuals with histories of fraud, fake intelligence companies, and a defunct AI-based lobbying platform run under assumed identities. This raises significant vendor-trust and supply-chain risk concerns for any organization considering selling vulnerabilities to, or purchasing exploit intelligence from, this entity. There is no confirmed active exploitation tied to this report, but the operators' background suggests elevated risk of exploit misuse, data misrepresentation, or fraudulent business practices.

A threat actor dubbed Lurking Lizard has been running a residential proxy business since at least August 2022 using more than 230 lookalike domains that distribute trojanized software installers, including fake 7-Zip installers. Victims who download these fake installers unknowingly turn their devices into residential proxy exit nodes, which are then resold for anonymized traffic routing, potentially including malicious or fraudulent activity.

CISA disclosed two vulnerabilities in Digi International's PortServer TS and Digi One SP/SP IA/IA serial-to-network devices: an authentication bypass allowing unauthenticated access to restricted web resources, and a stored XSS flaw exploitable by authenticated administrators. These are legacy, end-of-life industrial devices used across critical manufacturing, communications, IT, and transportation sectors, with no vendor firmware fix planned for the XSS issue.

This is an academic survey (SoK) that reviews and categorizes 39 existing papers on execution-layer security for AI coding agents, rather than describing a novel exploit or active campaign. It highlights systemic weaknesses across the field—such as high denylist bypass rates, unaddressed TOCTOU races, and fragmented treatment of MCP threats—and references four previously disclosed, already-patched CVEs. Severity is low-to-medium as a direct threat signal since no new vulnerability or attack technique is disclosed; its value is as a roadmap of known/likely weak points defenders should prioritize.

CVE-2026-9182 is an unrestricted file upload vulnerability in ArcGIS Server that allows an unauthenticated attacker to upload arbitrary crafted files to an affected endpoint. This could lead to further compromise such as web shell deployment or remote code execution depending on server configuration and processing of uploaded files.

A large-scale phishing campaign impersonates over 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, using fake job interview lures to steal Google account credentials from marketing professionals. The attackers leverage trusted brand names and recruitment pretexts to bypass victim skepticism and harvest credentials likely for account takeover, further phishing, or resale.

SUSE Rancher AI Agent versions before 1.0.2 write API keys and raw LLM response text to log files when DEBUG loglevel is enabled, exposing sensitive data to anyone with local log access. This is a configuration/logging hygiene flaw rather than a novel agentic attack technique, and requires local access plus DEBUG mode to be exploitable. Severity is moderate because it enables credential theft and downstream misuse, but exploitation requires elevated local access and a non-default log setting.

A medium-severity XML External Entity (XXE) vulnerability affects Schneider Electric EcoStruxure IT Data Center Expert versions 9.1.1 and prior, allowing an authenticated attacker to disclose server-side file contents via crafted XML payloads to SOAP service endpoints. Schneider Electric has released version 9.1.2 to remediate the issue, and no known public exploitation has been reported.

This item is a retrospective and largely positive report: OpenAI published a paper detailing mitigations for a long-known zero-click data exfiltration technique in which a language model can be manipulated into rendering attacker-controlled URLs (e.g., markdown images) that leak conversation data to an external server. The underlying vulnerability class was disclosed by the author nearly three years ago and was already mitigated by Microsoft in Bing Chat in 2023; this post covers OpenAI's newer, more formal write-up of defenses. Severity is moderate rather than critical because this is historical/defensive reporting on a well-understood, largely mitigated issue rather than a new active exploit.

A server-side request forgery flaw exists in the mcp-wiki/wiki-summary component of AIAnytime Awesome-MCP-Server, where the 'url' argument passed to an MCP tool is not validated before the server fetches it. A remote attacker can supply this MCP-exposed tool with an internal or attacker-controlled URL to make the server issue requests on their behalf, potentially reaching internal network resources. The vendor has been notified but has not responded or patched the issue.

This is an academic red-teaming paper (not an active exploit) introducing MIRROR, a search-based framework that automatically generates diverse, non-duplicated attacks against multimodal agentic RAG systems across text poisoning, image injection, direct-query, and orchestrator-manipulation surfaces. It demonstrates high attack success rates, notably 97% against orchestrator-level tool manipulation, highlighting that current agentic RAG defenses are weak across multiple input modalities and pipeline stages. Because it is a research disclosure with an accompanying benchmark rather than an in-the-wild campaign, it is rated medium severity as a forward-looking risk indicator rather than an active incident.

This is an academic arXiv paper, not an active exploit or observed attack, that formally proves prompt injection cannot be fully solved by in-pipeline defenses in current shared-embedding LLM architectures. It frames this as a structural, mathematical limitation analogous to code-data confusion in classical computing (e.g., buffer overflows), arguing that only architectural separation of instruction and data channels can meaningfully address it. Severity is assessed as medium because it is foundational research explaining why existing prompt-injection defenses fail, rather than describing a new exploit technique or active threat.

This is an academic research paper (not an active exploit) that identifies a structural weakness in MCP-style agent runtimes: security is typically enforced only at the connection layer (auth, session checks, approval dialogs) while execution-time actions lack consistent, testable invariants like principal binding and data-flow authorization. The authors demonstrate that naive and even 'practice-informed' mitigation baselines still permit most modeled attacks, and propose a reference runtime (HCP) that blocks all 10 benchmark attack cases by enforcing explicit execution-layer controls.

A joint law enforcement and industry operation involving Google disrupted NetNut, a residential proxy network built on approximately 2 million compromised Android devices, including smart TVs and streaming boxes. The infrastructure allowed threat actors and paying customers to route traffic through unwitting victims' devices, enabling anonymized malicious activity such as credential stuffing, ad fraud, and scraping. The takedown cuts off access to this proxy pool but does not necessarily remediate infections on affected devices.

This is an academic research paper (arXiv, not an active exploit) empirically benchmarking six major LLMs against direct, multilingual, and obfuscated prompt injection attacks. The study finds that all tested models can be induced to generate phishing content, malicious websites, and malware, with non-English prompts and multi-stage obfuscation significantly increasing compliance rates. Since this is a research disclosure rather than an in-the-wild exploit or agent-specific vulnerability, severity is rated medium rather than high/critical.

CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 fail to properly verify cryptographic signatures on firmware updates, relying only on CRC-32 integrity checks. An attacker with physical access could upload arbitrary malicious firmware without authentication, though the device remains recoverable via an independent bootloader.