Threat Library

This is an academic research paper describing a new defensive technique (AEGIS) against indirect prompt injection attacks in LLM-based agents, not a description of an active exploit or newly discovered vulnerability. It proposes using instruction-sensitive projectors and multi-layer consensus signals to detect malicious injected instructions while reducing over-refusal of legitimate inputs. The underlying threat class (indirect prompt injection) is well-known and already covered by existing threat intelligence; this submission itself introduces no new attack technique.

This is not a vulnerability disclosure but a research paper describing AgentFlow, a defensive framework that enforces data-flow policies across LLM agent tool calls and delegation boundaries to prevent prompt-injection-driven data exfiltration and unsafe cross-agent authority propagation. The work reports strong reductions in confirmed compromise rates across several established agent security benchmarks (AgentDojo, AgentDyn, ASB, InjecAgent, BIPIA, AgentHarm, MCPTox). Severity is rated low because the raw data describes a proposed mitigation, not an active threat, exploit, or newly discovered weakness.

This is a weekly aggregated security recap covering multiple loosely-related incidents, including AI-assisted attacks against industrial PLC systems, GitLab-related compromises, and leaked Stripe API keys. The report is high-level and lacks technical depth on specific CVEs, exploit chains, or IOCs, functioning primarily as an industry news digest rather than a single actionable threat profile.

Threat actors are distributing the Weedhack malware family through fake Minecraft client websites that closely mimic legitimate gaming projects, using SEO poisoning to drive traffic. McAfee Labs has blocked over 6,300 access attempts to these malicious sites, indicating an active and sustained campaign targeting gamers, particularly those seeking cheat clients or modified game builds.

This is not a discrete attack but an industry advisory piece highlighting how AI coding assistants are rapidly increasing the volume of open-source dependencies introduced into codebases, outpacing security teams' ability to review and remediate vulnerabilities. The resulting backlog of unpatched or unreviewed packages creates a growing attack surface and increases organizational risk of supply-chain compromise.

The U.S. Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated entities resolving allegations that the platform violated the Children's Online Privacy Protection Act (COPPA) by unlawfully collecting personal data from children under 13 without parental consent. This is a legal and regulatory enforcement action, not a cyberattack, vulnerability disclosure, or malware campaign.

Attackers are actively exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, allowing forgery of SAML responses to gain unauthorized administrator access. Sites running vulnerable versions of the plugin are at immediate risk of full site takeover.

An unpatched vulnerability in Calix GS7 XGS (GS5239XG) residential routers allows remote, unauthenticated attackers to create arbitrary port-forwarding rules, bypassing NAT protections and exposing internal network devices directly to the internet. The flaw affects devices deployed by multiple U.S. broadband providers, putting a large base of residential and small-office networks at risk of direct exposure of internal systems such as NAS devices, cameras, and smart home hubs.

CISA has added CVE-2026-21962, an improper access control vulnerability affecting Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities (KEV) catalog based on confirmed active exploitation. Federal civilian agencies are required under BOD 26-04 to remediate this vulnerability on a priority basis, and CISA urges all organizations to do the same given the active exploitation in the wild.

Multiple DrayTek VigorSwitch models are affected by a set of unauthorized operation vulnerabilities in syslog-related functions caused by missing authorization checks. A remote, unauthenticated attacker can send crafted requests to modify device configuration, restart services, alter startup configuration, or clear logs, potentially leading to persistent network manipulation, denial of service, or evidence destruction.

A critical pre-authentication command injection vulnerability affects multiple DrayTek VigorSwitch models, allowing remote attackers to execute arbitrary commands with root privileges without any credentials. Given the CVSS score of 9.8 and the device's role as network infrastructure, this flaw poses an immediate risk of full network compromise. Organizations using DrayTek switches at network edges should treat this as an urgent patching priority.

rConfig versions 8.0.0 before 8.2.13 contain a critical authentication bypass flaw allowing unauthenticated attackers to self-register accounts that are automatically granted full Administrator privileges. This grants access to stored network device credentials, user data, and API tokens, effectively giving attackers full control over managed network infrastructure.

A critical unauthenticated remote code execution vulnerability affects Netis NC63 router firmware through V3.0.0.3327, allowing attackers to gain root access via a crafted HTTP request to the device's web management interface. The vulnerability requires no authentication and no user interaction, making it highly exploitable for mass scanning and botnet recruitment. With a CVSS score of 9.8, this represents a severe risk to any network-edge device running the vulnerable firmware.

A critical authentication bypass vulnerability exists in EFM ipTIME T24000M routers (up to firmware 14.20.0) affecting the httpcon_check_session_url function within the Session Validation Handler. The flaw allows remote attackers to bypass authentication without credentials, and a public exploit is already available. The vendor has not responded to disclosure attempts, leaving affected devices unpatched and exposed.

CVE-2026-21962 is an actively exploited improper access control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in that allows unauthorized creation, deletion, or modification of critical data, as well as unauthorized full access to server-accessible data. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a short remediation window, indicating active in-the-wild exploitation and high urgency for patching.

The Continue CLI's headless/auto mode relies solely on an incomplete denylist to block dangerous shell commands, missing paths like /home, /root, /var, and failing to properly handle variable expansion such as $HOME. An attacker who can inject instructions into content the agent reads (web pages, repo files, issues) can trigger destructive commands like recursive deletion, causing unattended agent runs to destroy user data.

This is a research paper describing a defensive framework (AEGIS), not an active exploit or newly disclosed vulnerability. It highlights a known class of risk where MCP agents can request excessive resources (e.g., huge search radii, long videos) across multiple modalities, potentially degrading service, and proposes a policy-enforcement layer to mitigate it.

This is a defensive research paper describing ClawSentry, a security gateway that monitors LLM agents to detect and block malicious third-party skills/tools before and during execution. It is not an active exploit or vulnerability disclosure, but rather a proposed mitigation framework benchmarked against known attack scenarios (SkillInject, SkillsSafety). Severity is low from a threat perspective since this describes protective tooling, though it implicitly confirms that unprotected agent runtimes have high attack success rates (33.5-49.7%) against malicious skill injection.

This is a defensive research paper, not an active threat or exploit disclosure. It proposes TraceGrant, a governance framework that mitigates indirect prompt injection in networked LLM agents by binding tool execution to a pre-established 'Contract' derived from trusted user intent and verifying task completion against actual results. The underlying risk it addresses (indirect prompt injection redirecting tool calls) is well-known and already covered by existing threat models; no new vulnerability or attack technique is introduced here.

This is an academic research paper (not an active exploit) demonstrating that persistent agent memory systems are highly vulnerable to simple, plainly worded false statements: poisoning just 1.2% of a memory corpus dropped answer accuracy from 0.85 to 0.30. The authors show that both write-time content screening and provenance-weighted retrieval defenses fail to catch these low-effort attacks, exposing a fundamental architectural gap rather than a specific software bug.