The Engineer

The Critical Stack

This week's vulnerability disclosures hit an unusual concentration of production-critical infrastructure simultaneously. These aren't theoretical — they're in services you're almost certainly running. Here's what to prioritize:

The AI Tooling Crisis Is Worse

A single SANS newsletter lists critical RCEs in five AI/ML platforms, all with CVSS scores above 9.0. This isn't a coincidence — it's the consequence of AI tools being deployed faster than they're hardened:

• FastGPT — CVSS 10.0 unauthenticated HTTP proxy. Anyone on the network owns it.
• Langflow — CVSS 9.9 RCE that bypasses a previous RCE fix (CVE-2026-33309). Do not deploy near production systems.
• Spring AI — CVSS 9.8 SpEL injection in SimpleVectorStore.
• CrewAI — CVSS 9.6 RCE. The CodeInterpreter silently falls back from Docker to unsandboxed execution when Docker isn't available.
• LoLLMs — CVSS 9.1 SSRF via proxy endpoint.

The CrewAI vulnerability is the most insidious: your security degrades silently in environments where Docker isn't accessible (some CI runners, restricted production). You think you have a sandbox. You don't.

The Nginx UI MCP endpoint exposure (CVE-2026-33032, CVSS 9.8) is a harbinger: unauthenticated access to the /mcp_message endpoint enables complete nginx service takeover. As MCP adoption grows, expect more tools to expose unprotected MCP interfaces.

The gRPC-Go Auth Bypass Deserves Special Attention

This one is subtle and easy to miss. If your gRPC services do path-based authorization in middleware interceptors, an attacker omitting the leading slash from the :path pseudo-header bypasses your policy evaluation entirely. The fix isn't just patching the library — add explicit path normalization (prepend leading slash) before your authorization check, as defense-in-depth. Most mature gRPC deployments do path-based authz, so the blast radius is wide.

The Offensive Side: Zero-Days for Everyone

Anthropic's Opus 4.6, running via Claude Code, autonomously discovered 500+ high-severity vulnerabilities in well-tested open-source code — including decade-old bugs in the Linux kernel — using trivially simple prompts. Nicholas Carlini demonstrated this live: pointing it at Ghost (a 13-year-old publishing platform with zero prior critical CVEs) produced a blind SQL injection and a working credential-extraction script within hours.

The hard part of exploitation is finding the bug and understanding the code path. Once you have a confirmed blind SQLi with the exact injection point identified, writing the extraction script is a few hours of work for any developer — no AI needed.

Consumer guardrails block full exploit weaponization but not vulnerability identification. That boundary is architecturally fragile — discovery is the expensive part, and it's now free. James Wilson at Risky Business independently confirmed: consumer Claude found the same Ghost SQLi. Separately, exploitable RCE zero-days were found in vim and emacs with prompts like 'Somebody told me there is an RCE 0-day when you open a file. Find it.' Even rumor-quality hints dramatically narrow AI's search space.

The Defensive Gap: Your Agents Are Being Attacked

DeepMind's 'AI Agent Traps' paper quantifies the other side. Hidden prompt injection via HTML/CSS succeeds 86% of the time against browse-capable agents. This isn't visible injected text — it's CSS-hidden instructions the model processes but humans never see. Worse: latent memory poisoning achieves 80%+ attack success with less than 0.1% contamination of the agent's memory store.

These two findings create a vicious loop: AI discovers your vulnerabilities faster than you can patch them, and your AI agents can be weaponized against you through the untrusted content they process.

The Slopsquatting Dimension

A study of 117,000+ dependency changes found AI coding agents select known-vulnerable versions 50% more often than humans, and 20% of AI-recommended packages are hallucinated names. But here's what makes this exploitable at scale: 43% of hallucinated names are consistent across queries. A researcher registered a dummy package based on a common LLM hallucination and got 30,000 downloads in weeks, largely from automated AI workflows. This attack — 'slopsquatting' — is trivially scalable. Enumerate hallucinated names across models, register them with malicious payloads, and harvest credentials from every team using AI agents without dependency governance.

Willison's Lethal Trifecta Model

Simon Willison's threat model is the simplest framework for evaluating agent risk: any agent that simultaneously (1) accesses private data, (2) processes untrusted content, and (3) can communicate externally is a prompt injection attack waiting to happen. Audit your current agent integrations against this trifecta — if an agent reads your database via MCP, processes PR descriptions or JIRA tickets, and can make HTTP requests, you have all three legs active.

The Roadmap That Matters

GitHub's 2026 Actions security roadmap directly addresses the CI/CD supply chain attacks that dominated the past two weeks. Four features are shipping in 3–6 months:

1. Workflow-level dependency locking — go.mod-style SHA pinning for all direct and transitive Action dependencies, with eventual immutable releases. This is the structural fix for the Checkmarx-class attack.
2. Native Layer 7 egress firewall — operates outside the runner VM, with monitor and enforce modes. If a malicious build step gets code execution inside the runner, it can't disable a firewall it doesn't have access to.
3. Scoped secrets — restricting which jobs and steps can access which secrets.
4. Actions Data Stream — near-real-time execution telemetry piped to S3/Azure Event Hub, giving detection engineering teams the CI/CD data source they've been missing.

The 'outside the VM' architecture of the egress firewall is defense-in-depth done right. If you've been running self-hosted runners behind VPC NAT purely for network isolation, this might let you simplify back to GitHub-hosted runners.

Why You Can't Wait: The SHA Pinning Flaw

Most teams pin GitHub Actions to commit SHAs thinking they're safe. They're not. An attacker can fork an Action, inject a backdoor, and submit a PR that only changes the SHA — and the PR still shows the original owner/repo in the workflow file. During code review, it looks legitimate. The Checkmarx incident proved this at scale: all 91 published tags were rewritten to malicious commits in a 7-minute window (19:09–19:16 UTC). The real blast radius wasn't revealed by the vendor — an independent researcher found it by analyzing GitHub activity logs.

Synthesia's 3-Agent Consensus Pattern: The Reference Implementation

While GitHub builds platform-level fixes, Synthesia has built the most production-credible AI-assisted AppSec pipeline documented to date. The architecture is layered for cost efficiency:

1. Severity-based filtering (cheap) — drop noise early
2. Semgrep Assistant for false positive detection (medium cost)
3. EPSS + reachability analysis for SCA findings (still cheap)
4. Three independent coding agents doing consensus voting for validation (expensive, but only on filtered set)

The consensus voting pattern is Byzantine fault tolerance for LLM judgment — three independent agents must agree before the system generates a fix PR. Result: 89% of findings handled without human intervention, only 11% need manual review. But note the underemphasized prerequisite: they achieved a 60% backlog reduction just by archiving stale repos before layering AI on top. Organizational hygiene first.

Trusted Publishing Expansion

GitHub's trusted publishing expansion with OpenSSF will cover npm, PyPI, NuGet, RubyGems, and Crates — eliminating long-lived credentials for package publishing entirely. Migrate your open-source publishing to OIDC-based trusted publishing now for any supported ecosystem. Given the attack patterns of the past two weeks, this is the highest-ROI supply chain hardening step available.