Blog
Insights, updates, and deep dives on AI agents, decentralized standards, and the future of HOL.
Three Clueless Examples: Product Review, Evidence Checks, and Plain-Language Research
Three Clueless Examples: Product Review, Evidence Checks, and Plain-Language Research
A creator-approved PDF records three redacted, translated Codex-session examples, with the limits each one leaves in view.
Three Trust Boundaries Under Pressure: PHP, LiteLLM, and eMudhra
Three Trust Boundaries Under Pressure: PHP, LiteLLM, and eMudhra
Three October 21 security disclosures affected runtime handling, published package artifacts, and certificate authority key generation. Here is what operators should verify at each boundary.
Joel Hillier
BREAKING: GitLab CVE-2026-110264 lets attackers run code on self-managed servers with no login, even ones patched Oct 12
How to fix CVE-2026-110264: upgrade GitLab to 19.5.1, 19.4.3, 19.3.6, or the 19.2.9, 19.1.9, 19.0.10 and 18.11.13 backports. A crafted Org-mode file gives no-login code execution on self-managed GitLab, and servers patched on October 12 are exposed again.
HOL Guard
eMudhra CA keys leaked: forged HTTPS certs still pass in old Go, Python, Node.js and Java (CVE-2026-111943)
How to fix CVE-2026-111943: upgrade Go to 1.27.3 or 1.26.10 and rebuild, then update certifi to 2026.10.19, Node.js to 22.23.4, 24.22.1 or 26.12.1, and your ca-certificates. Eight eMudhra intermediate CA keys can be recovered from the public certificates, so non-browser clients will accept forged HTTPS for any site.
HOL Guard
BREAKING: LiteLLM 1.107.0 on PyPI and Docker latest shipped a credential stealer. Pin 1.106.2 and rotate your AI keys
How to fix the LiteLLM 1.107.0 compromise: pin litellm to 1.106.2, rebuild from a clean image, and rotate every key the host could read. All 1.107.0 wheels on PyPI and the Docker latest, main-latest and main-stable tags shipped a credential stealer that also dumps the proxy's stored provider keys.
HOL Guard
BREAKING: PHP2Shell lets attackers run code on PHP web servers with no login. Update PHP now (CVE-2026-109618, CVE-2026-109619)
How to fix CVE-2026-109618: upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart Apache and PHP-FPM. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers run code on PHP web servers with no login. PHP 8.1 and older get no upstream fix.
HOL Guard
BREAKING: Plex Media Server hijacked without a login to mine crypto and run proxies, now on CISA KEV (Plex2Shell, CVE-2026-96652)
How to fix CVE-2026-96652: upgrade Plex Media Server to 1.43.3.10861 or later. The Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) is exploited to install crypto miners and proxies, on CISA KEV Oct 20. Updating does not remove an infection.
HOL Guard
Your AI Agent Writes Code. Who's Auditing Its Commits?
A maintainer's guide to conventional-commits-framework — what it does, who it helps, and how to get started.
What I Check Before I Install a Claude Plugin on a Client's Computer
What I Check Before I Install a Claude Plugin on a Client's Computer
A Claude consultant's pre-install checklist for small businesses: who made it, what it tells Claude to do, what it runs, what it touches, what Claude finds when it reviews it, where it gets tested, and who keeps track.
A declaration buys fewer stages, never fewer boundaries
The ai-native-sdlc plugin packages six stages as committed Markdown artifacts and uses an opt-in PreToolUse gate to block uncovered source-code writes.
Letting an agent run Home Assistant, one approval at a time
Letting an agent run Home Assistant, one approval at a time
Home Assistant MCP (Vome) is now listed in HOL Guard. The source lists 57 tool entries across 11 risk classes: 56 marked for review and one `other` entry set to inherit its state.
VibesPlug's README lists 155 agents and supported coding tools
VibesPlug's README lists 155 agents and supported coding tools
The project README lists 155 specialized subagents, supported coding tools, npm setup commands and a standalone MCP server.
Your agent should never be handed a shell
Your agent should never be handed a shell
GuardFall reported exploitable agent-to-shell boundaries in 10 of 11 surveyed open-source AI coding agents under its tested configurations. SysKnife uses typed actions instead of model-supplied shell strings, terminal-issued approval receipts, and an Ed25519-signed audit chain.
HOL Guard research desk
Security research for the AI agent era
Threat guides and evidence dossiers on prompt injection, MCP tool poisoning, slopsquatting, and the attacks shaping how teams ship code with agents.
Prompt injection
How hidden instructions trick coding agents into unsafe work.
Read the researchEvergreen guideMCP security
Tool poisoning, overbroad permissions, and shadow MCP servers.
Read the researchNew dossierSlopsquatting and package hallucination
Slopsquatting is the supply-chain attack in which attackers register package names that AI models reliably hallucinate; when an agent writes an import for a package that never existed, the attacker’s registered code installs instead.
Read the researchNew dossierMalicious extensions and marketplace fraud
Malicious extensions and marketplace fraud place trojanized editor extensions, plugins, or CI actions inside trusted marketplaces, harvesting source code, prompts, and credentials from every developer who installs them.
Read the research