Blog
Insights, updates, and deep dives on AI agents, decentralized standards, and the future of HOL.
eMudhra CA keys leaked: forged HTTPS certs still pass in old Go, Python, Node.js and Java (CVE-2026-111943)
How to fix CVE-2026-111943: upgrade Go to 1.27.3 or 1.26.10 and rebuild, then update certifi to 2026.10.19, Node.js to 22.23.4, 24.22.1 or 26.12.1, and your ca-certificates. Eight eMudhra intermediate CA keys can be recovered from the public certificates, so non-browser clients will accept forged HTTPS for any site.
BREAKING: LiteLLM 1.107.0 on PyPI and Docker latest shipped a credential stealer. Pin 1.106.2 and rotate your AI keys
How to fix the LiteLLM 1.107.0 compromise: pin litellm to 1.106.2, rebuild from a clean image, and rotate every key the host could read. All 1.107.0 wheels on PyPI and the Docker latest, main-latest and main-stable tags shipped a credential stealer that also dumps the proxy's stored provider keys.
HOL Guard
BREAKING: PHP2Shell lets attackers run code on PHP web servers with no login. Update PHP now (CVE-2026-109618, CVE-2026-109619)
How to fix CVE-2026-109618: upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart Apache and PHP-FPM. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers run code on PHP web servers with no login. PHP 8.1 and older get no upstream fix.
HOL Guard
BREAKING: Plex Media Server hijacked without a login to mine crypto and run proxies, now on CISA KEV (Plex2Shell, CVE-2026-96652)
How to fix CVE-2026-96652: upgrade Plex Media Server to 1.43.3.10861 or later. The Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) is exploited to install crypto miners and proxies, on CISA KEV Oct 20. Updating does not remove an infection.
HOL Guard
Your AI Agent Writes Code. Who's Auditing Its Commits?
A maintainer's guide to conventional-commits-framework — what it does, who it helps, and how to get started.
What I Check Before I Install a Claude Plugin on a Client's Computer
What I Check Before I Install a Claude Plugin on a Client's Computer
A Claude consultant's pre-install checklist for small businesses: who made it, what it tells Claude to do, what it runs, what it touches, what Claude finds when it reviews it, where it gets tested, and who keeps track.
A declaration buys fewer stages, never fewer boundaries
The ai-native-sdlc plugin packages six stages as committed Markdown artifacts and uses an opt-in PreToolUse gate to block uncovered source-code writes.
Letting an agent run Home Assistant, one approval at a time
Letting an agent run Home Assistant, one approval at a time
Home Assistant MCP (Vome) is now listed in HOL Guard. The source lists 57 tool entries across 11 risk classes: 56 marked for review and one `other` entry set to inherit its state.
VibesPlug's README lists 155 agents and supported coding tools
VibesPlug's README lists 155 agents and supported coding tools
The project README lists 155 specialized subagents, supported coding tools, npm setup commands and a standalone MCP server.
Your agent should never be handed a shell
Your agent should never be handed a shell
GuardFall reported exploitable agent-to-shell boundaries in 10 of 11 surveyed open-source AI coding agents under its tested configurations. SysKnife uses typed actions instead of model-supplied shell strings, terminal-issued approval receipts, and an Ed25519-signed audit chain.
Why I built jevmem, and what it guards against
Why I built jevmem, a project memory plugin for Claude Code, and the three things it guards against, with numbers from my own tests.
BREAKING: BeyondTrust Remote Support zero-day lets attackers plant a web shell without logging in, now on CISA KEV (CVE-2026-102764)
How to fix CVE-2026-102764: upgrade BeyondTrust Remote Support to 24.3.1 or later and apply the BT26-05-RS patch from /appliance. Exploited as a zero-day since August, on CISA KEV Oct 16. Patching does not evict an attacker already inside.
HOL Guard
BREAKING: Exploited Atlassian bug lets strangers read files off Jira, Confluence and Bitbucket Data Center, now on CISA KEV (CVE-2026-21589)
How to fix CVE-2026-21589: upgrade Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center to Atlassian's Oct 5 fixed releases (Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19, Bitbucket 9.4.26/10.2.8/10.5.1). Unauthenticated file read, on CISA KEV since Oct 15.
HOL GuardHOL Guard research desk
Security research for the AI agent era
Threat guides and evidence dossiers on prompt injection, MCP tool poisoning, slopsquatting, and the attacks shaping how teams ship code with agents.
Prompt injection
How hidden instructions trick coding agents into unsafe work.
Read the researchEvergreen guideMCP security
Tool poisoning, overbroad permissions, and shadow MCP servers.
Read the researchNew dossierSlopsquatting and package hallucination
Slopsquatting is the supply-chain attack in which attackers register package names that AI models reliably hallucinate; when an agent writes an import for a package that never existed, the attacker’s registered code installs instead.
Read the researchNew dossierMalicious extensions and marketplace fraud
Malicious extensions and marketplace fraud place trojanized editor extensions, plugins, or CI actions inside trusted marketplaces, harvesting source code, prompts, and credentials from every developer who installs them.
Read the research