One Extra Dot in a Filename Lets Copilot Run Commands in VS
A trailing period slips past Copilot's protected-file check in Visual Studio and SSMS, enabling remote code execution. Microsoft fixed CVE-2026-103572 in its October patch.
Security flaws News and Analysis
9 verified stories covering Security flaws, product updates and industry developments.
Anthropic launches free OSS scanner, skips human review
Anthropic launched a free vulnerability scanner for open source projects on October 8. Reports go straight from its models to maintainers, with no human review or triage step in between.
Microsoft: Flaws Weaponized in Under a Day
Microsoft's 2026 Digital Defense Report finds attackers now weaponize flaws in under 24 hours, while patching still takes 30 to 60 days.
Meta patches Muse Mac flaw, removes hidden setting
A hidden, undocumented Muse for Mac setting let any local program hijack voice data and device access; Meta patched it but skipped filing a CVE.
AI patch benchmark recalculated: 26% becomes 86%
Trail of Bits reruns the scoring on 1Password's AI patch benchmark and gets an 86% success rate instead of 26%, pointing to flawed scoring rather than the models.
One-Tap Android Root Can Forge C2PA Camera Signatures
A one-tap Android root bug lets attackers get Pixel's secure chip to sign forged photos as genuine C2PA captures; Google says it can't be fixed.
Poisoned VS Code extension exposes 3,800 GitHub repos
A TeamPCP supply-chain campaign used Nx Console and related packages to steal developer credentials from GitHub, OpenAI and Mistral environments.
LeRobot flaw exposes robot servers to unauthenticated RCE
CVE-2026-25874 lets anyone who can reach a Hugging Face LeRobot PolicyServer execute code through unsafe pickle deserialization.
MCP Protocol Exposes 11 CVEs; Anthropic Calls It Expected Behavior
A supply chain security report reveals 11 CVEs tied to a design-level flaw in Anthropic's MCP STDIO transport, affecting over 150 million downloads and 200,000 servers. Anthropic declined to fix it, calling the behavior "expected."