Non-determinism is an issue with patching CVEs(flox.dev)

44 points by mathewpregasen 5 months ago | 12 comments

Accessing private GitHub repositories via MCP(invariantlabs.ai)

98 points by gokhan 1 year ago | 25 comments

GitHub MCP exploited: Accessing private repositories via MCP(invariantlabs.ai)

477 points by andy99 1 year ago | 287 comments

Invariant Labs blog post describing a vulnerability in the official GitHub MCP server that lets attackers access private repository data via AI agent prompt injection.

Claude Code Found a Linux Vulnerability Hidden for 23 Years(mtlynch.io)

351 points by eichin 6 months ago | 226 comments

Blog post by Michael Lynch describing how Anthropic researcher Nicholas Carlini used Claude Code to find remotely exploitable Linux kernel bugs, including one hidden for 23 years.

1-Click GitHub Token Stealing via a VSCode Bug(blog.ammaraskar.com)

620 points by ammar2 4 months ago | 95 comments

A blog post describing a VSCode webview bug that lets an attacker steal a GitHub token with repo read/write access, including private repos, via a single click.

CVE-2021-4440: A Linux CNA Case Study(grsecurity.net)

64 points by __bjoernd 2 years ago | 6 comments