[wiz]

September 11, 2026

• Wiz scanned ~3,000 internet-facing LiteLLM gateways and found 9.6% accepted the documented example master key sk-1234 or required no auth at all — which turns a post-auth root RCE via custom code guardrails (CVE-2026-59821) into an effectively pre-auth one. An MCP endpoint auth bypass (CVE-2026-59822) lets any Bearer token mint a valid session, was confirmed exploitable on hundreds of instances, was added to CISA KEV on 2 September, and Wiz saw it exploited in the wild on its honeypots. A pass-through endpoint with no URL validation enables cloud credential theft and was not assigned a CVE or fixed. Patches exist for the rest; the work was presented at DEF CON 34 (Wiz, The Hacker News). · AI Infrastructure & Agent Security

in Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign

July 1, 2026

• Microsoft IR research shows how a single poisoned MCP tool description can steer an agent into quietly exfiltrating company data without ever "breaking a rule" — every step looks routine, so default setups raise no alarm. Separately, Wiz detailed an Amazon Q VS Code extension flaw that auto-loaded workspace MCP configs without consent, enabling code execution and cloud-credential theft on opening a malicious repo (fixed in language server 1.65.0). The Hacker News, Wiz · AI & Model Security

in CitrixBleed Returns: watchTowr Discloses a New NetScaler Pre-Auth Memory Overread