One Fix in a Thousand

Three research groups published attacks this week with one property in common. The malicious instruction is invisible to whoever, or whatever, is reviewing the code. MemGhost, detailed in an arXiv paper titled "When Claws Remember but Do Not Tell," uses a single email to plant a false, persistent memory into an AI agent's memory files. The agent writes the note silently and reloads it every future session.

It worked 87.5% of the time against the OpenClaw framework on GPT-5.4 and 71.4% against the Claude Code SDK on Sonnet 4.6, and an input filter built to catch poisoned emails missed it more than nine times in ten.

The other two attack the code path directly. HalluSquatting, from researchers at Tel Aviv University, Technion, and Intuit, exploits the fact that package-name hallucinations are predictable and transferable across models, so attackers pre-register the names the models invent and wait. It hit an 85% success rate getting agents to reference attacker-controlled repository names.

Ghostcommit, from the University of Missouri-Kansas City's ASSET Research Group, hides prompt injection inside a PNG so an AI code reviewer reads a developer's .env file and exfiltrates the secrets as integer constants in a commit. Cursor and Antigravity leaked credentials under it; Anthropic's Claude Code refused.

CrowdStrike added five new prompt-injection techniques to its taxonomy the same week, and researchers confirmed a suspected AI-generated PowerShell script used in real Active Directory reconnaissance.

Trail of Bits published field reports from Patch the Planet, a collaboration with OpenAI that pairs its engineers with more than 30 open-source projects. In the first report, GPT-5.5-Cyber built in a single day what the team estimates would have taken a skilled security researcher weeks. It stood up fuzzing harnesses across a dozen entry points into zlib, with sanitizer builds, seeds, and multiple findings now in coordinated disclosure. Left to work on its own, the model judged that static review of a heavily-audited library was a poor use of its budget and built dynamic tooling instead.

Trail of Bits runs the program on a blunt premise. Capable models, it says, "will soon create a firehose of bug reports, and OSS maintainers are already spread thin." The same week, tl;dr sec led its issue with autonomous vulnerability hunting as the arriving norm.

The week's quieter story is that networks kept getting breached the ordinary way. watchTowr Labs shipped two pre-authentication teardowns of enterprise edge gear.

Progress Kemp LoadMaster, a load balancer that sits at the perimeter of many enterprise networks, carries CVE-2026-8037, an uninitialized-heap flaw that becomes unauthenticated remote code execution for anyone who can reach the API. The root cause is a single mishandled escape_quotes() routine. Separately, Citrix NetScaler drew CVE-2026-8451, a pre-auth memory overread in the same CitrixBleed class that has now been reappearing for two years.

Neither of these needed a language model to go wrong. They are the plain, well-understood failure mode, a reachable service at the network edge with a memory-handling bug, and they are still the way most intrusions actually start. The industry's attention budget is finite, and a week this heavy on novel AI attacks is exactly when the boring pre-auth RCE gets under-patched.

CVE-2026-48939, iCagenda (Joomla) arbitrary file upload to RCE

The attachment feature allows arbitrary file upload leading to PHP code execution. Exploited as a zero-day since June 15 in automated attacks against Joomla sites; CISA added it to the KEV catalog with a July 13 federal deadline. Fixed in iCagenda 4.0.8 and 3.9.15. CVSS 10.0 (Critical); actively exploited in the wild. Source

CVE-2026-56291, Balbooa Forms (Joomla) arbitrary file upload to RCE

A file-upload flaw leading to remote code execution in Balbooa Forms up to and including 2.4.0, added to CISA KEV alongside iCagenda after zero-day exploitation. Fixed in 2.4.1. CVSS 10.0 (Critical); actively exploited in the wild. Source

CVE-2026-8037, Progress Kemp LoadMaster pre-auth RCE

An uninitialized-heap bug in the escape_quotes() routine becomes unauthenticated remote code execution via heap-sprayed command injection, reachable by anyone who can hit the API. Affects GA v7.2.63.1 and older when the API is enabled. Critical; pre-authentication RCE. Source

CVE-2026-8451, Citrix NetScaler pre-auth memory overread (CitrixBleed class)

A pre-authentication memory overread in the recurring CitrixBleed vulnerability class, torn down by watchTowr this week. Memory disclosure; pre-authentication. Source

CVE-2026-20896, Gitea Docker image authentication bypass

The official Docker image trusts the X-WEBAUTH-USER header from any source IP, letting an unauthenticated client impersonate any known user. Affects versions up to 1.26.2; patched in 1.26.3 and 1.26.4. Exploited in the wild within two weeks of disclosure. CVSS 9.8 (Critical); actively exploited in the wild. Source

Progress ShareFile Storage Zone Controllers, suspected unauthenticated RCE

Progress ordered customers to manually power down on-prem Storage Zone Controllers over a "credible external security threat," with no patch, CVE, or workaround announced. The internet-facing Windows component and the emergency framing point to a remotely exploitable flaw. No CVE assigned; emergency shutdown ordered, exploitation suspected. Source

Zimbra Classic Web Client stored XSS to session code execution

A stored XSS in the Classic Web Client lets a specially crafted email run malicious script in the victim's session when the message is opened, exposing mailbox data, session data, and account settings. No CVE assigned; fixed in 10.1.19. Stored XSS to session code execution; patch available. Source

jscrambler 8.14.0 npm package compromise

A compromised release of the jscrambler npm package deployed a Rust-based infostealer during installation, poisoning the supply chain of a security-focused tool. Supply-chain compromise; malicious package release. Source