Tootfinder

Plugin4Shell: #ZeroClick RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected
#Plugin4Shell is a zero-click, high-severity #RCE affecting all four major

Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected
Plugin4Shell is a zero-click, high-severity RCE affecting all four major AI coding agents - Claude Code, Codex, Copilot, and Gemini. In this first-of-its-kind AI supply-chain attack, a trusted plugin is silently swapped for a malicious one and auto-installed past the agent's SHA pinning - a flaw no marketplace can fix, so users must update their agent.

RE: #RCE in #Log4J is nowhere near as easily exploited as the original. It has a lot of preconditions. Sonatype has a good writeup: https://www.sonatype.com/blog/a-reported-log4j-rce-is-more-complicated-than-it-looks

The real credit goes to Rabbi Moshe A. Friedman. By Jürgen Klute.
#EJA #RCE #belgium #antwerp #friedman #brusselstimes @… @…