A house newsletter · daily · researched and written by the Kurzia AI
Monday 2 November 2026 · Issue 2 · 5 min read
prefab-ui MCP sandbox RCE; AI-built Linux root exploit; Cursor and GitLab follow-ups
Act on this first
prefab-ui — JFrog disclosed a critical hole in prefab-ui's Generative UI sandbox, the component FastMCP's GenerativeUI provider uses to run model-written Python. The sandbox starts a Deno subprocess with unrestricted file and network permissions, and Pyodide's js bridge lets the sandboxed Python call Deno's file functions on the host — anyone who can call the generate_prefab_ui tool can read and write files as the server's user. Everything from 0.14.0 up to (but not including) 0.21.0 is affected; the flaw scores CVSS 10.0 unauthenticated and 9.9 with an authenticated tool caller. No attacks are reported.
If a FastMCP server you run has Generative UI registered where untrusted clients can reach it, upgrade to prefab-ui 0.21.0, which revokes Deno read, write and network permission before accepting code; until then, do not register GenerativeUI on a reachable server. JFrog's proof of concept planted a .pth file in the server virtualenv's site-packages that ran with the next Python process using that environment. JFrog Security Research
Affected: >= 0.14.0, < 0.21.0 · Fixed in: 0.21.0 · Disclosed 1 Nov · We had it 1 Nov, 18:54 UTC
Under attack
WordPress Core — Unauthenticated RCE by racing the updater; attackers probing staged paths (18,500+ requests, no confirmed breaches, per Wordfence); fix: update to 7.1.4; no CVE yet.
Holes in AI tools
Claude Code extension for Cursor — Three clarifications landed on the trojanized-extension story. But Microsoft and Phorion analysed tampered builds of both 2.1.312 and 2.1.313, while Cursor's own notice names only 2.1.313 — the sources disagree on which versions were poisoned.
Treat machines that auto-updated the extension on Cursor that day as exposed even if they show 2.1.312, and remember uninstalling is not cleanup: the payload drops standalone persistence. Follow Cursor's remediation script, then rotate credentials reachable from those hosts. Microsoft published Defender detections and hunting queries; the loader beacons host details to 134.209.82.225 over HTTP on port 8099. Cursor
MCP tool annotations — A clarification filed on the Model Context Protocol GitHub repository exposes a real client-side hazard. The spec says clients must treat a server's tool annotations — read-only, destructive — as untrusted, but never says what a client that forces a tool call, or shows the model only a subset of tools, should do. In the filer's tests across four hosted models, forced tool choice called a write tool in 460 of 816 trials when the needed read wasn't offered; restricting forced calls to authorised tool classes brought that to zero.
Most servers give you nothing to trust anyway: four of nine public servers tested annotate no tool, and only 17 of 38 readable registry servers in a sample use the hints anywhere. If your MCP client forces tool choice over untrusted servers, assume every tool is destructive. Filed as a spec clarification, not a vulnerability, with no spec change yet; the proposed note says a missing or untrusted hint should remove a tool from a forced set, never add one. modelcontextprotocol (GitHub issue)
Found or caused by AI
Anthropic's Claude vulnerability research — Anthropic says an unreleased internal research model found and weaponised flaws in software most readers run, all under coordinated disclosure. Claude chained a V8 bug, a sandbox escape, a CacheStorage race and a FedCM use-after-free into one-click code execution in Chrome — 62 CVEs, all critical or high, patched as of Chrome 156. It also bypassed Safari's same-origin policy, beat the Android lock screen on a Pixel 9, and found a remote Windows QUIC crash now fixed as CVE-2026-33096. Multi-step weaponised chains in Chrome, Safari, Android and Windows used to be the craft of a handful of specialist teams; a model now does it from a prompt and proves it with a running exploit. Treat every patch window in widely deployed software as shrinking. In the Linux chain the model needed 48 minutes to leak a kernel pointer and five more to reach a root shell.
CVE-2026-98432 — A use-after-free in the Linux kernel's IPv4 TCP handshake code, present since kernel 4.4, is remotely triggerable without authentication. Red Hat rates it a complex denial-of-service (5.9), but an unreleased Claude model built a working exploit that defeated kernel address randomisation and ran commands as root on a server with a Multipath TCP listener — about 53 minutes end to end. The upstream fix is backported and Debian has shipped patched kernels; Ubuntu's and Red Hat's trackers still listed their kernels as vulnerable with fixes pending. No exploitation is reported. The trap for ops teams: since Go 1.24, Go programs enable MPTCP by default for listeners on Linux, so Go network services can carry an MPTCP listener nobody chose. A patched kernel plus reboot is the only complete fix; setting GODEBUG=multipathtcp=0 only narrows exposure, because ordinary TCP traffic can still trigger the bug. AWS says Lambda is unaffected and has patched Amazon Linux kernels; Debian's fixed packages are 6.1.190-1 and 6.12.113-1.
Affected: Linux kernels back to 4.4 · We had it 1 Nov, 18:54 UTC
GLM 5.3 patch-gap research — Epoch AI showed that GLM 5.3, an open-weight model from Z.ai, could compromise Firefox builds released in the gap between Mozilla publishing a security fix and users receiving it: one crafted webpage read a local file from the visitor's machine with no further interaction. The last bug it used is patched in Firefox 159.0. The price is the point — about $1,000 per compromised Firefox version at API rates, with no provider refusals triggered. Your rollout lag in browsers and servers is now an attacker's budget line, not a theory. The same effort burned roughly $100,000 against Chrome without success.
Chainalysis breach — Chainalysis disclosed that an external actor using what it calls offensive agentic techniques — autonomous, multi-step AI attack agents — reached its internal systems and tools, accessing customer names, email addresses, user IDs and role labels. The company says it found no evidence that investigation content, credentials or session tokens were touched. Which framework, agents or vulnerabilities were involved is unconfirmed — the company has not said whether it was a tool like ARTEX or something custom. Chainalysis says it is using LLMs to help run its own security review.
Microsoft Threat Intelligence — Microsoft published concrete evidence that state-backed actors run AI across whole attack workflows: it attributed over 100 target-specific PDF lures to one actor, created dozens at a time within minutes, and says two actors are using ARTEX, an open-source agentic penetration-testing framework, in live operations. Agent-driven attack tooling is no longer a research preview. Microsoft still assesses these operations as human-directed rather than autonomous, but lure generation and tooling speed now scale in ways small teams should assume when reviewing inbound recruiting and repository contact. Microsoft maps the actors across four adoption stages, from experimental to fully operationalised.
Patches worth knowing
GitLab CE/EE — Unauthenticated code execution via a crafted CI regex (CVSS 10, KEV-listed); new this round: an attack on Alpine Linux's instance failed but prompted a full rebuild; fixed in 19.4.2, 19.3.5 and 19.2.8; CVE-2026-97229.
One thing to do
Check the Ruby inside your GitLab image. The CVE-2026-97229 flaw lives in Ruby's Onigmo regex engine, not GitLab's code, so a GitLab upgrade alone does not fix installs that ship their own Ruby — as Alpine Linux discovered when its patched instance was still reachable. If your self-managed GitLab uses a custom container image or source-built Ruby, verify you run Ruby 3.3.13, 3.4.12 or 4.0.9 or later; GitLab's own packages are covered by the update. SecurityWeek