CVE-2026-89332

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the...

EUVD-2026-76443

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the...

CVE-2026-89332

Amazon Kiro IDE (before version 0.8.135 ) is vulnerable to sensitive workspace data exfiltration through its Kiro Powers feature. Crafted repository content can cause the AI agent to modify the workspace settings file, redirecting the Kiro Powers registry request to an actor-controlled endpoint. ...

CVE-2026-89332 Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the...

CVE-2026-89332 Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the...

PT-2026-90052

Kiro IDE - Agent-Written Config - Data Exfiltration Attack Path - 1. Open a specially crafted untrusted repository in Kiro IDE. 2. The AI agent modifies the workspace configuration to point the Powers registry at an attacker-controlled endpoint. 3. Kiro asks the user to approve the change, but th...

Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers

Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence AI-powered, agentic integrated development environment IDE, that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE...

Investigation of STEEP for Secure Communications over SIMO and MISO Channels Subject to Full-Duplex Jamming and Eavesdropping

Secure communications over SIMO and MISO channels between wireless nodes are commonly encountered in applications and widely considered in the literature. This paper investigates such a problem by considering a newly proposed scheme called secrecy-message transmission by echoing encrypted probes...

Great responsibility, without great power

Welcome to this week's edition of the Threat Source newsletter. As I'm writing this, today April 28 is International Superhero Day. If you don't know the origin story behind this, perhaps you would assume that this day was dreamed up by Marvel. And… you would be correct. However, it's not a pure...

Warnings Mount in Congress Over Expanded US Wiretap Powers

Experts tell US lawmakers that a crucial spy program’s safeguards are failing, allowing intel agencies deeper, unconstrained access to Americans’ data...

U.K. Arrests Two Teen Scattered Spider Hackers Linked to August 2024 TfL Cyber Attack

Law enforcement authorities in the U.K. have arrested two teen members of the Scattered Spider hacking group in connection with their alleged participation in an August 2024 cyber attack targeting Transport for London TfL, the city's public transportation agency. Thalha Jubair aka EarthtoStar,...

U.K. Government Drops Apple Encryption Backdoor Order After U.S. Civil Liberties Pushback

The U.K. government has apparently abandoned its plans to force Apple to weaken encryption protections and include a backdoor that would have enabled access to the protected data of U.S. citizens. U.S. Director of National Intelligence DNI Tulsi Gabbard, in a statement posted on X, said the U.S...

Symbolic Generation and Modular Embedding of High-Quality Abc-Triples

We present a symbolic identity for generating integer triples $a, b, c$ satisfying $a + b = c$, inspired by structural features of the \emphabc conjecture. The construction uses powers of $2$ and $3$ in combination with modular inversion in $\mathbbZ/3^p\mathbbZ$, leading to a parametric identity...

Congress Again Fails to Limit Scope of Spy Powers in New Defense Bill

The National Defense Authorization Act passed today, but lawmakers stripped language that would keep the Trump administration from wielding unprecedented authority to surveil Americans...

On November 13, NIST NVD finally admitted the obvious: they had failed to process the CVE analysis backlog before the end of the fiscal year (September 30)

On November 13, NIST NVD finallyadmittedthe obvious: they had failed to process the CVE analysis backlog before the end of the fiscal year September 30. This is actually visible in their own statistics. At the moment, there are 19860 identifiers in the backlog. This week, 1136 new CVEs were...

The Next US President Will Have Troubling New Surveillance Powers

Over the weekend, President Joe Biden signed legislation not only reauthorizing a major FISA spy program but expanding it in ways that could have major implications for privacy rights in the US...

Researchers Uncover Windows Flaws Granting Hackers Rootkit-Like Powers

New research has found that the DOS-to-NT path conversion process could be exploited by threat actors to achieve rootkit-like capabilities to conceal and impersonate files, directories, and processes. "When a user executes a function that has a path argument in Windows, the DOS path at which the...

CVE-2024-30545

Cross-Site Request Forgery CSRF vulnerability in Nick Powers Social Author Bio allows Stored XSS.This issue affects Social Author Bio: from n/a through 2.4...

CVE-2024-30545

Technical details about CVE-2024-30545 are not provided in the connected documents; public information in the initial description indicates a CSRF-enabled Stored XSS vulnerability in Social Author Bio up to version 2.4. Monitor for authoritative fixes and advisories.

PT-2024-23475 · Unknown · Nick Powers Social Author Bio

Name of the Vulnerable Software and Affected Versions: Nick Powers Social Author Bio versions n/a through 2.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Nick Powers Social Author Bio. Recommendations: For versions n/a through 2.4, update to...