Spring4Shell: The RCE That Wasn’t Log4Shell (but Still Bit Hard)
A JDK 9 property path reopened a 2010-era bug class in Spring’s data binder — and gave every Tomcat admin a very bad 48 hours.
AutoJack: Hijacking AI Agents for Remote Code Execution
AutoJack turns an AI agent’s web browsing into host code execution: page JavaScript pivots through an unauthenticated localhost MCP route in AutoGen Studio dev builds. Under 2 seconds, no credentials. Defenses inside.