AI and Tech Summaries - AI Weekly Malaysia

Summaries

Short AI and tech summaries with source links, signal scores, and why each update matters for builders, founders, and Malaysian tech workers.

Window

Today Yesterday This week Last week This month Last month All time

Showing 1-1 of 1 results

Date	Provider	Score	Summary
03 Sep 2026, 1:19 PM	The Hacker News	5.5	CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners CISA added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including a CVSS 10.0 SSRF and a 7.8 OS command injection in SonicWall SMA 1000, a 9.8 improper authentication flaw in JFrog Artifactory allowing unauthenticated admin access under default config, a 6.5 HTTP request smuggling issue in Kludex Starlette, a 10.0 unauthenticated workflow execution flaw in Kestra OSS, and an 8.8 improper authentication bug in Berri LiteLLM's MCP Streamable HTTP endpoint that lets an unauthenticated attacker establish an authenticated MCP session with an arbitrary Bearer token. Why: If you run JFrog Artifactory with default configuration, patch immediately—unauthenticated network access yields admin privileges. If you expose LiteLLM's MCP Streamable HTTP endpoint in an AI agent stack, an attacker can hijack an authenticated MCP session with any Bearer token, which is critical for anyone building MCP-based agent tooling. Starlette users should check whether their auth depends on reconstructed URL paths, as request smuggling can bypass it. security vulnerabilities mcp litellm jfrog-artifactory starlette kestra

Date

Provider

Score

Summary

03 Sep 2026, 1:19 PM

The Hacker News

5.5

CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

CISA added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including a CVSS 10.0 SSRF and a 7.8 OS command injection in SonicWall SMA 1000, a 9.8 improper authentication flaw in JFrog Artifactory allowing unauthenticated admin access under default config, a 6.5 HTTP request smuggling issue in Kludex Starlette, a 10.0 unauthenticated workflow execution flaw in Kestra OSS, and an 8.8 improper authentication bug in Berri LiteLLM's MCP Streamable HTTP endpoint that lets an unauthenticated attacker establish an authenticated MCP session with an arbitrary Bearer token.

Why: If you run JFrog Artifactory with default configuration, patch immediately—unauthenticated network access yields admin privileges. If you expose LiteLLM's MCP Streamable HTTP endpoint in an AI agent stack, an attacker can hijack an authenticated MCP session with any Bearer token, which is critical for anyone building MCP-based agent tooling. Starlette users should check whether their auth depends on reconstructed URL paths, as request smuggling can bypass it.