AWS Systems Manager Agent Flaw Allows Bypass of Port Forwarding Restrictions
Amazon has patched a vulnerability in the AWS Systems Manager agent that allows an authenticated attacker to bypass port forwarding restrictions. The flaw, identified as CVE-2026-89049, was disclosed in a GitHub advisory and affects the agent's handling of blocked addresses.
The agent maintains a blocklist of link-local addresses to prevent forwarding sessions from reaching internal instance services. However, the protection fails to validate equivalent representations of the same address, enabling an attacker to reach the EC2 instance metadata service at 169.254.169.254 by using an alternative notation.
Once access is gained, the attacker can retrieve temporary credentials associated with the instance's IAM role. These credentials can then be used to make API calls to AWS from outside the compromised machine, with permissions defined by the assigned role.
Versions of the agent prior to 3.3.4851.0 are affected. The fix is included in version 3.3.4851.0 and all later releases. AWS advises reviewing any custom builds derived from the agent and restricting access to the AWS-StartPortForwardingSessionToRemoteHost document used to initiate forwarding sessions.
Additional recommendations include auditing Session Manager activity for signs of misuse and reviewing IAM roles attached to instances to enforce the principle of least privilege.
Related articles
GitSpawn Exposes Persistent Git Config Execution Risks in Coding Agents
Manifold Security released GitSpawn, detailing eight vulnerabilities across seven coding agents where opening a folder triggers arbitrary code execution via Git configuration before any user prompt. The core issue stems from the core.fsmonitor setting in .git/config, which Git executes during index updates like git status or git diff. While vendors including Anthropic patched Claude Code in version 2.1.196, the fix only blocks agent-initiated calls and leaves manual Git commands or other tools vulnerable. Additional vectors include nested bare repositories tracked under CVE-2026-45033 affecting GitHub Copilot CLI and unpatched agents such as Qwen Code and Grok Build. The researcher also released the Stroq tool to inspect repositories for dangerous settings like core.fsmonitor and postinstall scripts before opening them. The findings highlight that repository trust mechanisms from 2021 remain bypassed by modern AI coding tools.
Critical Unauthenticated File Upload Flaw in WooCommerce Wholesale Lead Capture Enables Active PHP Web Shell Attacks
A critical vulnerability tracked as CVE-2026-27540 affects WooCommerce Wholesale Lead Capture versions 2.0.3.1 and earlier, allowing unauthenticated attackers to upload arbitrary files including PHP web shells. The flaw resides in the wwlc_file_upload_handler AJAX action, where the file extension allowlist can be manipulated through the file_settings parameter to accept .php files. Exploitation has been observed in the wild with more than 100,000 blocked attempts since June 2026, including sustained campaigns from repeat IP addresses. The developer released version 2.0.3.2 on 20 February 2026 to address the issue, yet many sites remain unpatched. Organizations are advised to update immediately, audit wp-content/uploads for unexpected PHP files, and monitor admin-ajax.php requests for suspicious activity. In confirmed compromise cases, full remediation requires credential rotation and restoration from verified backups.
Vulnerability Management in Atypical Environments: ICS, Networks, IoT, Mobile, Hardware, and ML Systems
Vulnerability management follows the same core process across environments—identify assets, scan, assess risk, prioritize, remediate, and verify—but each domain introduces critical constraints. In industrial control systems, scanning must avoid disrupting physical processes, requiring audit-mode authenticated scans, digital twins for testing, and strict change windows. Network devices frequently suffer from poor segmentation, default SNMP community strings, and exposed management interfaces that enable traffic redirection or configuration tampering. IoT ecosystems remain plagued by default credentials, as demonstrated by the Mirai botnet that took down major DNS infrastructure in 2016, while modern botnets like Reaper and VPNFilter exploit unpatched firmware at massive scale. Machine learning systems face novel threats including prompt injection, prompt leaking, and jailbreaking that can bypass safety controls or exfiltrate training data. Mobile platforms suffer from extreme fragmentation that prevents timely patching of vulnerabilities such as Stagefright, Pegasus, and BlueBorne. Hardware-level flaws like Spectre, Meltdown, and BadUSB demonstrate that even firmware and silicon require coordinated microcode, OS, and application updates.
Google Issues Chrome 153 Security Update Addressing 42 Vulnerabilities Including Three Critical Flaws
Google has released a major security update for its Chrome browser version 153, fixing a total of 42 vulnerabilities. The update includes three critical-severity issues that could allow attackers to execute arbitrary code or cause memory corruption. Patches are now available for Windows, macOS, and Linux platforms, with versions 153.0.8010.48 and 153.0.8010.47. Among the critical fixes are out-of-bounds read in WebGL, use-after-free in Internals, and another use-after-free in Workers. The release also resolves 28 high-severity flaws affecting the V8 JavaScript engine, ServiceWorker, Skia, DOM, PDF, and other components. Medium and low severity issues were addressed as well, bringing the total to 42 vulnerabilities resolved.