🧰 Kestra

The items that name it 5

• [tl;dr sec] #345 - Bug Rumors → Exploits, Version Control DFIR, Agentic Worms
  articleas affected products2026-09-10
• When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog
  articleas affected products2026-08-26

  Workflow orchestration environment; compromised via CVE-2026-49869 authentication bypass leading to worker-side shell execution

• How AI orchestration platforms ship RCE by design | Ebook/Report | Endor Labs
  paperas affected products2026-08-26
• Hacking your life with AI can get you hacked | Blog | Endor Labs
  writeupas affected products2026-08-18

  Unauthenticated webhook triggers execute workflows outside the 'trusted users can create workflows' permission gate; {{ trigger.body.command }} rendered by Pebble and concatenated by ScriptService into /bin/sh -c, enabling RCE via a single curl with no auth. Closed as working-as-designed; no patch,

• CISA Adds Seven Known Exploited Vulnerabilities to Catalog | CISA
  advisoryas classification.technologies

In every workspace you can read 7