vibehacker
News

More news

View all

Bifrost CVE-2026-90898: unauth MCP client registration is RCE

JFrog found that Bifrost HTTP transport before 2.1.0 accepts an unauthenticated POST to /api/mcp/client and immediately starts the given stdio command as the gateway user when management auth is off (the default). Patch is transports/v2.1.0; rotate provider keys if the management API was exposed…

The Hacker News

Meta patches Muse macOS zero-day that let local attackers steer the agent

Meta hotfixed its Muse macOS app after researcher Patrick Wardle showed a local zero day that redirected cloud transcription to an attacker endpoint and let Muse take photos and write files without alerts. Meta says practical risk was low because the exploit needed malware already running under the user’s account…

The Verge

OpenAI ships GPT-6 Sol and Luna at half the 5.6 API price

OpenAI expanded GPT 6 with Sol (coding/complex work) and Luna (high volume clerical tasks), cutting API cost 50% vs the 5.6 Sol/Luna line via caching and inference gains. Sol is live in ChatGPT Work, Codex, and the API; Luna also rolls to Free and Go, with broader ChatGPT rollout through the day…

TechCrunch

Spotted something we missed? Start a thread.