A vulnerability (CVE-2026-113725) was discovered in the virtualenv package on the PyPI repository. The vulnerability was patched by Root, a package manager, and multiple fixed versions are now available. This update is relevant to developers and system administrators who use virtualenv, as it ensures the package is secure against potential exploits.

A vulnerability (CVE-2026-113718) was discovered in the virtualenv package, allowing an attacker to inject arbitrary code in Python applications using virtual environments. The vulnerability was patched by Root, and multiple fixed versions of virtualenv are available. This patch is relevant to developers and operators of AI agents that rely on Python and virtual environments, as it prevents potential code injection attacks that could compromise AI system security and integrity.

A vulnerability (CVE-2026-113722) has been patched in the virtualenv package on the Root:PyPI repository. The issue affected virtualenv, a tool for creating isolated Python environments. The vulnerability was addressed through a software update, with multiple fixed versions available. This patch ensures the security and integrity of virtual environments used in development and deployment of AI and data science applications.

A vulnerability, identified as CVE-2026-85008, has been patched in the undici package by Root. The undici package, a Node.js HTTP/2 implementation, was found to be vulnerable to a security issue. The Root team has released multiple patched versions to address this vulnerability, which users should update to ensure the security and stability of their systems. This patch is relevant to developers and operators of Node.js applications that utilize the undici package.

A vulnerability (CVE-2026-84961) was discovered in the undici package for Root:npm. The issue has been patched by Root, and multiple fixed versions are now available. The patch addresses a security concern that may impact users of the undici package, which is used for creating HTTP/2 and HTTP/3 clients.

A vulnerability (CVE-2026-83608) in the @xmldom/xmldom package was patched by Root. This affects users who rely on the package, which is used for parsing and manipulating XML documents in Node.js applications. The vulnerability has been fixed in multiple versions of the package, indicating that users should update to a patched version to prevent potential security risks.

A vulnerability (CVE-2026-44492) was discovered in the axios package for the Root:npm ecosystem. The issue has been patched by Root. The vulnerability affects users who depend on axios in their applications. To mitigate the risk, users should update their dependencies to a fixed version of axios, as multiple patched versions are now available.

A vulnerability was discovered in the `fast-agent serve` command. By default, it binds to all network interfaces on port 8000 without authentication, allowing any host with network access to control the agent. When the `--shell` flag is used, an unauthenticated remote client can execute arbitrary OS commands, resulting in unauthenticated remote code execution (RCE). This is due to the agent's default configuration in `cli/commands/serve.py`, `mcp/server/agentserver.py`, and `tools/localshellexecutor.py`. This vulnerability affects versions up to 0.7.20, including the Docker Python 3.13-slim image.

A security vulnerability has been discovered in the ezBookkeeping software, specifically in its use of the Gin framework. The vulnerability allows an attacker to bypass the source-IP allowlist by sending a spoofed `X-Forwarded-For` header, which is trusted by Gin due to a lack of explicit proxy configuration. This allows the attacker to access the system and forge attribution by setting the client IP address to the attacker-supplied header value. The impact is that an attacker can bypass security controls and remain anonymous, making it difficult to track and audit activities.

A vulnerability was discovered in the Shadow plugin for Gradle, a tool for creating shadow JARs. The issue arises from the plugin's reliance on Gradle's ZipFileTree for entry sanitization, which does not validate or sanitize ZIP entry names. This allows malicious upstream dependencies to include path traversal sequences, enabling an attacker to inject malicious entries into the output JAR. The vulnerability affects Gradle versions 7.6.2 and 8.x up to 8.2.0, making users directly exploitable. The issue also compromises downstream consumers who use unprotected extraction or older CI tooling, potentially allowing arbitrary file overwrites.

A vulnerability (GHSA-pxh4-856f-4h89) in the PyJWT package has been patched by Root. This vulnerability allowed for arbitrary code execution through crafted JWT payloads. The patch provides multiple fixed versions of the package.

A PyPI package named extrahtml has been compromised with malicious code. The code, embedded in a YAML loader, executes remote code from a provided file. The attackers intentionally included the malicious code in the package, which is then downloaded and executed, potentially leading to infostealer malware. This vulnerability affects organizations that rely on the extrahtml package, and developers should update to a secure version to prevent exploitation.

A vulnerability (OSV:MAL-2026-18772) was discovered in the PyPI package parseyaml, where malicious code is embedded in a dependency that pretends to be a YAML loader. This code executes remote code by downloading and running a malicious script from a provided file. The campaign has malicious intent, similar to infostealers. This vulnerability matters to people building or operating AI agents because it highlights the need for secure dependency management and code review, as an attacker can exploit this vulnerability to inject malicious code into their systems through a seemingly innocuous dependency.

A new malicious code item has been identified as MAL-2026-18770 in the bundyfed package on PyPI. This vulnerability allows an attacker to download and execute a malicious executable that contains an infostealer during package installation. The malicious code overrides the install command in setup.py, indicating a malicious intent to steal sensitive information. This matters to people building and operating AI agents as it highlights the importance of verifying the integrity and trustworthiness of dependencies and packages used in development and deployment.

A malicious RubyGem was discovered to contain a native extension script that executes during installation, collecting sensitive host data without user consent. The script gathers details such as the current working directory, hostname, login name, and files from /etc/resolv.conf, /etc/passwd, and /etc/hosts. The collected data is then transmitted to a hardcoded server via HTTPS, with a DNS lookup also being performed to an attacker-controlled domain. This malicious activity is unrelated to the declared publisher or build dependencies, indicating a potential security risk for users installing the affected RubyGem.

A RubyGem named dynamic-object-handler has been identified as containing malicious code. The gem, when installed, automatically executes a script that collects sensitive information from the system, including the current working directory, home directory, hostname, login name, and contents of certain system files. This information is then transmitted to a hardcoded Burp Collaborator subdomain, indicating unauthorized code execution on the system. The discovery highlights the importance of scrutinizing dependencies and verifying their integrity to prevent potential security breaches.

A malicious code vulnerability, identified as MAL-2026-18765, has been found in the donjon-ledger RubyGem. The issue arises from the gemspec declaring ext/mkrfconf.rb as a native extension, which executes automatically during installation. This allows the malicious code to collect host identifiers and sensitive system data, including the hostname, username, and contents of /etc/passwd, /etc/hosts, and /etc/resolv.conf. The code then sends this data to a hardcoded Burp Collaborator subdomain via a TLS connection, performing a DNS lookup to the same subdomain. This vulnerability presents a risk to users who install the affected gem, potentially allowing unauthorized data exfiltration.

A Python package named blender-headless on PyPI contains malicious code that leaks an installer's hostname and install/import event via DNS queries. The package's setup.py and gcplogpoc/init.py modules construct a DNS label with the installer's hostname and import event, and send it to a domain controlled by the attacker. This allows the attacker to bypass typical HTTP egress controls and potentially monitor or exploit the installation. The package has no legitimate functionality and appears to be a beacon for malicious activity.

A malicious package named infra-libs has been discovered on PyPI, a package repository. The package performs DNS exfiltration during installation, sending the installer's hostname to an unauthorized domain testa213022.dssldrf.net. This behavior is not justified by the package's declared functionality and is likely a dependency-confusion attack vector. Development teams should be cautious when using this package and consider replacing it with a trusted alternative.

A vulnerability (MAL-2026-18760) was discovered in the "expect-tests" package on the Python Package Index (PyPI). The issue is caused by the package's setup.py and gcplogpoc/init.py files reading the installer's hostname and encoding it into a subdomain of a suspicious domain, testa213022.dssldrf.net, which triggers DNS resolution and exfiltrates the hostname to a non-first-party DNS server. This occurs during installation and module import, potentially compromising the installer's hostname. The package's behavior is undisclosed, and its name and version (99.99.99) are inconsistent with its imported module name gcplogpoc, indicating a potential dependency-confusion or name-squatting attack.