Plugin4Shell – Zero Click RCE Vulnerability found in top four coding agents
fishthethis
11 points
2 comments
September 17, 2026
Related Discussions
Found 5 related stories in 128.3ms across 11,510 title embeddings via pgvector HNSW
- PHP2Shell: AI uncovers critical RCE in PHP danlark1 · 440 pts · October 21, 2026 · 65% similar
- PHP2Shell: Exploitation attempts and remediation trends acossta · 185 pts · October 27, 2026 · 60% similar
- Sandbox Escape Vulnerabilities Across 4 Coding Agent Vendors fogeltine · 11 pts · July 20, 2026 · 60% similar
- Pre-Authentication RCE in WordPress Core patrikg · 18 pts · July 17, 2026 · 59% similar
- Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure cubefox · 262 pts · October 22, 2026 · 58% similar
Discussion Highlights (2 comments)
devmor
This article is either AI-authored slop, or handwritten by people too mired in slop to write normal prose anymore. It’s painful to read, regardless of the topic’s impact.
SahAssar
This sounds very AI written and buries the lede, but my understanding is if you control the repo in a way that you can set the default branch state for a git repo and get a victim to install a plugin with the same git sha as that branch state you can RCE them? Pretty bad for a package manager, but this seems like something I would unfortunately expect from a harness/agent.