Workstation protection builds on the AI visibility, governance, and guardrails of the Cycode platform, blocking malicious packages in real time for customers Cycode, the leader in Agentic Developme…

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Cycode is adding workstation-level protection to stop developers and AI coding agents from downloading malicious or insufficiently vetted software packages.

Cycode’s Agentic Development Security Platform unites security and development teams with actionable, code-to-runtime context to identify, prioritize, and fix the software risk that matters.

Cycode’s Agentic Code Scanning routes code review between AI and rule-based engines, with benchmark claims covering six CVEs, authorization flaws and MLflow detection volume.

AIにNASAのソフトウェアを調べさせていたら、宇宙探査機に勝手な命令を送れてしまう可能性のある脆弱性が見つかったとIFLSが伝えました。発見したのは、サイバーセキュリティ企業Cycodeの研究チーム。大量のコードをAIに解析させ、セキュリ

Cycode has launched Agentic Code Scanning, a system that decides which AI or rule-based engine reviews code and at what cost.

Every AI security vendor ships a benchmark chart these days. Most of them don't survive a second phone call. On September 1, Cycode launched Agentic Code Scanning, a fourth layer that sits on top of i...

AIにNASAのソフトウェアを調べさせていたら、宇宙探査機に勝手な命令を送れてしまう可能性のある脆弱性が見つかったとIFLSが伝えました。発見したのは、サイバーセキュリティ企業Cycodeの研究チーム。大量のコードをAIに解析させ、セキュリ…

Agentic Code Scanning in the Cycode platform caught both authorization CVEs in benchmark testing that no rule engine could express. New Attack Chaining capabilities links related findings into the …

A critical flaw (CVSS 9.4) in NASA/JPL’s AIT-GUI let anyone send unauthenticated commands to spacecraft instruments. Cycode researchers found that AIT-GUI, the browser-based operator console in NASA/JPL open-source AMMOS Instrument Toolkit, shipped with no authentication, no session checks, and no CSRF protection on any of its state-changing endpoints. “AIT-GUI, the web front end of NASA/JPL’s […]

AIT-GUI, NASA/JPL open-source operator console, binds to every interface with no login (CVSS 9.4). A browser can send commands, and the 2.5.2 fix adds no auth.

В отворения софтуер на НАСА/JPL за наземни станции е открита критична верига от уязвимости. При определена конфигурация е било възможно външно лице без необходимата оторизация да изпраща команди към свързани устройства и космически апарати, да стартира сценарии и да изпълнява последователности от команди, съобщава The Hacker News. Проблемите са открити от изследователя Ювал Елбар от компанията Cycode в AIT-GUI. AIT е отворен набор от инструменти за създаване на наземни системи, които приемат телеметрия и предават команди към космически апарати, научни уреди и CubeSat спътници. AIT-GUI служи като операторски интерфейс за работа с такива системи.

Uzay araştırmalarının dev ismi NASA, yazılım tarafında yaşanan beklenmedik bir güvenlik ihlali iddiasıyla siber güvenlik dünyasının gündemine oturdu. Uzay araçlarını yönlendirmek ve bilimsel cihazları çalıştırmak için kullanılan özel bir kontrol panelinin, hiçbir şifre veya kimlik doğrulaması olmadan internete açık kaldığı anlaşıldı. Siber güvenlik firması Cycode araştırmacısı Yuval Elbar tarafından fark edilen bu açık, kötü niyetli kişilerin herhangi bir engelle karşılaşmadan sistem üzerinden uzay araçlarına komut göndermesine imkan tanıyordu.

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain, tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on the CVSS v3.1 scoring system, impacts AIT-GUI

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain, tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on the CVSS v3.1 scoring system, impacts AIT-GUI

A critical security flaw in NASA/JPL’s open-source AMMOS Instrument Toolkit GUI (AIT-GUI) could let an unauthenticated attacker send live commands to spacecraft and scientific instruments, run arbitrary scripts, and execute command sequences without ever logging in. Security researcher Yuval Elbar of Cycode disclosed an issue rated 9.4 on the CVSS v3.1 scale on August 13, 2026. This issue has been patched in AIT-GUI version 2.5.2, which was released on August 12, 2026. AIT-GUI is the browser-based operator console for the AMMOS Instrument Toolkit , a widely used open-source framework for building ground data systems that send commands to spacecraft and instruments and process the telemetry that comes back. In practical terms, it is the panel an operator uses to click a button and have that action translated into a real command sent to hardware, which is precisely why a routine web application bug becomes so consequential here. Critical NASA AIT-GUI Flaw According to the advisory , the AIT-GUI web server reads its configured host setting and then silently discards it, hardcoding the listener to bind on 0.0.0.0 across all network interfaces on port 8080 by default. An operator who deliberately restricts the console to localhost still ends up exposing it to the entire reachable network. Compounding that exposure, none of the application’s state-changing endpoints enforce authentication, authorization, or cross-site request forgery (CSRF) protection. The POST /cmd endpoint relays whatever command string it receives directly to the spacecraft command bus, while POST /script/run and POST /seq allow server-side script execution and command-sequence execution, respectively. The latter two endpoints also build filesystem paths from unvalidated user input, opening the door to path traversal outside their intended script and sequence directories. Researchers classified the issues under CWE-306 (missing authentication), CWE-352 (CSRF), and CWE-22 (path traversal). A separately tracked flaw, CVE-2026-60112, describes a related missing-authentication issue in which an attacker can obtain a valid session by calling Sessions.create() without any credential check, then invoke handle_cmd() to forward arbitrary commands straight to the AIT command bus. That CVE carries a CVSS v3.1 base score of 9.8 and was published on July 28, 2026, ahead of the fuller GHSA disclosure. Because the vulnerable endpoints accept standard form-encoded POST requests, they qualify as CORS “simple” requests that browsers deliver cross-origin without a preflight check. That means even a deployment that is firewalled off from the open internet is not necessarily safe: if an operator with browser access to the console simply visits a malicious webpage, that page can silently submit a form that fires commands at the console in the background. No credentials, no user interaction beyond opening a page, and no direct network exposure are required for this attack path to succeed. NASA-AMMOS has fixed the flaw in AIT-GUI 2.5.2, and organizations running the software are strongly urged to upgrade immediately and verify the console port is not reachable from untrusted networks. Cycode’s disclosure also recommends reviewing command and sequence history for any deployment that may have been exposed prior to patching. For teams maintaining or hardening deployments, the durable fixes include adding authentication, authorization, and CSRF protections to every state-changing route; binding the server to its configured host rather than the hardcoded 0.0.0.0; and confining script and sequence paths using canonicalization checks that mirror a safeguard already present elsewhere in the codebase on the /scripts/load endpoint. The disclosure underscores a broader lesson for ground systems and operational technology: these platforms inherit the same web application weaknesses seen across ordinary software, but the cost of a successful exploit is measured in real-world hardware actions rather than data breaches. No CVE had been formally assigned to the GHSA advisory at the time of writing, though a related CVE-2026-60112 has already been logged in the National Vulnerability Database. Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs:  Integrate TI Lookup in your SOC The post Critical NASA AIT-GUI Flaw Lets Unauthenticated Attackers Issue Spacecraft Commands appeared first on Cyber Security News .

KI kann Schwachstellen selbstständig finden und ausnutzen – in rasantem Tempo. Sicherheitsanbieter halten mit autonomen Agenten dagegen. Nun stellt auch Cycode ein System vor, das Risiken automatisch ...

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain, tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on the CVSS v3.1 scoring system, impacts AIT-GUI