Several major airlines have suspended Venezuela flights following an FAA NOTAM urging 'extreme caution' due to escalating military activity.

The security promise was simple. A plugin marketplace reviews a piece of code, locks it to a specific, verified version, and every AI coding agent that installs it gets exactly what was reviewed. No surprises or swaps. That promise just got broken, simultaneously, across every major AI coding agent on the market. On September 17, cybersecurity startup AIR Security publicly disclosed Plugin4Shell, a zero-click, high-severity remote code execution vulnerability affecting Anthropic's Claude Code, OpenAI's Codex, Microsoft's GitHub Copilot, and Google's Gemini CLI. The name is a deliberate echo of Log4Shell, the 2021 Apache flaw that shook enterprise security teams for months. This one hits a faster-moving target: the plugin ecosystems that have quietly become critical infrastructure for millions of software developers. The researchers who found it, Or Nevo, Dor Granat, and Niv Hoffman, describe it as the first supply-chain vulnerability of the AI agent ecosystem. That is not a small claim, and the technical details back it up. How the Attack Works To understand Plugin4Shell, you need to understand SHA pinning, the mechanism it breaks. When a marketplace approves a plugin, it records a cryptographic commit hash, a 40-character string that uniquely identifies an exact snapshot of the plugin's code. From that point forward, every agent that installs the plugin is supposed to check out precisely that commit. Reviewed code, nothing else, forever. The vulnerability is a single missing verification step. Affected agents fetch the pinned commit during installation but never confirm that the code they actually land on matches it. That gap opens the door to a Git reference resolution trick. For Claude Code, Codex, and GitHub Copilot, an attacker who controls a plugin repository can create a branch whose name is the exact 40-character pinned commit hash, set it as the repository's default branch, and point it at malicious code. When the agent runs its checkout, Git resolves the branch name instead of the commit object, because Git prefers a matching reference when the name is ambiguous. The agent installs attacker-controlled code, reports a clean install at the trusted hash, and nothing looks wrong. Gemini CLI has a slightly different variant. Its installer fetches the target commit and then checks out FETCH_HEAD, but if the repository's default branch is itself named FETCH_HEAD, that checkout resolves to the branch instead. The fetched commit gets silently discarded. What makes this zero-click is auto-update. Claude Code and Codex update installed plugins in the background by default. When a plugin's pinned commit is swapped upstream, an already-installed, already-trusted plugin gets silently replaced with a malicious version. No prompt. No reinstall. Nothing for the user to notice or decline. Plugins run with the permissions of the developer operating the agent. That means an attacker who succeeds here lands in the developer's machine with access to source code, cloud credentials, SSH keys, internal repositories, and production systems. The Context Makes It Worse Plugin4Shell is the third installment in a series of findings from AIR Security, each one showing a different layer of the AI plugin ecosystem collapsing under scrutiny. In earlier research called "The Story of Skills," the team published a malicious skill to a trusted marketplace and watched it spread to over 26,000 agents. In SkillJacking, they found 925 skills already in active use had been quietly hijacked from their original maintainers, affecting 134,000 agents, by taking over the repositories behind them. The industry's answer to SkillJacking was SHA pinning. Plugin4Shell is the answer to that answer. The takeovers AIR demonstrated in SkillJacking can now be combined with Plugin4Shell to bypass the exact safeguard that was supposed to contain them. The chain is proven end to end. Vendor Responses AIR found the vulnerability in May 2026, built working proof-of-concept exploits against all four agents, and disclosed everything to the vendors in June. What happened next drew a clear line between the companies that acted and the ones that did not. Anthropic patched Claude Code in version 2.1.179. OpenAI patched Codex in version 0.146.0. Both confirmed fixes after disclosure. Microsoft has not shipped a fix for GitHub Copilot. GitHub has argued that its platform blocks branch and tag names that resemble commit hashes, which limits the attack surface for GitHub-hosted plugins. AIR's counter is that Copilot also supports marketplaces hosted on Bitbucket and self-hosted git servers, which permit such names, and that GitHub's restriction does nothing for those configurations. The two positions describe different scopes. Copilot users currently have no patch. Google's response was to deprecate Gemini CLI entirely. The company confirmed in August that no fix would ship, directing users to migrate to an alternative product called Antigravity. Every existing Gemini CLI installation remains permanently vulnerable. What Users Should Do Now The fix, technically, is a single line of verification that every affected agent was missing: after checkout, compare the actual HEAD commit against the pinned hash and abort if they do not match. Because the check runs inside the agent rather than at the marketplace, no marketplace can enforce this guarantee on its own. Only an agent-side fix closes it. Claude Code users should update to version 2.1.179 or later. Codex users should update to version 0.146.0 or later. Gemini CLI users should migrate away from the product. GitHub Copilot users have no patch available and no confirmed timeline for one. For enterprise teams that have built internal vetting processes around SHA pinning, Plugin4Shell is a harder problem. The review passed. The pin was written. Different code got installed. Every downstream security process built on that guarantee inherits the failure. The most striking detail in AIR's disclosure is not the vulnerability itself. It is that four independent engineering teams at four separate companies all made the same mistake, building the same flawed assumption into their auto-update pipelines, and none of them caught it until an outside lab did. That is not an implementation error in one product. That is a design assumption the entire industry shared, and nobody questioned it.

LRT reported that allied Italian fighter jets shot down a drone over Lithuania shortly after midnight, while the Lithuanian military said it would not rush to conclusions about the incident. The military said an object flying towards Lithuania was detected in the country’s airspace at around midn…

Confrontée à une recrudescence d’intrusions de drones au-dessus de sites stratégiques, la France déploie de nouveaux moyens de détection et de neutralisation. Entre les tests conduits par la Task Forc...

Cristina Gomez reports on a security alert at Barksdale Air Force Base triggered by an unidentified object that prompted a shelter-in-place order without an intercept or identification, while authorities continue to investigate. She also details a high-visibility exchange between physicist Eric W. Davis and mathematician Eric Weinstein involving claims of decades-long U.S. crash-retrieval efforts, presidential briefings, and the exclusion of theoretical physicists from reverse-engineering programs.

AIR Security has emerged from stealth with $50 million in funding to launch AIR, a firewall designed to protect AI agents and their add-ons. The company says its research found thousands of public AI add-ons and AI Skills with untrusted instruction sources, impersonation tactics, and hidden behaviors that could expose enterprises...

Lithuania recorded no airspace incidents after drones breached Estonian airspace early Tuesday and Latvia issued an air threat warning, the Lithuanian Armed Forces told LRT. “No incidents have been recorded in Lithuanian airspace, and the security situation remains unchanged. The Lithuanian Armed…

Prime Minister Inga Ruginienė points the finger at Belarus over airspace incident.

Read next Sergey Lavrov spoke at the UN on Saturday. (Image: Getty) Russia has issued a chilling war

En l’espace de neuf jours, deux sites militaires français ont été survolés par des drones. Si la France ne pointe pas du doigt directement la Russie, tout indique, selon Xavier Tytelman, consultant aé...