Know what changed.
Trace why it matters.

Researchers say Plugin4Shell is a zero-click remote-code-execution vulnerability affecting Claude Code, Codex, Gemini CLI, Microsoft Copilot, and GitHub Copilot; exploitation could expose assets and data reachable by the agent. The attack targets trusted plugin marketplaces rather than the underlying model or agent, and researchers say it could reach millions of users and machines.

With automatic plugin updates enabled, swapping a pinned commit upstream can replace an installed plugin with malicious code; the researchers reported that Claude and Codex automatically update installed plugins by default.

A critical vulnerability in Check Point Security Management and Log Servers could let an unauthenticated network attacker execute code as root. Check Point released a fix through its LivePatch update channel; the supplied text truncates the statement about whether the flaw has been exploited.

The Security Management Server controls firewall policy and administrator access, so compromise could affect those management functions.

Dokploy versions 0.29.8 and 0.29.11, plus canary commit 24b02f5, are vulnerable to OS command injection during database backup creation and restoration. The vulnerable backup and restore functions incorporate user-controlled database-name or backupFile values into shell commands without shell escaping or restrictions on metacharacters.

An authenticated user with database-backup permission can execute arbitrary commands as root on the Dokploy host because the backup operations run in the root-privileged Dokploy process.