Two disclosures today put the security of AI coding agents' extension systems under scrutiny. Plugin4Shell showed that Claude Code, Codex, GitHub Copilot and Gemini CLI can be tricked into replacing a pinned, previously reviewed plugin with a malicious version because the repository remains the trust anchor rather than the reviewed code itself. A separate zero-click RCE affecting the same four agents extends the problem further: control of a marketplace plugin can provide an attacker with access comparable to that available to the employee running the agent. Anthropic and OpenAI have patched their agents, while GitHub Copilot remains unpatched. The weakness sits in how these agents validate and load extensions.

Two other incidents involved attack chains assembled from weaknesses that were individually less remarkable. Hacktron's OpenAI research combined a years-old libheif memory-safety issue with an SSO misconfiguration, turning a forum account compromise into ChatGPT and Codex account takeover and eventually access to an internal repository. WordPress's Click2Shell used a URL-parsing mismatch to force a theme installation without a click, then chained that access with a separate theme vulnerability to reach PHP execution. In both cases, the final compromise emerged from multiple weaknesses lining up across systems.

The WaterPlum campaign has also expanded considerably. Fake recruiters continue to distribute malicious npm packages during coding interviews, and coordinated reporting from Japan, the US, Australia and Germany has now put the confirmed impact at more than 30,000 infected devices and 7,000 compromised cryptocurrency wallets. The reporting gives a much clearer picture of the campaign's scale, with the same basic delivery technique reaching a substantially larger confirmed victim set.

Helpfeel confirmed a third party exploited a vulnerability in Gyazo's image upload server on 11 September 2026 to access its systems. The attacker disclosed roughly 23.62 million user records, including password hashes, email addresses and session IDs, alongside around 490 million image metadata entries. No payment card details were exposed, and Helpfeel has blocked the access routes and remediated the vulnerability.

Check Point disclosed CVE-2026-91843, a critical vulnerability scoring 9.8 on the CVSS scale, affecting its Security Management and Log Servers. The flaw could let an unauthenticated attacker remotely execute arbitrary code with root privileges via the login process. Check Point has released a LivePatch fix, with no exploitation observed in the wild so far.

Hacktron researchers combined a libheif heap buffer overflow with an OpenAI SSO misconfiguration to compromise employee ChatGPT and Codex accounts. The exploit relied on Discourse's forum passing HEIC images to a vulnerable, unpatched libheif library via ImageMagick, granting code execution. The team demonstrated internal repository access by opening a pull request through a compromised employee's Codex integration, then reported both issues, which OpenAI and Discourse have since patched.

Japanese, US, Australian and German authorities exposed the North Korean "WaterPlum" group, also known as Contagious Interview, targeting IT professionals worldwide. The actors pose as recruiters, tricking developers into running malicious npm packages containing malware such as BeaverTail and InvisibleFerret during fake job interviews. The group has infected over 30,000 devices across 100 countries and stolen roughly 10.71 million USD in cryptocurrency from more than 7,000 wallets.

Researchers at pwn.ai disclosed Click2Shell, a pre-authentication exploit chain in WordPress Core allowing remote code execution after a single click. A crafted theme-preview link exploits a selector injection to force an Administrator's browser into installing an attacker-chosen theme, which loads PHP during the Customizer preview. Chained with a separate flaw found in the Mobile Repair Zone theme, this lets an attacker execute arbitrary PHP without needing valid credentials. WordPress patched the core issue in version 7.1.1, released 17 September 2026.