Agent Field Kit cyber advisories

Agent Field Kit cyber advisorieshttps://agentfieldkit.com/agents/cyber2026-10-22T14:05:00-07:00 tag:agentfieldkit.com,2026:afk-2026-10-21-litellm-1-107-0LiteLLM 1.107.0 on PyPI and Docker contained a credential stealer and backdoor2026-10-22T00:00:00Z

LiteLLM 1.107.0 on PyPI and Docker contained a credential stealer and backdoor. Free first steps and sources included; full detail for subscribers.

tag:agentfieldkit.com,2026:afk-2026-10-21-railway-env-varsRailway: customer environment variables may have been accessed and some decrypted2026-10-22T00:00:00Z

Railway: customer environment variables may have been accessed and some decrypted. Free first steps and sources included; full detail for subscribers.

tag:agentfieldkit.com,2026:afk-2026-10-22-agent-skill-packages-malwareAgent skill packages flagged as malware on npm (opencode-skills-collection, agentic-awesome-skills, x402-prompt-injection-scan), plus an 'aanthropic' typosquat on PyPI2026-10-22T00:00:00Z

Agent skill packages flagged as malware on npm (opencode-skills-collection, agentic-awesome-skills, x402-prompt-injection-scan), plus an 'aanthropic' typosquat on PyPI. Free first steps and sources included; full detail for subscribers.

tag:agentfieldkit.com,2026:afk-2026-10-22-nextjs-16-4-1-rceNext.js: two critical unauthenticated RCEs fixed in 16.4.1 and 15.5.28 (now flagged by dependency scanners)2026-10-22T00:00:00Z

Next.js: two critical unauthenticated RCEs fixed in 16.4.1 and 15.5.28 (now flagged by dependency scanners). Free first steps and sources included; full detail for subscribers.

tag:agentfieldkit.com,2026:afk-2026-10-22-vllm-0-31-0vLLM before 0.31.0: remote code execution when trust_remote_code is on, plus cache and crash flaws2026-10-22T00:00:00Z

vLLM before 0.31.0: remote code execution when trust_remote_code is on, plus cache and crash flaws. Free first steps and sources included; full detail for subscribers.

tag:agentfieldkit.com,2026:afk-2026-10-22-mcp-ts-sdk-1-32-0MCP TypeScript SDK: five fixes for HTTP servers and clients (upgrade to 1.32.0 / 2.3.0)2026-10-22T00:00:00Z

MCP TypeScript SDK: five fixes for HTTP servers and clients (upgrade to 1.32.0 / 2.3.0). Free first steps and sources included; full detail for subscribers.

tag:agentfieldkit.com,2026:afk-2026-10-22-nodejs-oct-21-security-releaseNode.js Oct 21 security releases: Brotli decoder RCE and TLS hostname bypasses (upgrade to 22.23.4 / 24.22.1 / 26.12.1)2026-10-22T00:00:00Z

Node.js Oct 21 security releases: Brotli decoder RCE and TLS hostname bypasses (upgrade to 22.23.4 / 24.22.1 / 26.12.1). Free first steps and sources included; full detail for subscribers.

tag:agentfieldkit.com,2026:afk-2026-10-22-pyjwt-2-14-gitpython-3-2-1Python agent tooling: PyJWT 2.14.0 (forged tokens via empty-key JWK) and GitPython 3.2.1 (submodule hook RCE)2026-10-22T00:00:00Z

Python agent tooling: PyJWT 2.14.0 (forged tokens via empty-key JWK) and GitPython 3.2.1 (submodule hook RCE). Free first steps and sources included; full detail for subscribers.

tag:agentfieldkit.com,2026:afk-2026-10-22-goose-terminal-historyGoose: terminal integration can send shell history, including typed secrets, to your model provider2026-10-22T00:00:00Z

Goose: terminal integration can send shell history, including typed secrets, to your model provider. Free first steps and sources included; full detail for subscribers.

tag:agentfieldkit.com,2026:afk-2026-10-22-agent-sdk-fixes-openclaw-a2aAgent SDK fixes: OpenClaw 2026.6.6 (browser policy bypass) and A2A Java SDK 1.3.x (auth, SSRF, credential leaks)2026-10-22T00:00:00Z

Agent SDK fixes: OpenClaw 2026.6.6 (browser policy bypass) and A2A Java SDK 1.3.x (auth, SSRF, credential leaks). Free first steps and sources included; full detail for subscribers.