CLAUDE COLLABORATION TOOLS LEFT THE DOOR WIDE OPEN TO REMOTE CODE EXECUTION

Summary from the TLDR InfoSec newsletter

Researchers have discovered three now-patched vulnerabilities in Claude Code (CVE-2025-59536, CVE-2026-21852) that allowed remote code execution via malicious Hooks and MCP configurations in cloned repositories, plus API key theft through endpoint redirection in project settings files.