ZERO-CLICK RCE VULNERABILITY HIT FOUR MAJOR AI CODING AGENTS, TWO REMAIN UNPATCHED

Summary from the TLDR InfoSec newsletter

Plugin4Shell bypasses SHA pinning in Claude Code, Codex, GitHub Copilot, and Gemini CLI plugins.