A mail gateway bug with root access, an advisory-only AI scanner, and traces for Claude calls.
- Cisco says a crafted attachment can give an unauthenticated attacker root on Secure Email Gateway.
- GitHub says AI Scan for pull requests is generally available, with findings that cannot block a merge.
- Anthropic says OpenTelemetry export for the Claude API and Managed Agents is in beta.
Security
Cisco Secure Email Gateway: a crafted attachment can mean root
Cisco rates this arbitrary file write in the Advanced Malware Protection feature 9.8. An unauthenticated attacker who emails a crafted attachment through an affected gateway can write files and run commands as root, and Cisco lists no workaround. It hits physical and virtual gateways with File Reputation assigned to a mail policy and Content Scanner Tools older than 25.3.0.5525. Cisco says it contacted Secure Email Cloud customers where it saw malicious activity.
This week. Run contentscannerstatus on every gateway, update Content Scanner Tools to 25.3.0.5525 or later, and check system_logs for the “System Security” compromise messages Cisco lists.
AI
Anthropic launches OpenTelemetry export for the Claude API in beta
Anthropic says OpenTelemetry export is in beta for Messages API requests and Claude Managed Agents sessions. The SDKs emit spans in Python, TypeScript, C#, Go, Java, PHP and Ruby, and API-side spans come from a destination added in the Claude Console. It hits teams running agents who have had no trace of what a model call did.
This week. Add a test OpenTelemetry destination in the Console and read Anthropic’s docs page for what the spans contain before sending production traffic.
Platforms
GitHub makes AI Scan for pull requests generally available
GitHub says AI Scan reviews pull requests in languages CodeQL does not cover, including Terraform, Dockerfiles, Shell and PHP. Its findings cannot fail the code scanning check or block a merge, and it does not run on fork or Dependabot pull requests. Private repositories need Code Security or Advanced Security, and it uses Code Security AI Credits.
This week. Turn it on for one repository with Terraform or Dockerfiles, and keep your existing required checks as the merge gate.
Leave a Reply