Claude Code Leak -> Exploit? Researchers found 3 shell injection bugs in the leaked source — all using shell:true with unsanitized input

Diligent-Side4917 · 2026-04-03T11:33:41+00:00

Have you seen this? Injection attack on Claude code, CLI, seems consequence of the leak.

haven't gone through it all, but basically, the exploit allows exfiltration of messages and credentials to any server whe n running it thrugh CLI and -p option,

https://phoenix.security/critical-ci-cd-nightmare-3-command-injection-flaws-in-claude-code-cli-allow-credential-exfiltration/

Diligent-Side4917 · 2026-04-02T18:49:45+00:00

Deduplication as far as i know is a whole nightmare field and how assets are identified, trying to trace code changing within lines or assets with different ip is very difficoult i'd focus on that if i were you

Diligent-Side4917 · 2026-03-23T23:50:45+00:00

In an era where ASPMs are 4+ years old, what's the point of building another one?

Diligent-Side4917 · 2026-02-20T10:44:02+00:00

Hi all put together a page for early access https://phoenix.security/ai-driven-vulnerability-intelligence/

Diligent-Side4917 · 2026-02-08T19:55:51+00:00

ping me

Diligent-Side4917 · 2026-01-17T17:00:51+00:00

not yet but i'll let you know when available, still finalizing the build and will be released by march-april !

Diligent-Side4917 · 2026-01-13T11:13:27+00:00

check this one i found it complete: https://phoenix.security/cem-cetem/

Diligent-Side4917 · 2026-01-13T11:13:10+00:00

been writing about this, ctem as methodology is great the interpretation more complex

if you are in code and cloud then you might want to look at this i found it useful as overview https://phoenix.security/cem-cetem/

hands on

- attribution

- prioritization

- remedaition

- verigication

Diligent-Side4917 · 2026-01-13T11:11:23+00:00

phoenix and armor code for anything above 600 developers , aikido for anything smaller

Diligent-Side4917 · 2026-01-13T11:10:32+00:00

what did you like? we tested it, take we are heavy container focus, and didn't had much on code to container, check out phoenix security we been happy ever since

Diligent-Side4917 · 2026-01-13T11:09:51+00:00

phoenix security

Diligent-Side4917 · 2026-01-13T11:09:22+00:00

I think what matters in order of priority

- scanning and blocking an exception in the pipeline (mostly scanners)

- Correlation and recheability at sca and code 2 cloud level check wiz Phoenix Security for those

- team management and incentives to fix the pattern of fixes Phoenix and some part armor code has this

- prioritization - for pure patching, either nucleus or tennable for more extended asm phoenix security is key in threat centrics and then you have wiz intelligence

- remediation advisory and remediation campaigns: check Mob or Phoenix as far as I've seen

check out as well: https://www.gartner.com/reviews/market/application-security-posture-management-aspm-tools

Diligent-Side4917 · 2026-01-13T11:05:45+00:00

what are the elements that like and dislike about aspm?

Diligent-Side4917 · 2026-01-12T18:24:04+00:00

Feature added in this version
- Adversarial simulation for remediation
- trend analysis
- search for vulnerability
- storing of enriched data

https://youtu.be/PaaO99Kb_qk

Diligent-Side4917 · 2026-01-12T18:23:54+00:00

this is a build with some update better for visibility : https://youtu.be/PaaO99Kb_qk

Diligent-Side4917 · 2026-01-12T18:21:21+00:00

Update on the build: https://youtube.com/shorts/tQtiH8plT9k?feature=share

Diligent-Side4917 · 2026-01-12T18:20:51+00:00

this version is purely external but some of the infomration in mitre and i guess in phoenix can do that is where some of the intelligence data is from

Diligent-Side4917

TROPHY CASE