Top all-time · #4978
Oligo Security
Company blog · oligo.security/blogsecurity
Oligo Security is the company blog at oligo.security, writing about security. Since 2023, 15 different Hacker News readers have linked it 22 times, most often “0.0.0.0 Day: Exploiting Localhost APIs from the Browser”. No feed was found, so read it on the site itself.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
Security research posts on flaws such as the Anthropic MCP inspector RCE, sudo CVEs, the 0.0.0.0 private-network exploit and AirPlay bugs. Commenters link them as sources or related reading.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Oligo Security is a runtime security platform that helps organizations detect, investigate, and block AI threats across cloud, code, and AI agents in real time.
Most-linked posts?
- 0.0.0.0 Day: Exploiting Localhost APIs from the Browser7 people · 7 mentions · first linked 2024-08-07
- Critical RCE Vulnerability in Anthropic MCP Inspector – CVE-2025-495962 people · 3 mentions · first linked 2025-07-01
What Hacker News says?
The original blog post: [0] This is yet another very serious issue involving the flawed nature of MCPs, and this one was posted over 4 times here. To mention a couple of other issues such as Heroku's MCP server getting exploited [1] which no-one cared about and then GitHub's MCP server as well and a while ago, Anthropic's MCP inspector [2] had a RCE vulnerabilty with a CVE severity of 9.4! There is no reason for an…
Comment linking /blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596
on “Supabase MCP can leak your entire SQL database”Submitted AirBorne: Wormable zero-click remote code execution (RCE) in AirPlay protocol as a story · 130 points
HN discussionsudo is not fully battle tested, even today. You just don't really see the CVEs getting press. https://www.oligo.security/blog/new-sudo-vulnerabilities-cve...
Comment linking /blog/new-sudo-vulnerabilities-cve-2025-32462-and-cve-2025-32463
on “APT Rust requirement raises questions”Submitted 0.0.0.0 Day: Exploiting Localhost APIs from the Browser as a story · 15 points
HN discussionRelated: https://www.oligo.security/blog/0-0-0-0-day-exploiting-local...
Comment linking /blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser
on “Deprecate 0.0.0.0 for Private Network Access”Submitted 0.0.0.0 Day: Exploiting Localhost APIs from the Browser as a story · 6 points
HN discussionI found these references to Mullvad and TeamPCP >The whole operation ran primarily from Mullvad VPN exit nodes and virtual private server infrastructure, with little effort made to blend in. This was a high-tempo, low-stealth campaign designed to extract as much value as possible, as fast as possible.[1] >Wiz CIRT observed the bulk of TeamPCP’s activity originating from Mullvad Virtual Private Network (VPN) exit nod…
Comment linking /blog/teampcp-campaign-the-evolution-of-modern-supply-chain-attacks
on “Mullvad exit IPs are surprisingly identifying”Submitted Critical RCE Vulnerability in Anthropic MCP Inspector – CVE-2025-49596 as a story · 5 points
HN discussion> The vulnerability stems from the inability of certain browsers to properly handle the IP address 0.0.0.0, which is often assumed to be secure because it points to localhost. Attackers can exploit this flaw by crafting a malicious website that sends requests to localhost services running on an MCP server, thereby gaining the ability to execute arbitrary commands on a developer’s machine. The 0.0.0.0-day vulnerabili…
Comment linking /blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser
on “Critical RCE Vulnerability in Anthropic MCP Inspector – CVE-2025-49596”Submitted 0.0.0.0 Day: Exploiting Localhost APIs from the Browser as a story · 4 points
HN discussionPost by the security researchers themselves: * https://www.oligo.security/blog/airborne * https://news.ycombinator.com/item?id=43832084 CVE-2025-24252 and CVE-2025-24132 are two examples. Doing a search for "Oligo" in release notes gives various other results, e.g., * https://support.apple.com/en-ca/122374
Comment linking /blog/airborne
on “Apple Airplay-Enabled Devices Can Be Hacked via Wi-Fi”Submitted 0.0.0.0 Day: Exploiting Localhost APIs from the Browser as a story · 4 points
HN discussionThis does not make any sense whatsoever. > The new MCP server runs directly on the user’s machine. That local first design means sensitive data does not have to travel to the cloud just to be useful. Even if it is 'local', data can still be exfiltrated via prompt injection, even via Anthropic's MCP inspector which that was run 'locally' and was exploitable via going to a crafted URL link that points locally to the M…
Comment linking /blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596
on “Bitwarden MCP server secures AI access to your passwords”Submitted 0.0.0.0 Day: Exploiting Localhost APIs from the Browser as a story · 3 points
HN discussionSubmitted First targeted campaign against AI infrastructure found in wild as a story · 3 points
HN discussionSubmitted NIST's NVD Changes: A Wake-Up Call for CVE-Driven Security as a story · 2 points
HN discussionSubmitted Critical RCE Vulnerability in OpenSSH (CVE-2024-6387) – The Full Playbook as a story · 2 points
HN discussionSubmitted What Is ADR (Application Detection and Response)? as a story · 2 points
HN discussionSubmitted New Vulnerabilities in IBM WebSphere Liberty Can Lead to Full Server Compromise as a story · 1 points
HN discussionSubmitted The Future of Cloud Security Is Runtime as a story · 1 points
HN discussionSubmitted What Is Application Detection and Response (ADR)? as a story · 1 points
HN discussionSubmitted ShellTorch: Multiple Critical Vulnerabilities in PyTorch Model Server (CVSS 9.8) as a story · 1 points
HN discussion
