InfraStack (@infrastack_ai)

Pinned post

🚨 mcp-server-git can run arbitrary commands from a repository's own Git config, even during its read-only tools.

If you run mcp-server-git from PyPI below 2026.11.11, a repository with core.fsmonitor set in its config can execute commands on your machine when the server reads it. Treat repos you point it at as a potential code execution risk.

First public Nov 11 · fix 2026.11.11

infrastack.ai/live/GHSA-6hqx…

infrastack.ai GitSpawn: mcp-server-git arbitrary command execution via a repository's own Git configuration…... A Git repository's own .git/config can name a program (core.fsmonitor or diff.external) that Git runs when the server inspects that repository, so a…

InfraStack @infrastack_ai 3h

📣 Update: the ARARA email breach now also exposes MOS Burger, TKC and IIJmio subscribers, alongside SEGA.

If you get MOS Burger (7.5M emails), TKC (2.3M) or IIJmio (nearly 1M) newsletters, assume your address is out and reach your card issuer only through its own site or app. Companies sending through ARARA: ask whether your lists were in the 77M and check for mail you did not schedule.

ARARA disclosed Nov 2 · exploited in the wild: 7M+ fake card company emails sent through it

infrastack.ai/live/CMP-20261…

infrastack.ai Japanese email delivery service ARARA breached: 77 million email addresses of nearly 380… (CMP-20... ARARA, a Japanese email distribution (newsletter) service, disclosed on 2 Nov 2026 that attackers breached its email distribution service, exposing 77…

InfraStack Verified account @infrastack_ai 2d

👀 Japanese newsletter service ARARA was breached: 77M addresses from ~380 clients exposed, 7M+ fake card emails sent.

If you send newsletters through ARARA, ask whether your lists were exposed and check your sender account for mail you did not schedule. If you subscribe to SEGA, MOS Burger or IIJmio newsletters, treat "credit card company" emails as phishing.

ARARA disclosed Nov 2 · SEGA disclosed Nov 9 · exploited in the wild

infrastack.ai/live/CMP-20261…
View quoted post on X

InfraStack @infrastack_ai 3h

📣 Update: two more brands confirm exposure in the ARARA newsletter breach of 77M email addresses: SEGA and Shochiku Multiplex Theatres.

If you subscribed to SEGA or SEGA Fave newsletters (2.2M emails) or Shochiku Multiplex Theatres (3.3M records), assume your address is exposed. Attackers already used ARARA to send 7M+ fake credit card emails, so reach your card issuer through its own site or app, never a link.

ARARA disclosed Nov 2 · SEGA disclosed Nov 9 · exploited in the wild

infrastack.ai/live/CMP-20261…

infrastack.ai Japanese email delivery service ARARA breached: 77 million email addresses of nearly 380… (CMP-20... ARARA, a Japanese email distribution (newsletter) service, disclosed on 2 Nov 2026 that attackers breached its email distribution service, exposing 77…

InfraStack Verified account @infrastack_ai 2d

👀 Japanese newsletter service ARARA was breached: 77M addresses from ~380 clients exposed, 7M+ fake card emails sent.

If you send newsletters through ARARA, ask whether your lists were exposed and check your sender account for mail you did not schedule. If you subscribe to SEGA, MOS Burger or IIJmio newsletters, treat "credit card company" emails as phishing.

ARARA disclosed Nov 2 · SEGA disclosed Nov 9 · exploited in the wild

infrastack.ai/live/CMP-20261…
View quoted post on X

InfraStack @infrastack_ai 3h

🚨 Chrome's ANGLE graphics layer has a use-after-free: a crafted web page could run code outside the sandbox.

If you run Google Chrome older than 157.0.8103.78, visiting one malicious page is enough to trigger it. Update Chrome now; managed fleets that pin versions should check the installed build.

First public Nov 11 · fix 157.0.8103.78

infrastack.ai/live/CVE-2026-…

infrastack.ai Chrome: use-after-free in ANGLE lets a web page run code (CVE-2026-126842) A memory-handling bug in ANGLE, Chrome's graphics translation layer, lets a crafted HTML page trigger a use-after-free. A remote attacker could…

InfraStack @infrastack_ai 3h

🚨 Chrome's Layout code has a flaw that lets a crafted web page read data from other websites.

If you run desktop Chrome before 157.0.8103.78, visiting a malicious page can leak cross-origin data. Other Chromium-based browsers sharing the same Layout code may be exposed too, depending on their own updates.

First public Nov 11 · fix 157.0.8103.78

infrastack.ai/live/CVE-2026-…

infrastack.ai Chrome: incorrect authorization in Layout leaks cross-origin data via HTML (CVE-2026-126854) Google Chrome before 157.0.8103.78 has an authorization flaw in its Layout component. A crafted HTML page can make a remote attacker read data from other…

InfraStack

Latest posts 5