Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-03-17 · source-backed
Two critical disclosures today that share a disturbing ancestry. CVE-2026-3059 and CVE-2026-3060 are both CVSS 9.8 remote code execution vulnerabilities in SGLang — the popular LLM inference framework — via unsafe pickle deserialization in the ZeroMQ broker and disaggregation module. Zero authentication required. Any SGLang deployment exposing multimodal or disaggregation features is fully exploitable right now.
Separately, BeyondTrust revealed that Amazon Bedrock AgentCore's Code Interpreter sandbox permits outbound DNS queries, enabling attackers to establish interactive shells and exfiltrate data from inside agent code execution environments. The sandbox was supposed to be the security boundary. DNS was the escape hatch.
The SGLang vulns are the third instance of the ShadowMQ pattern — unsafe ZeroMQ + pickle combinations copied across the AI inference stack. Meta's vLLM had CVE-2025-30165. NVIDIA TensorRT-LLM had CVE-2025-23254. The same anti-pattern keeps replicating because inference framework developers treat internal IPC as trusted — then deploy it on networks where it isn't.
If you're running SGLang: disable multimodal and disaggregation features until patches land, or firewall the ZeroMQ ports. If you're running Bedrock AgentCore: assume the sandbox is not a security boundary and treat agent-generated code as untrusted even after execution. The DNS exfiltration vector means any data accessible inside the sandbox can leave via DNS resolution — a channel most network monitoring ignores entirely. Source
Each link below shares sources, entities, or timing with this story.
Meta partners with Google / Shared entities / Same source domain / What happened next
Linked by a graph relationship (Meta partners with Google); both cover CVE, CVSS, LLM; reported by the same outlet (thehackernews.com).
AWS released Amazon Bedrock AgentCore / Shared entities / Shared topic / What happened next
Linked by a graph relationship (AWS released Amazon Bedrock AgentCore); both cover Bedrock AgentCore, Code Interpreter, DNS; overlapping topics (agentcore, bedrock, code, data, execution).
Linked by a graph relationship (AWS released Amazon Bedrock AgentCore); both cover Bedrock AgentCore, BeyondTrust, DNS; overlapping topics (agentcore, bedrock, execution, exfiltration, sandbox).
Muse Code built by Meta / Shared entities / Same source domain / Shared topic / What happened next
Linked by a graph relationship (Muse Code built by Meta); both cover CVE, CVSS, Meta; reported by the same outlet (thehackernews.com).
Simon Willison released LLM / Shared entity: CVE / Same source domain / Shared topic / What happened next
Linked by a graph relationship (Simon Willison released LLM); both cover CVE; reported by the same outlet (thehackernews.com).
Simon Willison released LLM / Shared entity: LLM / Shared topic / What happened next / Tension
Linked by a graph relationship (Simon Willison released LLM); both cover LLM; overlapping topics (data, featur).
Meta uses Gemini / Shared entity: CVE / Same source domain / What happened next / Tension
Linked by a graph relationship (Meta uses Gemini); both cover CVE; reported by the same outlet (thehackernews.com).
Meta uses Gemini / Shared entity: Bedrock AgentCore / Shared topic / What happened next
Linked by a graph relationship (Meta uses Gemini); both cover Bedrock AgentCore; overlapping topics (agentcore, bedrock, code).