Oligo Security's company blog reports on vulnerabilities such as AirPlay, MCP Inspector, sudo and OpenSSH flaws, and on runtime security.
HN links it for research like the AirBorne AirPlay exploits and the 0.0.0.0 Day browser issue, with commenters citing it for specific CVEs.
I found these references to Mullvad and TeamPCP
>The whole operation ran primarily from Mullvad VPN exit nodes and virtual private server infrastructure, with little effort made to blend in. This was a high-tempo, low-stealth campaign designed to extract as much value as possible, as fast as possible.[1]
>Wiz CIRT observed the bulk of TeamPCP’s activity originating from Mullvad Virtual Private Network (VPN) exit nodes and virtual private server hosts such as InterServer.[2]
1: https://www.oligo.security/blog/teampcp-campaign-the-evolution-of-modern-supply-chain-attacks
2: https://www.wiz.io/blog/tracking-teampcp-investigating-post-compromise-attacks-seen-in-the-wild
This does not make any sense whatsoever.
> The new MCP server runs directly on the user’s machine. That local first design means sensitive data does not have to travel to the cloud just to be useful.
Even if it is 'local', data can still be exfiltrated via prompt injection, even via Anthropic's MCP inspector which that was run 'locally' and was exploitable via going to a crafted URL link that points locally to the MCP server. [0]
Again, the concept of MCPs are totally incompatible with security.
[0] https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596
Post by the security researchers themselves:
* https://www.oligo.security/blog/airborne
* https://news.ycombinator.com/item?id=43832084
CVE-2025-24252 and CVE-2025-24132 are two examples. Doing a search for "Oligo" in release notes gives various other results, e.g.,
* https://support.apple.com/en-ca/122374
sudo is not fully battle tested, even today. You just don't really see the CVEs getting press.
https://www.oligo.security/blog/new-sudo-vulnerabilities-cve-2025-32462-and-cve-2025-32463
Related: https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser