cybercrime.clubhttps://cybercrime.club/tags/developer-tools/Infrastructure security news for people who build infrastructure.Hugo -- gohugo.ioen-usWed, 22 Jul 2026 23:10:32 -0400Hidden Web Text Turns AWS Kiro Into an RCE Chain: MCP Config Rewrite via Prompt Injectionhttps://cybercrime.club/posts/aws-kiro-agentic-ide-mcp-config-prompt-injection-rce/Wed, 22 Jul 2026 23:10:32 -0400https://cybercrime.club/posts/aws-kiro-agentic-ide-mcp-config-prompt-injection-rce/Researchers at Intezer and Kodem Security show how hidden text on an ordinary web page could make AWS's Kiro agentic IDE rewrite its own MCP config and execute attacker code — no approval dialog, no CVE, patched in Kiro 0.11.130.vulnerabilities