Saturday, May 9, 2026 · 1 of 5

1. Semantic Kernel RCE + file-write CVEs disclosed

   Prompt injection in SK Python (<1.39.4) enables host RCE via eval(); SK .NET (<1.71.0) allows arbitrary file writes. Upgrade now.

   May 7