GraphQL

My notes show GitLab also just patched two other critical flaws.

There's a GraphQL code injection flaw, CVE-2026-99478.

Right.

And the other is CVE-2026-8771-TIME.

Which is a CDSS 9.9, by the way.

Right, 9.9. And that one is described as an insecure deserialization bug in DuoChat access that bypasses serialization via crafted GraphQL subscription argument.

That's a mouthful.

It really is.

Adobe says it's working on a fix, but hasn't offered a release time.

Sansa recommends disabling GraphQL and rotating Magento credentials if a compromise is suspected.

Um, you know, e-commerce zero day, uh, I can't think of a better way to kick off the weekend here.

Mark, anything here to, uh, uh, that, uh, you wanna know more about within this story? A lot of interesting technical details here, or Sansa has the mitigations out, a patch will be out, dot, dot, dot, someday.

I think for the most part, the default is exactly what you said, where I think we'll just collapse on the same standards we've been using all the time.

OpenAPI, GraphQL, Nix, all these things are definitely no reason to invent a new thing for the most part.

I think this is really interesting and something I thought a lot about as just someone who's building tools, right? It's like what actually does, like what does something that actually does deserve to be built new look like, right? And I think what that looks like is when kind of the fundamental math you do of like how should this abstraction look and what should it optimize for, whenever that changes based on agents, like fundamentally what you want.

So like I think a really good example of this actually is just, the way we do pull requests, for example, the way we like get code merged, right? I think a lot of people will report, like if you start having like these like high velocity, many agents working at once, when it comes to this, I think you'll notice that like your agents just get stuck In rebase hell, they get just stuck having to...

And it's telling its own stories, but to all the influence.

And I wonder...

We don't need another GraphQL.

We'd rather do another OpenAPI spec.

That's the MCP for WebMCP, it's W3C like other standards bodies.

For WebMCP, you are really only working on it on the client, but that doesn't mean that it can't negotiate or create server actions like kickoff arrest or GraphQL API interaction.

Also, the way that people are using it agentically, you do have headless scenarios that you can use WebMCP.

But we're also thinking about a new surface area of co-browse.

So don't leverage the existing DOM structure.

Think in agent actions.

I would also want to leverage existing APIs in your application like REST or GraphQL.

If you have those, those can be invoked with a tool with a really good description.

Adobe says it's working on a fix but hasn't offered a release time.

Sansec recommends disabling GraphQL and rotating Magento credentials if compromise is suspected.

[transition effect] Shadow AI steps into the light.

The UK's National Cybersecurity Centre says unapproved AI tools are creating security gaps companies may not see.