Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Fix availableCritical · CVSS 10EPSS 1.2%

Published Sep 24, 2026 · updated Sep 24, 2026

What to do

  1. Upgrade to a fixed version: decepticon-core 1.1.17, decepticon 1.1.17, decepticon-sdk 1.1.17.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIdecepticon-core1,123 downloads/week

Vulnerable versions
<= 1.1.16
Fixed in
1.1.17

Check your project: pip show decepticon-core

PyPIdecepticon1,159 downloads/week

Vulnerable versions
<= 1.1.16
Fixed in
1.1.17

Check your project: pip show decepticon

PyPIdecepticon-sdk1,013 downloads/week

Vulnerable versions
<= 1.1.16
Fixed in
1.1.17

Check your project: pip show decepticon-sdk

Sources

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

← All critical vulnerabilities