Intelligence View

⚡ tsecurity.de Intelligence

GitHub Release: cline/cline vdesktop-v0.0.25 (10.09.2026)

Release desktop-v0.0.25 von cline/cline auf GitHub: ChatGPT Subscription (Codex) now lists only the models your plan can actually use. Two separate paths…

AI & KI Nachrichten GitHub · cline/cline 10.09.2026, 06:57 Uhr 3 Min. Lesezeit

↗ Quelle (GitHub · cline/cline)

Reagiere als Erste:r — dein Feedback zählt!

STANDARD — Regulärer Patch-Zyklus ~3 Min. (534 W.)

Deep Tech

GitHub Release: cline/cline vdesktop-v0.0.25 (10.09.2026) cline/clinevdesktop-v0.0.2510.09.2026@github-actions[bot] ChatGPT Subscription (Codex) now lists only the models your plan can actually use.

Angriffsfläche

Enterprise IT / Cloud Infrastruktur

Exploit-Status

Geringe Ausnutzungswahrscheinlichkeit / Keine aktiven Kampagnen

Sofortmaßnahme

Asset-Inventar prüfen & Upstream-Advisory überwachen

cline/clinevdesktop-v0.0.2510.09.2026@github-actions[bot]

ChatGPT Subscription (Codex) now lists only the models your plan can actually use. Two separate paths filled the picker from the shared OpenAI catalog, so GPT-4o, GPT-4.1, and chatgpt-image-latest showed up alongside the Codex models, and the runtime lost the Codex context caps. The model rules also match what the backend now accepts: gpt-5.4 and gpt-5.4-mini were retired for ChatGPT accounts on 2026-08-31 and are gone, the default moves to gpt-5.6-terra, and every Codex model is capped at the real 400K/272K/128K backend budget instead of inheriting the API's 1.05M limits

Windows updates no longer fail with "Error opening file for writing". The compiled sidecar re-executes itself as the detached Cline Hub daemon, which outlives the app by design, and Tauri's NSIS installer only kills the main binary — so the daemon still held code-sidecar.exe and the install stopped until you killed the process by hand. The installer now stops it first, matched on the full path so updating one channel does not take down a side-by-side Cline Beta's sessions

Your prompt is no longer lost when a send fails before the turn starts — switching to Codex and having the OAuth refresh throw, for instance. The runtime never took the prompt, so post-send hydration wiped the optimistic bubble and you had to retype it. The text and attachments now come back to the composer, merged with anything you attached while the send was pending, and left alone if you have already started typing something else

Providers that authenticate through a local CLI — Claude Code, Codex CLI — can now start sessions without an API key. They showed as Configured in Settings via their local-auth capability, but session start still refused them with "Missing API key"

OpenCode is now treated as a local CLI provider rather than an OAuth one, so it shows the local CLI notice instead of a browser sign-in button that could not do anything. It authenticates from the credentials the opencode CLI itself stores

Session import from Claude Code, Codex, and opencode has its own page in Settings instead of a row buried in General

The composer's provider picker now marks which providers you have already configured

The model picker distinguishes models that share a name, and Cline Pass subscription models are listed separately from the free fallback tier

Published DMGs use the intended window layout and background again. Tauri skips the Finder AppleScript that applies them whenever CI is set, which GitHub Actions always sets, so every DMG since the artwork landed shipped with a stock Finder window even though the artwork was generated and validated

Cline's recommended, free, and subscribed model lists now ship with the app, so they are correct at first launch instead of waiting on a live catalog fetch

Refreshed the model catalog. Adds NaN (nan.builders) and changes the resolved default model for 36 providers — including Bedrock, Vertex, OpenRouter, Kilo, GitHub Copilot, Gemini, Cerebras, Fireworks, Requesty, and Vercel AI Gateway. Several move off Claude Fable 5.1 to GPT-6 Astra, Vertex goes to Gemini 3.8 Flash, and OpenRouter/Kilo to Inception Mercury 2.5. If you use one of those without pinning a model, expect a different default

Full Changelog: desktop-v0.0.24...desktop-v0.0.25

1. Sofort-Triage & Abwehrmaßnahmen

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - GitHub Release: cline/cline vdesktop-v0.0.25 (10.09.2026)
id: a12187a3-8d7a-456a-8cd2-5efac5abd17f
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "GitHub Release: cline/cline vd" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("GitHub Release clinecline vdesktop-v0025")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*GitHub Release clinecline vdesktop-v0025*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "GitHub Release clinecline vdesktop-v0025"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

Microsoft Teams erhält Backup und Wiederherstellung für Notfälle

IT Nachrichten

NÄCHSTER BEITRAG 1 Min

VW: Im Oktober soll neuer 39 Cent Ladetarif „We Charge City“ starten

Android Tipps & SecurityWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich GitHub Release: cline/cline vdesktop-v0..... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')

Echtzeit-Radar & Feeds

👥 Community & Social

🕒 tsecurity.de Such-Trends & Chronologie

GitHub Release: cline/cline vdesktop-v0.0.25 (10.09.2026)

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

2. Cyber Threat Intelligence & Forensik

MITRE ATT&CK Matrix Navigator 14 Taktiken

tsecurity.de Cognitive Threat RAG

tsecurity.de LIVE

Echtzeit-Radar & Feeds

👥 Community & Social

GitHub Release: cline/cline vdesktop-v0.0.25 (10.09.2026)

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

2. Cyber Threat Intelligence & Forensik

MITRE ATT&CK Matrix Navigator 14 Taktiken

Mehr aus dieser Kategorie

tsecurity.de Cognitive Threat RAG

tsecurity.de App