The Patching Friars' AlmanacA calendar of CVE saints

February 10

PromptwareHoly card for promptware, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 IGNORA TUTTO Promptware LEGIT ERGO PARET
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Promptware, Who Disguised Himself as Text

Patron of overly obedient AI assistants, emails that talk to machines, and anyone who follows instructions even where none should be.

Life

Between January and February 2026 Ben Nassi, Bruce Schneier, Oleg Brodt and Elad Feldman proposed that we stop calling prompt injection a single trick and see it as multi-stage malware: promptware. They described a seven-step kill chain, from initial access hidden in a web page or email to the final objective, by way of persistence and spreading to other users. Their conclusion: the first step can't be cured today, so the chain has to be broken further along.

Prayer

O Saint Promptware, who hides between the lines, teach our assistants to tell data from orders. Amen.

How to celebrate

Celebrated by giving AI agents only the permissions they need, asking before irreversible actions, and distrusting any text that hands out instructions.

Do everything you read, and one day you'll read the wrong thing.

Technical record

Disclosed on
February 10 2026
CVE
CVE-2025-53773
CVSS
7.8
Product
Microsoft · Microsoft Visual Studio 2022 version 17.14

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.

Sources: arxiv.org · arxiv.org

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.