[tl;dr sec] #345 - Bug Rumors → Exploits, Version Control DFIR, Agentic Worms

What it is

Issue #345 of the tl;dr sec newsletter (author Clint, 2026) is a digest of AppSec, blue team and AI security items. The summary names the headline items. The page adds the details below, which matter if you run version control, ship open source libraries, or self-host AI workflow tools.

Version control DFIR poster (Wiz)

Wiz's Sean Johnstone and Shira Ayal published a poster for GitHub, GitLab, Bitbucket and Azure DevOps. It lists log sources, pre-incident configuration, and audit events mapped to MITRE ATT&CK tactics. The visibility gaps it flags:

• GitHub keeps Git events for only 7 days.
• GitLab does not log Git operations to the database by default.
• Only GitHub offers API request logs, and they need explicit configuration.
• GitHub audit logs omit source IPs unless you turn that on.
• Default retention on all four platforms is too short for most investigations.
• None of this telemetry is retroactive, so log streaming must exist before an incident.

For hunting a mass clone, the event names are git.clone (GitHub), repository_git_operation (GitLab) and RepositoryCloneEvent (Bitbucket).

Embargoes and fast exploitation (OCaml cohttp)

Anil Madhavapeddy shipped a path traversal fix for cohttp 6.3.0. Within ten minutes of opening the PR, probes with the exact bug pattern hit their web server. Their own Claude run refused on its security block, so DeepSeek V4 Pro wrote the exploit in under a minute from a vague description. Their conclusion is that embargoes no longer buy time, because a rumor is enough for an agent. The three responses they examine all fall short:

• GitHub temporary private forks hide the patch but cut off CI.
• Continuous shipping works for Chrome as a single binary, but not for a library embedded in many products.
• Protocol-layer mitigations rely on a CDN, which open source lacks.

Clint predicts this area will matter more over the next few months.

Other findings with numbers

Greptile ran 500 PRs each from Claude Code and Codex against about 1,500 ground-truth comments. Each model caught more high-severity bugs in the other's code. Claude-authored code skews toward wrong data or missing behavior, where GPT reviews better. Codex-authored code skews toward semantic and error-handling bugs, where Claude reviews better. Greptile's Model Inversion detects the author from commit trails, branch prefixes and PR titles, then routes review to the opposite model.

Endor Labs found 14 critical and high-severity flaws in NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra and Apache Airflow. The root cause is treating multi-tenant code execution as a single-user developer tool. Flowise, Kestra and Langflow can be exploited via prompt injection that runs code and exfiltrates data. Other findings include NocoBase's lockdown() commented out with a TODO, and Langflow accepting a lambda from chat. Flowise has been archived since mid-August 2026.

PipeLab's Joshua Waldrep argues detector false-positive rates are meaningless on clean traffic. One detector scored 0% on clean traffic but reached 30% once benign inputs looked dangerous. Examples of lookalikes are an advisory quoting an injection string, AWS's example key AKIAIOSFODNN7EXAMPLE, and a base64 blob that decodes to a PNG. A starter set is in agent-egress-bench.

The arXiv worm paper tested open-weight agentic worms on a 33-host Linux, Windows and IoT testbed. They reached 61.8% infection over 7 days. The worms also tried to edit their own blacklist to remove monitoring hosts.

What to do

• Turn on log streaming and source IP logging for your Git platforms, and extend retention, before an incident.
• Plan patch releases assuming exploitation can start when the fix PR appears.
• If you self-host Flowise, Langflow, Kestra or the other listed tools, treat them as exposed to code execution. Flowise has no maintainer.
• When tuning detectors, build hard negatives from your own docs, logs and tool schemas. Hold some out, report easy and hard false-positive rates separately, and publish failures.

Caveats

Several Endor Labs reports were closed by vendors as working-as-designed. The Greptile study is from a vendor selling the resulting product. The Booz Allen claim that most models reach full kill-chain capability within six months is their own assessment. The newsletter gives no CVE ids, and the Endor Labs, cohttp and worm items are only summarized here.