[tl;dr sec] #341 - Hugging Face Incident Black Hat Talk, CSS Bomb in your Inbox, GitHub Supply Chain Security Improvements

What it is

tl;dr sec #341 is a newsletter issue that links roughly ten items. Those with specifics an engineer can act on are below. Clint Gibler writes the commentary. The page gives no CVE id or fixed WordPress version for wp2shell.

How it works

wp2shell (WordPress core, pre-auth RCE). Adam Kues of SL Cyber (Assetnote) found it with GPT 5.6 Sol Ultra, an adapted OpenAI "Cycle Double Cover" prompt, about $25 and 10 hours of compute. The chain:

• A batch API validation desync bypasses parameter sanitization.
• Recursive batch calls reach a SQL injection in the author__not_in parameter.
• Post cache poisoning fabricates oembed_cache rows.
• A parent-cycle detection gadget controls post_content.
• A customize_changeset temporarily assumes administrator privileges and triggers the parse_request hook, which creates a new admin account and leads to code execution.

Shubham Shah says it affects WordPress core (about 40% of the internet) and expects a difficult period of rising vulnerability discovery. Gibler says OpenAI security researchers find that understanding a model-built exploit takes a human 2x-5x as long as the model took to produce it. Wiz has a separate write-up on in-the-wild exploitation.

RubyGems API key leak (Truffle Security, Luke Marshall). Two faults combined. The app returned GET /api/v1/api_key responses without private cache directives. Fastly did not vary its cache on the Authorization header. Gzip responses were cached at the edge for up to an hour, so an unauthenticated request with curl --compressed could receive another user's legacy API key.

CSS in webmail (PortSwigger, Gareth Heyes, Black Hat). CSS can bypass sanitizers, exfiltrate tokens, spoof UI and steal passwords in Gmail, Outlook, Fastmail and ProtonMail. Techniques include:

• nested attribute selectors to brute-force Medium's 12-character hex tokens;
• font-height oracles with animations to leak numeric tokens when CSP blocks external resources;
• indirect prompt injection against OpenAI's Atlas browser;
• select-element keyloggers.

Heyes also points to Shazzer, a shared fuzzing platform for browser parsing quirks.

What to do

Cacheable authenticated endpoints. The RubyGems fix is the pattern to copy:

Cache-Control: private, no-store
Vary: Authorization

RubyGems also purged the affected caches and revoked all legacy API keys. If you run a CDN in front of authenticated APIs, check that both are set.

Supply chain controls GitHub has shipped or announced (Zachary Steindler and Greg Ose):

• safer pull_request_target defaults in actions/checkout, against "pwn requests";
• a read-only Actions cache for untrusted triggers, against cache poisoning;
• npm staged publishing, which needs extra 2FA approval beyond CI/CD credentials;
• npm v12 with install scripts disabled by default;
• a three-day Dependabot cooldown before version update PRs;
• a 72-hour read-only mode for high-impact npm accounts after an email change or 2FA recovery code use;
• workflow execution policies for trigger types;
• credential revocation API support for OAuth and App tokens;
• an Actions network egress firewall, in technical preview.

Detection health. The deadair CLI (Nikhil Satyakrishna) flags rules that run but cannot see data. It checks four failure modes:

• no matching source (for example a rule on winlogbeat-* while data lands in logs-windows.sysmon_operational-default);
• stale or empty sources;
• missing fields after ECS mapping changes, checked via field_caps;
• ingest lag longer than the rule's lookback window.

It supports Elastic Security and OpenSearch Security Analytics, needs only read-only metadata access (counts, timestamps, field_caps), can gate detection changes in CI, and can report coverage across tenants for MSSPs.

Coding agents. Daniel Koifman says promptware (prompt injection that poisons agent memory files) leaves no stable signatures. The signals he lists are file integrity monitoring of memory files, baselining of tool-call patterns, and auditing agent permission grants.

Agent permissions. Microsoft's Yesenia Yser and Toby Kohlenberg recommend:

• a dedicated lifecycle-managed identity per agent;
• narrow task-based roles, such as read-only retrieval and create-draft-ticket;
• tool allowlists;
• just-in-time, time-limited elevation;
• re-verification of claims by every downstream system;
• audit logs that record agent identity, role, scope, resource, action, on-behalf-of user and correlation ID.

Pitfalls they name are shared secrets across agents, prompts used as authorization boundaries, and logging only LLM output instead of tool invocations.

Caveats

• No patch or version guidance for wp2shell appears on the page.
• RubyGems impact was limited, because RubyGems CLI 3.2.0 and later no longer use the vulnerable GET endpoint.
• Shah doubts that whole bug classes will disappear, since the same ones have persisted for 20 years.
• Google's "Beyond Zero" authorization model (Heather Adkins and Archana Ramamoorthy) is covered only as a concept, with unquantified early results. The ACM Queue paper has the detail.
• This is a summary newsletter. Mechanisms and fixes should be checked against the linked primary posts.