[tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026

What it is

Issue #347 of the tl;dr sec newsletter (published around October 2026) links to roughly a dozen security write-ups. Most are summarized only by name in the catalog entry. The parts a defender or AppSec engineer can act on are the GitHub logging guidance, the Nginx $uri misconfiguration, the browser phishing defenses, and the details of the AI-harness and BlueMoon campaigns.

How it works

Nginx CRLF desync. Tom Stacey (PortSwigger) and Tobia Righi (TurtleSec) show that using $uri in a proxy_pass directive is the root cause. Nginx decodes the path before forwarding it upstream, so an attacker's %0d%0a becomes a real header boundary at the backend. That allows response queue poisoning. An injected Transfer-Encoding header gives a CL.TE desync. The worm variant fires XSS in a victim's browser and uses that browser to attack the next victim. Reported impact: leaked internal tokens at a telecoms provider ($20,000), card numbers exposed from inside a payment provider's Kubernetes cluster, and stolen unpublished TikTok clips via cookie tossing ($4,500).

AI-harness breaches. Gambit Security's Eyal Sela describes one financially motivated actor chaining three open-source harnesses: Strix (scanning), Cairn (exploitation) and Hermes (orchestration). Between July and September 2026 the actor compromised at least 27 companies. Total cost was $12,000 to $18,000, about $25 per target. Models used were GLM 5.2, DeepSeek v4 Pro and Opus-4.6 via OpenRouter. Over 600,000 cards were taken from two retailers, and skimmers were placed on 19+ sites. Skimmer methods included JavaScript file appending, S3 bucket poisoning and a Kubernetes initContainer on the production front end. One example chain: SQLi, MFA bypass, file upload, RCE, privilege escalation, AWS Secrets Manager dump, database decryption.

BlueMoon. Proofpoint reports that four mostly China-aligned espionage actors used a Chrome and Windows exploit kit from 28 August 2026. The chain is a V8 type confusion, a V8 sandbox escape and a Windows kernel LPE. Both V8 bugs were patch-gap zero-days: fixed upstream in Chromium source but not yet in stable builds. The LPE only works on older Windows builds. TA412's payload was GemStone, a browser extension disguised as Google Gemini.

Java gadget hunting. Stephen Breen (Atredis) used WALA call graphs in SQLite, a FastAPI query server and Claude Code with JDWP debugging. This found 17 confirmed chains (6 novel) in WildFly, Payara and IBM WebSphere in two days. The plans and runbook are in the llmchainhunter repo.

What to do

For GitHub PAT incidents, Wiz's Eden Abergil gives six steps: contain the PAT, reconstruct the timeline, find the leak source, assess blast radius, rotate exposed credentials, and hunt for unauthorized use of the leaked secrets.

Enable Enterprise Log Streaming before an incident. Reconnaissance api.request events appear only there, and git.clone events are retained for seven days.

For hunting, Datadog's guide baselines each user's repository access, source IPs and geography. It flags clones across unfamiliar teams, bulk downloads from hosting providers and off-hours activity. Track a token across event types with hashed_token, the most reliable identifier. In the PAT campaign (mid-May to early June 2026), the phases were API reconnaissance from AWS us-east-1, validation clones from a HostPapa IP, and mass exfiltration from 102 AWS ca-central-1 IPs.

For Nginx, audit proxy_pass directives that use $uri. Scanners: the Burp extension crlf-powered-desync-scanner and the nuclei templates crlf-desyncs.

Against fake-login phishing (Certitude Consulting), require Ctrl+Alt+Delete before every Windows login via Group Policy. Add phishing-resistant MFA and browser policies that block fullscreen and keyboard lock by default.

For dependency forensics, Andrew Nesbitt's git-pkgs indexes dependency history across 35 package managers into SQLite. It scans against OSV, outputs SARIF, and flags the same package version shipping different SHA-256 hashes across commits.

Caveats

Datadog lists logging quirks that break investigations:

• external_identity_nameid is missing from some api.request events.
• Identity and source IP are omitted on failed requests.
• Token permission metadata reflects the token's own organization.
• Repository visibility is split across visibility, public_repo and repository_public.

Certitude reported its browser bugs to Chromium and Mozilla in May 2024, and neither has given a patch timeline. The newsletter includes only brief summaries, so check the linked originals before relying on details.