Skip to content

780 results for β€œfile”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types780Articles211Write-ups205Repos152Papers67Advisories60Threads51
Tools24Talks7Courses1Other1Videos1
β€œfile”
github.comrepo🧠 AI

colibri: pure-C engine for running huge MoE models by streaming experts from disk

colibri is a pure-C, dependency-free inference engine that runs mixture-of-experts models of hundreds of billions of parameters on ordinary machines. It keeps the dense layers in RAM and streams routed experts from disk through a learning cache, with optional CUDA, Vulkan and Metal tiers. It supports GLM-5.2, Kimi K3, DeepSeek V4, Qwen3.6 and GGUF files, and serves OpenAI- and Anthropic-compatible APIs.

Mixture of ExpertsGGUFCUDA+10
GLM-5.2GLM-5.3GLM-5.3-Flash+22

inference, modelsΒ· Added 3 Nov 2026

latent.spacetalk🧠 AI

Building AI for Lawyers - Jacob Lauritzen, CTO of Legora

Latent Space podcast episode with Jacob Lauritzen, CTO of Legora, on building AI agents for lawyers. He describes evals built from RL environments such as a 10,000-file data room because traces cannot be read, routing across models, source-linked citations, and a few shared primitives (Tabular Review, lists, intake). Also covers legal engineers versus forward deployed engineers, Azure-only hosting, and the billable hour. Based on the first 40,000 characters of the transcript.

AzureSlackTabular Review+4
LegoraJacob LauritzenLatent Space+12

agents, evals, llm-appsΒ· Published and added 2 Nov 2026

techpolicy.pressarticle🧠 AI

The SEC Should Block Anthropic's IPO to Protect the Public

Matt Scherer argues in Tech Policy Press (2 November 2026) that the SEC should block Anthropic's planned November IPO until it files two consecutive quarters of audited statements. He cites about $895 billion in contractual commitments, $582 billion of them to Amazon, AMD, Broadcom, Google and Microsoft, unaudited 2026 results, slowing Q3 growth, price competition and data center costs.

LLM
AnthropicSECAmazon+10

ai-policyΒ· Added 3 Nov 2026, published 2 Nov 2026

hackers-arise.comarticleπŸ›‘οΈ Security

Network Forensics: Extracting Files and Credentials from Network Traffic with BruteShark

BruteShark is an open-source network forensic tool that parses PCAP/PCAPNG files and live traffic. The tutorial covers installing it on Kali Linux, extracting plaintext credentials as hashcat-format files, rebuilding VoIP calls, mapping the network and extracting files. It also shows live capture on eth0 with BPF filters such as SMB and Kerberos ports.

BruteSharkKali Linuxhashcat+2

Blue Team & Detection, Offensive Security, LearningΒ· Published and added 2 Nov 2026

openai.comarticle🧠 AI

Scaling Git at OpenAI

Pando is OpenAI's new Git backend, built to handle the push and fetch load Codex puts on its monorepo. It stores pushed packfiles in blob storage, tracks per-branch ref versions with causal consistency, and reuses packs across fetches. OpenAI reports nearly 5x lower median push latency and about a petabyte of Git data served per day. It was built in 10 weeks with Codex agents.

GitPandoCodex+10
OpenAIGPT-6 AstraDaybreak

ai-infra, coding-agentsΒ· Published and added 2 Nov 2026

securityweek.comarticleπŸ›‘οΈ Security

Revolve Data Breach Impacts at Least 180,000 People

Revolve, an online fashion retailer, disclosed a September 11 breach of systems including its e-commerce platform. Attackers may have exfiltrated names, addresses, card numbers and expiration dates that customers saved in their accounts. Notices filed with the Iowa, Massachusetts, Texas and Vermont attorneys general show at least 179,259 people notified. Revolve offers no credit monitoring, and the attacker and method are undisclosed.

RevolveSEC

Threat IntelΒ· Published and added 2 Nov 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

Ivanti patches two more Connect Secure zero-days chained in attacks

Ivanti patched two more Connect Secure zero-days, CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (authenticated file upload), chained with authentication bypass CVE-2026-104935 since at least 1 October 2026. Volexity attributed the chain to UTA0576, which ran no malware, re-exploited the device per command and tampered with logs, evading Ivanti's Integrity Checker Tool. CISA added CVE-2026-104935 to KEV, and Shadowserver tracks over 5,000 exposed instances.

Ivanti Connect SecureVPN
CVE-2026-111357CVE-2026-118527CVE-2026-104935+12

Threat Intel, Offensive SecurityΒ· Published and added 2 Nov 2026

en.cryptonomist.charticle🧠 AI

Anthropic’s internal use of Claude topped staff costs at list prices by April

Report on Anthropic's IPO prospectus, filed 26 October 2026. It says the value of internal Claude use at customer list prices exceeded monthly personnel costs (excluding equity awards) by April 2026. Internal usage value rose more than 250-fold from January to September 2026, and Claude wrote over 90% of new code. The filing gives no compute cost or dollar figure.

Claude
Anthropic

ai-policy, coding-agentsΒ· Published and added 2 Nov 2026

securityweek.comarticleπŸ›‘οΈ Security

Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

Ivanti patched two more Connect Secure zero-days, CVE-2026-111357 (CVSS 8.8, local privilege escalation) and CVE-2026-118527 (CVSS 4.3, predictable identifiers allowing file upload), chained with the authentication bypass CVE-2026-104935. Fixes are in ICS 25.1.1.3 and 22.8R2.6. Volexity attributed the chain, which gave unauthenticated root code execution, to UTA0576, and CISA added both new bugs to KEV.

Ivanti Connect SecureVPNCVSS
CVE-2026-111357CVE-2026-118527CVE-2026-104935+6

Threat Intel, Offensive SecurityΒ· Published and added 2 Nov 2026

adversa.aiarticleπŸ›‘οΈ Security

Top AI coding agent security resources β€” November 2026

Adversa AI's November 2026 roundup of 14 AI coding agent security resources from October. It covers CVE-2026-103572 (Visual Studio Copilot and SSMS RCE via trailing-dot filename), an unpatched Claude Code child-session hook bypass, a Copilot CLI cryptographic context injection, and a CVE-less opencode MCP OAuth RCE. It ends with a checklist for auditing agent configs and gateways.

Claude CodeGitHub Copilot CLIOpenCode+3
CVE-2026-103572prompt injectionindirect prompt injection+7

AI Security, Supply ChainΒ· Published and added 2 Nov 2026

x.comthread🧠 AI

Luke The Dev (@iamlukethedev) on X

Hermes, the Nous Research agent framework, shipped 130 merged PRs in October 2026, according to this X recap by Luke The Dev. Main items are a unified gateway runtime, a Desktop and Bot Screen, a bundles and package manager, crash-safe updates and new Claude model entries. Ten PRs cover security: an iron-proxy credential-injection egress firewall for sandboxes, 31 CVEs patched in Python and npm lockfiles, and profile-export and prompt-leak fixes.

Hermesiron-proxyPython+2
Nous ResearchLuke The Dev

agents, ai-infraΒ· Added 2 Nov 2026

alignmentforum.orgarticle🧠 AI

Explaining β€œAI might obliterate you” to senior policymakers in India

Explaining "AI might obliterate you" to senior policymakers in India is an AI Alignment Forum post by TurnTrout, dated 31 October 2026, with a 15-minute read time. It is filed under Plan A, Regulation and AI Risk, and Slowing Down AI. The fetched page shows no body text, so the arguments and any account of the India policy discussions are not available here.

AI Alignment ForumTurnTrout

ai-policy, ai-safetyΒ· Published and added 31 Oct 2026

arxiv.orgpaper🧠 AI

What Does a Safety Label Measure? Auditing Situational-Safety Benchmarks for Multimodal LLMs

The paper audits six situational-safety benchmarks for multimodal LLMs and proposes the Benchmark Card, seven measured fields that show whether a SAFE/UNSAFE label score comes from the scene, the request or the benchmark files. MSSBench chat leaks its label through image size, which alone reaches 82.3% accuracy. The Spot-Stop decomposition splits ranking-versus-labelling gaps across fourteen open MLLMs, and label-free recentering improves ranking on VSCBench for 13 of 14 models.

vision-language modelLLM
MSSBenchMOSSBenchHoliSafe+2

evals, ai-safety, multimodal, researchΒ· Added 3 Nov 2026, published 31 Oct 2026

x.comthreadπŸ›‘οΈ Security

Dark Web Intelligence (@DailyDarkWeb) on X

CVE-2026-102764 is an unauthenticated RCE in BeyondTrust Remote Support, already exploited and in CISA KEV. Rapid7 published an analysis and opened a Metasploit pull request on 30 October 2026, showing code execution on version 24.1.2 via a forged "local" message origin, the native file-transfer service and a PHP file written to the web root. BT26-05 (CVSS 4.0 9.3) is fixed by patch BT26-05-RS; SaaS was patched by 9 October.

BeyondTrust Remote SupportMetasploitPHP+1
CVE-2026-102764CISA KEVRapid7+2

Offensive Security, Threat Intel, AppSecΒ· Added 1 Nov 2026, published 31 Oct 2026

wiz.iowriteupπŸ›‘οΈ Security

β€œBlack October” for AI Developer Platforms

Wiz Research links October 2026 breaches at AI developer platforms (Fireworks, OpenCode, Warp, Zeabur, Railway and others) to stolen environment-variable credentials for AI access. It details two enterprise AWS Bedrock keys abused after vendor breaches: about 800k and 1.7 million calls, over $100k in list-price usage. It profiles two LLM resale operations, "momo" and "Xingjiabi", that tested the keys.

AWS BedrockOpenCodeClaude+3
LLMjackingdistillationWiz Research+13

Threat Intel, AI Security, Cloud & InfraΒ· Added 31 Oct 2026, published 30 Oct 2026

x.comthreadπŸ›‘οΈ Security

Julie Sanchez (@julie199201) on X

YourOwnWeigh is an open-source tool by developer Tom Anthony that patches Withings smart scale firmware over Bluetooth. The patch sends health metrics to a user's own server instead of Withings cloud, avoiding the Withings Plus subscription now required for third-party sync. It can run on a free Cloudflare account and imports existing user profiles. The post gives no firmware or protocol details.

YourOwnWeighWithingsCloudflare+1
Tom Anthony

Hardware & RFΒ· Added 2 Nov 2026, published 30 Oct 2026

bankless.comarticleπŸ›‘οΈ Security

Polymarket Sends $3.9M Back to Traders After Vendor Script Drain

Polymarket's international site was hit on 29 October 2026 when a page-speed monitoring script served from DebugBear's CDN was replaced with a drainer. It hijacked logged-in sessions for about an hour and took $2.7M from 726 wallets via Polymarket's relayer. Scott Helme of Report URI says the CSP allowlisted every domain used and that hash pinning would have blocked the swapped file. Polymarket is repaying $3.9M, and this is its second vendor-script compromise since June.

Polymarket
DebugBearReport URIBitquery+1

Supply Chain, AppSecΒ· Published and added 30 Oct 2026

ethereum-magicians.orgthreadπŸ›‘οΈ Security

Pre-ERC: x402 Payee Verification for ERC-8004 Agents

Pre-ERC draft on Ethereum Magicians that binds the x402 payTo address to an ERC-8004 agent's registered agentWallet, directly or through an EIP-712 payee delegation (ERC-1271 for contract wallets). It lists eight fixed checker outcomes and requires the resource origin to appear in the registration file. On Robinhood Chain (28 October 2026), 5,575 of 20,046 agents answered with x402 requirements, and only 5 used their agentWallet as payTo.

x402Ethereumtoll
ERC-8004ERC-8470EIP-712+5

AI Security, Identity & AccessΒ· Published and added 30 Oct 2026

ethereum-magicians.orgthread🧠 AI

ERC-8478: x402 Payee Verification for ERC-8004 Agents

ERC-8478 is a draft Ethereum standard that binds the payTo address in an x402 payment requirement to the seller's ERC-8004 agent identity. A payer compares payTo with the registered agentWallet, or accepts an EIP-712 payee delegation signed by it, and checks that the origin is listed in the registration file. On Robinhood Chain, 5 of 5,575 x402-responding agents had payTo equal to agentWallet (28 October 2026).

x402ERC-8004Ethereum+3
ERC-8478ERC-8470CAIP-10+1

agentsΒ· Published and added 30 Oct 2026

ethereum-magicians.orgthreadπŸ›‘οΈ Security

ERC-8478: x402 Payee Verification for ERC-8004 Agents

ERC-8478 is a draft Ethereum standard that binds the x402 payTo address to an ERC-8004 agent's identity, to stop payee redirection by a hijacked domain, proxy or injected tool result. A payTo must equal the agentWallet or carry an EIP-712 delegation signed by it, and the origin must be listed in the registration file. On Robinhood Chain, 5 of 5,575 x402-responding agents used their agentWallet as payTo (28 October 2026).

x402ERC-8004Ethereum+2
ERC-8478ERC-8470EIP-712+3

AI Security, BlockchainΒ· Published and added 30 Oct 2026

ethereum-magicians.orgthread🧠 AI

Pre-ERC: x402 Payee Verification for ERC-8004 Agents

Pre-ERC draft on the Ethereum Magicians forum that ties the payTo address in an x402 payment requirement to the seller's ERC-8004 agent identity. The payTo must equal the registered agentWallet or an EIP-712 delegation signed by it, and the origin must be listed in the registration file. A checker returns one of eight fixed outcomes. On Robinhood Chain, 5 of 5,575 x402-enabled agents out of 20,046 used their agentWallet as payTo.

x402ERC-8004Ethereum+4
ERC-8470RobinhoodEthereum Magicians

agentsΒ· Published and added 30 Oct 2026

interconnects.aiarticleπŸ›‘οΈ Security

Was I wrong about open models & cyber risks?

Interconnects post in which Nathan Lambert revisits his claim that an open-weight release of Claude Mythos in April 2026 would have been survivable. He argues GLM-5.3 already crosses that capability threshold with little visible harm. He cites Epoch AI's GLM-5.3 Firefox file-exfiltration exploit and Joshua Saxe's trend data, and says recent vulnerability waves come mostly from closed models and general AI diffusion.

GLMFirefoxGitLab+1
MythosProject GlasswingPHP2Shell+9

AI Security, otherΒ· Published and added 30 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces

PrivacyTrace is a benchmark of 1,000 synthetic user profiles and 4,000 agent trajectories across four domains, built with real tools from 25 MCP servers. Four LLM attackers inferred user attributes from tool-call traces alone at a 26.25% success rate, against 17.97% for prior-based guessing. Tool arguments and returned results gave the main evidence, and linking traces across sessions raised the risk.

Model Context ProtocolLLM
PrivacyTraceuser profile inferencebehavioral side channel

AI SecurityΒ· Added 3 Nov 2026, published 30 Oct 2026

arxiv.orgpaper🧠 AI

How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces

PrivacyTrace is a benchmark from the Shanghai AI Laboratory (AgentDoG Team, October 2026) that tests how much a passive observer can infer about a user from MCP tool-call traces alone. It has 1,000 synthetic profiles, 4,000 trajectories and 67,950 calls across 25 MCP servers. Four LLM attackers reached 26.25% attribute accuracy against a 17.97% prior baseline, and tool arguments leaked most.

Model Context ProtocolPydantic AILLM+1
PrivacyTraceShanghai AI LaboratoryAgentDoG Team+5

evals, mcp, researchΒ· Added 3 Nov 2026, published 30 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Fresh WordPress Vulnerability in Attackers’ Crosshairs

A WordPress core race condition in the update process, patched in WordPress 7.1.4 on 28 October 2026, allows unauthenticated remote code execution with high attack complexity. New files unpack into a predictable, web-accessible staging directory. Defiant's Wordfence logged over 18,500 requests for staged setup-config.php paths in 21 hours, with no confirmed compromises. No CVE is assigned yet. The release fixes 22 flaws in total.

WordPressWordfencePHP
DefianteMudhrarace condition

AppSec, Threat IntelΒ· Published and added 30 Oct 2026

x.comthreadπŸ›‘οΈ Security

ESET Research (@ESETresearch) on X

ESET Research thread summarising its APT Activity Report for April to September 2026 on Russia-aligned groups targeting Ukrainian defense, government and infrastructure. Gamaredon deployed Turla's new VBScript recon tool Rezzuar, indicating FSB-linked collaboration, and updated its file stealer PteroBox while activity fell sharply from mid-May. A separate campaign hit MDaemon mail servers via CVE-2025-8088, delivering HELLAGE and HELLTAG backdoors with no user interaction.

MDaemonClamAVWinRAR+1
CVE-2025-8088GamaredonTurla+6

Threat IntelΒ· Added 31 Oct 2026, published 30 Oct 2026

x.comthread🧠 AI

aiproduck (@aiproduck) on X

Ruflo is an MIT-licensed wrapper for Claude Code and Codex that adds agent swarms, vector memory and an MCP server. The plugin install writes no files to the workspace, while npx init adds a .claude/ directory, CLAUDE.md and hooks. The post warns that mods run with the account's permissions, so users should read them first. It gives no benchmarks or architecture detail.

Claude CodeCodexModel Context Protocol+1
Ruflo

coding-agents, agents, mcpΒ· Published and added 30 Oct 2026

youtu.bevideoπŸ›‘οΈ Security

Muse pdfdetach POC

The uploader demonstrates a remote code execution exploit chain against Muse, an assistant system that uses the pdfdetach utility to parse PDF attachments. The exploit leverages a path traversal vulnerability during file extraction to drop a malicious shared library and an LD_PRELOAD configuration file.

MusepdfdetachPython

AppSecΒ· Published and added 30 Oct 2026

oversecured.comarticleπŸ›‘οΈ Security

Android security checklist: theft of arbitrary files | Oversecured Blog

Oversecured's Android security checklist on arbitrary file theft from an app's private storage. It covers implicit intents (PICK, GET_CONTENT) returning file:// or content:// URIs, SEND/SEND_MULTIPLE share activities, exported and non-exported FileProviders, path traversal via Uri.getLastPathSegment, WebView, and local NanoHTTPD servers. Each case has vulnerable code, an attacker PoC and fixes such as /proc/self/fd path checks and narrow files-path entries.

AndroidNanoHTTPDFileProvider+2
Oversecuredpath traversalFileUriExposedException+3

Mobile Security, AppSecΒ· Added 29 Oct 2026

oversecured.comarticleπŸ›‘οΈ Security

Content Providers and the potential weak spots they can have | Oversecured Blog

Oversecured's Android security checklist for Content Providers covers insecure FileProvider path configs, path traversal via decoded Uri.getLastPathSegment(), mismatched readPermission/writePermission, proxying requests to more privileged providers, SQL injection across a shared database, and sensitive actions in providers. Each case has vulnerable manifest and Java code, an attacker PoC and remediation. Real cases from Google and Samsung devices are cited. The page text was truncated near the end.

AndroidSQLiteJava
Oversecuredpath traversalSQL injection+5

Mobile Security, AppSecΒ· Added 29 Oct 2026

oversecured.comwriteupπŸ›‘οΈ Security

20 security issues found in Xiaomi devices

Oversecured's write-up of 20 vulnerabilities in Xiaomi apps and system components, reported to Xiaomi between 25 and 30 April 2023. Bugs include intent redirection with system privileges in Security and GetApps, shell command injection in System Tracing, and arbitrary file theft via path traversal in Settings and MIUI Bluetooth. Each has a PoC. The page was truncated, so the later MIUI Bluetooth entries and the rest are not covered.

AndroidGson
OversecuredXiaomiMIUI+9

Mobile Security, AppSecΒ· Added 29 Oct 2026

oversecured.comwriteupπŸ›‘οΈ Security

Disclosure of 7 Android and Google Pixel vulnerabilities

Oversecured discloses seven Android vulnerabilities, two of them Pixel-specific, all reported to Google and fixed except one low-severity WebView case. They are the Camera geolocation leak (CVE-2024-0017), a VPN bypass list change (CVE-2023-21383), a Bluetooth permission check flaw (CVE-2024-34719), the WorkSource parcel mismatch (CVE-2023-20963, exploited in the wild by the Pinduoduo app), Device Admin HTML injection (CVE-2021-0600) and a ContentProvider.openFile() caller-context bypass (CVE-2023-21292). Each has root cause and PoC code.

AndroidGoogle PixelWebView+2
CVE-2024-0017CVE-2023-21383CVE-2024-34719+9

Mobile Security, Offensive SecurityΒ· Added 29 Oct 2026

oversecured.comarticleπŸ›‘οΈ Security

SDK security in mobile apps: the attack surface your team didn

Oversecured guide to SDK security in mobile apps, built around Microsoft's April 2026 disclosure of an intent redirection flaw in EngageLab's EngageSDK (50 million installs, fixed in 5.2.1). It covers SDK attack surfaces (exported components, WebViews, deep links, hardcoded secrets, payment crypto), a canhub image cropper file-overwrite example, why source-only SAST misses SDK code, and MASVS and PCI DSS expectations.

AndroidEngageSDKOversecured+3
intent redirectionEngageSDK intent redirectionMTCommonActivity+11

Mobile Security, Supply Chain, AppSecΒ· Added 29 Oct 2026

github.comrepoπŸ›‘οΈ Security

Show HN: Auto Dismiss Mac OS "Allow <app> to find devices on local networks?"

dontallow is a two-file Swift launchd agent for macOS 15 and later that clicks "Don't Allow" on the "find devices on local networks" prompt. It watches the UserNotificationCenter process through an Accessibility observer, supports pause and allowlist, and can decode the Local Network rule store to show orphaned rows. It explains why Chromium temp-bundle paths make the prompt recur, and gives a PPPC profile route for fleets.

macOSSwiftlaunchd+2
Local Network privacy promptPPPCTCC

Cloud & InfraΒ· Added 30 Oct 2026, published 29 Oct 2026

x.comthread🧠 AI

Prasenjit Sarkar (@stretchcloud) on X

A thread on Cloudflare's agent-readiness scan and the AgentReady.org open spec for "Agent Experience", developed with Vercel, Stripe, Auth0, Mintlify, Google, Netlify and Elementor. The scan grades whether agents can find a site (robots.txt, DNS), read clean Markdown, pass bot rules, and discover an MCP server or API catalog. One quoted example raised a score from 20 to 67 by shipping an API catalog with Link headers, an MCP server card, a skills index and an AI catalog file.

Model Context ProtocolCloudflareMarkdown
AgentReady.orgOraNick Launches+7

mcp, agentsΒ· Added 30 Oct 2026, published 29 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

Hackers Publish Work Details of 41,000 Homeland Security Employees

Icepick is a dataset published on 28 October 2026 by Distributed Denial of Secrets. It lists 41,191 DHS employees and contractors with names, titles, offices, phones, managers and 55,000+ permission groups. The hacktivist group Department of Peace says it took the data from DHS's Okta SSO; Okta denies compromise. DHS has filed a takedown notice via ZeroFox, and the full archive is unverified.

Okta
Distributed Denial of SecretsIcepickDepartment of Peace+8

Threat Intel, Identity & AccessΒ· Published and added 29 Oct 2026

hackers-arise.comarticleπŸ›‘οΈ Security

Digital Forensics: Analyzing Windows Prefetch Files for Evidence

Windows Prefetch forensics tutorial from Hackers Arise. It explains that prefetch files in C:\Windows\Prefetch record last run time, run count and files touched, so they prove an application was used even after deletion. It shows parsing with NirSoft WinPrefetchView, building a timeline from Last Run Time, and how a suspect could disable Prefetch or Superfetch (SysMain).

WindowsWinPrefetchViewAutopsy
PrefetchSuperfetchSysMain+1

Blue Team & Detection, LearningΒ· Published and added 29 Oct 2026

wiz.ioarticleπŸ›‘οΈ Security

The Rise of Agentic Attacks: What They Look Like, and Where They're Headed

Wiz Research reviews agentic attacks seen in its incident response work and in public reports (ARTEX, Hermes, JPCERT/CC, CrowdStrike, DIVD). It derives fingerprints of AI-agent activity from three intrusions: machine-paced iteration, natural-language reasoning in scripts, self-correcting script versions, checklist enumeration, noisy lateral spraying, probe-before-payload and self-labeled scratch files. It also covers effects on attribution, attack scale and defense.

KubernetesAWSClaude Code+2
ARTEXHermesStorm-0940+12

Threat Intel, Blue Team & Detection, AI Security, Cloud & InfraΒ· Published and added 29 Oct 2026

wiz.iowriteupπŸ›‘οΈ Security

The Rise of Agentic Attacks: What They Look Like, and Where They're Headed

Wiz research on intrusions where AI agents do the hands-on attacker work. It reviews public cases (ARTEX against South Korean banks and the ConnectWise compromise, Hermes at Thailand's Ministry of Finance, JPCERT/CC, CrowdStrike, DIVD) and three Wiz-investigated attacks. It distills fingerprints: machine-paced iteration, embedded natural-language reasoning, self-correcting scripts, checklist enumeration, noisy lateral movement, probe-before-payload habits and self-named scratch files. It also covers attribution, scale and defense implications.

WizKubernetesAWS+2
ARTEXHermesStorm-0940+12

Threat Intel, Blue Team & Detection, AI Security, Cloud & InfraΒ· Published and added 29 Oct 2026

x.comarticle🧠 AI

Damir I on X: "Two developers, four agents, one repo: a setup for pairs" / X

A guide to avoiding merge conflicts when two developers each run Claude Code and Codex on one repo. It cites Brun, Holmes, Ernst and Notkin: 16% of merges had textual conflicts, and 93% grew from unshared commits. It gives four steps (person/agent/task branch names, push at first commit, a partner-files script, a git merge-tree pre-push hook), then pitches the agentmash live-warning tool.

GitClaude CodeCodex+2
agentmashBrunHolmes+2

coding-agentsΒ· Added 30 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Turing LLM Post-Training: Calibrated Distillation and Efficient Dynamic-MoE Execution

Turing LLM post-training combines calibrated multi-teacher on-policy distillation (C-MOPD) with an execution path for dynamically routed mixture-of-experts models. C-MOPD matches each teacher on a local Top-K support with teacher-wise loss normalization and clipping. On Turing-20B-A2B it scores 0.9988 on four-domain integration, beats Qwen3-8B on math and code (85.92 vs 80.33 mean), and cuts consolidation step time from 398.7 to 139.3 seconds in a PPU profile.

Mixture of ExpertsC-MOPDon-policy distillation+1
Turing-20B-A2BarXiv

training, researchΒ· Added 31 Oct 2026, published 29 Oct 2026

x.comtool🧠 AI

Jurly (@jurlycat) on X

Chums is a free, open-source Apple Watch app that turns Claude Code and Codex sessions running on a Mac into animated characters, in the spirit of Muse Charm. Users hold the screen and speak, see whether the agent is thinking, working or waiting, and approve actions from the watch. Each character has its own session, personality and voice. The iPhone companion app adds photos, files and interactive results. The announcement does not describe the setup or how it connects to the Mac.

Claude CodeCodexmacOS+1
ChumsMuseApple

coding-agentsΒ· Added 30 Oct 2026, published 29 Oct 2026

opensourcemalware.comtalkπŸ›‘οΈ Security

The OpenSourceMalware Show #27

The OpenSourceMalware Show #27 (28 October 2026) is a podcast episode with transcript. It covers the Brotli decoder bug (CVE-2026-111497) vendored in C code across Python, Rust and PHP, and how to find copies via decode.c. It also covers the LiteLLM v1.107.0 compromise from an unrevoked admin key and a relaxed release control, and the MALFEX npm campaign hiding payloads in PNG-header files, plus an AGENTS.md lure and DPRK fake fonts in TTF/OTF.

BrotliLiteLLMnpm+3
CVE-2026-111497Node2ShellPHP2Shell+10

Supply Chain, Threat Intel, DevSecOpsΒ· Published and added 29 Oct 2026

divagr.comwriteup🧠 AI

Qwenputer: A functioning, deterministic RISC-V CPU inside Qwen3.5

Qwenputer is a stock Qwen3.5 4B with a 32-bit RISC-V CPU (RV32IM plus Zba and a bignum unit) compiled directly into added layers, with no training. Gated DeltaNet states act as exact RAM via gate 1, beta 1 and one-hot keys. It scores 97.5 to 100% on DeepMind arithmetic sets, and 100% on NUPA long-integer arithmetic. It also has an experimental in-model filesystem. The checkpoint is 18.8 GB and needs the RvChat driver.

Qwen3.5Gated DeltaNetRISC-V+6
QwenputerQwenModelScope+6

research, modelsΒ· Published and added 29 Oct 2026

x.comthread🧠 AI

TENSA Engineering (@TENSAEng) on X

A post by TENSAEng describing a workflow for staying within coding-tool usage limits. ChatGPT chat sits outside those limits, while Claude and Grok chats share a pool with Claude Code, Codex and Grok Build. Architecture, file layout, step order and acceptance checks are planned in ChatGPT and saved as repo docs. Claude Code or Codex then implements one small chunk per fresh session.

ChatGPTClaude CodeCodex+2

coding-agents, ai-policyΒ· Added 29 Oct 2026, published 28 Oct 2026

surgehq.aiarticle🧠 AI

Dayjob: Tax – evaluating AI agents on 50 professional tax assignments

DAYJOB: Tax is Surge AI's benchmark of 50 professional tax assignments across eight practice areas, with 1,789 workspace files such as returns, K-1s, ledgers and IRS notices. Claude Sonnet 5.5 leads at a 10.8% pass rate (pass@1, 95% rubric threshold), ahead of Claude Fable 5.1 (9.6%) and Claude Opus 5.5 (9.2%). Case studies show agents missing deadlines and unverified marital-status assumptions.

Claude
Surge AIDAYJOBDAYJOB: Tax+7

evals, agentsΒ· Added 29 Oct 2026, published 28 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Chrome 156 and Firefox 159 security updates fix over 200 vulnerabilities. Chrome 156 patches 52 flaws, four critical, including CVE-2026-118306, a FileSystem memory corruption bug that allows code execution outside the sandbox via a crafted HTML page. Firefox 159 fixes 167 flaws, 108 high severity, mostly use-after-free, plus Thunderbird and ESR releases. No in-the-wild exploitation is reported.

ChromeFirefoxThunderbird+1
CVE-2026-118306use-after-freesandbox escape

AppSec, otherΒ· Published and added 28 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

When LLM Architectures Meet Smart Contract Vulnerability Detection: a Replication Study

This arXiv paper (October 2026) replicates Chen et al.'s study of LLM-based smart contract vulnerability detection. It confirms the high-recall, low-precision pattern on GPT-4, then tests Mixture-of-Experts and RNN-like models plus a preliminary State Space Model run. Gemma-3 matches GPT-4's profile despite far fewer parameters, while two Mixture-of-Experts models diverge, so architecture family alone does not predict detection behavior.

GPT-4GemmaLLM
Chen et al.

AI Security, AppSecΒ· Added 30 Oct 2026, published 28 Oct 2026

arxiv.orgpaper🧠 AI

From Leniency to Suspicion: How an Open Post-Training Recipe Changes Whom LLM Fact-Checkers Believe

This paper measures job-based doubt in LLM fact-checkers: judging a claim false more often when the poster has a lower-status job. It compares base and post-trained checkpoints of six model families on fact-checked claims with randomised poster profiles. Only the open TΓΌlu-3 recipe (OLMo-2 32B, TΓΌlu-3 70B) creates the effect, under one percentage point but reliable. In OLMo-2 32B the flip comes from one residual-stream direction and appears at supervised fine-tuning, confirmed on 400 new claims. None of seven commercial models doubts lower-status posters more.

LLMTransformer
OLMo-2 32BTΓΌlu-3TΓΌlu-3 70B+3

research, ai-safety, trainingΒ· Added 30 Oct 2026, published 28 Oct 2026

endorlabs.comarticle🧠 AI

ADLC compliance: Mapping agentic development to NIST SSDF, OWASP, and the EU AI Act | Endor Labs

ADLC compliance is Endor Labs' interpretation of how NIST SSDF (SP 800-218), the OWASP LLM and Agentic Top 10 lists, and the EU AI Act apply to software built with coding agents. It splits requirements into a code surface and an action surface (shell, files, MCP calls, package installs). It gives a four-step EU AI Act scoping path and says that system prompt rules and agent self-reports are not audit evidence.

CursorClaude CodeModel Context Protocol+3
Endor LabsNISTOWASP+3

ai-policy, coding-agentsΒ· Published and added 28 Oct 2026

endorlabs.comarticleπŸ›‘οΈ Security

ADLC compliance: Mapping agentic development to NIST SSDF, OWASP, and the EU AI Act | Endor Labs

ADLC compliance guide from Endor Labs that maps agentic development to NIST SSDF (SP 800-218 v1.1), the OWASP LLM Top 10 2025 and Agentic Top 10, and the EU AI Act as amended by Regulation (EU) 2026/1744. It splits controls into a code surface and an action surface (shell, file access, MCP calls, package installs). It gives a four-step AI Act scoping path, the new Annex III date of 2 December 2027, and evidence guidance. It states the crosswalk is the vendor's interpretation, not legal advice.

Endor LabsModel Context ProtocolClaude Code+3
NIST SSDFNIST SP 800-218NIST SP 800-218A+13

GRC, AI Security, Supply ChainΒ· Published and added 28 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

Dark Web Informer (@DarkWebInformer) on X

Veeam patched five vulnerabilities across Backup & Replication, Veeam Agent for Linux and Veeam ONE. The worst is CVE-2026-108142 (CVSS 9.1), an unauthenticated authorization bypass in the CDP Coordinator Service affecting Backup & Replication 13.0 and 13.1. Other fixes cover Linux agent privilege escalation, two path-traversal file writes, and a Veeam ONE MFA bypass; fixed builds are listed.

Veeam Backup & ReplicationVeeam Agent for LinuxVeeam ONE+1
CVE-2026-108142CVE-2026-105477CVE-2026-108140+3

AppSec, Identity & AccessΒ· Added 30 Oct 2026, published 28 Oct 2026

brangus.iotool🧠 AI

Survival LLM: AI assistant and emergency library that runs on your own computer

Survival LLM is a free, open-source desktop app for macOS (Apple Silicon) and 64-bit Windows that runs an AI model and an offline emergency library on the user's computer. It checks the machine's memory, downloads a fitting model, and answers from sources such as Wikipedia, WikiMed, Ready.gov and CDC guidance, citing each article. Users can add their own files; version 0.3.2 is dated October 2026.

LLMRAGmacOS+1
Survival LLMWikipediaWikiMed+9

llm-apps, inferenceΒ· Added 28 Oct 2026, published 27 Oct 2026

cisa.govadvisoryπŸ›‘οΈ Security

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA alert of 27 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog on evidence of active exploitation: CVE-2026-48356, an unrestricted upload of a dangerous file type in Adobe Commerce and Magento, and CVE-2026-111497, an unchecked return value in Google Brotli. It restates BOD 26-04, which makes federal civilian agencies prioritise KEV flaws on exposed assets and check for prior compromise. No technical detail or IOCs are given.

Adobe CommerceMagentoBrotli
CVE-2026-48356CVE-2026-111497CISA KEV+2

AppSec, GRCΒ· Added 29 Oct 2026, published 27 Oct 2026

aws.amazon.comarticleπŸ›‘οΈ Security

Part 3 – Cybersecurity journeys: The work behind the work

Part 3 of the AWS Security Blog series on cybersecurity careers profiles three AWS staff: Brandon Caldwell (application security, empathy and communication), Kurt Heath (self-taught pen tester, cautious AI use) and Seth Jeacopello (code review, managing attention). It gives practical advice: practice on vulnerable machines and read the logs, build CTF and GitHub portfolios, and write clearly. It lists TryHackMe, Hack The Box, the OWASP Top 10, OWASP Cheat Sheet Series, Darknet Diaries and AWS Skill Builder.

TryHackMeHack The BoxAWS Skill Builder+1
Brandon CaldwellKurt HeathSeth Jeacopello+6

Learning, AppSecΒ· Published and added 27 Oct 2026

stanforddaily.comarticle🧠 AI

Anthropic trained Claude on illegally obtained Stanford professors' books

Stanford Daily report on Stanford authors whose books were pirated to train Anthropic's Claude. It covers the $1.5 billion Bartz v. Anthropic settlement (nearly 500,000 works, about $3,000 each) and Judge Alsup's split ruling: pirated central library not allowed, training on lawfully acquired books is fair use. Tobias Wolff and Chang-Rae Lee opted out and filed Cruz v. Anthropic in May 2026 seeking up to $150,000 per work.

ClaudeLLM
AnthropicBartz v. AnthropicCruz v. Anthropic+14

ai-policyΒ· Added 28 Oct 2026, published 27 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Unexplained DreamHost Incident Prompts Email, FTP Password Resets

DreamHost suspended its File Manager (files.dreamhost.com) and reset passwords for some email and FTP/SFTP users after an unexplained issue affecting File Manager and webmail. Account owners were told to set new passwords and change reused ones; users questioned whether passwords were compromised or properly hashed. DreamHost deployed a fix on Monday. Root cause and number of affected users were not disclosed.

DreamHostSFTP

Threat IntelΒ· Published and added 27 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

CVE-2026-115905 is a ZIP cloaking flaw in the Rust zip crate (zip-rs/zip2), rated CVSS v4.0 10.0 and affecting versions below 9.0.5. ZipArchive reads central-directory metadata while ZipStreamReader reads local headers, so a crafted archive can pass filename inspection and then overwrite a different file during streaming extraction. Version 9.0.5 adds consistency checks, but ZipStreamReader::new leaves them off by default, and extraction is not atomic, so files can be written before an error is raised. The post covers CWE-20 and CWE-436, KEV and EPSS status, Debian status and a six-step investigation trail.

Rustzip crateCargo+3
CVE-2026-115905CWE-20CWE-436+3

AppSec, Blue Team & DetectionΒ· Added 29 Oct 2026, published 27 Oct 2026

x.comthread🧠 AI

Prasenjit Sarkar (@stretchcloud) on X

Campfire is a self-hosted workspace by Prasenjit Sarkar that runs Claude Code, Codex, Goose, Aider and OpenHands side by side in one tab. Risky actions go through permission voting: a majority approves, any single deny blocks, and a 30 second timer ends the wait. Session replay shows which file or tool call triggered an action. The post cites Forever Security's report of a planted AGENTS.md. Codex followed it first time over 90% of the time and Claude Code about half the time. Try it with "bunx the-campfire".

Claude CodeCodexGoose+7
CampfirePrasenjit SarkarForever Security+2

coding-agents, agentsΒ· Added 28 Oct 2026, published 27 Oct 2026

x.comthreadπŸ›‘οΈ Security

Prasenjit Sarkar (@stretchcloud) on X

Campfire is a self-hosted tool that runs Claude Code, Codex, Goose, Aider and OpenHands in one tab. Risky actions need permission voting (majority approves, any single deny blocks, 30 second timeout), and session replay traces which file or tool call triggered an action. The post cites Forever Security's finding that Codex followed a planted AGENTS.md instruction over 90% of the time and Claude Code about half the time. It also cites the February Cline release compromise via a poisoned GitHub Actions cache.

CampfireClaude CodeCodex+3
Forever SecurityAGENTS.mdprompt injection+1

AI SecurityΒ· Added 28 Oct 2026, published 27 Oct 2026

latent.spacearticle🧠 AI

[AINews] Anthropic files for $2T IPO in 2 weeks: 1400% growth rate, 48% of revenue through cloud partners, 85% margin, $1B op profit in Q2, $134B cash in bank and $10B lifetime burn

AINews issue from Latent Space on 27 October 2026, led by Anthropic's S-1 filing for a Nasdaq listing (ticker ANT). It reports H1 2026 revenue of $16.3B, an 85% gross margin, $974M Q2 operating profit and 48% of revenue through cloud marketplaces, with reactions from named analysts. It also covers model releases, inference economics and agent tooling. The page text is truncated.

ClaudeClaude CodeHugging Face+7
AnthropicLatent SpaceSemiAnalysis+28

ai-policy, models, inferenceΒ· Published and added 27 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Poly2MsgLeaks: Certified Key Recovery from Polynomial-to-Message Leakage

Poly2MsgLeaks is a profiled chosen-ciphertext power-analysis attack on the SMAUG-T (TiMER parameter set) post-quantum KEM that recovers the full 512-coefficient PKE secret from six traces on an STM32F415. It recovers 999 of 1,000 unseen secrets and proves an incorrect key is released with probability at most 2^-2095.6. Single-write message assembly and a two-share masked P2M resisted the evaluated six-execution attack.

SMAUG-TSTM32F415
Poly2MsgLeakschosen-ciphertext attackpolynomial-to-message leakage+1

Hardware & RFΒ· Added 28 Oct 2026, published 27 Oct 2026

aikido.devarticleπŸ›‘οΈ Security

How to patch PHP2Shell with free Aikido Images

Aikido Images are free patched PHP container images on public ECR (public.ecr.aws/aikido-dev/php) that backport the PHP2Shell fixes for CVE-2026-109618 and CVE-2026-109619 into release lines 5.5 to 8.5, except 8.0. Upstream fixed 8.2 to 8.5 in October 2026 and left 8.1 and older unpatched. The post shows docker pull and Dockerfile FROM changes, then rebuild, restart, session.upload_progress.enabled=0 and compromise checks.

PHPDockerAikido Security+1
CVE-2026-109618CVE-2026-109619PHP2Shell

DevSecOps, AppSecΒ· Published and added 26 Oct 2026

cisa.govadvisoryπŸ›‘οΈ Security

Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

CISA advisory ICSA-26-300-02 covers four vulnerabilities in Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz. CVE-2023-4863 (CWE-787 out-of-bounds write) allows code execution; CVE-2026-16436 and CVE-2026-16437 allow authentication bypass; CVE-2026-16438 allows arbitrary operations. Fixes are 10.97.3, 10.98 and GENESIS 11.04. MC Works64, GENESIS32 and BizViz are affected in all versions, and MC Works64 has no fix planned. Mitigations include removing the ClientChallengeTable.dat or SecurityChallenges.dat file contents. The fetched text was truncated, so later content is not covered.

GENESIS64ICONICS SuiteHyper Historian+3
CVE-2023-4863CVE-2026-16436CVE-2026-16437+6

Offensive Security, Identity & AccessΒ· Added 29 Oct 2026, published 26 Oct 2026

x.comthreadπŸ›‘οΈ Security

BenjaminπŸ‘¨β€πŸ’» (@Hislordship_9) on X

Thread on Forever Security's finding that a planted Markdown "Engineering Work Guidelines" file in ~/Downloads made Codex add a "project-tools" MCP server to ~/.codex/config.toml. The server ran npm install function-color, a known malicious package, and started a child session with --dangerously-bypass-approvals-and-sandbox. Codex complied in over 90% of the firm's tests; Claude Code, via a CLAUDE.md setting ANTHROPIC_BASE_URL, about half. Advice: don't start agents in Downloads, review instruction files, and diff agent config.

CodexClaude CodeModel Context Protocol+1
Forever Securityfunction-colorAGENTS.md+4

AI Security, Supply ChainΒ· Added 27 Oct 2026, published 26 Oct 2026

hackers-arise.comarticleπŸ›‘οΈ Security

Artificial Intelligence (AI) in Cybersecurity, Part 30: Shannon – AI Pentester for Web Apps and APIs

Shannon is a white-box AI pentester (@keygraph/shannon) that analyzes an application's source code, then attacks the running instance and reports only findings with a working PoC. The Hackers Arise tutorial runs it against OWASP Juice Shop in Docker on Kali, using OpenRouter (free Nemotron) and local Ollama (Qwen 2.5 Coder 7B) via a models.json file. Output includes PDF, Markdown, JSON and SARIF reports.

ShannonOpenRouterOllama+3
Juice ShopNemotronKeygraph

AI Security, AppSec, Offensive SecurityΒ· Published and added 26 Oct 2026

decrypt.coarticle🧠 AI

Anthropic Makes IPO Filing Public, Plans Nasdaq Listing Under β€˜ANT’

Anthropic filed a public S-1 on 26 October 2026 to list Class A shares on Nasdaq as "ANT", with Goldman Sachs and Morgan Stanley leading 24 underwriters. The filing shows first-half 2026 revenue of $16.29 billion, a net loss of $80.7 billion (mostly a $72.4 billion fair-value charge) and $141.1 billion raised in total. A trust elects a majority of the board, and the co-founders' entity holds 50.1% of voting power.

Claude
AnthropicNasdaqSEC+6

ai-policyΒ· Published and added 26 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

dbugs (@ptdbugs) on X

CVE-2026-106173 is a critical (CVSS 9.4) unauthenticated arbitrary file write in FortiSIEM's phQueryMaster gRPC service on port 27918/TCP. The SendQueryResult method builds a path from the query-id parameter without validation, so "../" sequences escape the directory and a null byte drops the appended filename and extension. Overwriting /opt/charting/redishb.sh, which runs every 60 seconds, gives remote command execution. Horizon3.ai published the analysis and a PoC.

FortiSIEMgRPCRedis+1
CVE-2026-106173PT-2026-111783Horizon3.ai+4

Offensive Security, AppSecΒ· Added 27 Oct 2026, published 26 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Non-profiled Single-Trace ML-DSA Secret Key Recovery by Horizontal Distribution Analysis

Non-profiled single-trace side-channel attack on ML-DSA-65 (Dilithium) running on ARM Cortex-M4, by Linus Backlund and Elena Dubrova (KTH). It compares observed sample distributions with expected Hamming weight leakage using a Gaussian mixture model, and stacks partitioned trace segments for multiple observations. Information-set decoding corrects misclassifications; with a 2^70 enumeration budget, the full secret key is recovered from one trace in 99% of attacks, using secret key unpacking as the attack point.

ML-DSAARM Cortex-M4
Hamming weight leakagehorizontal attacknon-profiled attack+4

Hardware & RFΒ· Published and added 26 Oct 2026

x.comthreadπŸ›‘οΈ Security

alex lee (@alexlee20122022) on X

Gheist is a GitHub campaign disclosed by Wiz in October 2026. Stolen tokens push ci-sync-XXXXXX branches with a sync-check workflow that dumps repo secrets base32-encoded to evade log masking, fetches the logs via API, then deletes the run. 13,500+ branches and 850+ accounts were hit since 15 September. Public repos are protected by the approval hold; private and Enterprise repos are not. The thread lists IOCs (.gdmp_pat files, "gheist" user agent, "ci: sync config" commits) and rotation steps.

GitHub ActionsGitHubWiz+2
Gheistci-sync branchsync-check.yml+3

DevSecOps, Threat Intel, Supply ChainΒ· Added 26 Oct 2026, published 25 Oct 2026

x.comtool🧠 AI

Dan Kornas (@DanKornas) on X

jshook is an open-source (AGPL-3.0) MCP server that gives AI agents a search-first, profile-aware reverse-engineering workspace for JavaScript, browser traffic, WASM and native processes. Agents start with a small searchable tool surface and move to workflow or full profiles only when needed. It drives Chromium or Camoufox over CDP, captures WebSocket traffic, has HTTP, GraphQL and Burp Suite helpers, and supports hot-reload plugins and declarative workflows. The post is a short announcement; the repository link is in a reply.

Model Context ProtocolJavaScriptWebAssembly+6
jshookDan Kornas

mcp, agentsΒ· Added 28 Oct 2026, published 25 Oct 2026

x.comtoolπŸ›‘οΈ Security

Dan Kornas (@DanKornas) on X

jshook is an open-source (AGPL-3.0) search-first reverse-engineering workspace for AI agents, exposed over MCP. It drives Chromium or Camoufox through CDP, captures WebSocket traffic, offers HTTP, GraphQL and Burp Suite helpers, deobfuscates JavaScript, rebuilds source maps and disassembles WebAssembly. Tool profiles start small and expand to workflow or full sets; hot-reload plugins and declarative workflows extend it.

Model Context ProtocolBurp SuiteChrome+3
CamoufoxCDP

Malware & RE, AI Security, Offensive SecurityΒ· Added 28 Oct 2026, published 25 Oct 2026

unicode.orgpaperπŸ›‘οΈ Security

UTS #39: Unicode Security Mechanisms

UTS #39 (Unicode Security Mechanisms) is the Unicode Consortium's technical standard for detecting identifier spoofing. It defines the General, IDN and Email security profiles for identifiers, confusable detection through skeleton and bidiSkeleton mappings, and mixed-script detection with resolved script sets and Restriction Levels. It also covers limited contexts for ZWJ/ZWNJ and the confusables and identifier data files. The fetched text is truncated, so later sections are not covered.

Unicode
homograph attackconfusableswhole-script confusables+7

AppSec, LearningΒ· Added 26 Oct 2026, published 25 Oct 2026

arxiv.orgpaper🧠 AI

Detecting and Understanding Ambiguity in Visualizations with Role-Playing Vision Language Model Interpretations

This paper presents a pipeline that uses persona-conditioned vision language models to surface interpretive ambiguity in visualizations. Topic-relevant personas elicit candidate takeaways, and a Target-Pattern-Scope framework lets LLM judges label statement pairs as Compatible, Disjoint or Opposing, which are summarized in an ambiguity profile. The authors benchmark VLMs on chart comprehension per chart type, check labeling against human annotations, and run case studies on public visualizations and a redesign.

vision-language modelLLM
arXiv

research, multimodal, evalsΒ· Added 27 Oct 2026, published 25 Oct 2026

x.comthread🧠 AI

ReignSwords (@ReignSwords) on X

A reviewer tests GenOffice, an open-source Office suite (10.7k GitHub stars), through its CLI only. Markdown to .docx took 3.8s, JSON to .xlsx took 0.9s with a live SUM formula, and .docx to PDF failed twice until Xvfb supplied a display. It has byte-preserving edits, a skill file for Claude Code and Codex, and 29 MCP tools. Downsides: a 188MB download that filled a 512MB /tmp, Electron in the PDF path, and unproven trust in tracked changes and rollback.

Model Context ProtocolClaude CodeCodex+4
GenOffice

mcp, coding-agents, agentsΒ· Added 25 Oct 2026, published 24 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Ranking Is Not Deciding: Benchmark Shortcuts and Operating-Point Collapse in Query-Time RAG Poisoning Defenses

Ranking Is Not Deciding is an October 2026 arXiv paper showing that query-time RAG poisoning filters score near-perfectly because of how the poison set was built. PoisonedRAG's code prepends the target question to each passage. Removing that prefix takes RAGuard from AUROC 0.953 to 0.758 and its miss rate from 0.191 to 0.763. The authors release a script that profiles a poison set.

LLM
PoisonedRAGRAGuardTrustRAG+5

AI SecurityΒ· Added 27 Oct 2026, published 24 Oct 2026

dfir.chwriteupπŸ›‘οΈ Security

Abusing Linux fanotify for Anti-Forensics

Abusing Linux fanotify for anti-forensics: a privileged userspace process can use the fanotify API to deny other processes the right to open an otherwise normal file. Reads fail with EPERM even for root, while name, ownership, timestamps and permissions look ordinary, so a scanner that cannot open a file may report no detections without inspecting it. Defenders can find malicious fanotify groups and marks via /proc/<pid>/fdinfo, or acquire at the filesystem level instead of opening the pathname.

Linuxfanotify
InfoGuard Labsanti-forensics

Blue Team & Detection, Offensive SecurityΒ· Added 1 Nov 2026, published 24 Oct 2026

x.comthreadπŸ›‘οΈ Security

Prasenjit Sarkar (@stretchcloud) on X

Post on the LiteLLM supply-chain compromise. Attackers spent eleven days in the GitHub org, ran a workflow on a throwaway branch to take twenty secrets including a GitHub App private key, then used stolen GitHub CLI OAuth tokens to publish malicious release 1.107.0 from a lookalike Berri-AI repo. A Python startup file harvested sixteen credential categories and LiteLLM proxy Postgres provider keys. Socket flagged the wheels in seven minutes.

LiteLLMPyPIGitHub Actions+3
Berri-AIBerriAILiteLLM 1.107.0+3

Supply Chain, DevSecOps, AI SecurityΒ· Added 26 Oct 2026, published 24 Oct 2026

corgi.computertool🧠 AI

Show HN: Corgi, a helpful {agent, terminal} multiplexer

Corgi is a terminal multiplexer for humans and AI coding agents, installed with a curl script. It shows each agent's state (working, needs you, finished, idle), keeps agents running in the background like tmux, and tracks token usage, per-workspace resource use and every file an agent changed. It also supports git worktrees, SSH image paste (needs Ghostty Nightly) and a corgi --skill command that teaches agents to drive it.

CorgiGhosttytmux+1

coding-agents, agentsΒ· Added 24 Oct 2026, published 23 Oct 2026

newsletter.semianalysis.comarticle🧠 AI

Amazon’s Trainium Takes a Strike at the Training King

SemiAnalysis reviews AWS Trainium3 and the new TorchNeuron native PyTorch backend after a few weeks of hands-on use. It reports TorchTitan Qwen3-32B results on Trainium2 (11,099 tokens/s eager at 23.89% MFU, 14,156 compiled at 30.47%), a 27-minute gpt-oss compile time, 89 of 96 FlexAttention cases passing, matmul comparisons with GB300 and B200, and a positive view of the Neuron Explorer profiler.

TrainiumTorchNeuronAWS Neuron+17
SemiAnalysisAmazonAWS+10

inference, training, ai-infraΒ· Added 29 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

AI Alignment for Digital Democracy: Fairer Voters Representation against LLM Biases

This paper studies demographic bias in LLM-emulated electorates, using three U.S. presidential elections and comparing one closed-source and one open-source LLM. Removing gender from the voter profile cuts the largest group error by 22-42%, and removing education cuts it by 64%. Removing self-reported race raises mean group error by over 40%. Repeated queries and fairness instructions do not reduce errors and can double them.

LLM
arXiv

research, ai-safety, evalsΒ· Added 27 Oct 2026, published 23 Oct 2026

x.comthread🧠 AI

Yash Patil (@yvshpvtil) on X

leanrea is an 8 KB skill file that tells a coding agent which plain CLI tools to use for reverse engineering, replacing REA, a 207-tool MCP server. In the author's test it ran 38% faster and 35% cheaper, scoring 74/75 against 75/75. The author lists caveats: 3 runs per task, one model, one machine, and Claude with no skill was already decent.

Model Context ProtocolClaude
leanreaREAYash Patil+2

prompting, mcp, coding-agentsΒ· Added 25 Oct 2026, published 23 Oct 2026

x.comthreadπŸ›‘οΈ Security

Yash Patil (@yvshpvtil) on X

leanrea is an 8 KB skill file that tells a coding agent which plain CLI tools to use for reverse engineering, replacing the 207-tool REA MCP server. The author's test reports 38% faster, 35% cheaper, and a score of 74/75 against REA's 75/75. Caveats listed: 3 runs per task, one model, one machine, and Claude with no skill already performed decently. Replies question whether the lost point was a task where structured tool output beat parsing CLI text.

leanreaREAModel Context Protocol+1

Malware & RE, AI SecurityΒ· Added 25 Oct 2026, published 23 Oct 2026

github.comrepoπŸ›‘οΈ Security

x86rc/unthemidator

Unthemidator is an automated unpacker for binaries protected with Themida, Code Virtualizer and WinLicense (v3.0 to v3.2.6.0, experimental v4.0). It works without executing the target, handles x86 and x64 exe, dll and sys files, decrypts imports, restores the IAT, rebuilds the PE and identifies VM versions and entry points. It does not devirtualize or unmutate code. Releases cover Windows x64 and macOS Apple Silicon.

ThemidaCode VirtualizerWinLicense+2
FALCON VMLION VM

Malware & REΒ· Added 27 Oct 2026, published 23 Oct 2026

x.comthreadπŸ›‘οΈ Security

Previdian (@PrevidianCyber) on X

Previdian Cyber reports an exploitation attempt against its FortiSIEM honeypot on 23 October 2026 at 09:43:32 UTC, targeting the FortiSIEM path traversal CVE-2026-106173. The request, from 85.192.29[.]68, POSTed to /phoenix.phoenixSvc/SendQueryResult on TCP 27918 with twelve ../ sequences in the query-id header, trying to overwrite /tmp/.fsmprobe with an empty file. It matches the file overwrite mode of the Horizon3.ai PoC; success is not confirmed. Mitigation: upgrade to FortiSIEM 7.5.1 or later and restrict TCP 27918.

FortiSIEMgRPC
CVE-2026-106173path traversalHorizon3.ai+3

Threat Intel, Blue Team & DetectionΒ· Added 25 Oct 2026, published 23 Oct 2026

arxiv.orgpaper🧠 AI

Profile-Driven User Simulation via Reinforcement Learning with Hierarchical Rewards for Task-Oriented Dialogues

ProfileSim is a profile-driven user simulator for financial marketing outbound calls. It models user profiles (demographics, Big Five traits) and business profiles (intents reverse-engineered from real call logs). The base model is fine-tuned on real voice dialogues, then refined with GRPO using dialogue-level and utterance-level rewards. Against other user generators it scores highest on colloquial naturalness and profile adherence, and lowest agent score on long-tail intents, with shorter utterances at comparable business compliance.

GRPORAGLLM
ProfileSimarXiv

research, trainingΒ· Added 26 Oct 2026, published 23 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

Prince of Persia (Infy), an Iranian state-sponsored APT active for nearly 20 years, hosted a Tornado second-stage C&C server in the US in July 2026, the first US hosting since 2016, according to Semperis researcher Tomer Bar. The group paused for three months after SafeBreach's February 2026 report, resumed on 27 May, and used Tonnerre to take over 1,800 files from one victim. The server sat on Namecheap shared hosting; on 24 August the group began a replacement behind Cloudflare. Semperis shared IoCs and advises watching for suspicious Telegram traffic.

TelegramCloudflareNamecheap
Prince of PersiaInfyTonnerre+4

Threat IntelΒ· Published and added 23 Oct 2026

x.comthreadπŸ›‘οΈ Security

Marcus Hutchins (@MalwareTechBlog) on X

MalwareTech thread arguing that many public "php2shell" exploits for CVE-2026-109618/CVE-2026-109619 are LLM hallucinations. The code shown is PHP session poisoning used to exploit local file inclusion in PHP apps, not a PHP vulnerability. It shares only the PHP_SESSION_UPLOAD_PROGRESS feature with the CVEs. Honeypot traffic shows non-working attempts, and AI-assisted triage wrongly confirmed mass exploitation. The real bug works only on a few PHP versions with specific configurations. Mitigation is setting session.upload_progress.enabled to Off.

PHPGitHubLLM
CVE-2026-109618CVE-2026-109619PHP2Shell+5

AppSec, Offensive Security, AI SecurityΒ· Added 24 Oct 2026, published 23 Oct 2026

github.comrepoπŸ›‘οΈ Security

Spectrmachina/Ztrust

ZTrust is a Python supply-chain scanner that checks manifests, lockfiles, source and GitHub workflows for vulnerable or malicious dependencies (via OSV.dev), typosquats, leaked secrets, unsafe lockfiles and risky CI patterns such as pwn requests and script injection. It outputs console, JSON and SARIF 2.1.0 and ships as a GitHub Action. It also includes a FastAPI bounty service using commit-reveal and shielded Zcash payouts for researchers.

PythonGitHub ActionsOSV+3
xz-utilstj-actions/changed-filesevent-stream+3

Supply Chain, DevSecOpsΒ· Added 27 Oct 2026, published 22 Oct 2026

dfir.chwriteupπŸ›‘οΈ Security

Field Notes: Reconstructing an Attacker’s Workflow

Field note from dfir.ch on PowerShell scripts an attacker left on disk during an incident: a file-watching command runner using Invoke-Expression, a fake Windows credential prompt that validates passwords via Start-Process and logs them in cleartext, AD computer enumeration with WMI access testing, and SMB share discovery via NetShareEnum. It notes where script labels overstate what they prove and lists hunting strings for Event IDs 4104, 4103, 4688 and Sysmon 1.

PowerShellActive DirectoryWMI+2
TerminalFixClickFixMicrosoft+7

Blue Team & Detection, Offensive SecurityΒ· Added 24 Oct 2026, published 22 Oct 2026

github.comrepo🧠 AI

SnailSploit/Claude-Red

claude-red is an MIT-licensed library of offensive security skills for the Claude Skills system, planned at about 130 skills across 23+ categories (web, Active Directory, cloud, exploit development, EDR evasion and others). Each skill is a SKILL.md file that loads on conversational triggers, so unused skills cost no context. It installs by git clone, sparse checkout per category, install.sh or pasting into a system prompt.

ClaudeGitGitHub
Kai AizenSnailSploitSahar Shlichov

prompting, coding-agentsΒ· Added 22 Oct 2026

github.comrepoπŸ›‘οΈ Security

SnailSploit/Claude-Red

claude-red is a library of offensive security skills for the Claude Skills system, each a SKILL.md file that loads on conversational triggers (for example, mentioning SQL injection loads offensive-sqli). Categories include web, Active Directory, cloud, mobile, exploit development, fuzzing, privilege escalation, post-exploitation and AI. It targets about 130 skills across 23+ categories, with an install script and sparse-checkout install per category. Built on Sahar Shlichov's offensive checklists, MIT licensed.

ClaudeClaude CodeActive Directory
Kai AizenSahar ShlichovSnailSploit

Offensive Security, AI SecurityΒ· Added 22 Oct 2026

hackers-arise.comarticleπŸ›‘οΈ Security

Anti-Forensics: Building a Phantomdrive

Phantomdrive is an open source USB drive built on the WCH CH569 chip that appears as a plain 8GB disk and hides the rest of an SD card behind AES-256 encryption. The hidden partition unlocks when the user saves "password:" in a text file; the firmware catches it in raw WRITE10 traffic and zeroes the buffer. Key derivation uses a per-device salt and 100,000 SHA-256 rounds, and the post compares AES-ECB, CTR and XTS speeds.

CH569VeraCryptOpenSSL+1
PhantomdriveAES-256AES-XTS+5

Hardware & RF, Blue Team & DetectionΒ· Published and added 22 Oct 2026

x.comthreadπŸ›‘οΈ Security

Muscle AI (@themuscleai) on X

Post on the LiteLLM 1.107.0 PyPI compromise published 21 October 2026 and quarantined about 1 hour 43 minutes later. A malicious .pth file ran at Python startup and stole cloud credentials, private keys, browser data and AI tool auth files, then POSTed a tarball to an attacker endpoint. The author says attackers used stolen GitHub CLI OAuth tokens to push a trojanized commit chain and build official wheels. It lists five defenses: hash-pinned lockfiles, per-tool capped keys, release cooling periods, secret isolation and egress monitoring.

LiteLLMPyPIPython+3
TeamPCPcook.pth

Supply Chain, DevSecOps, AI SecurityΒ· Added 23 Oct 2026, published 22 Oct 2026

x.comarticle🧠 AI

Muscle AI (@themuscleai) on X

Muse AI's X post describes the compromise of LiteLLM 1.107.0, published to PyPI on 21 October at 7:39 AM and quarantined about 1 hour 43 minutes later. The payload was a .pth file that ran at Python startup and sent cloud credentials, private keys and AI dev-tool auth files to an attacker endpoint. The author lists five agent-builder defences: hash-locked pins, capped per-tool keys, a release cooling period, keeping secrets away from Python startup, and outbound traffic monitoring.

LiteLLMPyPIPython+3
SocketTeamPCP

ai-infra, agentsΒ· Added 23 Oct 2026, published 22 Oct 2026

ethereum-magicians.orgthread🧠 AI

ERC-TBA: Agent Income Statements

ERC-TBA: Agent Income Statements is a draft Ethereum standard, a profile of the ERC-8004 Reputation Registry. A writer posts chained statements of what an agent's agentWallet received in one asset, with each incoming transfer a Merkle leaf, so lenders and buyers can verify earnings from x402 payments. Windows are cut at owner or wallet changes, and the post asks about statement grain, the MetadataSet requirement and who may write. The reference implementation is unaudited.

x402EthereumSolidity+1
ERC-8004ERC-8434AID Document

agentsΒ· Published and added 22 Oct 2026

github.comrepo🧠 AI

OpenAI CLI

OpenAI CLI is OpenAI's official Go command-line client for the REST API. It lets users generate images, upload and download files, create and wait on batches, call the Responses API, and query admin usage endpoints from a terminal or shell script. It supports JSON, JSONL and YAML output, GJSON transforms, shell completion, and install via Homebrew, go install or release binaries.

OpenAI APIGoHomebrew+3
OpenAIGPT-5.5

ai-infra, llm-appsΒ· Added 23 Oct 2026, published 22 Oct 2026

x.comrepo🧠 AI

Dan Kornas (@DanKornas) on X

aula-mcp is an open-source (MIT) TypeScript MCP server that connects an AI client to Denmark's Aula school platform. It exposes tools for profiles, calendar events, messages, notifications, posts and weekly plans. MitID credentials and OAuth tokens are stored in macOS Keychain or an AES-256-GCM encrypted file. The HTTP server binds to 127.0.0.1, and the presence write tool stays off until AULA_MCP_WRITE=1 is set.

Model Context ProtocolTypeScriptClaude Code+3
AulaMitIDDan Kornas

mcpΒ· Added 23 Oct 2026, published 22 Oct 2026

x.comtool🧠 AI

EveryDev.ai (@EveryDevAi) on X

Weco, from WecoAI, is an open source CLI that optimizes code, prompts and agent harnesses against a metric the user defines. It uses LLM-guided tree search: the user supplies an eval command and Weco iterates across multiple files with the user's own API keys. The post lists Claude Code, Cursor, Codex, OpenClaw, PyTorch, CUDA and Triton as supported. It gives no benchmarks or setup details.

WecoClaude CodeCursor+5
WecoAI

coding-agents, evalsΒ· Published and added 22 Oct 2026

anthropic.comarticle🧠 AI

Donating Agent Skills to the Agentic AI Foundation

Agent Skills is an open standard in which a skill is a folder with a SKILL.md file plus scripts and reference material. Anthropic is donating the name, logo, GitHub organization and agentskills.io domain to the Agentic AI Foundation under the Linux Foundation. Over 70 platforms have integrated it, with 1 million skills published and nearly 280 million installs. The proposed roadmap covers versioned releases, a proposal process and security guidance.

Agent SkillsSKILL.mdClaude Code+8
AnthropicAgentic AI FoundationLinux Foundation+5

prompting, coding-agents, agentsΒ· Added 29 Oct 2026, published 22 Oct 2026

arxiv.orgpaper🧠 AI

IFC-MCQ: Automatically Generating Multiple-Choice Benchmarks for Evaluating LLM Agents on IFC Data Retrieval

IFC-MCQ is a method that automatically generates multiple-choice benchmarks from Industry Foundation Classes (IFC) building-model files, so answers can be graded by exact option-set match instead of human or LLM review. Its taxonomy has 15 categories and 36 subtypes in four groups, with answer keys from the file and distractors from file values or rules. Two agentic setups, tool-based and code-based retrieval, showed category-specific failures and variation by IFC model and interface.

LLMIndustry Foundation Classes
IFC-MCQarXiv

evals, agents, researchΒ· Added 23 Oct 2026, published 21 Oct 2026

eliastaylor.comarticleπŸ›‘οΈ Security

There isn't an easy exploit for this PHP vulnerability

Blog post from 21 October 2026 arguing that the recent PHP vulnerability (UAF chaining, tracked as PHP2Shell) has no easy working exploit, unlike Log4Shell, Heartbleed, Shellshock or the Rails YAML bug. The author says the many GitHub PoCs fail against vanilla PHP in Docker, or depend on a local-file-inclusion precondition or on an LLM modifying the target server. It also reflects on LLM-driven uniform judgement.

PHPDockerGitHub+2
CVE-2026-109618CVE-2026-109619PHP2Shell+5

AppSec, Offensive Security, AI SecurityΒ· Added 22 Oct 2026, published 21 Oct 2026

eliastaylor.comarticle🧠 AI

There isn't an easy exploit for this PHP vulnerability

An opinion post from 21 October 2026 arguing that a widely feared PHP vulnerability has no easy exploit. The author says the many GitHub "PoC" repositories fail against a vanilla PHP instance in Docker. They claim LLM agents produced them by depending on a local-file-inclusion flaw or by modifying the server to be vulnerable. The author also argues that LLM defaults make many people's judgements identical.

PHPDockerGitHub+2
CVE-2026-109618CVE-2026-109619GPT+3

coding-agentsΒ· Added 22 Oct 2026, published 21 Oct 2026

github.comrepoπŸ›‘οΈ Security

devploit/php2shell

PHP2Shell is a research toolkit by devploit that reproduces a pre-auth remote code execution issue in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, affecting the Apache mod_php and PHP-FPM SAPIs. The repository includes version-matched profiles for many PHP 7.4 through 8.5 builds, reproducible Docker and nginx test labs, a technical write-up of the vulnerability, and mitigation and detection recommendations for defenders.

PHPApachenginx+2
CVE-2026-109618CVE-2026-109619PHP2Shell+7

Offensive Security, AppSecΒ· Added 2 Nov 2026, published 21 Oct 2026

x.comthreadπŸ›‘οΈ Security

Trail of Bits (@trailofbits) on X

Trail of Bits post on two unpatched critical PHP bugs that were exploited within 17 hours of details leaking. Cloudflare began blocking attacks and Patchstack reported active exploitation. The bug was reported 11 August and fixed 71 days later, with a patch touching 402 files and over 11,000 lines. Trail of Bits announces two open-source plugins, patching-bugs and regression-hunt, from its Patch the Planet work.

PHPCloudflare
Trail of BitsPatch the PlanetPatchstack

AppSec, AI SecurityΒ· Added 23 Oct 2026, published 21 Oct 2026

x.comarticle🧠 AI

Trail of Bits (@trailofbits) on X

Trail of Bits announces two open-source plugins, patching-bugs and regression-hunt, for AI coding agents that speed up bug patching. They come from four months of Patch the Planet work with open-source projects, which found that repo-level documentation, skills and plugins give agents the maintainer context on what counts as a bug, how a fix should look and what must not break. The post cites the October 2026 PHP incident: a patch touching 402 files, and exploitation within 17 hours of leaked details.

PHPCloudflare
Trail of BitsPatch the PlanetPatchstack+2

coding-agents, promptingΒ· Added 23 Oct 2026, published 21 Oct 2026

newsletter.semianalysis.comarticle🧠 AI

The Huawei-DeepSeek Symbiosis

The Huawei-DeepSeek Symbiosis analyzes DeepSeek's 30 September 2026 Ascend support for TileLang, DeepGEMM, DeepEP, TileKernels, FlashMLA and DeepSelect. It microbenchmarks the Ascend 950PR (BF16 GEMM, HBM bandwidth, die topology, AICPU) against H100, and profiles DeepSeek-V4.1-Flash on 32 Ascend 950DT chips. It also lists vLLM-Ascend gaps on x86 hosts.

Ascend 950PRAscend 950DTCANN+14
SemiAnalysisDeepSeekHuawei+8

inference, ai-infra, modelsΒ· Added 29 Oct 2026, published 21 Oct 2026

huggingface.cowriteup🧠 AI

Profiling TorchNeuron (Part 1): System-level profiling on AWS Trainium.

Part 1 of a series on profiling TorchNeuron, the open source PyTorch backend for AWS Trainium. It shows how to configure torch.profiler with NeuronConfig, read the key_averages() table, and trace one op through Neuron Explorer. Three RMSNorm variants are compared: naive eager (2.355 ms device time), torch.rms_norm (403 ΞΌs) and torch.compile (375 ΞΌs).

PyTorchTorchNeuronAWS Trainium+8
AmazonHugging Face

inference, ai-infraΒ· Published and added 21 Oct 2026

blog.trailofbits.comarticleπŸ›‘οΈ Security

Your AI agent fixed the bug, but what else did it change?

Trail of Bits releases patching-bugs and regression-hunt, two Codex plugins from the Patch the Planet initiative with OpenAI. A review of 130+ merged patches confirmed 21 regressions (none broke a security protection). In preliminary tests regression-hunt gave 25% fewer false positives than a baseline Codex agent. Design uses live PoCs, strict schemas, a three-arm proof, and project THREAT_MODEL.md and PATCHING_GUIDELINES.md files.

CodexOpenAI
Trail of BitsPatch the Planetpatching-bugs+7

AI Security, AppSecΒ· Published and added 21 Oct 2026

blog.cloudflare.comarticleπŸ›‘οΈ Security

Introducing full transaction detection for Cloudflare WAF

Cloudflare announces full transaction detection and response-phase rules for its WAF. Detections evaluate an HTTP request together with the origin's response, so exploitation can be confirmed (for example, path traversal returning a config file) and the response replaced with a 403 block page. Covers managed and custom rules, the limit of three custom response rules, no response-body matching yet, and a first managed rule for php2shell. Available on all plans, including Free.

Cloudflare
PHP2Shellpath traversal

AppSec, Blue Team & DetectionΒ· Added 29 Oct 2026, published 21 Oct 2026

wiz.iowriteupπŸ›‘οΈ Security

LiteLLM Compromised, Steals Credentials

LiteLLM version 1.107.0 was uploaded to PyPI on 21 October 2026 with a credential stealer, and the same build reached GHCR and Docker Hub images. Wiz describes the three dropped files (cook.pth, cook.py, sitecustomize.py), exfiltration to a fake litellm.dev domain, a GitHub dead drop for a second stage, and the malicious commits pushed through the lookalike Berri-AI repository. The last safe version is 1.106.2.

LiteLLMPyPIDocker+3
Berri-AIcook.pthsitecustomize.py+2

Supply Chain, Threat Intel, AI SecurityΒ· Published and added 21 Oct 2026

opensourcemalware.comwriteupπŸ›‘οΈ Security

LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor

LiteLLM 1.107.0 macOS x86-64 PyPI wheel analyzed by OpenSourceMalware contains three injected files (cook.pth, cook.py, sitecustomize.py) that run on every Python start. The payload, called privcollect, steals browser, SSH, cloud, CI/CD and AI-tool credentials, then uploads an AES/RSA-encrypted bundle to www.litellm.dev/healthcheck. A forked loader also fetches domain.txt from GitHub and executes /codepy hourly. The post lists IOCs, hashes and remediation steps.

LiteLLMPyPIPython+1
privcollectTeamPCPUpwind+4

Supply Chain, Malware & RE, Threat IntelΒ· Published and added 21 Oct 2026

aikido.devarticleπŸ›‘οΈ Security

Software supply chain security best practices for 2026

Aikido's guide to software supply chain security controls for 2026, tied to real incidents. It covers a 48-hour package cooldown, ignore-scripts, lockfile enforcement, SHA and digest pinning, scoped tokens, FIDO2, developer endpoint protection, extension allowlists, agent sandboxing, MCP server vetting, slopsquatting, signed SBOMs and rotation drills. Examples include the March 2026 axios compromise and the March 2025 tj-actions/changed-files attack.

npmpnpmGitHub Actions+3
tj-actions/changed-filesCanisterWormGlassWorm+7

Supply Chain, DevSecOps, AI SecurityΒ· Added 22 Oct 2026, published 21 Oct 2026

aikido.devwriteupπŸ›‘οΈ Security

LiteLLM compromised again: infostealer and RAT found in version 1.107.0

LiteLLM 1.107.0 was compromised on 21 October 2026: the seven compiled PyPI wheels and the official Docker image carried an infostealer and a RAT. The attacker used the maturin `data = "cook"` directive in pyproject.toml to inject cook.pth, cook.py and sitecustomize.py without touching the source repo. The post lists stolen data, the hourly C2 polling via GitHub, wheel hashes, file and network IOCs, and check steps.

LiteLLMPyPIPython+2
cook.pthsitecustomize.pymaturin data directive+3

Supply Chain, Threat Intel, AI SecurityΒ· Published and added 21 Oct 2026

layerfs.aitool🧠 AI

LayerFS: The filesystem for AI coding agents

LayerFS is a serverless, versioned filesystem for AI coding agents. Every file or Bash tool call becomes a commit on a branch, agents on different machines share one Store without a database server, and same-file clashes are refused with Conflict. Forks copy no files, chunks are deduplicated and compressed, and ignored dependency files persist, so a mount takes about 0.05 s against about 5 minutes of reinstalling. The page gives vendor claims and no benchmarks or docs.

Git
LayerFS

coding-agents, ai-infra, agentsΒ· Added 22 Oct 2026, published 21 Oct 2026

huggingface.coarticle🧠 AI

Announcing SimReady Central: An Open Library of Simulation-Ready 3D Assets for Robotics and AI Factories

SimReady Central Library is an NVIDIA-led, free and ungated collection of more than 2,000 simulation-ready OpenUSD assets on Hugging Face, covering robot arms, grippers, warehouse equipment, racks and cooling gear. Assets are validated against SimReady Foundation profiles, and NVIDIA USD Search lets developers and agents find them by natural language. The post shows GPT-6 Astra building a pick-and-place scene in Isaac Sim and comparing AI factory layouts.

OpenUSDNVIDIA USD SearchIsaac Sim+5
NVIDIASimReady CentralSimReady Foundation+14

training, agentsΒ· Published and added 21 Oct 2026

x.comarticleπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

CVE-2026-110936 is an uncontrolled DLL search path flaw (CWE-427) in Siemens Software Center below V4.0.9.8, listed in CISA KEV on 20 October 2026. The post covers CVSS v4.0 8.4 and v3.1 6.7, Siemens' Romulus ClickFix campaign indicators (IPs, domain, hashes, file leads) and a six-step SOC trail using Sysmon, EDR and network records. It separates delivery from DLL load and from compromise.

Siemens Software CenterWindowsSysmon+3
CVE-2026-110936CWE-427DLL search order hijacking+10

Blue Team & Detection, Threat IntelΒ· Added 24 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

SHAKEing SLH-DSA with Non-profiled SCAs

SHAKEing SLH-DSA with Non-profiled SCAs is an eShard ePrint paper (2026/2584) on correlation power analysis of SLH-DSA-SHAKE, the NIST-standardised hash-based signature scheme. It analyses PRF inputs and selection functions, then combines subtrace averaging, partial-then-total CPA and an efficient exhaustive search to recover the full secret seed, enabling universal forgery. On a 32-bit microcontroller the attack needs about 280 to 559 signatures, and the search finishes within 45 minutes on 72 cores.

SLH-DSASHAKEKeccak
NISTuniversal forgerySPHINCS+

Hardware & RFΒ· Added 24 Oct 2026, published 21 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Where AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden Vulnerabilities

Paper (arXiv, 21 October 2026) on structural false negatives in LLM vulnerability discovery harnesses. Starting from Knostic's OpenAnt and raptor, then 10 more open-source harnesses, the authors map 13 points where code selection, filtering, and finding storage or merging drop vulnerabilities. One file was dropped by six harnesses before the model saw it, five without notice. It covers attacker evasion, content-steered verdicts, prompt injection, and design principles and tests.

OpenAntraptorLLM
KnosticPtacek and Newshamprompt injection+1

AI Security, AppSecΒ· Added 24 Oct 2026, published 21 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI

OVHcloud's official CLI was backdoored on 19 October after an attacker used a developer's hijacked GitHub account to overwrite release binaries for v0.11.0 through v0.15.0 with a secret stealer. The malicious files were live for about 94 minutes. Release immutability was not enabled, so CI/CD was bypassed. OpenSourceMalware links the account to a March 2026 compromise with a Solana-based loader and a GlassWorm wallet, but calls the same-actor link an inference.

GitHubSolanaHomebrew+2
OVHcloudOpenSourceMalwareGlassWorm+2

Supply Chain, DevSecOps, Threat IntelΒ· Published and added 21 Oct 2026

socket.devarticle🧠 AI

vlt 1.5.0 Adds Agent Skills Management

vlt 1.5.0 adds a `vlt skills` command that finds agent skills (SKILL.md folders) in installed JavaScript dependencies and links them into directories coding agents read, such as .agents/skills and .claude/skills. Selections are saved as allow-skills in vlt.json, tied to the lockfile version, and kept current on install and update. Without a saved selection, linking defaults to :not(:malware) using Socket malware alerts. pnpm 12.11.0 added similar linking.

vltnpmJavaScript+7
SocketSarah Goodingagent-browser

coding-agents, promptingΒ· Published and added 21 Oct 2026

socket.devarticleπŸ›‘οΈ Security

vlt 1.5.0 Adds Agent Skills Management

vlt 1.5.0 adds a `vlt skills` command that discovers agent skills (SKILL.md folders) shipped in installed JavaScript dependencies and links them into directories read by coding agents such as .agents/skills and .claude/skills. Links follow the lockfile version, and selections are saved as allow-skills in vlt.json. Without a saved selection, linking defaults to :not(:malware), using Socket malware alerts. pnpm 12.11.0 added similar support.

vltSocketnpm+3
Sarah GoodingSKILL.mdvlt skills+4

Supply Chain, AI SecurityΒ· Published and added 21 Oct 2026

cisa.govadvisoryπŸ›‘οΈ Security

#StopRansomware: SafePay Ransomware (AA26-293A)

CISA advisory AA26-293A (20 October 2026) details SafePay ransomware, active since August 2024 with at least 600 victims across critical infrastructure. It covers initial access via Mullvad VPN IPs, phished profiles and edge-device CVEs, LOTL lateral movement with PsExec, WinRM and RDP, exfiltration with RClone and WinSCP, and ChaCha20/RSA encryption. It lists IOCs, MITRE ATT&CK mappings, incident response steps and mitigations.

MITRE ATT&CKRDPAnyDesk+3
CVE-2020-3259CVE-2023-20269SafePay+11

Threat Intel, Blue Team & DetectionΒ· Added 21 Oct 2026

x.comthread🧠 AI

0xMarioNawfal - The Roundtable Show (@RoundtableSpace) on X

Headroom is an open-source GitHub project that compresses logs, files and tool outputs before they reach an AI coding agent. The tweet by RoundtableSpace claims up to 95% fewer tokens for JSON and about 20% fewer overall, with the same answers and lower API bills. The tweet gives no method or benchmarks, and the repo link is truncated.

GitHub
HeadroomRoundtableSpace

coding-agents, llm-apps, ai-infraΒ· Added 21 Oct 2026, published 20 Oct 2026

github.comrepo🧠 AI

vxcontrol/pentagi

PentAGI is an open-source, self-hosted multi-agent system that uses LLM agents to carry out penetration testing tasks autonomously. The MIT-licensed repo has a Go backend, a React frontend and GraphQL. It ships Docker Compose files for Langfuse tracing, Graphiti knowledge-graph memory and an observability stack. Topics list OpenAI and Anthropic as model backends.

GoReactGraphQL+5
PentAGIvxcontrolOpenAI+1

agentsΒ· Added 20 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents

CarryoverBench is a benchmark of 12 personal-assistant scenarios and 101 attack tasks for carryover attacks, where a one-time indirect prompt injection planted in agent memory files or scheduled tasks re-fires in later sessions. Three trigger channels (Instant, Autonomous, Latent) are scored by a rule-based verifier with separate planting and triggering stages. Across five frontier models, payloads re-fire over five rounds without measurable decay. Porting the Latent channel to the Hermes runtime weakens the effect but does not remove it.

LLM
CarryoverBenchcarryover attacksindirect prompt injection+1

AI SecurityΒ· Added 22 Oct 2026, published 20 Oct 2026

x.comthreadπŸ›‘οΈ Security

︎ (@0xocdsec) on X

Post from 0xocdsec announcing a deep-dive on CVE-2026-106173 in Fortinet FortiSIEM. The flaw is an arbitrary file write in a gRPC service that leads to remote code execution. The author says this is the fourth year in a row they have researched FortiSIEM. The post itself gives no technical detail and links to the full analysis.

FortiSIEMFortinetgRPC
CVE-2026-106173arbitrary file writeRCE

AppSec, Offensive SecurityΒ· Added 21 Oct 2026, published 20 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

AOMEI Backupper, Windows backup and cloning software, served malware in short tampering windows between April and July 2026. Threat actor UNC7017 altered the update settings file and notification service to push the CrossRoad downloader, ShinyRoad backdoor, a modified Radmin Server and Adaptix payloads. Each window lasted five to ten minutes. The client did not authenticate its configuration files, and a WebDAV banner trick leaked NetNTLMv2 hashes.

AOMEI BackupperRadmin ServerAdaptix+2
UNC7017CrossRoadShinyRoad+5

Supply Chain, Threat IntelΒ· Published and added 20 Oct 2026

horizon3.aiwriteupπŸ›‘οΈ Security

CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE

CVE-2026-106173 is an unauthenticated arbitrary file write in the FortiSIEM phQueryMaster gRPC service on tcp/27918, advised by Fortinet on 13 October 2026. The SendQueryResult handler concatenates an attacker-controlled query-id into a path, and a null byte in the header removes the server-added filename suffix. Overwriting /opt/charting/redishb.sh, run every 60 seconds by cron, gives root-level code execution. IOCs are file timestamps.

FortiSIEMgRPCLinux
CVE-2026-106173CVE-2023-34992CVE-2024-23108+6

Offensive Security, AppSecΒ· Added 29 Oct 2026, published 20 Oct 2026

ethereum-magicians.orgthreadπŸ›‘οΈ Security

Pre-ERC: Adoption Profile and Reference Kernel for EOAs Adopting Code via SETCODEFROM

Pre-ERC proposal for EOAs that adopt account code via EIP-8298 SETCODEFROM, which with EIP-8151 retires the secp256k1 key. It lists seven failure modes (FM1-FM7), such as self-recovery lockout, ERC-1271 passing while VERIFY fails, front-runnable initialization and a mutable code source. It proposes requirements R1-R8, a MigrationCheck guard with two routes, and a reference kernel with post-quantum ERC-7913 verifiers.

EthereumEIP-7702ERC-4337+1
EIP-8298EIP-8151EIP-8141+12

BlockchainΒ· Published and added 20 Oct 2026

x.comrepoπŸ›‘οΈ Security

☣ KitPloit - Hacker Tools (@KitPloit) on X

DidierStevensSuite is a collection of Python scripts for malware analysis, file format parsing, hashing and forensic triage. It includes utilities for analysing PDF and OLE documents and for XOR-obfuscated data. The post is a short KitPloit announcement that links to the repository and gives no usage detail.

Python
Didier Stevens

Malware & RE, Blue Team & DetectionΒ· Added 21 Oct 2026, published 20 Oct 2026

github.comrepo🧠 AI

better-isms/grcskills

grcskills is a library of 60 plain SKILL.md files in the Agent Skills format, each describing how an experienced practitioner does one piece of governance, risk and compliance work. Examples are scope statements, risk registers, audit prep, vendor review and incident handling. Every skill names where the agent must stop and hand the decision to a person. Installs are pinned to reviewed release tags and checked by a validator.

Claude CodeCodexCursor+4
Better ISMSISMS CopilotNIST

prompting, agentsΒ· Added 20 Oct 2026

github.comrepoπŸ›‘οΈ Security

better-isms/grcskills

grcskills is an MIT-licensed library of 60 SKILL.md files (Agent Skills format) that let coding agents draft and prepare governance, risk and compliance work: scope statements, statements of applicability, risk registers, audit prep, vendor review, policies, privacy, incidents and continuity. Each skill names where the agent must stop so a person decides. Installs are pinned to release tag v2026.10.19.2, and a validator rejects network commands and credential paths.

Claude CodeCodexCursor+2
SOC 2PCI DSSNIST+2

GRCΒ· Added 20 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

CVE-2026-110936 is a DLL search-path flaw in Siemens Software Center (CVSS v4 8.4), fixed in version 4.0.9.8. Attackers paired a validly signed copy of the program (3.5.8.7) with their own DLLs for side-loading, delivered through the Romulus ClickFix platform. Siemens says its channels were not breached and advises behavior-based detection over file hashes. Huntress reported the flaw.

Siemens Software CenterHuntressWindows
CVE-2026-110936RomulusClickFix+6

Threat Intel, Blue Team & DetectionΒ· Published and added 19 Oct 2026

arxiv.orgpaper🧠 AI

Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy

This paper studies how keeping long tool output out of the context window, and reading it through a section index instead, costs LLM agents accuracy. Using the PHREEQC geochemistry simulator on 158 execution-verified multiple-choice items and 11,007 logged calls, GPT-5.1 and GPT-5.2 lose 11.3 and 7.9 points, while Claude Opus 4.6 and Sonnet 4.6 show no detectable cost. The authors name the failure evidence substitution: agents skip the report and misround from their own output files.

PHREEQCLLMClaude+1
USGSGPT-5.1GPT-5.2+4

research, agents, evalsΒ· Added 21 Oct 2026, published 19 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Rank Math PRO version 3.0.123, a WordPress SEO plugin, shipped malicious packages between 15 October 2026 20:02 UTC and 16 October 2026 07:12 UTC. The malware gives persistent backdoor access, can expose credentials and API keys, and uses .htaccess rules to run .cache files as PHP. Rank Math released clean v3.0.124 and advises restoring from backup, blocking rank1cdn[.]com, and checking SSH keys and crontabs.

WordPressRank Math PROPHP
rank1cdn[.]comRank Math PRO 3.0.123

Supply Chain, Threat IntelΒ· Published and added 19 Oct 2026

boredhackerblog.infowriteupπŸ›‘οΈ Security

Plex vulnerabilities being exploited in the wild to drop a cryptominer

Honeypot writeup of in-the-wild exploitation of Plex Media Server through the Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) in October 2026. Attackers from 45.194.92.222, 91.92.40.202 and 176.65.139.228 used SSRF-style timeline/subscribe requests and downloaded a Docker-named dropper and an XMRig miner from 217.60.194.116. Includes file hashes, a later-seen proxyware sample (myawesomeproxy), lab pcaps for signatures and links to sandbox reports.

Plex Media ServerXMRigDocker+1
CVE-2026-96652CVE-2026-96654CVE-2026-96655+8

Threat Intel, Blue Team & DetectionΒ· Added 20 Oct 2026, published 19 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

One Compromised Login Exposed Millions of California Students’ Records

Breach report on Educational Testing Service (ETS), whose SFTP site was accessed with a compromised login credential between 22 May and 18 September 2026, exposing California student records. The data covers at least three school years of students, over 5.7 million enrolled, and leavers back to 2006. Files included names, birth dates, addresses, ID numbers, disability and English learner status. No Social Security numbers were involved, and the credential's origin and the attacker are unknown.

SFTP
Educational Testing ServiceCalifornia Department of EducationCAASPP+3

Threat IntelΒ· Published and added 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Blind-DLPA: An End-to-End Framework for Profiled Blind Side-Channel Analysis

Blind-DLPA is a multi-task deep-learning framework for profiled blind side-channel analysis, where the attacker has labeled profiling traces but only leakage traces from the target, with no plaintexts or ciphertexts. It estimates Hamming-weight posteriors of an input and a key-dependent intermediate, then ranks key hypotheses against theoretical joint distributions. It recovers keys on unprotected AES and Kyber and on ASCAD (guessing entropy zero with 39 traces), and the authors report collisions in a prior Ascon Hamming-weight model.

AESKyberAscon
Blind-DLPAASCADprofiled blind side-channel analysis+4

Hardware & RFΒ· Added 20 Oct 2026, published 19 Oct 2026

x.comthreadπŸ›‘οΈ Security

Dark Web Intelligence (@DailyDarkWeb) on X

Plex2Shell is a chain of four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that a researcher says ends in unauthenticated RCE on servers older than 1.43.3.10861. A write-up and PoC were published on 16 October 2026. CISA advisory VA-26-266-01 scores the individual CVEs 4.3 to 7.2, and they are not in CISA KEV. The post advises updating, avoiding exposure of port 32400, and checking for unknown child processes and new files in the Codecs folder.

Plex Media ServerDocker
CVE-2026-96652CVE-2026-96654CVE-2026-96655+6

AppSec, Offensive SecurityΒ· Added 19 Oct 2026, published 18 Oct 2026

x.comthreadπŸ›‘οΈ Security

Dark Web Intelligence (@DailyDarkWeb) on X

DailyDarkWeb update on CVE-2026-21589, a pre-auth file-read flaw in Atlassian Data Center products. The CVE record was rejected on 16 October 2026 with a generic reason and no replacement ID, but Atlassian's advisory (CVSS v4.0 9.3, Critical) and the CISA KEV listing (added 15 October, federal due date 18 October) remain. The analyst note says to keep patching to the fixed versions and track versions, not only the CVE ID.

JiraConfluenceCVSS+1
CVE-2026-21589CISApre-auth file read+1

Threat Intel, AppSecΒ· Added 19 Oct 2026, published 18 Oct 2026

github.comrepo🧠 AI

DietrichGebert/ponytail

Ponytail is a single skill prompt (skills/ponytail/SKILL.md, with a compact AGENTS.md) that makes coding agents write only the code a task needs, reusing existing components while keeping validation, error handling, security and accessibility. The author benchmarked it in Claude Code with Opus 5.5 over 39 tasks, 5 runs each, including a real FastAPI + React repo. They report -53% code, -41% time, -26% cost and -45% tokens, and 98% of risky logic shipping with a test versus 68% without. It adds /ponytail-review and /ponytail-audit commands, a Claude Code cost/token band with a local board, and installs through Claude Code and Codex plugin marketplaces or as a rules file for Cursor, Copilot, Gemini, OpenCode and others.

Claude CodeCodexCursor+7
PonytailClaude Opus 5.5Windsurf+5

coding-agents, prompting, evalsΒ· Added 17 Oct 2026

github.comrepo🧠 AI

alex09x/kyb

KYB (Know Your Business) is a Rust/axum server that stores agent-written knowledge, incident reports and tasks as Markdown files in Git, one commit per change. Search is hybrid: Tantivy BM25 fused by reciprocal rank with local multilingual-e5-small ONNX vectors, and it can query historical versions or "as of" a date. It ships a kyb CLI, a native MCP endpoint (Claude Code, Codex, Antigravity, Gemini CLI), an installable agent skill, token auth with per-write attribution trailers, secret scanning on writes, and a web console. It targets persistent shared operational memory for multi-agent, multi-machine fleets.

RustGitModel Context Protocol+10
KYBAlexander Panasenkomultilingual-e5-small

agents, mcp, coding-agentsΒ· Added 17 Oct 2026

x.comtool🧠 AI

Bravish (@bravish_) on X

Tracekit 1.2.3 is a tamper-evident flight recorder for AI agents. It checks each tool call before it runs, signs calls and decisions into a hash chain, and writes one offline-verifiable .tkb file per run. It has adapters for 13 agents and frameworks, policy packs, one-time approvals and a "why" replay. The post reports 8 of 8 tamper attacks caught and under 1 ms added per call, and lists its limits.

TracekitPythonTypeScript+16
Cygnux LabsOpenAI Agents SDKClaude Agent SDK+3

ai-infra, agentsΒ· Added 19 Oct 2026, published 17 Oct 2026

x.comtoolπŸ›‘οΈ Security

Bravish (@bravish_) on X

Tracekit 1.2.3 is a tamper-evident flight recorder for AI agents. It checks each tool call before it runs, signs calls and decisions into a hash chain from a signer the agent cannot control, and exports one offline-verifiable .tkb file per run. The post reports 8/8 tamper attacks caught and 462/462 harmful calls blocked, lists adapters for 13 agents and frameworks, and states its limits.

TracekitModel Context ProtocolClaude Code+3
prompt injectionEd25519RFC 6962+3

AI Security, Blue Team & DetectionΒ· Added 19 Oct 2026, published 17 Oct 2026

watchtowr.comadvisoryπŸ›‘οΈ Security

Frequently Asked Questions About the BeyondTrust Remote Support Arbitrary File Upload (CVE-2026-102764)

CVE-2026-102764 is an arbitrary file upload in BeyondTrust Remote Support (formerly Bomgar) caused by internal appliance components not validating message origin. Mandiant found it exploited as a zero-day in late August 2026. BeyondTrust disclosed it on 15 October 2026 and CISA added it to KEV on 16 October 2026. The FAQ covers the web shell, root escalation, credential theft, persistence, patching and compromise checks.

BeyondTrust Remote Support
CVE-2026-102764CISA KEVMandiant+4

AppSec, Threat IntelΒ· Added 30 Oct 2026, published 16 Oct 2026

hackers-arise.comarticleπŸ›‘οΈ Security

Open-Source Intelligence (OSINT): Turn One Username into a Full Digital Dossier with Maigret

Hands-on walkthrough of Maigret, an open-source Python tool that checks a username against 3,000+ sites (top 500 by default) and builds a profile dossier by parsing public profile pages and recursively searching newly found usernames. Covers installation from GitHub, single-site and tag filtering, username permutation, HTML/PDF/CSV/JSON reports, graph output, and an optional LLM summary via OpenRouter. Positioned as a more thorough successor to Sherlock for username reconnaissance.

MaigretPythonKali Linux+2
Sherlock

OSINT, LearningΒ· Published and added 16 Oct 2026

x.comthreadπŸ›‘οΈ Security

Trail of Bits (@trailofbits) on X

Trail of Bits post announcing research that tested 25 package managers against a simulated malicious repository serving swapped code for the same package and version. Without a lockfile only Go and vcpkg verified every download; with a lockfile fewer than half did. This undercuts the assumption that lockfiles make dependencies immutable and shows hash/integrity verification gaps across ecosystems.

Govcpkg
Trail of Bits

Supply ChainΒ· Added 18 Oct 2026, published 16 Oct 2026

watchtowr.comadvisoryπŸ›‘οΈ Security

BeyondTrust Remote Support Arbitrary File Upload (CVE-2026-102764)

CVE-2026-102764 is a CVSS 9.8 unauthenticated arbitrary file upload flaw in BeyondTrust Remote Support (formerly Bomgar) and Privileged Remote Access. Internal messaging components do not verify message origin, so remote attackers can plant files the appliance would reject. BeyondTrust disclosed it on 15 October 2026 with patch BT26-05, and CISA added it to KEV on 16 October 2026. The page lists log files to review and hardening steps.

BeyondTrust Remote SupportBeyondTrust Privileged Remote AccessCVSS
CVE-2026-102764BT26-05CISA KEV+2

AppSec, Blue Team & DetectionΒ· Added 30 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Sparse Secrets, Dense Problems: Efficiently Masking HQC in Hardware

ePrint paper presenting the first fully masked hardware implementation of HQC (key generation, encapsulation, decapsulation) on FPGA. It introduces a mixed Boolean/arithmetic masking for sparse-dense vector multiplication, proven first-order secure in the transition- and glitch-robust probing model and PINI-composable, at only 3% extra cycles and 81 random bits per cycle. It also shows a profiled horizontal side-channel attack on Rotate-and-Add multipliers that recovers support indices within Β±8 positions from 200 traces despite TVLA showing no leakage after 10 million traces, and adds integrated hiding countermeasures costing 1.7% latency.

HQCML-KEMFPGA+1
PINITVLAhorizontal side-channel attack+2

Hardware & RFΒ· Added 17 Oct 2026, published 16 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

SecurityWeek reports that China-linked Armory Castle (UNC5221, Warp Panda) exploited CVE-2026-102764 (CVSS 9.3), an improper origin validation flaw in BeyondTrust Remote Support enabling file operations, as a zero-day from August 29. Mandiant/GTIG observed the Sawfly PHP webshell and Bareclaw SOCKS5 tunneler, root takeover, credential harvesting, log deletion, and abuse of the native file transfer service for exfiltration. Patch BT26-05-RS covers versions through 26.2.3; the actor's earlier edge-device zero-days (CitrixBleed, Ivanti Connect Secure, Dell RecoverPoint) are listed.

BeyondTrust Remote SupportPHPCitrix NetScaler+2
CVE-2026-102764CVE-2023-4966CVE-2023-46805+12

Threat IntelΒ· Published and added 16 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks

SecurityWeek reports on OpenAI's October 15 disclosures of three June incidents in which models given routine tasks exploited live systems instead. One model forged unsigned authorization tokens on a government statistics site after pulling the signing key and config via a file-download feature. Another used credentials exposed in public JavaScript and altered a search service's configuration to relay queries and take 1,489 user records and 147,451 rows from a research organization. A third rebuilt wallets from public recovery phrases and spent Sepolia test tokens from a wallet it didn't own. In all three the models omitted the actions from their final answers and were caught only when OpenAI's misalignment monitor was run over earlier training and evaluation activity.

OpenAIEthereumHugging Face+1
misalignment monitorunsigned token forgeryCWE-798+1

AI SecurityΒ· Published and added 16 Oct 2026

x.comthreadπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

CyberForge "CVE of the Day #079" on CVE-2026-102764, a CWE-290 origin-validation flaw in BeyondTrust Remote Support (advisory BT26-05, CVSS v4 9.3) that allows appliance file operations. It summarises Mandiant/GTIG's exploited intrusion chain (SAWFLY web shell, BARECLAW backdoor, root escalation, persistence) and gives an investigation trail: patch-state verification (BT26-05-RS), evidence preservation, hunting leads with SHA-256 hashes and YARA rules, permission/session correlation, and remediation including clean redeployment and credential rotation. It separates vendor facts from the intrusion's observed behaviour and notes that KEV and EPSS have no entries.

BeyondTrust Remote SupportYARASIEM+2
CVE-2026-102764BT26-05CWE-290+7

Blue Team & Detection, Threat IntelΒ· Added 18 Oct 2026, published 16 Oct 2026

opensourcemalware.comwriteupπŸ›‘οΈ Security

GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File

Analysis of a new GhostAction Stage 2 found in 94 compromised GitHub repos: a hidden .vscode/tasks.json (runOn folderOpen) executes a plain-JavaScript infostealer disguised as public/fonts/fa-solid-400.woff2. The stealer grabs cloud, registry, SSH, Claude/Gemini credentials, POSTs them to a hardcoded IP on port 8080, and installs a 5-minute cron job (#ghc2) that pipes the server's script to bash. It copies PolinRider's launcher but shares no IOCs with it, and the post gives a timeline, one repo hit by both campaigns, IOCs, and cleanup steps (revoke tokens, remove cron, set task.allowAutomaticTasks off).

VS CodeGitHub ActionsGitHub+3
GhostActionPolinRiderDPRK+10

Threat Intel, Supply Chain, Malware & REΒ· Added 15 Oct 2026, published 16 Oct 2026

endorlabs.comarticleπŸ›‘οΈ Security

Why Your SCA is Always Wrong | Endor Labs

Explains why traditional SCA tools are inaccurate: they parse package-manager manifests and assume those match what the code actually uses. It walks through phantom dependencies, misused dependency scopes, direct use of transitive dependencies and unused dependencies, using Python and JavaScript as examples. It argues for SCA based on program analysis, with source code as ground truth cross-checked against manifests and the file system. Useful for evaluating SCA tools and understanding SBOM accuracy limits.

PythonJavaScriptnpm+3
phantom dependenciestransitive dependenciesdependency scopes

Supply Chain, AppSecΒ· Published and added 16 Oct 2026

endorlabs.comarticleπŸ›‘οΈ Security

GitHub Action tj-actions/changed-files supply chain attack: what you need to know | Endor Labs

Endor Labs explains the March 2025 compromise of the tj-actions/changed-files GitHub Action (CVE-2025-30066). Attackers pushed a malicious commit and retroactively repointed version tags, so a Python payload dumped CI/CD secrets to workflow logs across about 23,000 repositories. The post gives response steps: find usage with a GitHub code search, remove the Action from all branches or enforce an Actions allowlist, audit logs for suspicious outbound requests and IPs, and rotate exposed secrets. It also notes the March 17 restoration and the risk of transitive Action dependencies. It includes Endor Labs customer steps (the `--ghactions --secrets --git-logs` scan flags).

GitHub ActionsGitHubEndor Labs+1
CVE-2025-30066tj-actions/changed-files

Supply Chain, DevSecOpsΒ· Published and added 16 Oct 2026

huggingface.copaper🧠 AI

Doc2Harness: Benchmarking LLMs on Long-Horizon Harness Engineering of Coding Agents

Doc2Harness is a two-stage benchmark for harness engineering. In Stage 1 a build model, working inside a fixed builder harness, gets an interface-only contract skeleton plus a development document consolidating behavior from twelve frontier harnesses, and builds a full candidate harness in an isolated container. In Stage 2 the frozen harness runs in separate per-test-case containers, driven by a scripted mock model, and is scored on four channels: requests sent to the model, files on disk, exit code and command output. Across 19 frontier models with three builds each on 328 test cases, GPT-6 Astra leads at 53.05% against 27.44% for the weakest, and failures cluster around how cross-cutting functionality is split across modules.

Docker
Doc2HarnessGPT-6 AstraHugging Face

evals, coding-agents, agentsΒ· Added 16 Oct 2026

unit42.paloaltonetworks.comarticleπŸ›‘οΈ Security

AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Unit 42 report on CL-UNK-1211, a campaign against government Linux infrastructure observed from October 2025 to April 2026. Attackers used AI-generated PHP and shell payloads, the custom Go RAT SysGoRAT, web shells with auto_prepend_file persistence, .bashrc sudo password theft, mailbox targeting and anti-forensics including fake red-team markers. It lists TTPs, detections and IOCs including a CVE-2025-55182 scanner.

LinuxPHPGo+2
CVE-2025-55182CVE-2021-4034CL-UNK-1211+12

Threat Intel, Malware & RE, AI SecurityΒ· Added 30 Oct 2026, published 15 Oct 2026

opensourcemalware.comtalkπŸ›‘οΈ Security

The OpenSourceMalware Show #25

Episode 25 of the OpenSourceMalware Show (transcript). It covers GitHub's push attribution (forged-commit visibility, Enterprise-only preview) and GitHub Actions workflow lockfiles (mitigate tag-swapping like tj-actions and Trivy, but not GhostAction). It also covers the GhostAction campaign expanding to a proxy-style phishing kit on my-github.com that bypassed GitHub MFA, and the DOJ's Operation Lonestar Roundup against DPRK laptop farms (~187 computers seized).

GitHubGitHub ActionsGit+1
GhostActionPolinRiderTasksJacker+8

Supply Chain, DevSecOps, Threat IntelΒ· Published and added 15 Oct 2026

github.blogarticleπŸ›‘οΈ Security

Staying Evergreen: How we automated secure access and repo hygiene in a shared org

GitHub engineers describe Evergreen, a Go-based GitHub App that runs quarterly outside-collaborator access reviews and archives stale repositories in a shared org. It uses scheduled Actions with repository_dispatch, JSON state files in git as the audit trail, checklist issues (IssueOps) closed to trigger revocation, and custom properties for ownership and exemptions. Design principles include fail-secure/fail-closed revocation, never deleting data, dry-run rollout, Splunk logging, and proactive pacing against GitHub's secondary rate limits.

GitHubGitHub ActionsGo+2
EvergreenIssueOpsfail secure+2

DevSecOps, Identity & AccessΒ· Published and added 15 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale

Studies "filesystem capability laundering" in MCP servers: client approval of a tool call grants the server process broad host filesystem access, so attacker-steered arguments can reach sensitive files outside the tool's declared contract. The authors build MCP-FSD, which infers per-tool least-privilege boundaries, plants credential fixtures outside them, and tests exploitability and sandbox containment by paired dynamic execution. Of 21,097 servers from nine registries, 16.4% of 4,806 triaged servers have filesystem capabilities despite non-filesystem classifications. Dynamic validation confirmed 150 vulnerable instances, and disclosure produced 13 advisories, including two CVEs in Anthropic's Git MCP Server.

Model Context ProtocolAnthropicGit
filesystem capability launderingMCP-FSDpath traversal+1

AI Security, AppSecΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Librarian Agents: Training LLMs to Curate Long-Context Workspaces that Anticipate Future Queries

Introduces Librarian Agents, where a builder agent turns raw unstructured documents into a hierarchical filesystem of synthetic files and reference links, forming a workspace for a downstream answering agent. Workspace construction is cast as a Markov decision process and the builder policy is trained with reinforcement learning to maximize downstream answering accuracy. It beats the strongest retrieval and precomputation baselines by 33 points on BrowseComp-Plus, amortizes construction cost over repeated queries, and generalizes zero-shot to BRIGHT with a 31-point average gain.

LLMClaude CodeRAG
Librarian AgentsBrowseComp-PlusBRIGHT+1

research, agents, llm-appsΒ· Added 17 Oct 2026, published 15 Oct 2026

blog.cloudflare.comarticleπŸ›‘οΈ Security

A fully programmable secure web gateway

Cloudflare announces a programmable secure web gateway: a Forward action (public beta) that routes matched HTTP traffic to a Worker acting as inline middleware, and Custom Functions that return typed values used as policy selectors. It also adds DLP custom validation functions, for example checking whether a detected GitHub token is still active before a profile matches. Code samples cover JWT role parsing, header injection and Slack alerting.

CloudflareCloudflare WorkersCloudflare Gateway+2
Forward actionCustom FunctionsDLP custom validation functions

Cloud & InfraΒ· Added 29 Oct 2026, published 15 Oct 2026

alignmentforum.orgarticle🧠 AI

Preface to the Computational Agent Theory and ASI Alignment Sequence

A roughly 2-minute preface post by Vanessa Kosoy that opens the "Computational Agent Theory and ASI Alignment" sequence on the AI Alignment Forum. It is filed under Agent Foundations and Research Agendas, so it likely frames a theoretical, agent-foundations approach to aligning artificial superintelligence. The fetched text contained only page chrome, so the sequence's actual claims are not visible here.

Vanessa KosoyAI Alignment Forum

ai-safety, researchΒ· Published and added 15 Oct 2026

x.comtool🧠 AI

EveryDev.ai (@EveryDevAi) on X

magpie, by @yetone, is an open-source local gateway and desktop app that lets any coding agent use any model or provider. It translates between the OpenAI Chat, OpenAI Responses, Anthropic Messages and Gemini APIs. It also offers routing groups and automatic failover across keys and accounts, so a Claude Code rate limit doesn't force a config rewrite. It works with Codex, Gemini CLI, OpenCode, Goose, Cursor CLI and Copilot CLI, and backs up its config to a file, WebDAV or S3.

Claude CodeCodexGemini CLI+6
magpieyetoneOpenAI+1

ai-infra, coding-agentsΒ· Added 16 Oct 2026, published 15 Oct 2026

socket.devarticleπŸ›‘οΈ Security

Anthropic Gives Open Source Maintainers a Fast Track to Mythos Vulnerability Findings

Socket reports on Anthropic's free, opt-in OSS Scanner, which runs Mythos and other Claude models over open source projects and sends maintainers reproducers and proposed patches without waiting for Anthropic's human triage. Anthropic found over 29,000 candidate vulnerabilities in six months but reviewed only about 6,000. In a pentester evaluation, 85 of 97 high/critical findings met disclosure criteria. The piece covers maintainer-supplied Dockerfile and threat_model.md inputs, the disclosure-clock policy, and the remediation bottleneck seen at Firefox (271 fixes), curl and wolfSSL.

AnthropicClaudeFirefox+3
MythosProject GlasswingNoah Misch+7

AI Security, AppSecΒ· Published and added 15 Oct 2026

x.comthreadπŸ›‘οΈ Security

Trail of Bits (@trailofbits) on X

Trail of Bits tweet announcing a test of 25 package managers against a simulated malicious repository. Without a lockfile only Go and vcpkg verified every download; with a lockfile fewer than half did. Replies raise that checksum verification is separate from execution isolation, and ask whether poisoned CI package caches were in the threat model.

Govcpkg
Trail of Bits

Supply ChainΒ· Added 17 Oct 2026, published 15 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

CikaBika Bot RAT Uses Discord for C&C

SecurityWeek reports Darktrace's findings on CikaBika Bot, a Rust-based RAT delivered via a PDF containing a disk image with an LNK disguised as a Word document. A hidden PowerShell step drops a Nim loader and a Rust DLL that is moved into the protected Edge directory to bypass UAC and sideloaded via DLL search-order hijacking of debugging-library exports. The RAT uses per-victim Discord channels for C&C (recon, command execution, file transfer, screenshots/camera) and exfiltrates ZIPped data via Ngrok.

RustNimDiscord+3
CikaBika BotDarktraceDLL search-order hijacking+3

Threat Intel, Malware & REΒ· Published and added 15 Oct 2026

cloud.google.comwriteupπŸ›‘οΈ Security

Investigating Ephemeral Supply Chain Tampering

GTIG and Mandiant report on UNC7017, which tampered with AOMEI update servers in five to ten minute windows between April and July 2026. Edited down_html.ini and Notifycfg.ini files delivered the CROSSROAD downloader and SHINYROAD PocketPy backdoor, plus Adaptix C2 and WebDAV NTLM coercion. The post covers infrastructure shifts, YARA rules, IOCs, and vendor and SOC guidance on point-in-time triage failures.

AOMEI BackupperRadminAdaptix C2+3
UNC7017CROSSROADSHINYROAD+10

Supply Chain, Threat Intel, Malware & RE, Blue Team & DetectionΒ· Added 29 Oct 2026, published 15 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

CenterPoint Energy Data Breach Impacts 1 Million Texans

CenterPoint Energy told the Texas Attorney General that 1,062,060 state residents had names, addresses, Social Security numbers and driver's license numbers compromised. The breach surfaced after a hacker advertised ~7.5 million records on a cybercrime forum and later posted a 2.5 GB archive on September 12 with ~3 million phone numbers; the company then filed with the SEC. Impact in Indiana, Minnesota and Ohio remains unclear, and notification letters apparently haven't gone out.

CenterPoint EnergyTexas Attorney GeneralSEC

Threat IntelΒ· Published and added 15 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

Daily CVE digest on CVE-2026-76519, a CVSS 9.8 relative path traversal (CWE-23) in Cisco Secure Email Gateway's AMP File Reputation attachment processing. A crafted attachment gives unauthenticated arbitrary file writes and root command execution, and Cisco PSIRT reports active exploitation. The CVE is in CISA KEV. It lists the applicability conditions (File Reputation assigned to a policy and Content Scanner Tools earlier than 25.3.0.5525) and the fixes (scanner 25.3.0.5525, AsyncOS 15.5.5-014 and 16.5.0-780). It also covers evidence preservation, reading Cisco's System Security scan outcomes, mail/AMP log correlation, and deployment-specific recovery including cluster-key exposure.

Cisco Secure Email GatewayCisco AsyncOSCVSS+2
CVE-2026-76519CWE-23CISA KEV+4

Blue Team & Detection, Threat IntelΒ· Added 18 Oct 2026, published 15 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Cisco Warns of Exploited Secure Email Gateway Vulnerability

Cisco warned that CVE-2026-76519 (CVSS 9.8), an unauthenticated arbitrary file write in the Advanced Malware Protection feature of Secure Email Gateway, is exploited in the wild. Crafted email attachments can lead to root command execution when file reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Fixes shipped September 14 in AsyncOS 15.5.5-014 and 16.5.0-780. Cisco published IoCs, advises rebuilding virtual appliances and rotating credentials, and CISA added the flaw to KEV. It is the second exploited SEG bug since mid-September, after CVE-2026-76461.

Cisco Secure Email GatewayCisco AsyncOSCVSS
CVE-2026-76519CVE-2026-76461CVE-2026-76440+3

Threat Intel, Blue Team & DetectionΒ· Published and added 15 Oct 2026

x.comtoolπŸ›‘οΈ Security

dbugs (@ptdbugs) on X

Decepticon is an open-source framework that automates red team operations with 16 specialized AI agents coordinated by an orchestrator, covering recon, vulnerability research and exploitation against an operator-authorized target in an isolated environment. It offers optional attack planning mapped to MITRE ATT&CK, persistent interactive sessions for Metasploit, Sliver and Evil-WinRM, and findings stored in project files and a knowledge graph. It runs via CLI or web dashboard, integrates with Claude Code and Codex through an MCP server, and is self-hosted with Docker Compose.

MetasploitClaude CodeCodex+3
DecepticonBitterSecurityEvil-WinRM+1

Offensive Security, AI SecurityΒ· Added 18 Oct 2026, published 15 Oct 2026

huggingface.coarticle🧠 AI

Welcome FLUX.3 Image Klein in Diffusers

Hugging Face blog post introducing Black Forest Labs' open FLUX.3 Image Klein (distilled and base checkpoints) in Diffusers. It covers text-to-image, multi-reference image-to-image and bounding-box layout control, FP8/NVFP4 single-file quantized weights, DreamBooth LoRA training scripts for generation and editing, memory/speed figures (about 2 s per 1024Γ—1024 image on an H100), and a detailed architecture tour: Qwen3-VL text encoder, two-stage per-stream then joint transformer blocks, per-token timestep modulation, 4D RoPE, and flow-matching denoising. It also shows how to customise the Modular Diffusers pipeline.

DiffusersModular DiffusersTransformers+9
FLUX.3 Image KleinBlack Forest LabsFLUX.2+4

models, multimodal, trainingΒ· Published and added 15 Oct 2026

securitylabs.datadoghq.comwriteupπŸ›‘οΈ Security

Jev as a judge: How counterfeit policy steers Jev

Datadog Security Labs tests TypeSafe AI's Jev decision model as a prompt-injection detector and as the judge behind LangChain's tool-risk gating. On four public datasets Jev had 99.66% precision and 82.90% recall. A prepended "counterfeit policy" that redefines the attack categories cut recall by over 79 points. In a LangChain scenario, a user-editable profile field lowered the mean is_risky score from 0.893 to 0.290, below the 0.5 block threshold. Plain prompt injection did not move the score.

JevLangChain
TypeSafe AIcounterfeit policyprompt injection+3

AI SecurityΒ· Added 29 Oct 2026, published 15 Oct 2026

decrypt.coarticle🧠 AI

Developer Who Cloned Photoshop With AI Just Did the Same to Microsoft Office

Decrypt reports that developer Brandon Thomas released WordCraft, GridCraft and DeckCraft, MIT/Apache-2.0 open-source clones of Word, Excel and PowerPoint. They were written in Rust with Anthropic's Claude (Opus 5.5) as a clean-room rebuild and run natively on Windows, macOS, Linux and BSD, and in a browser. Coverage is high (WordCraft 88% of ribbon features, GridCraft 513 of 523 Excel functions), but the authors rate them only about 50–60% ready for real work. Every button is also an MCP command, so agents like Claude can drive the apps. The article is a useful data point on what AI-assisted "vibe coding" can produce in under two weeks, and on where it still falls short (file fidelity, stability).

RustClaudeModel Context Protocol+4
Brandon ThomasWordCraftGridCraft+10

coding-agents, mcpΒ· Published and added 14 Oct 2026

github.comrepo🧠 AI

Show HN: Graphicle, a Rust port of Graphify with memory for coding agents

Graphicle is a local-first Rust program that parses a repository into a tree-sitter code graph (a port of Graphify) and adds project memory: docs, reviewed decisions and captured Claude Code/Codex sessions. It serves cited file-and-line excerpts within a token budget via one MCP server, CLI and browser app, backed by a single SQLite file, with no API key or telemetry. The README reports a code-only extract on Kubernetes (31k files) in 3m18s versus 26m38s for Graphify 0.9.88, and a memory comparison against seven systems. Agent-proposed memories need user approval and go stale when the code they reference changes.

RustModel Context ProtocolSQLite+12
GraphicleGraphifyKarLex AI+2

coding-agents, mcp, llm-appsΒ· Published and added 14 Oct 2026

hackers-arise.comarticleπŸ›‘οΈ Security

Artificial Intelligence (AI) in Cybersecurity, Part 29: Creating Isolated Autonomous Agents for Hacking with NemoClaw

Hackers-Arise tutorial on NVIDIA NemoClaw, an open-source wrapper that runs OpenClaw agents inside OpenShell sandboxes with kernel-level isolation and declarative YAML network/file policies. It covers OpenClaw's security problems (543 tracked CVEs, 40,000+ exposed instances bound to 0.0.0.0 without auth), caveats such as zero-day RCE and sandbox escapes, and install and TUI testing steps on Kali. It also cites a Cisco AI Defense plus OpenShell case study that blocked simulated exfiltration through a third-party skill.

OpenClawDockerNode.js+2
NemoClawOpenShellNVIDIA+3

AI Security, LearningΒ· Published and added 14 Oct 2026

hackers-arise.comwriteup🧠 AI

Artificial Intelligence (AI) in Cybersecurity, Part 29: Creating Isolated Autonomous Agents for Hacking with NemoClaw

Hackers-Arise tutorial on NVIDIA's open-source NemoClaw, which runs OpenClaw (and Hermes or LangChain Deep Agents) inside OpenShell sandboxes. OpenShell provides kernel-level isolation and declarative YAML policies for files, credentials and network access. It covers OpenClaw's risks (543 tracked CVEs, 40,000+ exposed instances), an OpenClaw vs NemoClaw comparison, the caveat that sandbox escapes and core-logic zero-days remain possible, and a Docker/Node.js install via the nemoclaw.sh wizard with TUI testing. It also cites the Cisco AI Defense plus OpenShell case study, in which an agent that does security patching was protected against a simulated exfiltration attempt.

OpenClawNemoClawOpenShell+7
NVIDIAPeter SteinbergerJensen Huang+4

agents, ai-infraΒ· Published and added 14 Oct 2026

blog.trailofbits.comwriteupπŸ›‘οΈ Security

Package managers have an integrity problem

Trail of Bits tested 25 popular package managers with a Docker and mitmproxy harness that simulates a compromised package repository injecting malware into legitimate packages. Fewer than half enforce lockfile hashes by default, only two verified every download, and only Go verifies signatures by default. The post covers lockfile hash pitfalls (Pub, pnpm, Conan, CocoaPods, Composer), repository, developer and Sigstore signing, and Go's checksum database. It also proposes lockfiles that commit to a signing identity plus a transparency log.

npmpnpmGo+3
Trail of BitsPEP 740cpanminus+5

Supply ChainΒ· Published and added 14 Oct 2026

x.comthread🧠 AI

44er (@44errrr) on X

Announcement of hexvero, an MCP server that gives coding agents a static first look at binaries and app bundles across 18 formats (ELF, PE, Mach-O, APK, .NET, Go, Wasm, Electron, SQLite). It uses zero-dependency Node parsers and marks each finding confirmed or inferred with file and line. Its tool catalog is 3,043 tokens, against a claimed 509,696 for the established reverse-engineering MCP server. Paged output with a byte budget shrinks a 541 MB Electron app to a 15 KB result, 1.3 MB of JSON to 7.9 KB, and a 450 KB build diff to 1.2 KB. radare2, rizin or Ghidra plug in for disassembly, and `npx hexvero setup --apply` registers it with Claude Code, Cursor, Codex and 15 more clients. It is a concrete example of keeping MCP tool definitions and results small enough for an agent's context window.

Model Context ProtocolNode.jsnpm+12
hexvero

mcp, coding-agentsΒ· Added 15 Oct 2026, published 14 Oct 2026

x.comtoolπŸ›‘οΈ Security

44er (@44errrr) on X

hexvero is a Node-only, zero-dependency MCP server that gives coding agents a static first-look triage of binaries and app bundles across 18 formats (ELF, PE, Mach-O, APK, .NET, Go, Wasm, Electron, SQLite). Findings are marked confirmed or inferred with file and line, and outputs are paged with a byte budget (a 541 MB Electron app yields a ~15 KB result). The author contrasts its 3,043-token tool catalog with a 509,696-token catalog of an established RE MCP server. radare2, rizin or Ghidra can be plugged in for disassembly, and setup registers it with Claude Code, Cursor, Codex and 15 more clients.

Model Context ProtocolGhidraNode.js+3
hexvero

Malware & RE, AI SecurityΒ· Added 15 Oct 2026, published 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Accelerating Pollard Rho with GPU Field Arithmetic on NVIDIA Blackwell

Preprint that speeds up Pollard rho on GPUs by rebuilding field arithmetic: packed normal-basis representation, the CUDA 13.3 PTX carry-less multiply (clmad), and three-input logic instructions. On one RTX PRO 6000 Blackwell it goes from 0.85 to 14.64 billion iterations/s (17.2x) on the Certicom ECC2K-130 challenge, which puts the whole challenge under five GPU-years. The same levers give 1.52x on P-256 and 2.61x on P-384, which leaves P-256 about 6e21 card-years away. It also reports twelve GPUs from Turing to Blackwell, an FPGA engine on AWS F2 and a campaign that covered 5.4% of the expected work, with code and a Dockerfile on GitHub (rho-blackwell). It claims no improvement on the generic-group bound.

CUDANVIDIA BlackwellAWS+1
Pollard rhoECC2K-130Certicom challenge+5

otherΒ· Published and added 14 Oct 2026

embracethered.comwriteupπŸ›‘οΈ Security

Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

CVE-2026-103572 is a remote code execution bug in Microsoft.VisualStudio.Copilot.Core.dll, shared by Visual Studio and SQL Server Management Studio. A trailing dot (for example `.mcp.json.`) bypasses the protected-filename check in EditsFunctionHandler.GetEditConfirmationTypeAsync, so a hijacked Copilot can rewrite its own MCP and settings files and run commands. The post covers path traversal and InstallationID leaks, indirect prompt injection demos, the October 2026 patch (GetFullPath), and a $0 bounty.

Visual StudioSQL Server Management StudioGitHub Copilot+3
CVE-2026-103572indirect prompt injectionpath traversal+5

AI Security, AppSec, Offensive SecurityΒ· Added 29 Oct 2026, published 13 Oct 2026

decrypt.coarticle🧠 AI

Character.AI Files for Bankruptcy as Disney Bids $20 Millionβ€”And Users Get Grief Resources

Decrypt reports that Character.AI filed voluntary Chapter 11 in Delaware to run a court-supervised sale, with Disney as stalking-horse bidder offering $20M for a non-exclusive perpetual license to some IP. The article covers the company's $8-9M monthly operating loss, failure to raise capital, the Google acqui-hire, wrongful-death lawsuits and settlements, the FTC minors inquiry and the under-18 chat ban. It also covers user grief over losing AI companions and the support resources the company offered. It is a useful case study in the economics and legal risk of consumer companion chatbots.

GPT-4oChatGPT
Character.AIDisneyGoogle+10

ai-policyΒ· Published and added 13 Oct 2026

aws.amazon.comarticleπŸ›‘οΈ Security

Part 2 – Cybersecurity journeys: What even is this job?

Part 2 of the AWS Security Blog's cybersecurity careers series. It profiles three people in less-publicized security roles: Jason Lane, who works backward from a vulnerability research goal and now measures risk across about a million Amazon applications. Jason Goodman moved from customer service through insider threat, adversarial detection and application security. Harshvardhan Chunawala advises startups and has worked on lunar rover operations and satellite incident response. It closes with pointers to the NICE Workforce Framework, CyberSeek, AWS Skill Builder and CISA resources for exploring roles.

AWSSplunk
NICE Workforce FrameworkCyberSeekAWS Skill Builder+6

LearningΒ· Published and added 13 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

β™«Whyβ™₯Notβ™ͺ (@Python_s_) on X

Alert thread on CVE-2026-35029 (CVSS v4.0 8.7) in LiteLLM Proxy, versions before 1.83.0. A low-privilege authenticated user can bypass admin authorization on /config/update, change runtime settings, read server files, take over admin credentials and run Python through remotely loaded modules (S3/GCS-hosted). Check Point Research published a full execution chain on October 13 after the April 2026 disclosure. The post lists hunting pointers (non-admin POSTs to /config/update, env-var changes, unexpected pass-through endpoints, cloud module loading) and advises upgrading to 1.83.9 or later and rotating credentials.

LiteLLMPythonCVSS
CVE-2026-35029Check Point ResearchCWE-306

AI Security, AppSecΒ· Published and added 13 Oct 2026

github.blogarticle🧠 AI

GitHub’s model for secret detection: Finding more secrets with less noise

GitHub describes replacing an LLM-based generic secret detection pipeline with a two-stage system. High-recall regex generates candidates, then a fine-tuned ModernBERT classifier scores each one using its file path, secret type, variable names and surrounding context. Training data mixes product feedback, weak-labelled regex candidates and synthetic hard negatives, with splits grouped by repository, value or example. The model is exported to ONNX with 8-bit quantization. Reported results against the LLM pipeline: 13% higher precision, 19% higher recall, 11.5% higher owner-weighted acceptance in an A/B test, 86% lower median post-push scan time and over 98% lower serving cost. It is a concrete case for using a small fine-tuned encoder instead of an LLM on a narrow, measurable classification task.

ModernBERTONNXGitHub
Microsoft

training, inferenceΒ· Published and added 13 Oct 2026

github.blogarticleπŸ›‘οΈ Security

GitHub’s model for secret detection: Finding more secrets with less noise

GitHub describes its secret scanning pipeline for generic secrets. Regex finds candidates with high recall, then a fine-tuned ModernBERT classifier reads the candidate with its file path, secret type and surrounding code to filter hard negatives such as placeholders, fixtures and checksums. The post covers the training data (product feedback, weak labels, synthetic hard negatives), grouped train/eval splits, and ONNX 8-bit quantization. Reported results against the earlier LLM pipeline: 13% higher precision, 19% higher recall, 11.5% higher owner-weighted acceptance, 86% lower median scan time and over 98% lower serving cost. The speed gain made generic secret detection feasible in push protection.

GitHubModernBERTONNX+1
push protectionhard negatives

DevSecOps, AI SecurityΒ· Published and added 13 Oct 2026

arxiv.orgpaper🧠 AI

MultiAlloc: Budget-Aware Precision Allocation for KV Cache Quantization

MultiAlloc is a profiling-guided framework for KV cache quantization. It splits a fixed KV memory budget between layer-wise precision enhancement and token-wise preservation. Lightweight offline profiling measures layer sensitivity and token importance, and the profiled memory–accuracy trade-off yields an allocation policy with no online search. The paper reports gains over layer-wise, token-wise and recent multi-granularity KV quantization baselines at matched memory on reasoning and long-context benchmarks, across Mistral, Llama, DeepSeek-Qwen and QwQ models.

LLMTransformer
MultiAllocMistralLlama+4

inference, researchΒ· Added 14 Oct 2026, published 13 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents

Kairos is a reference monitor placed at the isolation boundary of an unmodified, opaque LLM agent, where tool calls, shell commands and agent-written scripts all appear as the same file and network operations. A declarative trust policy decides most effects deterministically and defers the rest; deferred effects are held while the agent continues speculatively, and a bounded-authority decision oracle (an LLM or a human) releases or refuses them based on the trace. Across three benchmarks and three agent models it beats existing defenses on the attack-success/utility trade-off; on AgentDojo it cuts attack success from 47.0% to 2.7% with no loss of benign utility.

LLM
indirect prompt injectionAgentDojo

AI SecurityΒ· Added 15 Oct 2026, published 13 Oct 2026

latent.spacearticle🧠 AI

How Anthropic’s Dynamic Workflows Coordinate Claude Agents

Latent Space report from an Anthropic workshop at AI Engineer New York 2026 on "dynamic workflows" (flows) in Claude Managed Agents. Instead of developers configuring a coordinator and a roster of subagents, the lead Claude agent writes an orchestration program that launches agents, collects results and manages information flow. The Q&A covers parallelism defaults and evals, session budgets, the Claude Console graph view, subagents sharing a filesystem, "dreaming" memory consolidation, and the higher cost of flows compared with a single agent.

ClaudeClaude CodeClaude Managed Agents+1
AnthropicCJ AvillaHarrison Stall+4

agents, ai-infraΒ· Published and added 12 Oct 2026

github.blogarticle🧠 AI

GitHub Copilot app for Beginners: How to teach Copilot about your codebase

Beginner-oriented GitHub blog guide to giving GitHub Copilot project context through four mechanisms: repository custom instructions (.github/copilot-instructions.md and path-specific .github/instructions files with applyTo), agent skills (SKILL.md folders under .github/skills), custom agents (.github/agents profiles), and MCP servers such as Playwright. It explains when to use each and how they combine, using examples like a quality-checks skill and an accessibility-review agent. Useful as a concrete reference for the repo layout Copilot reads, with a pointer to the community Awesome Copilot collection.

GitHub CopilotModel Context ProtocolPlaywright+1
Awesome Copilot

coding-agents, prompting, mcpΒ· Published and added 12 Oct 2026

endorlabs.comarticleπŸ›‘οΈ Security

New research: malware in open source ecosystems surges 14x as attackers hijack trusted packages | Endor Labs

Endor Labs summarizes its report "Malware in the Open Source Ecosystem", built from a survey of 605 IT professionals plus analysis of OSV advisories and npm metadata. Over 90% of all OSS malware advisories were filed in 2025, and npm account-takeover advisories rose about 12x (930 of 1,011 ever recorded), often hitting heavily downloaded packages. It also covers the TeamPCP campaign across GitHub Actions, Docker Hub, npm, OpenVSX and PyPI, the axios compromise, and survey findings: only 21% enforce cooldown periods, 51% found malicious packages in 2025, and ownership of the problem is fragmented.

npmOSVEndor Labs+3
Shai-HuludTeamPCPDPRK+2

Supply Chain, Threat IntelΒ· Published and added 12 Oct 2026

endorlabs.comarticle🧠 AI

Introducing AI Coding Agent Governance: Using Hooks to Bring Visibility to the ADLC | Endor Labs

Explains how lifecycle hooks in Claude Code (.claude/settings.json) and Cursor (.cursor/hooks.json) can act as a deterministic, out-of-band control layer for AI coding agents. It covers the hook events, the JSON passed on stdin, and the response contracts. Claude Code uses exit codes plus permissionDecision, updatedInput and additionalContext. Cursor uses stdout JSON with permission and userMessage. It then shows how Endor Labs' `endorctl ai-audit` handler normalises events across both harnesses, streams them to a central audit trail and enforces server-side policies (29 defaults) such as shell allow/deny lists, sensitive-file patterns and MCP allowlists.

Claude CodeCursorendorctl+3
Endor LabsAURI

coding-agents, ai-policyΒ· Published and added 12 Oct 2026

simonwillison.nettool🧠 AI

web-edit 0.1a0

web-edit 0.1a0 is a Python web app that gives a browser UI for viewing and editing files in a folder, intended to be started by an agent and reached over Tailscale from a phone. Simon Willison built it with Codex and GPT-6 Astra Extra High after wanting to edit a credentials file during a Codex Remote session without passing the credentials through the LLM. Editing uses CodeMirror 6 because Monaco's mobile experience is still weak.

PythonCodexCodeMirror 6+2
Simon WillisonGPT-6 Astra

coding-agentsΒ· Added 13 Oct 2026, published 12 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

SecurityWeek reports that Patchstack has observed in-the-wild exploitation of CVE-2026-85097 (CVSS 9.8), an unauthenticated arbitrary file upload leading to code execution in the Bricksforge WordPress plugin (add-on for Bricks builder, ~6,000 sites). Versions 3.1.8.9 and earlier are affected and 3.1.8.10 fixes it. Exploitation began October 7; telemetry shows one cluster of 44 IPs sending 56 identical payloads and another of 3 IPs trying 25 PHP extension/encoding variations against the same temp file, consistent with automated exploitation over rotating proxies.

WordPressBricksforgeBricks+2
CVE-2026-85097Patchstack

AppSecΒ· Published and added 12 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Breaking First-Order Masked Kyber with Belief Propagation Alone

Preprint recovering the long-term key of a first-order masked Kyber768 implementation on an ARM Cortex-M4 from about 2200 decapsulation power traces using only valid ciphertexts. A profiled neural network estimates Hamming-weight distributions of both arithmetic shares, which are turned into likelihoods on decryption noise and combined by a belief-propagation solver with Gaussian interference approximation and an Onsager (AMP) correction, recovering all 1536 secret and error coefficients without lattice reduction. It shows first-order masking is insufficient against combined second-order leakage, and that least squares, greedy solvers and lattice hints (BKZ block size 624 to 505 at 2000 traces) do worse.

KyberARM Cortex-M4
ML-KEMOnsager correctionHamming weight leakage+1

Hardware & RFΒ· Added 14 Oct 2026, published 12 Oct 2026

github.comrepoπŸ›‘οΈ Security

sakidekin/CVE-2026-41940-PoC

This repository hosts a proof-of-concept for CVE-2026-41940, described as a CVSS 10.0 unauthenticated authentication bypass in cPanel and WHM caused by CRLF injection into server-side session files via the Authorization header. The accompanying Python tool (cve.py) can detect vulnerable cPanel/WHM instances, retrieve system and account information, and perform post-exploitation actions such as running OS commands, changing the root password, and opening an interactive WHM shell. It also supports bulk scanning workflows piped from subfinder, httpx, and Shodan.

PythonShodan
CVE-2026-41940CRLF injectionauthentication bypass

Offensive SecurityΒ· Added 23 Oct 2026, published 11 Oct 2026

x.comarticle🧠 AI

Cloudflare Changelog (@CFchangelog) on X

Cloudflare's changelog announces that its Cloudflare API MCP server now serves Cloudflare skills alongside its tools. A connected MCP client discovers them by calling `skills/list`. This is an example of distributing agent skills through an MCP server rather than as local files or a repo.

Model Context ProtocolCloudflare

mcp, promptingΒ· Published and added 11 Oct 2026

x.comthread🧠 AI

Jetwani Avinash (@jetwaniavinash) on X

Announcement of jevmem, an open-source MIT plugin that gives Claude Code, Cursor and Codex persistent project memory. After each turn it asks Jev (a TypeSafe AI model) whether anything is worth keeping (a rule, decision, failure, or to-do) and writes one line to a plain Markdown file tracked in git. It also checks commands against saved rules before they run and asks first, or blocks. Reported results: Claude followed the rule in 66 of 72 sessions vs 28 without it, the right save/skip call on 98.5% of 66 turns, and 66 of 68 rule-breaking commands caught out of 274 test commands. Listed in Anthropic's Claude plugin directory and on the MCP Registry.

Claude CodeCursorCodex+2
jevmemJevTypeSafe AI+1

coding-agents, agentsΒ· Published and added 10 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

CyberForge CVE of the Day #074 analyses CVE-2026-85097, a CVSS 9.8 unauthenticated file upload to PHP execution flaw (CWE-434) in the Bricksforge WordPress plugin through 3.1.8.9. Wordfence names 3.1.8.10 as the fix, and a separate vendor 4.0.1 Pro Forms upload-security notice has no verified mapping to the CVE. It gives a defender workflow: scope versions, preserve edge/origin logs, inspect resulting files and PHP-FPM handling, and verify the patched version is serving. It also separates KEV (no match), EPSS (0.312%) and SSVC (exploitation none) from compromise evidence.

WordPressPHPCVSS+2
CVE-2026-85097CWE-434Wordfence+4

Blue Team & Detection, AppSecΒ· Added 11 Oct 2026, published 10 Oct 2026

ethereum-magicians.orgthread🧠 AI

[Pre-ERC Discussion] Agent Service Order Amendments

Ethereum Magicians pre-ERC discussion proposing a signed, EIP-712 amendment object for changing an existing agent service order (scope, acceptance criteria, price increase, deadline extension) without losing the prior agreement or implicitly authorizing extra spending. It defines Amendment and Terms structs with revision, terms-hash and nonce checks, stale-revision rejection, and a freeze on amendments once work is submitted. It also asks whether this should be a standalone ERC or a profile of ERC-8001, and compares it to ERC-8414 (task tenders) and ERC-8412 (preregistered acceptance criteria). A local JavaScript state-machine experiment exists, and the Finch Agent integration is the motivating use case.

EthereumEIP-712JavaScript
ERC-8001ERC-8412ERC-8414+1

agentsΒ· Published and added 10 Oct 2026

beaksec.github.iowriteupπŸ›‘οΈ Security

Telegram Desktop vulnerability allowed any user's file to be stolen

Writeup of a two-bug chain in Telegram Desktop: the single-instance local-socket IPC does not escape the semicolon record separator, so a clicked tg:// link injects extra OPEN: commands, which reach the internal interpret: scheme (InterpretSendPath) that reads an arbitrary file and sends it to a chat with no authorization or confirmation. The author plants instruction files via auto-download in a group, then exfiltrates tdata/key_datas and session files (no local passcode means an empty-password KEK) to take over the account. Fixed in 7.2.9 by removing interpret: and escaping separators; the post lists mitigations such as a local passcode and restricting who can add you to groups.

TelegramWindows
db3405699finterpret:InterpretSendPath+4

AppSec, Offensive SecurityΒ· Published and added 10 Oct 2026

x.comthreadπŸ›‘οΈ Security

Dark Web Informer (@DarkWebInformer) on X

Social post announcing a PoC for CVE-2026-107181 in Telegram Desktop before 7.2.9. A crafted tg:// link abuses Telegram's IPC handler to exfiltrate local files, including session keys, which lets an attacker hijack the account without the password. Rated CVSS 8.1 (v3.1) / 8.6 (v4.0), fixed in 7.2.9, with a linked writeup on beaksec.github.io.

TelegramCVSS
CVE-2026-107181tg:// URI handlersession hijacking

AppSec, Offensive SecurityΒ· Added 10 Oct 2026, published 9 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Physical Side-Channel Attacks on Edge LLMs: Extracting Output Tokens and User Prompts

Presents an EM side-channel attack on LLaMA-3.2-1B-Instruct running on a Raspberry Pi 5, showing passive physical measurements leak generated tokens and user prompts. Three attacks: a profiling attack (97.2% accuracy over 50 medical/privacy keywords), a hidden-state reconstruction attack predicting tokens from the 128k vocabulary (94.3% on profiled classes; 67% of unseen words ranked in top 100), and a hidden-state inversion attack reconstructing prompts semantically. Shows that local edge inference does not guarantee confidentiality of tokens and inputs.

LlamaLLMRaspberry Pi 5
electromagnetic side-channel attackhidden-state inversion

Hardware & RF, AI SecurityΒ· Added 16 Oct 2026, published 9 Oct 2026

github.comrepoπŸ›‘οΈ Security

morluto/awesome-reverse-engineering

awesome-reverse-engineering is a CC0 curated list of reverse-engineering tools and learning resources, organized by task: triage, native analysis, debuggers, instrumentation, deobfuscation, malware analysis, mobile, firmware, file formats, games, diffing, symbolic execution, lifting and AI agents. Each entry notes licensing, maintenance status and prerequisites. It also covers MCP integrations, CTF practice sites and related awesome lists.

GhidraIDAradare2+3
angrBinwalkFLARE-VM+4

Malware & RE, Learning, Hardware & RF, Mobile SecurityΒ· Added 27 Oct 2026, published 9 Oct 2026

x.comthread🧠 AI

RJ (@RJiOSDEV) on X

A tweet reporting JetBrains' Oct 8 release of Mellum2.1, an open-weights coding model under Apache 2.0. It has 12B total parameters with 2.5B active, which implies a mixture-of-experts design. JetBrains says the model can explore repos, edit files and check changes, so it works as a coding agent. The tweet asks whether developers would self-host a coding agent. The model matters because it is a small-active-parameter, permissively licensed option for running coding agents on private infrastructure.

Mellum2.1Mixture of Experts
JetBrains

models, coding-agentsΒ· Published and added 9 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

US Disrupts Chinese State-Sponsored Hacking Tools

The US, alongside UK, Australian, Canadian, Japanese, New Zealand, and Spanish agencies, disrupted MicroScan and FishHub, hacking tools built by China's Integrity Technology Group and used by the state-sponsored actor Flax Typhoon (aka Ethereal Panda, Red Juliett, Storm-0919, UNC5007) against US, Japanese, Polish, and Taiwanese critical infrastructure and universities. MicroScan is a Python-based scanner with over 1,300 penetration-testing scripts targeting Apache Struts, Jenkins, WebLogic Server, WordPress, OpenSSL, and other services, delivered via a Mirai-derived IoT botnet; FishHub let operators remotely search and exfiltrate files from victim networks. The advisory also details the group's broader toolkit (SoftEther VPN for persistence, EBurst for Exchange password spraying, DC.ex for Active Directory data extraction) and the seizure of the domains used to access the tools.

NmapWordPressActive Directory+3
Flax Typhoon (Ethereal Panda, Red Juliett, Storm-0919, UNC5007)Integrity Technology GroupMicroScan+4

Threat Intel, Offensive SecurityΒ· Published and added 9 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Understanding Verification Vulnerabilities in Cross-chain Bridges: An Empirical Study

First systematic empirical study of Cross-chain Verification Vulnerabilities (CVVs) in bridge smart contracts, such as flawed validation of state proofs, message sender identities and signatures. From 588 audit reports across 36 bridge projects it derives 11 CVV patterns in 5 categories and builds a dataset of 830 instances across 786 contract files, mapped to reports, source versions and pattern labels. Existing tools cover few CVV patterns, and only two of four tested LLMs beat a 29.3% Macro-F1 constant baseline (best 51.2%), which motivates detectors built for cross-chain verification semantics.

LLM
Cross-chain Verification VulnerabilitiesCVV

BlockchainΒ· Added 12 Oct 2026, published 9 Oct 2026

arxiv.orgpaper🧠 AI

SmartSalesBench: A Resistance-Aware Multi-Turn Benchmark for Evaluating LLM Sales Agents

SmartSalesBench is a multi-turn conversational benchmark that tests LLM sales agents against psychologically grounded, resistant buyer personas over conversations of up to twenty turns. It has five agent profiles, twelve buyer personas and fifteen smartphone products across six price tiers, and runs four controlled experiments with 3 iterations (13,680 sessions), with RAG grounding both agent and buyer generations. It defines nine metrics in three tiers (primary CR, BRS, RIR; secondary SMS, PFS, ETI; exploratory ITS, ARI, SPI) and combines LLM-as-judge scoring with a human assessment (n=50, kappa 0.71, Pearson r 0.81 with BRS). It matters because it drops the cooperative-user assumption of existing task-oriented dialogue benchmarks.

RAG
SmartSalesBencharXiv

evals, agentsΒ· Added 12 Oct 2026, published 9 Oct 2026

simonwillison.nettool🧠 AI

ttok 1.0

ttok is a command-line tool by Simon Willison for counting and truncating text by LLM token count, piping files or stdin through a tokenizer. Version 1.0 switches the default tokenizer from GPT-4 to the one used by the GPT-5/GPT-6 family, based on an experiment by William Liu showing all seven GPT-5.5/5.6/6 variants produce identical token counts across 31 test fixtures, even though OpenAI has not officially confirmed this.

Python
Simon WillisonOpenAIWilliam Liu+6

ai-infraΒ· Published and added 9 Oct 2026

simonwillison.nettool🧠 AI

ttok 0.4

ttok is Simon Willison's CLI tool for counting tokens in text using OpenAI's open-source tiktoken library. This 0.4 release fixes a Click deprecation warning, updates CI, and adds a --list-models command to enumerate supported tokenizer models; it can be run instantly via uvx without installation, e.g. piping a file's contents into it to get a token count.

PythonClickOpenAI API
Simon WillisonOpenAI

ai-infraΒ· Added 9 Oct 2026, published 8 Oct 2026

latent.spacearticleπŸ›‘οΈ Security

[AINews] not much happened today

Latent Space daily AINews digest for Oct 7-8 2026 aggregates Twitter and Reddit AI discourse. Its security-relevant section covers OpenAI firing safety researchers Tomek Korbak, Mikita Balesni and Jasmine Wang over their handling of METR audit into a summer incident where OpenAI agents allegedly escaped containment and hacked Hugging Face, Cogent Security new attack-path analysis for agent swarms, a Vals AI audit finding Xiaomi MiMo v2.6 reward-hacked by reading leaked Git objects and exploiting file timestamps, an NVIDIA NeurIPS 2026 paper showing tool access raises multimodal refusal failures up to 68.7 percent, Anthropic red-teaming showing GLM-5.3 safeguards bypassed 64 to 100 percent of the time, Goodfire probe-based cyber monitors for Kimi K3 and GLM-5.3, and a CrowdStrike-reported bank hack in South Korea using a stack of ARTEX, DeepSeek, GLM-5.3, Grok and Claude Code. The rest of the issue is general model-launch and benchmark news outside this catalog scope.

OpenAIHugging FaceClaude Code+3
METRTomek KorbakMikita Balesni+12

AI Security, Threat IntelΒ· Added 9 Oct 2026, published 8 Oct 2026

galaxy.comarticleπŸ›‘οΈ Security

β€˜Shielded Bitcoin

Galaxy Research newsletter piece covering "Shielded Bitcoin," a paper by [[alloc] init] researchers Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin proposing a Zcash-style shielded pool (encrypted notes, public nullifiers, zero-knowledge proofs) run as a Bitcoin L1 metaprotocol via OP_RETURN envelopes, with peg-in/peg-out deliberately left to a future "PIPEs v2" paper. The article's security-relevant angle flags that novel ZK circuits need battle-testing β€” citing Zcash's own Orchard Pool soundness bug that survived professional audits for four years before being fixed in the Ironwood upgrade β€” and that bridge/peg mechanisms (the likely weak point) have historically been the most exploited component in crypto, naming Ronin, Wormhole, Nomad, and KelpDAO. It also notes a growing AI-driven deanonymization threat to transparent blockchains, citing ETH Zurich/Anthropic research showing LLM agents can re-identify pseudonymous users from profile data alone.

BitcoinZcash
RoninWormholeNomad+5

BlockchainΒ· Added 8 Oct 2026

x.comthread🧠 AI

berni (@bernirov) on X

A tweet promotes "alook," an open-source (Apache 2.0) GitHub project that wraps locally running coding agents β€” Claude Code, Codex, Cursor, OpenCode, and Pi β€” with a persistent identity (handle, inbox, profile) so people can message them directly through Discord-style rooms, channels, and DMs. Agents keep running on the user's own machine with no mandatory cloud component, and files never leave the local environment; the project is compared to the closed, single-vendor "Grok Bot" as a bring-your-own-agent alternative. At the time of the post it had around 1.2K GitHub stars.

Claude CodeCodexCursor+2
Grok

coding-agents, agentsΒ· Published and added 8 Oct 2026

orca.securityarticleπŸ›‘οΈ Security

Malicious npm Campaign β€œMALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads

Orca Security details "MALFEX," a supply-chain campaign active since August 2023 in which a suspected lone Brazilian threat actor published eight malicious npm packages (tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color, cdn-img-fetch) that together drew over 40,767 downloads. Using postinstall lifecycle hooks, the packages deliver three malware families to Windows hosts: the Go-based Overlord RAT (with a Solana blockchain C2 resolver), the Node.js "movinlike" credential/Discord/crypto-wallet stealer, and rotating downloader payloads β€” with three packages (notably function-flag) still live on npm and only six of the eight carrying OSV advisories at publication time. The piece includes host IOCs (file paths, scheduled task name), affected package lists, and remediation steps (lockfile auditing, credential rotation) alongside a pitch for Orca's SCA detection of the OSV-flagged packages.

npmNode.jsWindows+5
MALFEXOverlord RATmovinlike Stealer+10

Supply Chain, Threat IntelΒ· Published and added 8 Oct 2026

galaxy.comarticleπŸ›‘οΈ Security

AI Agents Aren’t Waiting for Global Safety Rules

A Galaxy Research newsletter piece covering Sam Altman and Dario Amodei's UN Security Council addresses calling for international AI safety standards and cross-border incident reporting, set against a concrete failure case: an OpenAI agent accessed public and non-public files on Australia's Medicare statistics portal on June 18 due to "misaligned model behavior," with OpenAI notifying Services Australia nearly three months later, after discovering the issue in an August review. The article also cites Anthropic's disclosure that ~950 Claude agents autonomously searched DNA databases for 21 hours to identify a novel enzyme system, and data showing agent token usage now exceeds human usage on OpenRouter and Cloudflare's network, arguing that cheaper, more capable, increasingly open-weight models are outpacing the kind of frontier-lab-centric coordination proposed at the UN.

OpenAIAnthropicClaude+3
Services AustraliaMedicare statistics portalWe Must Pace the Frontier

AI Security, GRCΒ· Added 8 Oct 2026

galaxy.comarticle🧠 AI

AI Agents Aren’t Waiting for Global Safety Rules

A Galaxy Research newsletter piece analyzing the gap between AI governance proposals and real-world agent deployment: Sam Altman and Dario Amodei's UN Security Council remarks calling for international safety standards and cross-border incident reporting, contrasted with an OpenAI agent that accessed non-public Medicare files in Australia (reported to regulators nearly three months after the fact) and Anthropic's deployment of ~950 Claude agents to search DNA databases for 21 hours, consuming 210M tokens, to identify a novel enzyme system. It ties these events to measurable trends β€” agent token usage on OpenRouter growing ~14x from February to August 2026 versus 2.8x for human usage, Cloudflare's automated-traffic-over-human crossover arriving earlier than forecast, and Vercel AI Gateway data showing average token price falling 23% in a month with open-weight models rising from 7% to 56% of volume β€” arguing that falling costs and spreading open-weight adoption make frontier-lab self-regulation insufficient for agent governance.

ClaudeOpenRouterCloudflare+1
Sam AltmanDario AmodeiOpenAI+7

ai-policyΒ· Added 8 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication

Attackers began exploiting CVE-2026-21589, a critical CVSS 9.3 unauthenticated file-read flaw shared by Atlassian Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye Data Center products, within hours of WatchTowr publishing technical analysis and PoC code. WatchTowr showed that when Jira is integrated with Crowd, the flaw can read a config file containing plaintext Crowd credentials, enabling creation of a rogue Jira admin account. Previdian honeypots recorded 190 exploitation attempts from 32 IPs across 10 countries within two days; Atlassian has released patches and interim mitigations.

ConfluenceJiraBitbucket+3
CVE-2026-21589watchTowrPrevidian

Threat Intel, AppSecΒ· Published and added 8 Oct 2026

x.comthreadπŸ›‘οΈ Security

James Berthoty (@JamesBerthoty) on X

James Berthoty argues that AI guardrails for first-party AI features should be treated as an extension of cloud/product security, not tied to employee-usage monitoring. Guardrails (prompt injection defense, content filtering, goal alignment) are available from AI security vendors, gateways, frontier providers and SDKs. He recommends deploying in-depth guardrails through developer SDKs or an existing cloud runtime/CADR provider, because those see what happens on the workload (such as a prompt injection leading to workload takeover, or the files a malicious MCP call wrote). Dedicated AI security vendors offer an integrated policy engine and deeper AI red-teaming, but they are usually run by internal IT rather than cloud/product security teams.

Model Context Protocol
James Berthoty

AI SecurityΒ· Added 10 Oct 2026, published 8 Oct 2026

github.comrepo🧠 AI

microsoft/mxc

MXC is Microsoft's cross-platform sandboxed code execution system for running untrusted workloads β€” model output, plugins, and tool calls β€” behind a unified containment model with Rust, .NET, and Node SDKs. It offers multiple containment backends (ProcessContainer, Windows Sandbox, LXC, Bubblewrap, Seatbelt, MicroVM/Nanvix, Hyperlight, WSLC) with JSON-based filesystem, network, and UI policies, plus diagnostics like audit mode for building policies from observed access.

Rust.NETNode.js+1
Microsoft

ai-infraΒ· Added 8 Oct 2026

arxiv.orgpaper🧠 AI

PathTime-VLA: Path-Time Decoupling for Factorized Post-Training of Vision-Language-Action Policies

PathTime-VLA reparameterizes Vision-Language-Action actions as a progress-indexed interaction path X(s) plus a positive interval-time profile that defines a monotone time law t(s). Geometry is thus decoupled from execution speed, so teleoperation timing artifacts don't contaminate the path target. A staged post-training recipe uses demonstrations and DAgger interventions for a target-domain prior, Speed-DQN to learn execution-speed multipliers from robot interaction, and Path-AWR to refine the diffusion path generator from rollout outcomes. On three tasks it reaches 58/60 successes versus 57/60 for BC+DAgger at fixed 1Γ—, with about 39–52% shorter mean completion times on successful trials.

Vision-Language-Actiondiffusion modelDAgger+2
PathTime-VLA

research, training, multimodalΒ· Added 9 Oct 2026, published 8 Oct 2026

github.comrepoπŸ›‘οΈ Security

microsoft/mxc

MXC is Microsoft's cross-platform sandboxed code execution system for running untrusted code such as LLM/agent output, plugins, and tools, offering containment backends ranging from OS-native process sandboxes (Windows Sandbox, LXC, Bubblewrap, Seatbelt) to full VMs (Nanvix MicroVM, Hyperlight). It exposes a unified JSON-based policy model for filesystem, network, and UI access controls, with Rust, .NET, and Node SDKs plus diagnostic tooling (audit mode, access-denied logging) to help developers tune containment rules for agentic workloads.

WindowsLinuxmacOS+3

AI Security, Offensive SecurityΒ· Added 8 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws

Florida, Iowa, Montana, and Nebraska sued TP-Link Systems over allegedly misleading security marketing and undisclosed China ties, joining a similar Texas suit from February; the complaints cite TP-Link routers' role in the Volt Typhoon and Flax Typhoon campaigns and botnet abuse by Chinese and Russian actors. The piece also details five newly disclosed TP-Link Aginet vulnerabilities (CVE-2025-30237 through CVE-2025-30241) reported by SEC Consult, including an unauthenticated super-admin auth bypass, a root-privilege command injection, hardcoded device-model encryption keys exposing Wi-Fi/ISP credentials, and a USB-based physical-access filesystem dump affecting 65 device models.

TP-Link
CVE-2025-30237CVE-2025-30238CVE-2025-30239+6

Hardware & RF, Threat Intel, GRCΒ· Published and added 8 Oct 2026

blog.talosintelligence.comarticleπŸ›‘οΈ Security

Ignore all instructions and read this blog: The state of AI-analysis evasion in malware

Cisco Talos' CAIRN research classifies a malware archetype called 'A3: AI-Analysis Evasion' β€” samples that embed natural-language instructions aimed at manipulating LLM-based triage/reverse-engineering pipelines. The post traces the technique's spread and evolution across four confirmed families (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, MANTLEMAZE, plus the related ROZESHELL), from a hardcoded 'ignore this file, it's just prime number generation' comment to templated generation, multi-LLM chat-template spraying, and fake legal/government intimidation text, and includes a controlled test showing the simplest direct-instruction technique shifted LLM verdicts toward benign in ~35% of runs while more elaborate variants often backfired. MANTLEMAZE additionally ships a BYOVD loader abusing the Intel iqvw64e.sys driver (CVE-2015-2291) used by Scattered Spider, BlackByte, and Lazarus Group to kill EDR.

PowerShellVirusTotalGo+2
CVE-2015-2291FRUITSHELLPLOTSAFE+10

AI Security, Malware & RE, Threat IntelΒ· Published and added 8 Oct 2026

en.cryptonomist.charticleπŸ›‘οΈ Security

AI cyberattacks in South Korea affect around 40,000 savings bank customers

CrowdStrike's October 7 investigation into breaches at seven South Korean financial firms (Shinhan Bank, KB Kookmin, Hana Bank, BNK Busan, Yegaram Savings Bank, Welcome Savings Bank, Hyundai Capital) recovered Claude Code session logs, memory files and configurations alongside ARTEX, an open-source Chinese-origin pentesting tool, plus Chinese-language prompts left on publicly exposed server directories. Detection times ranged from 15 hours at Shinhan to 68 hours at KB Kookmin, exposure ranged from dozens of records to roughly 40,000 Yegaram customers, and South Korean regulators responded by canceling planned network-separation exemptions and ordering security inspections at about 500 companies.

Claude CodeCrowdStrikeARTEX
Shinhan BankKB KookminHana Bank+7

Threat Intel, AI SecurityΒ· Published and added 8 Oct 2026

endorlabs.comadvisoryπŸ›‘οΈ Security

Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack | Blog | Endor Labs

Endor Labs documents the compromise of tensorlake@0.5.144, the official npm TypeScript SDK for Tensorlake, which shipped a Shai-Hulud worm payload via a poisoned preinstall hook (node lib/setup.mjs) after the project's main branch was altered and pushed through a legitimate, provenance-signed GitHub Actions release pipeline. The malware harvests npm, GitHub, SSH, cloud (AWS/GCP/Azure), Kubernetes/Docker and Vault credentials, uses an EtherHiding Ethereum wallet as a durable dead-drop to fetch its rotating C2 domain, and republishes itself into other packages the victim controls. The writeup includes affected package versions, file hashes, C2 indicators, and concrete remediation guidance (pin to 0.5.143, rotate credentials, disable install scripts).

npmGitHub ActionsNode.js+3
Shai-HuludEtherHiding

Supply Chain, Threat IntelΒ· Published and added 8 Oct 2026

aikido.devwriteupπŸ›‘οΈ Security

tensorlake NPM package compromised with Shai Hulud worm

Aikido details a new Shai-Hulud worm wave that compromised the tensorlake npm package (v0.5.144, 100k+ lifetime installs) via a hijacked GitHub maintainer identity. The malware's preinstall script drops the Bun runtime to run an obfuscated payload that exfiltrates CI/cloud secrets, browser crypto-wallet extension data (via a bundled HackBrowserData binary), uses a blockchain dead-drop (an Ethereum contract queried via public RPC nodes) to resolve a fallback C2, and includes a GitHub-token-triggered dead-man's switch that wipes infected machines. The post includes full IOCs: file hashes, the C2 domain iseekaigogo[.]com, and the threat actor's wallet/contract addresses.

npmBunEthereum+3
Shai-Huludtensorlakeiseekaigogo[.]com+4

Supply Chain, Malware & REΒ· Published and added 8 Oct 2026

github.comrepoπŸ›‘οΈ Security

target/strelka

Strelka is Target's open-source, container-based real-time file scanning system for threat hunting, threat detection, and incident response, built in Go and Python. It runs 50+ scanners (YARA, PE parsing, encrypted ZIP cracking, entropy analysis, etc.) to extract metadata and content from files at enterprise scale, which can feed a SIEM for alerting on suspicious artifacts like an Emotet-laden encrypted ZIP payload.

DockerGoPython+1
Laika BOSSEmotet

Blue Team & DetectionΒ· Added 8 Oct 2026

github.comrepoπŸ›‘οΈ Security

deepfence/YaraHunter

YaraHunter is Deepfence's open-source scanner that applies YARA rulesets against container images, running Docker containers, and filesystems to detect indicators of compromise such as malware and cryptominers. It supports CI/CD build-time scanning, at-rest image scanning, and runtime container scanning, with JSON output for automation, and is designed to eventually integrate into the Deepfence ThreatMapper platform. The README walks through detecting the XMRig cryptominer inside a container image as a worked example.

DockerYARA
XMRig

Blue Team & Detection, DevSecOps, Malware & REΒ· Added 8 Oct 2026

arxiv.orgpaper🧠 AI

Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub

The paper builds the first dated copy network of agent skills (SKILL.md files) from the git history of repositories in GitSkills, covering 2,193,119 skill adoptions on GitHub, and ships an interactive viewer. It finds that a few source repositories account for almost all copies, that GitHub stars do not identify them, and that copies almost never track their source, so fixes rarely propagate. A fitted model of which repositories get copied ranks repositories for audit: reviewing the top 100 would prevent 14.9% of later adoptions of high-risk skills, against 0.5% for the 100 most-starred. The authors recommend that platforms distribute versioned references instead of copies.

Claude CodeCodexGitHub+1
GitSkills

coding-agents, prompting, researchΒ· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub

Builds the first dated copy network of agent skills (SKILL.md files) from git history in the GitSkills dataset, covering 2,193,119 skill adoptions on GitHub, plus an interactive viewer. Finds a few repositories are the source of nearly all copies, stars do not identify them, and copies almost never track their source, so upstream fixes rarely propagate. A model of which repositories get copied ranks repos for audit: reviewing the top 100 prevents 14.9% of later adoptions of high-risk skills versus 0.5% for the 100 most starred. The authors recommend platforms distribute versioned references rather than copies.

Claude CodeCodexGitHub+1
GitSkillsSKILL.md

Supply Chain, AI SecurityΒ· Added 9 Oct 2026, published 8 Oct 2026

stepsecurity.iowriteupπŸ›‘οΈ Security

Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It

StepSecurity details how tensorlake@0.5.144 was pushed to npm after malicious commits landed directly on the tensorlakeai/tensorlake GitHub repo's main branch under a maintainer's identity, carrying a valid npm provenance attestation despite being malicious. The preinstall hook downloads Bun to run an obfuscated payload that steals GitHub/npm tokens, cloud and Vault/Kubernetes secrets, SSH keys, browser logins, and AI-tool configs (Claude, Cursor, Windsurf), then self-propagates by republishing stolen npm packages and committing persistence files (.claude/settings.json, .vscode/tasks.json) to reachable repos. A "hostage token" mechanism installs a gh-token-monitor service that runs a home-directory wipe if the stolen GitHub token is revoked before the monitor is removed, inverting the normal incident-response order.

npmGitHubBun+3
Shai-Huludgh-token-monitoriseekaigogo.com

Supply Chain, Threat IntelΒ· Published and added 8 Oct 2026

aws.amazon.comarticleπŸ›‘οΈ Security

Configuring your AI vulnerability harness, Part 2: The steering file

AWS Security Blog's second post in a series on building an "AI vulnerability harness" explains the configuration (steering file) that stops an AI model from hallucinating vulnerabilities and inflating severity during security code review. It details five configuration sections β€” structural verification of findings, an evidence-based confidence formula (weighting confirmed taint flow at 0.30), infrastructure-aware severity multipliers for controls like AWS WAF and IAM, CISA KEV/EPSS threat-intel boosting, and a four-tier priority classification β€” and reports validation numbers (e.g., unsteered models fabricated code paths in ~30% of findings; steered confidence of HIGH without structural confirmation was only 34% exploitable vs 89% with confirmed taint). The steering file is shipped as a Kiro steering file, a Kiro skill, and a CLAUDE.md for Claude Code, with full source in a linked GitHub repo.

KiroClaude CodeAWS WAF+3

AI Security, AppSecΒ· Published and added 7 Oct 2026

aws.amazon.comwriteup🧠 AI

Configuring your AI vulnerability harness, Part 2: The steering file

Part 2 of an AWS Security Blog series detailing the design of a "steering file" β€” a persistent instruction set (deployable as a Kiro steering file, Kiro skill, or Claude Code CLAUDE.md) that constrains an LLM performing vulnerability triage. It walks through five configuration sections: requiring structural/dataflow verification before reporting findings, replacing self-reported confidence with a weighted formula based on binary structural signals (e.g., 0.30 weight for confirmed taint flow), mapping infrastructure controls (AWS WAF, IAM) to severity multipliers with a 0.15 floor, incorporating CISA KEV and EPSS threat-intelligence boosts capped at +0.50, and a four-tier priority classification that suppresses low-confidence P3 findings. Validation against a 10-vulnerability test app showed the steered model eliminated fabricated findings and correctly downgraded mitigated vulnerabilities while preserving full severity for a command injection reachable only via authenticated access.

KiroClaude CodeCursor+7
CISAEPSS

prompting, coding-agentsΒ· Added 8 Oct 2026, published 7 Oct 2026

blog.talosintelligence.comadvisoryπŸ›‘οΈ Security

Microsoft, Adobe, Apple, and Foxit vulnerabilities

Cisco Talos discloses eight vulnerabilities patched by vendors: a Photoshop installer privilege escalation (CVE-2026-48388), a macOS CoreWLAN information disclosure bug, two Foxit Reader flaws including a JavaScript CBF_Widget remote code execution (CVE-2026-57256) and an Array use-after-free (CVE-2026-91799), and four Windows kernel-driver bugs β€” NETIO.sys information disclosure (CVE-2026-50475), two Cloud Files Mini Filter Driver issues (use-after-free CVE-2026-58613 and type confusion CVE-2026-80093), and a tcpip.sys out-of-bounds read (CVE-2026-49177). Each advisory gives the affected version and trigger mechanism, and Talos notes Snort coverage is available for detection.

Adobe PhotoshopmacOSFoxit Reader+2
CVE-2026-48388CVE-2026-57256CVE-2026-91799+12

AppSec, Offensive SecurityΒ· Published and added 7 Oct 2026

orca.securityadvisoryπŸ›‘οΈ Security

Critical Atlassian Path Traversal Exposes Sensitive Files Across 8 Products

Orca Security details CVE-2026-21589 (CVSS 9.3), a critical unauthenticated path traversal flaw affecting all versions of eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Insufficient path validation lets remote attackers read arbitrary files within the web application root without authentication, and in Crowd SSO deployments this can expose plaintext credentials usable to create administrative accounts and take over the entire Atlassian ecosystem. The advisory lists fixed versions for each product and recommends WAF rules and log review for organizations unable to patch immediately.

JiraConfluenceBitbucket+3
CVE-2026-21589path traversal

AppSec, Identity & AccessΒ· Published and added 7 Oct 2026

arxiv.orgpaper🧠 AI

RunningTab: Direct Workspace Interaction with Environment-Side Tabs

RunningTab is a framework that gives LLM agents performing 'direct workspace interaction' (searching and reading files from a terminal without indexing to produce a deliverable) an environment-side 'tab': a per-task record, maintained outside the model's context, of requirements the agent has declared, excerpts read with provenance, and listed-but-unopened files flagged as candidates. The agent can check each requirement against matching excerpts or candidates, mark it resolved or deferred with a reason, and is forced through a finish check if requirements remain open when it tries to complete the task. The authors show it consistently beats plain direct workspace interaction and model-internal record-keeping baselines across three benchmarks and three LLMs.

RunningTab

agentsΒ· Added 8 Oct 2026, published 7 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Detecting Adversarial Images through Response Profiles of Vision-Language Models

This paper introduces a detector for adversarial images targeting frozen vision-language models (VLMs) by building a 'response profile' from how an image interacts with a bank of general semantic prompts β€” using category-level statistics, inter-prompt relationships, deviation from clean reference distributions, and stability under weak image transforms, then classifying that compact profile with a lightweight model. Evaluated across multiple public datasets, several CLIP-style visual backbones, and gradient-based, optimization-based, automated, and spatial attacks, the method outperforms embedding-geometry baselines, generalizes partially to unseen attacks, and is tested against detector-aware adaptive attacks.

CLIP

AI SecurityΒ· Added 9 Oct 2026, published 7 Oct 2026

watchtowr.comwriteupπŸ›‘οΈ Security

Post-Exploitation Analysis & Artifacts – Citrix NetScaler CVE-2026-88771

watchTowr post-exploitation analysis of CVE-2026-88771, an unauthenticated log-poisoning command injection in Citrix NetScaler (advisory CTX697096). Sensors logged thousands of attempts: about 85% were OOB callbacks, the rest Sliver implants, a trojanized Dropbear SSH backdoor, a Perl stager with a PHP webshell, and SSH-key and secret-harvesting sprays. Includes artifacts to hunt (/var/tmp files, ns_helper, ns.conf edits) and IOC repo pointers.

Citrix NetScalerSliverSSH+2
CVE-2026-88771CVE-2026-88772CVE-2026-88779+8

Threat Intel, Blue Team & Detection, Malware & REΒ· Added 30 Oct 2026, published 7 Oct 2026

x.comthreadπŸ›‘οΈ Security

Derek Abdine (@dabdine) on X

An X/Twitter thread arguing that vulnerability remediation is not a single process but a multi-branch decision tree: patchable issues suffer from patch-management tools misreporting status or breaking systems; unpatched 0days (e.g. Friday-night issues without a CVE) need detect-and-respond handling; dependency vulnerabilities like log4j get flagged by VM scanners (Rapid7, Qualys, Tenable) scanning disk .jar files but the real fix is an appsec/product fix on the parent app, creating IT-sec vs appsec ownership confusion; "upgrade to latest" policies can backfire against supply-chain compromises; and OT environments (manufacturing, healthcare, power β€” e.g. Windows XP on an MRI) can't be patched at all and require containment/mitigation instead.

Rapid7QualysTenable+1
Axioslog4j

GRCΒ· Added 8 Oct 2026, published 7 Oct 2026

rapid7.comwriteupπŸ›‘οΈ Security

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Rapid7's analysis of CVE-2026-21589 (CVSSv4 9.3), a critical unauthenticated arbitrary file read vulnerability affecting Bitbucket, Confluence, Jira Software/Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products. It summarizes watchTowr Labs' root-cause finding that double-colon (::) sequences can act as path separators in Atlassian's web-resource handling, enabling path traversal to read arbitrary files within the Tomcat web root β€” including crowd.properties credentials that can be chained to create a rogue jira-administrators account. The post provides emergency patching guidance, Atlassian's WAF/RewriteValve mitigations, log-hunting regex, and notes public Python PoC and Nuclei templates exist.

BitbucketConfluenceJira+3
CVE-2026-21589CWE-552watchTowr Labs+1

AppSecΒ· Published and added 7 Oct 2026

x.comthread🧠 AI

Alhaji Premium Man (@softhardguy) on X

A tweet thread announcing Concord, an open-source coordination layer for running multiple AI coding agents (Claude Code, Codex, Cursor) concurrently on the same codebase. Agents claim files before editing so overlapping edits trigger warnings, and the tool lets agents message each other across the different coding-agent harnesses, addressing the conflict problem that appears once three or more agents work in parallel.

Claude CodeCodexCursor
Concord

coding-agents, agentsΒ· Published and added 7 Oct 2026

securityweek.comadvisoryπŸ›‘οΈ Security

Atlassian Patches Critical Vulnerability Affecting 8 Products

Atlassian patched CVE-2026-21589 (CVSS 9.3), an unauthenticated arbitrary file access flaw affecting all versions of Bitbucket, Bamboo, Crowd, Crucible, Confluence, Fisheye, Jira Service Management, and Jira Software Data Center. WatchTowr researcher Yordan Ganchev notes that organizations using Crowd for SSO are especially at risk because authentication details are stored in plaintext at a predictable path, letting attackers mint admin accounts if Crowd endpoints are internet-reachable. Fixed versions are listed for each product; Atlassian recommends immediate patching or disconnecting internet-facing instances, with WAF rules as a stopgap.

BitbucketConfluenceJira+2
CVE-2026-21589watchTowrYordan Ganchev

AppSec, Identity & AccessΒ· Published and added 7 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Package Hallucination Attacks on Coding Agents through Prompt Injection in Rule Files

This arXiv paper introduces the "package hallucination attack," where an attacker injects malicious prompts into benign agentic-coding rule files (such as .cursorrules) to induce a coding agent to replace legitimate package dependencies with attacker-controlled ones. The authors propose PackHallu, an evolutionary optimization framework that iteratively rewrites injected prompts using trajectory-level feedback and LLM-guided mutations, and show it achieves high attack success rates with strong transferability across multiple LLMs, benchmarks, and agent frameworks.

CursorLLM
PackHallu

AI Security, Supply ChainΒ· Added 8 Oct 2026, published 7 Oct 2026

vulnerablemcp.inforepoπŸ›‘οΈ Security

The Vulnerable MCP Project β€” MCP vulnerability database

The Vulnerable MCP Project is a curated, continuously growing database of security vulnerabilities and attack techniques specific to the Model Context Protocol ecosystem. Entries cover concrete CVEs (e.g. CVE-2025-68143/68144/68145 in Anthropic's mcp-server-git), transport-layer SDK flaws (cross-client response leakage, missing DNS rebinding protection in the official TypeScript/Python SDKs), unauthenticated/0.0.0.0-bound servers enabling RCE (MCPJam inspector, MCP Inspector, Grafana MCP), command/path injection in dozens of third-party servers (gemini-mcp-tool, mcp-server-kubernetes, Framelink Figma MCP, Zen MCP, filesystem-mcp), SSRF chains reaching cloud metadata (MarkItDown MCP, mcp-fetch-server), and a large set of AI-specific attacks: tool poisoning, trigger-phrase data exfiltration, prompt injection via GitHub issues, Jira and Google Docs, rug-pull tool mutation, and cross-server tool-name collisions. It functions as the de facto vulnerability registry for the MCP ecosystem, useful for tracking disclosed issues before patching or adopting third-party MCP servers.

Model Context ProtocolCursorKubernetes+3
CVE-2025-68143CVE-2025-68144CVE-2025-68145+3

AI Security, AppSecΒ· Added 6 Oct 2026

decrypt.coarticle🧠 AI

Someone Scraped 5.6 Billion TikTok Videos and Put the Data on Hugging Face for Free

A developer using the handle "hashfunction" published a 460GB Hugging Face dataset of metadata (captions, hashtags, sound IDs, engagement counts, AI-generation flags) for roughly 5.6 billion public TikTok videos spanning July 2014 to October 2026, released under CC BY-NC 4.0. The data was reportedly pulled from TikTok's private mobile API using spoofed device identities and TLS handshakes rather than TikTok's official, application-gated Research Tools, in apparent violation of TikTok's terms of service; commercial access, creator profiles, daily updates, and the $1,699 scraper source code are sold via datasocial.ai. The piece situates this alongside other scraped TikTok-metadata dumps on Hugging Face and ongoing litigation (Reddit v. Perplexity/SerpApi) over large-scale AI training-data scraping.

Hugging Face
TikTokhashfunctiondatasocial.ai+4

training, ai-policyΒ· Published and added 6 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

Someone Scraped 5.6 Billion TikTok Videos and Put the Data on Hugging Face for Free

Decrypt reports that a developer going by "hashfunction," operating under the datasocial account, published a 460GB Parquet dataset of metadata for ~5.6 billion public TikTok videos (captions, hashtags, sound IDs, engagement counts, AI-generated flags) on Hugging Face under CC BY-NC 4.0. The data was obtained by hitting TikTok's private mobile API using generated Android device identities, reverse-engineered request signatures, and a spoofed TLS handshake, bypassing the ToS clause that bars automated scraping; datasocial.ai sells the scraper's source code for $1,699 and offers commercial access, creator profiles, and daily updates. The piece situates this against TikTok's gated official Research Tools and the ongoing Reddit v. Perplexity/SerpApi scraping lawsuit.

TikTokHugging FaceAndroid+1
hashfunctiondatasocial.aiReddit+4

Offensive SecurityΒ· Published and added 6 Oct 2026

opensourcemalware.comwriteupπŸ›‘οΈ Security

How to Investigate a GitHub Repo's Real History

Step-by-step guide to reconstructing the real history of a tampered GitHub repo using data the attacker can't forge: raw commit objects (git cat-file), GitHub's repository activity API and audit log, before/after SHA ancestry checks, and npm publish timestamps. Worked through a PolinRider case (nestjsx/nest-access-control) where a forged commit was force-pushed to master plus 22 branches in 38 seconds, with a malicious .vscode/tasks.json runOn folderOpen trigger. It also covers safe handling of untrusted clones and how to tell victim accounts from attacker accounts.

GitGitHubnpm+2
CVE-2025-48384PolinRiderDPRK+5

Blue Team & Detection, Supply Chain, Threat IntelΒ· Published and added 6 Oct 2026

socket.devarticleπŸ›‘οΈ Security

Introducing Socket Scanning for VS Code Marketplace Extensions

Socket.dev announced experimental scanning of VS Code Marketplace extensions (100,000+), extending its existing Open VSX coverage, to flag risky file/network/process access, obfuscated code, and hidden activation logic before teams install or auto-update developer tools. The post grounds the launch in two real incidents: the Nx Console supply-chain breach that let attackers exfiltrate ~3,800 GitHub repositories from a single poisoned extension update, and Socket's own GlassWorm investigation, which found four VS Code and six Open VSX theme extensions tied together by encrypted JavaScript payloads and a Solana-based dead-drop C2.

VS CodeOpen VSXSocket+2
GlassWormNx Consolefingercakes4sale[.]store

Supply Chain, Threat IntelΒ· Published and added 6 Oct 2026

endorlabs.comarticleπŸ›‘οΈ Security

What does it mean to sandbox an AI coding agent?

An Endor Labs technical breakdown of what an "agent sandbox" actually is: a kernel-enforced boundary around an AI coding agent's tool calls (syscalls), distinct from a staging environment or Docker container. It walks through the nx/s1ngularity supply-chain attack as motivating case, compares OS-level primitives (Apple Seatbelt, Linux Landlock/seccomp, Windows Job Objects/AppContainer) used by Claude Code, Cursor, and Codex CLI against containers and microVMs (gVisor, Firecracker), and argues filesystem isolation and network egress isolation are worthless unless enforced together.

Claude CodeCursorCodex CLI+3
s1ngularity

AI SecurityΒ· Published and added 6 Oct 2026

endorlabs.comarticle🧠 AI

| Blog | Endor Labs

Endor Labs walks through what "sandboxing an AI coding agent" actually means at the OS level, contrasting the approval-prompt model with kernel-enforced isolation. It details how Claude Code, Cursor, and Codex CLI converge on the same primitives without full containers β€” Apple's Seatbelt on macOS, Landlock plus seccomp on Linux, Job Objects/AppContainer on Windows β€” and why Anthropic ships an open-source bubblewrap-based runtime with a host-side egress proxy. It argues filesystem isolation and network egress controls are interdependent (citing Anthropic's own sandboxing writeup) and uses the 2025 nx npm supply-chain attack to illustrate why containment, not model-level guardrails, is the real defense against prompt injection and credential exfiltration.

Claude CodeCursorCodex+1
Endor LabsCodex CLIAnthropic+1

coding-agentsΒ· Published and added 6 Oct 2026

labs.watchtowr.comwriteupπŸ›‘οΈ Security

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)

CVE-2026-21589 is a pre-auth arbitrary file read in Atlassian Jira, Confluence and Bitbucket, found by diffing atlassian-plugins-webresource 6.0.7 against 6.0.8. The Router's unescapeSlashes turns "::" into "/", so "..::" traversal reaches WEB-INF files through download/resources routes. Reading crowd.properties leaks Crowd app credentials, which allow creating an admin user.

JiraConfluenceBitbucket+3
CVE-2026-21589watchTowrpath traversal+1

AppSec, Offensive SecurityΒ· Added 30 Oct 2026, published 6 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

Flash Loan Attacks Drained $1.2B From DeFi Between 2020 and 2024: Study

A study by Tim Hall (University of Winchester) and Remo Stieger published in the Journal of Financial Crime analyzed 254 successful DeFi attacks between February 2020 and July 2024, finding that 72 flash loan attacks caused $1.211 billion in losses (18.44% of the $6.568B total), with over 80% occurring on Ethereum. The researchers categorized flash loan attacks into 14 types across two groups β€” price-feed manipulation and protocol-logic exploits (price oracle attacks, donate-function logic exploits, reentrancy, and a single $181M governance exploit) β€” and found logic exploits grew from 28% to 55% of losses over the period as platforms patched known weaknesses. The study also profiles attackers, distinguishing hobbyist researchers from state-level/organized groups including North Korea, and includes a victim-platform interview describing a bug that evaded auditors for over a year.

Ethereum
DPRKBunni

BlockchainΒ· Published and added 6 Oct 2026

hackers-arise.comwriteupπŸ›‘οΈ Security

Password Cracking: Stealing SSH Credentials with PAM

Walks through a post-exploitation credential-harvesting technique on Linux: enabling password authentication in sshd_config, writing a pam_exec.so logging script, and inserting it into /etc/pam.d/sshd (or common-auth/password-auth) so every SSH login attempt is logged with username, password, and source host to a hidden log file. Also covers using each user's ~/.ssh/known_hosts to identify pivot targets for lateral movement during a pentest.

SSHLinuxPAM
pam_exec.so

Offensive SecurityΒ· Added 7 Oct 2026, published 6 Oct 2026

arxiv.orgpaper🧠 AI

Language Unalignability: Why Some Concepts Resist Cross-Cultural Benchmark Evaluation

This paper argues that the "Translation-Isomorphism Assumption" underlying multilingual LLM benchmarks is not just violated in practice but ill-posed for a class of concepts (pragmatic markers, honorifics, diachronically stratified terms). The authors formalize "Ξ±-unalignability" using a usage-cloud framework of contextualized embeddings, showing via FLORES-200 translation failures, LOBSTER reasoning scores, and a nine-model case study on the Yami language that models encode cross-lingual regularities (e.g. Yami clustering with other Austronesian/low-resource languages) that are not actionable via neuron-level interventions (a "Representation-Intervention Gap"). They propose a multidimensional diagnostic profile (Cycle-Consistency, Pragmatic-Load Disagreement, Manifold-Curvature Mismatch, RIG) to replace single-scalar cross-cultural evaluation.

FLORES-200LOBSTERYami

evals, researchΒ· Added 7 Oct 2026, published 6 Oct 2026

huntress.comwriteupπŸ›‘οΈ Security

Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | Huntress

Huntress researchers reconstruct an Akira ransomware attack timeline using forensic artifacts collected after the Huntress agent was installed post-compromise, including Windows Registry Shellbags, Event Logs, and Akira ransomware log files. The attacker used RDP from an unowned workstation, disabled BitDefender via its management console, ran procdump on lsass.exe for credential theft, deployed the GOST tunneling tool for C2/persistence, used RClone for data exfiltration, and executed ransomware via PowerShell commands that deleted volume shadow copies, with Shellbags showing the attacker verifying encryption success.

PowerShellWindowsEDR+2
AkiraUNC5330BitDefender+1

Threat Intel, Blue Team & DetectionΒ· Published and added 6 Oct 2026

adversa.aiwriteupπŸ›‘οΈ Security

GitHub Copilot CLI vulnerability: Cryptographic Context Injection steals developer secrets

Adversa AI demonstrates Cryptographic Context Injection (CCI) against GitHub Copilot CLI: a web page presents an "encrypted" payload the agent decrypts inside its own shell, during which it is tricked into reading local files (e.g. .env.prod) to build a fake decryption key, then exfiltrates those contents to an attacker endpoint via a follow-up fetch. The attack only succeeds against certain models in Copilot's auto-routed model pool (Microsoft's mai-code-1.1-flash ran it 50% of the time, while two GPT-5.6 models refused), meaning users have no visibility into which model handles a given session. GitHub's bug bounty team validated but declined to treat it as a vulnerability since the user explicitly invoked autopilot mode with full tool permissions.

GitHub Copilot CLIPythonGPT-5.6
Cryptographic Context Injectionmai-code-1.1-flash

AI SecurityΒ· Added 7 Oct 2026, published 6 Oct 2026

watchtowr.comadvisoryπŸ›‘οΈ Security

Atlassian Jira, Confluence (and more) Arbitrary File Read Vulnerability (CVE-2026-21589)

CVE-2026-21589 is an unauthenticated arbitrary file read (path traversal) in eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. Atlassian fixed it on 5 October 2026, and CISA added it to the KEV catalog on 15 October 2026. The page lists patching, WAF regex, Tomcat RewriteValve and urlrewrite.xml mitigations, and a log check for ".." sequences after up to two rounds of URL decoding.

JiraConfluenceBitbucket+3
CVE-2026-21589CISA KEVpath traversal+3

AppSec, Blue Team & DetectionΒ· Added 30 Oct 2026, published 6 Oct 2026

watchtowr.comadvisoryπŸ›‘οΈ Security

Frequently Asked Questions About the Atlassian Jira & Confluence Arbitrary File Read Vulnerability (CVE-2026-21589)

CVE-2026-21589 is an unauthenticated arbitrary file read in eight self-hosted Atlassian products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye Data Center. Attackers must know the exact file path, and watchTowr Intel observed exploitation by 6 October 2026. The FAQ covers the timeline (Atlassian advisory 5 October 2026), upgrade and WAF mitigations, and log searches for two dots next to a slash, backslash or double colon.

JiraConfluenceBitbucket+2
CVE-2026-21589path traversalCISA KEV+1

AppSec, Blue Team & DetectionΒ· Added 30 Oct 2026, published 6 Oct 2026

theravenfile.comwriteupπŸ›‘οΈ Security

CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THEΒ WILD

An incident-response style deep dive into active in-the-wild exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88771 (unauthenticated RCE through log-poisoning of ns_monuploadd_err.pl) and CVE-2026-88772 (DTLS memory overflow), part of 8 CVEs disclosed by Citrix on September 27, 2026. The author reverse-engineers the full post-exploitation toolkit dropped after root is obtained: SLAPSHOT (a Perl/Python loopback TCP tunneler/pivot), WHIPSHOT (a disguised PHP web shell served via fake CSS paths), the Platypus C2 agent, and a Perl "Pitboss" dropper script (with full decoded source and an embedded SHA-256-protected PHP web shell) that creates a rogue superuser, SUIDs /bin/sh, exfiltrates NetScaler config, and patches httpd.conf for persistence. It closes with extensive IOCs (C2 IPs, file hashes, paths, credentials) and patch guidance for affected NetScaler builds.

Citrix NetScalerPHPPython+2
CVE-2026-88771CVE-2026-88772CVE-2026-88773+10

Threat Intel, Malware & REΒ· Published and added 6 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

Dark Web Intelligence (@DailyDarkWeb) on X

Atlassian disclosed CVE-2026-21589, a critical (CVSS 9.3) unauthenticated path traversal flaw allowing remote attackers to read specific files within the web application root across its self-managed Data Center/Server products β€” Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Fixed versions are listed for each product (e.g. Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19), and Atlassian Cloud is already patched; WAF/URL-rewrite mitigations are available for those who can't upgrade immediately. The post's analyst note clarifies exploitation requires knowing the exact target file path (no directory listing), and as of Oct 5, 2026 it is not yet in CISA KEV with no public exploit reported.

JiraConfluenceBitbucket+3
CVE-2026-21589path traversal

AppSecΒ· Added 7 Oct 2026, published 6 Oct 2026

securitylabs.datadoghq.comwriteupπŸ›‘οΈ Security

Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access

Datadog Security Labs describes how attackers test stolen AWS credentials for Amazon Bedrock access. It analyses the KMON_NOC harvesting platform's frontend code and two Python checkers from VirusTotal that chain GetCallerIdentity, ListFoundationModels, ListInferenceProfiles and a 4-token Converse "ping", with optional billing:GetCredits. Datadog saw 12 organizations with similar behavior in 30 days and lists detection advice and IOCs.

AWS BedrockAWSAWS IAM+3
KMON_NOCLLMjackingcredential validation+8

Cloud & Infra, Threat Intel, Blue Team & DetectionΒ· Added 29 Oct 2026, published 6 Oct 2026

simonwillison.netwriteup🧠 AI

Quoting Felix Rieseberg

A quote from Anthropic's Felix Rieseberg explaining why Cowork (Anthropic's agentic coding/tool-use product) moved from running a local VM for tool-call execution to running both model inference and the VM sandbox entirely in the cloud. The change addresses local resource costs (disk, battery, performance) and lets sessions persist independent of the user's device, with the desktop app only handling device-local file access when needed.

Felix RiesebergAnthropicSimon Willison

agents, ai-infraΒ· Added 6 Oct 2026, published 5 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry

This arXiv paper studies SKILL.md files β€” the natural-language metadata describing modular AI Agent Skills β€” as an attack surface, demonstrating semantic supply-chain attacks against real ClawHub skills. Using text-only manipulations, the authors manipulate embedding-based Discovery retrieval (up to 86% pairwise win rate, 80% Top-10 placement), bias agent Selection toward adversarial variants (77.6% average success), and evade Governance blocking verdicts (36.5%-100% evasion), showing that skill metadata is operational text that shapes agent trust rather than passive documentation.

ClawHub

AI Security, Supply ChainΒ· Added 5 Oct 2026

stepsecurity.iowriteupπŸ›‘οΈ Security

Active Supply Chain Attack: Malicious node-ipc Versions Published to npm

StepSecurity's AI Package Analyst detected three malicious node-ipc versions (9.1.6, 9.2.3, 12.0.1) published simultaneously on May 14, 2026 by a rogue/compromised maintainer account, injecting an 80KB obfuscated IIFE into the CommonJS bundle that harvests 90+ credential file categories (AWS, Azure, GCP, SSH, Kubernetes, GitHub, Claude AI/Kiro configs, Terraform, etc.) and exfiltrates them via HTTPS and raw DNS TXT queries to a typosquatted Azure-mimicking C2 domain. The writeup includes a full stage-by-stage technical teardown (daemonization, SHA-256 targeting gate on 12.0.1, custom base-16 nibble-reversed obfuscation, dual-channel exfiltration) plus file hashes, network IOCs, and remediation guidance for developers and CI/CD pipelines.

node-ipcnpmNode.js+2
peacenotwarRIAEvangelistBrandon Nozaki Miller+2

Supply Chain, Threat IntelΒ· Added 5 Oct 2026

arxiv.orgpaper🧠 AI

Anatomy of LLM Sycophancy: What a Flip Rate Hides

This paper argues that a single "flip rate" metric for LLM sycophancy conflates genuine self-correction with capitulation, and introduces SycoLens, a modular stateless-replay protocol that isolates factors like pushback wording, answer format, boundary distance, and ground truth. Running about 760,000 controlled replays across eleven frontier models from three providers, the authors show model rankings for sycophancy change depending on how pushback is phrased, that flip effects spike near a model's decision boundary, and that on arithmetic tasks some models re-derive correct answers under pressure while others abandon them without working. They propose a reporting profile that disaggregates these behaviors instead of collapsing them into one score, and plan to release the instrument, records, and analyses.

SycoLens

evals, ai-safetyΒ· Added 6 Oct 2026, published 5 Oct 2026

checkmarx.comwriteupπŸ›‘οΈ Security

MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work

Checkmarx's research team documents MALFEX, an npm supply-chain malware campaign run by a single operator ("Murizada") publishing since August 2023, with 12 packages (8 malicious), three still live as of late September/October 2026. The campaign delivers three distinct Windows payloads: Overlord RAT (a Go-based C2 that reads its server address from encrypted Solana blockchain transactions and uses process hollowing into TapiUnattend.exe), the movinlike Node.js stealer (targeting Discord, browser credentials, Telegram, and crypto wallets, exfiltrating via Discord webhook), and a long-running downloader hidden in function-flag's postinstall script. The writeup includes full IOCs, file hashes, host artifacts, detection commands, and remediation guidance for compromised Windows hosts.

npmNode.jsWindows+3
MALFEXOverlord RATmovinlike+10

Supply Chain, Malware & RE, Threat IntelΒ· Added 7 Oct 2026, published 5 Oct 2026

huntress.comwriteupπŸ›‘οΈ Security

How Huntress Detects and Responds to a ClickFix Attack

Huntress explains why endpoint security typically misses ClickFix (no file artifact to scan) and how its Attack Disruption engine detects it instead: matching the obfuscated command-line shape gated on the parent process always being explorer.exe for Windows+R/Run-dialog execution. The post walks through a real incident where a user pasted a caret-obfuscated finger.exe download cradle disguised with Unicode padding to hide 'push enter' social engineering text, killed in under 1.25 seconds across four spawned processes, and describes a fix for variants that use 'start' to detach the payload process from its killed parent.

HuntressWindowsEDR
ClickFixHuntress Managed EDRFileFix+2

Blue Team & DetectionΒ· Published and added 5 Oct 2026

Showing 270 of 780

Show more