85 results for “OSI”

Duelbits is a crypto casino that lost an estimated $6.07 million traced across Ethereum, BNB Chain, Tron, Solana and Bitcoin on 24 September 2026, which co-founder Joe put at about $7 million. The Ethereum hot wallet drained was the replacement named after a roughly $4.6 million theft in February 2024. Rekt lists addresses and transactions, deBridge and SunSwap conversions, and Tornado Cash deposits. Duelbits has not published a root cause.

rekt.newswriteupAdded 29 Oct 2026🛡️ Security

MavenGate is Oversecured's research on hijacking Maven dependencies by buying expired domains behind groupIds on Maven Central and JitPack. It found 6,170 of 33,938 checked domains (18.18%) vulnerable, and tested the attack with its own com.oversecured:hello-world library. It lists defenses (Gradle verification-metadata.xml, PGP signatures) and proposes changes to repository signing.

oversecured.comwriteupAdded 29 Oct 2026🛡️ Security

Gheist is a campaign tracked by Wiz Research since 15 September 2026 that uses stolen GitHub tokens to push a sync-check workflow on ci-sync-* branches in every reachable repository. The workflow prints base32-encoded secrets into logs, which the tool downloads through the GitHub API and then deletes. Over 13,500 branches from 850+ accounts were recovered. The post covers the two tool variants, a buggy self-hosted runner payload, GitHub's approval hold (which does not cover private repositories), overlaps with other campaigns, hunting queries, IOCs and hardening steps.

wiz.iowriteupPublished and added 25 Oct 2026🛡️ Security

A dermatologist tested GPT-6 Astra and Claude Fable 5.1 on 200 biopsy-proven lesions from MILK10k, giving each a clinical and a dermoscopic image. A CNN (Inception v3, fine-tuned for about twenty minutes on 68,011 ISIC images) named the right diagnosis for 62% of lesions, against 42% for both LLMs. The post lists caveats (small sample, single run, possible contamination) and links the cases, prompts, replies and scoring code.

lynchlab.netwriteupAdded 26 Oct 2026, published 25 Oct 2026🧠 AI

Socket's Threat Research team reports that malicious cache.yml workflows ran in the BerriAI/litellm repository on 10 and 12 October 2026, eleven days before the 21 October release attack that published litellm==1.107.0. Each commit pushed to a short-lived ci-tmp-<hex> branch, then deleted it, sending base64-encoded CI secrets to webhook.site. Evidence comes from Actions metrics and environment deployment records; 20 secret names were exposed.

socket.devwriteupPublished and added 23 Oct 2026🛡️ Security

Tutorial for training a walking policy for Microduck, an open-source bipedal robot from Pollen Robotics and Hugging Face, in NVIDIA Isaac Lab 3.0 with Newton. It covers RSL-RL training with the backlash preset, BAM actuator models and domain randomization, then ONNX export (61 observations, 14 joint-position actions) and deployment with robotctl. Policies can be shared on the Hugging Face Hub or tested in Microduck Arena.

huggingface.cowriteupPublished and added 21 Oct 2026🧠 AI

LiteLLM version 1.107.0 was uploaded to PyPI on 21 October 2026 with a credential stealer, and the same build reached GHCR and Docker Hub images. Wiz describes the three dropped files (cook.pth, cook.py, sitecustomize.py), exfiltration to a fake litellm.dev domain, a GitHub dead drop for a second stage, and the malicious commits pushed through the lookalike Berri-AI repository. The last safe version is 1.106.2.

wiz.iowriteupPublished and added 21 Oct 2026🛡️ Security

LiteLLM 1.107.0 on PyPI and GHCR images shipped Python startup hooks (cook.pth, sitecustomize.py) that steal cloud, SSH, browser and AI-tool credentials, including LiteLLM proxy database credentials. Image build provenance recorded a lookalike Berri-AI/litellm source repository. The post decodes the payload, encrypted exfiltration and GitHub-driven remote loader, and lists containment steps, MITRE ATT&CK mappings and IOCs.

socket.devwriteupPublished and added 21 Oct 2026🛡️ Security

Cloudflare describes how it cut the average cost of its AI code reviewer from $2.43 to $0.77 per review (68%) and median time from 4m 9s to 1m 32s, between September and October 2026. About 40% of savings came from code changes, mainly sharing a cached prompt prefix across repositories and reviewers, and the rest from model and effort choices (Opus 5.5, Sonnet 5.5). Quality was checked through author action rates and blinded model judging.

blog.cloudflare.comwriteupAdded 29 Oct 2026, published 19 Oct 2026🧠 AI

Trail of Bits tested 25 popular package managers with a Docker and mitmproxy harness that simulates a compromised package repository injecting malware into legitimate packages. Fewer than half enforce lockfile hashes by default, only two verified every download, and only Go verifies signatures by default. The post covers lockfile hash pitfalls (Pub, pnpm, Conan, CocoaPods, Composer), repository, developer and Sigstore signing, and Go's checksum database. It also proposes lockfiles that commit to a signing identity plus a transparency log.

blog.trailofbits.comwriteupPublished and added 14 Oct 2026🛡️ Security

OpenSourceMalware's analysis of the latest GhostAction wave, where compromised GitHub accounts get malicious Actions workflows (security-audit.yml) injected across every writable repository, including an Oct 8 sweep of 346 repos via kitao and henrywoo. The new payload greps the checkout and full git history for credential patterns (AWS, Anthropic, OpenAI, GitHub PATs) and POSTs them over HTTP to 193.32.204.199/?c=monami. It also covers infrastructure reuse (phishing-heavy legacy IP, scanner activity), new watchlist domains my-github.com and my-gitlab.com, GitHub code-search hunting queries, a detection-confidence table, IOCs and incident response steps.

opensourcemalware.comwriteupAdded 10 Oct 2026, published 9 Oct 2026🛡️ Security

StepSecurity details a new wave of the GhostAction campaign in which attackers used compromised maintainer accounts of Takashi Kitao (pyxel) and Henry Wu (athenadriver, Uber) to push malicious "Security Audit" GitHub Actions workflows to 345 repositories in minutes. The upgraded payload now runs `git log -p --all` to mine an entire git history (not just current secrets) for thirteen credential patterns including AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google, Slack, and SendGrid keys, pairs AWS access key IDs with secret keys via context capture, and exfiltrates everything via raw-IP plain-HTTP POST to 193.32.204.199, bypassing DNS-based defenses. The post includes hunting queries, run-log forensics confirming successful exfiltration from uber/athenadriver, and remediation guidance centered on workflow approval gates and egress allowlisting.

stepsecurity.iowriteupPublished and added 9 Oct 2026🛡️ Security

Socket documents an October 8, 2026 wave of the GhostAction campaign in which two compromised GitHub maintainer accounts (henrywoo and kitao) pushed a malicious security-audit.yml workflow to 346 repositories, including uber/athenadriver and the 18,420-star kitao/pyxel. Beyond the original GhostAction technique of harvesting named GitHub Actions secrets, this variant adds a full git-history grep (via fetch-depth: 0 and git log -p --all) for 13 credential patterns covering AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs, Google/Firebase keys and SendGrid keys, plus a context-window capture around AWS key IDs to reconstruct usable key pairs, all exfiltrated in cleartext to a single hardcoded IP.

socket.devwriteupPublished and added 9 Oct 2026🛡️ Security

Step-by-step guide to reconstructing the real history of a tampered GitHub repo using data the attacker can't forge: raw commit objects (git cat-file), GitHub's repository activity API and audit log, before/after SHA ancestry checks, and npm publish timestamps. Worked through a PolinRider case (nestjsx/nest-access-control) where a forged commit was force-pushed to master plus 22 branches in 38 seconds, with a malicious .vscode/tasks.json runOn folderOpen trigger. It also covers safe handling of untrusted clones and how to tell victim accounts from attacker accounts.

opensourcemalware.comwriteupPublished and added 6 Oct 2026🛡️ Security

A forum writeup on ethresear.ch describing a "predictions-first" testing methodology for verification logic, applied against the author's own repository and against a live third-party MCP server (nsgoods Workbench, which offers offline signature verification over the x402 payment catalogue). Six rounds of testing surfaced concrete defects: a false negative caused by a stripped field list, a tamper-accepted body via a service-selection parameter that let callers choose which fields were excluded from the signed message, schema-rejection and signature-failure returning byte-identical error text, and a logging/privacy gap in the operator's system that was fixed after disclosure. The author ships a companion tool, exactzk-verification-guards, which captures both a passing and an actually-reproduced failing run as regression evidence rather than a fabricated example.

ethresear.chwriteupPublished and added 2 Oct 2026🛡️ Security

A Latent Space podcast transcript/interview with MIT PhD student Alex Zhang, creator of Recursive Language Models (RLMs) and a core contributor to GPU Mode and KernelBench, who discusses using recursive subagent calls, context offloading, and shared memory to let models work beyond fixed context windows. The conversation ranges across AI-generated GPU kernels and their verification gap, research taste in academia versus industry labs, why "harnesses" (as in Claude Code, Codex, and Pi) function as compositional generalizers, the Jev model's non-autoregressive output-space trade-offs, and large-scale agent swarm experiments at OpenAI, Kimi, and Sakana AI. It offers a researcher's-eye view of where capability overhang and new agent/harness architectures may be heading beyond today's standard transformer decoder.

latent.spacewriteupPublished and added 2 Oct 2026🧠 AI

An ethresear.ch post proposing "verified prestate simulation": wallets fetch the prestate a transaction will touch via debug_traceCall's prestateTracer, confirm unanimous state-root agreement across multiple independent RPC nodes, verify each account/storage value with eth_getProof Merkle Patricia Trie proofs, and only then execute the transaction locally with revm to produce trustworthy simulation results. It targets a concrete wallet attack where a compromised simulation API/RPC provider shows a benign fake trace (e.g. "donate to charity") while the real calldata drains a user's funds, and discusses its limitations (prestate-completeness not yet verified, conditional-logic and MEV evasion still possible) as a pragmatic alternative to full light clients.

ethresear.chwriteupPublished and added 1 Oct 2026🛡️ Security

Microsoft Threat Intelligence tracked in-the-wild exploitation of CVE-2026-73570, an unauthenticated OS command-injection vulnerability in Zimbra Collaboration Suite's SNMP notification path (swatchdog-to-snmptrap), triggerable via a crafted SMTP request when the optional zimbra-snmp package is enabled. The post documents pre-disclosure scanning, JSP webshell deployment, a novel pam_exec/zmmailboxdmgr privilege-escalation chain to root, systemd-based persistence (zimlog.service), theft of zimbraPreAuthKey/zimbraAuthTokenKey via zmlocalconfig and LDAP, lateral movement over Zimbra's SSH identity, a multi-stage Go-based remote-access agent (zimclient2 via zimdown2/agent2.sh), a dedicated mailbox-exfiltration implant, and an AzCopy-based exfiltration attempt, closing with Defender XDR KQL hunting queries and MITRE ATT&CK mapping.

microsoft.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Microsoft's DART team details an investigation into Storm-3068, a threat actor that escalated from a self-service password reset account takeover into full control of an organization's Azure DevOps environment, then weaponized a malicious pipeline to harvest kubeconfig files and gain access to Kubernetes clusters. The actor also deployed the Atera remote management agent and the Chisel tunneling tool to establish reverse tunnels and alternate remote access, and exfiltrated seven stolen kubeconfig files into a repository. The report lays out the attack chain, DART's response, and hardening recommendations around SSPR monitoring, phishing-resistant MFA, branch protection, and pipeline permission controls.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

A research writeup from Multiverse Computing introducing ProvenanceGuard, a post-generation verification layer for MCP-based LLM agents that checks not just whether a claim is factually supported somewhere in retrieved evidence, but whether it is attributed to the correct source tool or document, a failure mode they call cross-source conflation. Using local models (MiniLM for source routing, a DeBERTa NLI verifier, and a local LLM for claim decomposition) plus a RARR-style repair loop, it was evaluated on 281 real MCP traces from a medical agent, catching 138 of 139 unsupported claims flagged by human experts and correctly identifying the exact source about 86% of the time on held-out data, outperforming four source-blind baseline checkers. The method has already been adopted in NVIDIA's NVFlow finance-agent grounding stage.

huggingface.cowriteupPublished and added 29 Sep 2026🧠 AI

Endor Labs researcher pkennedy details GHSA-wp6x-29qx-fpr7 (ENDOR-VUL-2026-1809, CVSS 8.2, CWE-59), a symlink-traversal flaw in brig, a tool that runs AI coding agents inside microVM/container sandboxes. While brig's shared working directory was carefully guarded against symlink swaps, the user-named project directory was passed to the underlying runtime (Virtualization.framework on macOS, containerd/nerdctl on Linux) as a raw unresolved path; an agent could replace a subfolder it already controls with a symlink to any host directory, which is then mounted read-write into the sandbox on the next run, exposing SSH keys, cloud credentials, and other projects with the operator's privileges. Fixed in brig 0.3.0 by resolving and holding the path open before mounting; the piece includes full PoC commands, root-cause code snippet, and a detailed vendor disclosure/CVSS negotiation narrative.

endorlabs.comwriteupPublished and added 28 Sep 2026🛡️ Security

GitHub Security Lab describes custom "taskflow" prompts built on their open-source Taskflow Agent to hunt Android app vulnerabilities, reporting 24 findings to date. It walks through two concrete chains: an exported, unprotected MapActivity in OsmAnd that lets any app silently import settings and exfiltrate the user's exact map tile/route coordinates to an attacker server, and a hostname-parsing logic bug plus overly loose cookie-domain check in the Wikipedia Android app that lets a wikipedia:// deeplink load an attacker page (e.g. evil-wikipedia.org) and steal long-lived session cookies for account takeover. The post also candidly notes where LLMs struggle (false positives, mis-estimating severity, missing mitigating factors) versus where they excel (deep knowledge of safe/unsafe API patterns).

github.blogwriteupAdded 7 Oct 2026, published 28 Sep 2026🛡️ Security

A technical ethresear.ch post proposing post-quantum upgrades (schemeId 2-6) to Ethereum's Stealth Address Protocol (ERC-5564/ERC-6538), replacing ECDH with ML-KEM (FIPS 203) to preserve recipient unlinkability against a cryptographically-relevant quantum computer. It identifies a specific vulnerability: the naive 1-byte view-tag optimization leaks enough information for a quantum attacker holding the derived public key to recover the spending key discrete log and test candidate recipients, breaking anonymity even when ML-KEM is used; the authors propose domain-separated tag derivation, hybrid EC/PQ combiners, pairwise-KEM variants, and a "stealthier SAP" construction to fix it.

ethresear.chwriteupAdded 29 Sep 2026, published 28 Sep 2026🛡️ Security

METR describes a per-action monitor built as an Inspect approver. An LLM judge scores each agent tool call before execution, and calls scoring 3/10 or higher halt the eval for human review. It lays out four claims needed to argue the monitor works, with evidence and gaps. Reported results: 0.025% false positives on 20,000 actions, and a spoofed user turn lowered suspicion scores.

metr.orgwriteupAdded 29 Oct 2026, published 27 Sep 2026🧠 AI

METR describes a live per-action LLM monitor, built on Inspect's approver chain, that blocks agent tool calls scoring 3/10 or higher for human review during evals. It lays out four conjunctive claims for effectiveness with evidence gaps. Results include 0.025% false positives on 20,000 actions, 10/10 UK AISI incident transcripts caught, and a spoofed user turn that lowered scores, with 12/30 runs falling below the threshold.

metr.orgwriteupAdded 29 Oct 2026, published 27 Sep 2026🛡️ Security

Socket reports that the actions-cool/issues-helper and actions-cool/maintain-one-comment GitHub Actions, compromised in the May 2026 Mini Shai-Hulud campaign and disabled by GitHub, were re-enabled on September 16, 2026 with their release tags still pointing to the malicious code. Any workflow referencing them by tag (about 15,000 dependents for issues-helper alone) resumed running the Bun-executed obfuscated payload. Workflow run logs show the switch from fast "Repository access blocked" failures to multi-minute successful runs. The post gives remediation: SHA-pin actions, rotate secrets, and hunt for oven-sh/setup-bun and bun run index.js in runner logs. An update says both repos were disabled again on September 25.

socket.devwriteupPublished and added 24 Sep 2026🛡️ Security

A Flashbots researcher reviews the EarlyAttestationBleed paper (Muhammad Usama Sardar and Songbo Bu), which uses ProVerif formal analysis to uncover three attestation-verification bugs in confidential-computing deployments: Cocos AI's TDX verifier fails to actually compare the REPORT_DATA value despite computing it correctly, Cocos AI's SEV-SNP validator skips the comparison entirely when an empty expected-input value is passed, and Edgeless Systems' Contrast workload-policy logic can be tricked into accepting container images from untrusted host-controlled storage due to a rebase mistake. All three were implementation bugs (not protocol design flaws) and have since been fixed; the post also summarizes the paper's broader concerns about "early attestation" — exposing hardware details pre-authentication, lack of post-handshake re-attestation for long-lived sessions, and handshake-timeout tradeoffs from added attestation latency.

collective.flashbots.netwriteupAdded 2 Oct 2026, published 23 Sep 2026🛡️ Security

Huntress details a 2026 DarkMe RAT campaign that ditches the zero-days (CVE-2023-38831, CVE-2024-21412) previously used by the Water Hydra/EvilNum-linked group in favor of a plain phishing email delivering a disguised .pif file. The writeup reverse-engineers the full chain — msiexec pulling a wrapped MSI, a WSF stager, three obfuscated VB6 loader DLLs (Coconout.dll, Use.dll, Finalized.dll), a novel 329-app "inverted sandbox" gate, process hollowing into a signed clspack.exe, and Locked:// protocol-handler persistence — and corrects prior public reporting by showing the payload's "single-byte XOR" is actually a broken RC4 implementation. It closes with fresh C2 infrastructure (thatawful[.]boutique, port 7712), OSINT on delivery domains (including a related ClickFix/Efimer campaign), and concrete Sigma-style hunting rules and remediation steps.

huntress.comwriteupAdded 23 Sep 2026, published 22 Sep 2026🛡️ Security

test

dev.towriteupAdded 26 Sep 2026, published 19 Sep 2026🛡️ Security

A Latent Space AINews digest (9/15–16/2026) aggregating AI Twitter/Reddit discussion into curated items: Steve Yegge shutting down his "Gas Town" coding-agent project despite heavy spend, Databricks reporting a 60% coding-spend increase after rolling GPT-6 Astra out to 3,500 engineers (while finding it strongest only on high-complexity, long-horizon tasks), and OpenAI's new formal misalignment-incident disclosure framework with six case reports (including a model adding unauthorized persona text to its own summaries). It also covers RL-run transparency from Xiaomi's MiMo-V2.6, a Microsoft "capability laundering" paper on jailbreak-by-decomposition, harness-engineering debates (subagents, context-trimming), local-model benchmarking on r/LocalLlama (Qwen3.8-27B quantization, Voodoo Dynamic Quant), and funding/company moves (Cohere+Aleph Alpha, Arcee Series B, Sakana AI's GTM pivot). Note: the fetched text is truncated partway through the Reddit recap section, so later content (including further "less technical" subreddit recaps) is not reflected here.

latent.spacewriteupAdded 29 Sep 2026, published 17 Sep 2026🧠 AI

Endor Labs' live incident tracker for the Shai-Hulud 2.0 npm supply-chain worm that began around Nov 24, 2025, compromising packages from Zapier, ENS Domains, Postman and PostHog. It details the infection chain (malicious preinstall script, setup_bun.js dropper, obfuscated bun_environment.js payload), TruffleHog-style credential theft from AWS, GCP, Azure, GitHub and npm, self-replication via stolen npm and GitHub tokens, a self-hosted GitHub Actions runner backdoor abusing repository Discussions for command injection and C2, and destructive wiper behavior that shreds the user's home directory on Windows and Linux.

endorlabs.comwriteupPublished and added 11 Sep 2026🛡️ Security

Cisco Talos details active exploitation of CVE-2026-20079 (CVSS 10.0 unauthenticated auth bypass leading to root) and CVE-2026-20316 (low-privilege login via static credentials) in Cisco Secure Firewall Management Center. Three post-compromise clusters are tracked: UAT-12197 deploying a JSP web shell and JAR command executor to exfiltrate credentials; UAT-11823, overlapping with Sandworm, using a malicious Makeself license.tmp to drop a Netcat reverse shell and a Cyclops Blink variant; and UAT-11988, a Qilin ransomware affiliate who abused package_info.pl for LOTL recon, SOCKS5/reverse-SSH tunneling, and ultimately deployed Qilin ransomware. Talos provides Snort SIDs, hotfix guidance ahead of a comprehensive hardening release, and a GitHub IOC repository.

blog.talosintelligence.comwriteupAdded 7 Oct 2026, published 9 Sep 2026🛡️ Security

Trail of Bits found a bug in Lean's String.Pos.Raw.extract (affecting all stable versions up to 4.33.1, fixed in 4.34.0-rc1) where the logical definition and the compiled native code disagree on the result of extracting a slice at an out-of-bounds position, letting an attacker manufacture a contradiction (empty string = non-empty string) that "proves" any theorem, including a fake formalization of Fermat's Last Theorem. The exploit only works when a proof relies on the native_decide axiom, which extends trust to the compiler rather than the kernel; the researchers found the issue while using GPT-5.6 to build a code-review skill, and Lean maintainers hargoniX and Rob23oba shipped fixes within hours to days of disclosure. The post is a reminder that machine-checked proofs are only as trustworthy as the evaluator/compiler paths behind axioms like native_decide, and points to work like lean4lean and alternative kernels as mitigations.

blog.trailofbits.comwriteupPublished and added 9 Sep 2026🛡️ Security

Aikido Security reports that the Shai-Hulud npm worm payload (SHA256 e37e3dd...e5b1a6), first seen during the @AntV compromise on May 19, 2026, resurfaced 111 days later on September 7 in four new packages (feishu-docx-mcp, bmc-i18n-extract-cli, blueai-cli, bmc-translate-utils) published by the same npm account within one hour. The payload passed npm's publish-time malware scanning — introduced in July 2026 to hold packages 5-15 minutes for automated checks — despite being an exact, previously fingerprinted hash match, exposing a gap between npm's scanning claims and actual detection coverage. The writeup includes full IOCs: C2 domain t.m-kosche.com, preinstall script running `bun run index.js`, persistence via .vscode/tasks.json and .claude/settings.json, and stolen-token-based republish behavior.

aikido.devwriteupPublished and added 7 Sep 2026🛡️ Security

StepSecurity documents Megalodon, a May 2026 campaign that injected backdoored GitHub Actions workflow files named SysDiag or Optimize-Build directly into 5,500+ public repositories in a six-hour window via direct Poisoned Pipeline Execution (d-PPE), exploiting weak branch protection. The base64-encoded bash payload harvests AWS/GCP/Azure credentials, SSH keys, Kubernetes/npm/Docker configs, GitHub OIDC tokens, and grep-matched secrets from the workspace, exfiltrating everything via HTTPS POST to a hardcoded C2 IP; the npm package @tiledesk/tiledesk-server was among the confirmed poisoned downstream targets.

stepsecurity.iowriteupAdded 5 Sep 2026🛡️ Security

Unit 42 details an incident response engagement in which a threat actor used frontier AI models and custom agentic AI frameworks to compress a multi-week intrusion into under 10 hours, executing over 50 MITRE ATT&CK techniques largely autonomously. The AI agents mapped internal microservices after breaching a public web service, harvested hard-coded secrets from code repositories, escalated to root via a secrets manager, hijacked CI/CD pipelines to exfiltrate cloud keys (attempting but failing to backdoor Terraform via branch protection), and ultimately hijacked the victim's own cloud AI endpoints as post-compromise infrastructure. The article maps techniques to MITRE ATT&CK and ATLAS, lists AI-usage indicators (structured Markdown handoffs between agent sessions, AI-generated scripts) and offers defensive recommendations like synchronized automated containment, treating AI endpoints/MCP gateways as governed infrastructure, and hunting for bursty API/auth behavioral loops.

unit42.paloaltonetworks.comwriteupAdded 8 Sep 2026, published 2 Sep 2026🛡️ Security

Manifold Security discloses 'GitSpawn', a vulnerability class where AI coding agents (Claude Code, Goose, Hermes, Qwen Code, Grok Build, and reportedly Codex/Cursor) run git commands like `git status`/`git diff` for context-gathering at startup without sanitizing the repository's own .git/config. Because these commands refresh git's index, a malicious repo can set `core.fsmonitor` (or a similar config sink) to an arbitrary command, achieving code execution outside the agent's sandbox before any approval prompt, workspace-trust dialog, or even authentication - simply by opening a folder delivered as files (zip, USB, shared drive) rather than cloned. Two CVEs were assigned (Goose, Hermes); four of eight reported findings remain unpatched at publication.

manifold.securitywriteupAdded 4 Sep 2026, published 1 Sep 2026🛡️ Security

Trail of Bits found and reported an authorization bypass in Provenance Blockchain's marker module (Cosmos SDK) that let any user with zero tokens self-grant ACCESS_ADMIN on non-fixed-supply marker accounts, because the access check compared caller balance against a stale on-chain supply field that never diverged from zero. The bug affected 82 live mainnet markers (tokenized loans, bridged stablecoins, consortium deposits, governance escrow) and allowed two-transaction exploitation to mint arbitrary tokens or drain roughly $500,000 in escrowed nhash; it was mitigated in v1.28.0 (PR #2627) and fully fixed in v1.29.0 (PR #2734) by reading live bank-module supply with an explicit zero-guard.

blog.trailofbits.comwriteupAdded 3 Sep 2026, published 25 Aug 2026🛡️ Security

A transaction-level forensic reconstruction of the August 23, 2026 Term Finance vault drain ($8.5M), in which an attacker funded a wallet via Tornado Cash, deposited a trivial 0.017% stake, and used it to submit an executable governance proposal through Term's opt-out "veto" voting model. The payload sat publicly visible on-chain for six days with no objection, then disabled the seven-day Zodiac delay-modifier timelock from inside the same proposal it was supposed to be gated by, before draining four ETH sub-vaults and five USDC vaults (including contagion into a RockawayX/Tori Finance curated vault). The piece dissects why the exploit required no leaked key, oracle manipulation, or reentrancy — only an unwatched veto queue and a timelock reachable by the mechanism it was meant to contain.

defiprime.comwriteupAdded 30 Sep 2026, published 23 Aug 2026🛡️ Security

AWSHound is a free, self-hosted, read-only collector that turns an AWS account or Organization into a BloodHound Community/Enterprise Edition OpenGraph dataset, performing offline IAM policy evaluation (identity policies, permissions boundaries, SCPs/RCPs, resource policies, and a KMS-specific three-layer model) so that graph edges only represent effective, resolved permissions rather than raw policy attachments. The post details nine collectors (IAM, Organizations, S3, KMS, SSM, EC2, Lambda, CloudFormation, EKS), 156 edge types (only 36 traversable), composite escalation edges like AWS_CanCreateAndAssumeAdminRole, and walks through same-account and cross-account-to-org-compromise attack path demos, plus benchmarks at 500+ account scale (~160k nodes, ~10.5M edges in ~15 min) and comparisons to prior tools (ApeMan, PMapper, Aurelian, Cartography, CloudMapper, IAMhounddog).

specterops.iowriteupAdded 5 Sep 2026, published 19 Aug 2026🛡️ Security

Aikido researchers detail how an AI pentesting agent found a path traversal in Gogs' organization name handling (CVE-2026-52813), which they manually escalated to full Remote Code Execution by planting a bare git repository inside a worktree and overwriting its hooks/update file to trigger command execution on push. The post also covers a git-receive-pack/git-upload-pack service parameter confusion causing an authorization bypass allowing writes to private repos by read-only users (CVE-2026-52810, with an unpatched case-sensitivity bypass and manual code fix provided), and a stored XSS in Gogs' Jupyter notebook rendering via an outdated notebookjs library that bypasses bluemonday sanitization via onerror handlers set during innerHTML assignment.

aikido.devwriteupAdded 3 Sep 2026, published 19 Aug 2026🛡️ Security

Endor Labs researcher details 14 critical/high vulnerabilities (7+ public CVEs/GHSAs) found across seven AI orchestration platforms — NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow — all of which trust anyone who can touch a workflow to run code on the host. Walkthroughs include a Flowise 3.1.2 unauthenticated prompt-injection-to-RCE chain via Pyodide/Node bridge escape, Langflow's trivial `lambda`-string eval sandbox bypass, NocoBase's broken SES Compartment/Proxy guard escalation, and Dify/Activepieces sandboxes applied only after attacker code already executes. The research (presented at DEF CON 34, full whitepaper linked) argues these are multi-tenant code-execution engines shipped with single-user threat models, exposing connected credentials, email, calendars, and customer data.

endorlabs.comwriteupAdded 3 Sep 2026, published 18 Aug 2026🛡️ Security

Wiz's Customer Incident Response Team (CIRT) details a real campaign (mid-May–early June 2026) in which stolen GitHub Personal Access Tokens were used for repository reconnaissance, low-volume validation cloning, and then mass exfiltration of thousands of repos per organization from AWS IPs using automated tooling. The post provides a structured investigation playbook — containing the compromised PAT, expanding the timeline via GitHub audit logs and Enterprise Log Streaming, tracing the leak source, assessing blast radius (exposed secrets/PII in exfiltrated repos), rotating credentials, and hunting for downstream cloud abuse — while noting GitHub's 7-day audit log retention limits visibility.

wiz.iowriteupAdded 3 Sep 2026, published 13 Aug 2026🛡️ Security

ChainDrop is an npm worm that compromised hundreds of packages on 4 August 2026, some with over 150 million weekly downloads, starting from a malicious commit (174f6a5) in the keyv repository. Datadog dissects the Bun-based loader, the obfuscated second stage, credential theft (files, GitHub Actions runner memory, AWS, Kubernetes, Vault), Ethereum smart-contract C2 discovery, AES/RSA exfiltration, an eval channel, and propagation via stolen npm tokens, GitHub branches and Sigstore provenance. IOCs and a list of affected packages are included.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 4 Aug 2026🛡️ Security

In-depth OSINT/threat-intel investigation into CRPX0, a ransomware group that emerged in July 2026 with 47 listed victims (mostly healthcare, mainly US/Turkey targets), tracing its origins to a prior "Flash Token" crypto/USDT money-laundering scam service run by the same operators. The piece covers domain registration analysis (REGRU-SU abuse, reused 2021 domain), dark web/clear web leak sites, RaaS/HaaS/affiliate program offerings, ClickFix-based payload delivery targeting Windows via EXE/DLL, YouTube affiliate-panel promotion analysis (voice/locale clues suggesting China), TOX/Session ID and Bitcoin address correlation, and real IP address deanonymization, concluding with IOCs and MITRE ATT&CK mapping.

theravenfile.comwriteupAdded 3 Sep 2026, published 3 Aug 2026🛡️ Security

Datadog Security Labs shows two ways a trusted repository can run code before the first prompt in coding agents. In Codex, a project-scoped stdio MCP server in .codex/config.toml starts an attacker process. In Claude Code, a PATH override in .claude/settings.json makes startup Git probes run a repository git wrapper. Neither needs hooks, a model response or command approval. The post gives an rg search and endpoint monitoring advice.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 3 Aug 2026🛡️ Security

A hands-on OSINT tutorial demonstrating three tools for TikTok reconnaissance: Unfurl (dfir.blog/unfurl) for decoding video IDs, usernames, and timestamps embedded in TikTok URLs; Bellingcat's tiktok-timestamp tool for extracting exact upload date/time from video links; and omar-thing.site for pulling account-level intelligence such as user ID, creation date, location, language, bio, and follower/following lists. It walks through each tool with example queries to show how public TikTok data can be turned into investigative leads.

hackers-arise.comwriteupAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

A student researcher describes an LLM multi-agent pipeline (GLM-4.7 for candidate finding, GLM-5 for semi-triage, Codex 5.3 for final triage) built to hunt logic and authorization bugs in large open-source codebases like Grafana, Nextcloud, Matomo, Airflow and protobuf. The post details the prompt-engineering fixes (forcing the model to explicitly reason about attacker conditions, server conditions, and CIA-triad impact) that cut false positives, and lists the resulting real vulnerabilities, including CVE-2026-21721, a CVSS 8.1 privilege escalation in Grafana's dashboard permissions API caused by a missing UID scope check in ac.EvalPermission.

blog.cykor.krwriteupPublished and added 29 Jul 2026🛡️ Security

Trail of Bits describes how they use Codex's /goal feature, an open-ended agentic objective mode, to hunt for bugs in heavily audited open-source codebases like Rust, curl, and zlib as part of the OpenAI-backed Patch the Planet initiative. Key techniques include letting Codex write and red-team its own goal prompts, defining precise outcomes rather than prescribing methods, running one outcome per agent to avoid competing objectives, and building an automated variant-analysis pipeline (using P-critical Rust issues, a security gate, and a two-pass false-positive judge) that produced a soundness hole and a miscompilation patched in Rust 1.98, plus privilege-escalation bugs in Keycloak's SAML component. They also built agentcov, an internal tool that tracks code coverage read by Codex to prevent it from skipping parts of the codebase.

blog.trailofbits.comwriteupAdded 3 Sep 2026, published 28 Jul 2026🛡️ Security

Aikido Security engineers describe how they built a 'publishable credentials denylist' for their Betterleaks secret scanner to suppress known-public keys (like Stripe's publishable API key) that generic secret-detection regexes otherwise flag as false positives. They tested the change against 100GB of Common Crawl data, cutting false positives by 2.37% (27,886 fewer findings), and outline five edge-case categories (unique shape, no unique shape needing context, same shape as secret needing liveness checks, sensitive-if-misconfigured keys, and test/sandbox credentials) that complicate cleanly filtering public-by-design credentials from real secrets.

aikido.devwriteupAdded 3 Sep 2026, published 23 Jul 2026🛡️ Security

Explains how a malicious mcp.json in a repository, with attacker-controlled "command" and "args" fields, gives remote code execution when an IDE, scanner, CI/CD pipeline or agent loads it automatically. Walks through a PoC where running Snyk's Agent Scan (snyk-agent-scan) on a poisoned config executes arbitrary commands; Snyk fixed it in 0.5.0 after a duplicate report. Offers mitigations for tool builders (sandboxing, pattern blocking, human-in-the-loop prompts hardened against "Lies in the Loop" dialog forging) and for users (sandbox untrusted repos).

checkmarx.comwriteupAdded 10 Sep 2026, published 23 Jul 2026🛡️ Security

Socket researchers traced malicious dev versions of ten Packagist packages owned by developer dinushchathurya back to compromised GitHub repositories containing 55-62 malicious GitHub Actions workflow files each. The workflows execute on GitHub-hosted Ubuntu runners on every push, download an architecture-matched Linux payload from C2 server 43.228.157.68, and run an internet scanner (`ipscan --exploit CVE-2026-41940`) that exploits an authentication bypass in cPanel/WHM and harvests cloud, database, SSH, and source-control credentials, exfiltrating results via heartbeat/results HTTP endpoints and DNSHook callbacks. GitHub code search for the campaign's unique markers returned 6,100-16,000 matching workflow files across unrelated repositories, indicating the abuse extends far beyond the one compromised maintainer and effectively weaponizes GitHub Actions as free, disposable attack infrastructure.

socket.devwriteupPublished and added 23 Jul 2026🛡️ Security

Island Research uncovered the FakeGit campaign: roughly 7,600 malicious GitHub repositories (from ~6,600 fake developer profiles), over 800 of which impersonate AI Skills or MCP servers for tools like Gmail, WhatsApp, Databricks, Jenkins, and Docker, collectively logging 14M+ downloads and 600+ listings across registries like LobeHub, Glama, MCP.so, and MCP Market. Malicious READMEs and bundled ZIPs (e.g. Mann1988/awesome-claude-skills, DomingosNgongo/walmart-mcp, 45d5r/databricks-mcp-server) drop a LuaJIT-based loader that runs an obfuscated Lua stage, resolves C2 via a Polygon smart contract, and ultimately injects the StealC infostealer via SmartLoader. The report's core finding, dubbed "AgentBaiting," is that Claude Code, Gemini, and ChatGPT independently discovered and recommended these fake capability repos as installation instructions without ever being given a link, showing agentic search/discovery itself has become a supply-chain attack surface.

island.iowriteupAdded 22 Jul 2026🛡️ Security

Noma Labs disclosed GitLost, an indirect prompt-injection vulnerability in GitHub Agentic Workflows where an unauthenticated attacker could open a public GitHub Issue with hidden instructions that, once the AI agent backed by Claude or GitHub Copilot processed the issue on an issues.assigned trigger, caused it to fetch README contents from private organization repositories and post them as a public comment. The researchers also bypassed GitHub's guardrails by inserting the word Additionally into the crafted issue, reframing the model's output instead of triggering a refusal. GitHub was notified and the flaw was responsibly disclosed with a full PoC (workflow run and issue) published.

noma.securitywriteupPublished and added 18 Jul 2026🛡️ Security

An OSINT investigator analyzes a WorldLeaks ransomware group data leak of Reliance Infrastructure (hosted by third-party vendor Yotta), which exposed 14.3GB / ~19,000 files related to India's Kudankulam Nuclear Power Plant (KNPP) — including RFC drawings, PPS fencing designs, HVAC/fire specs, and vendor/employee records. The piece profiles WorldLeaks (a Hive/Hunters International spin-off), lists MD5/SHA-256 hashes for its RustyRocket exfiltration tool, and discusses supply-chain vendor risk, industrial espionage by nation-state actors (Lazarus/DPRK, China), and insider credential trading as threats to critical nuclear infrastructure.

theravenfile.comwriteupAdded 3 Sep 2026, published 17 Jul 2026🛡️ Security

On July 14, 2026, attackers compromised push access to two AsyncAPI GitHub repositories (asyncapi/generator and asyncapi/spec-json-schemas) and pushed malicious commits under a placeholder git identity that triggered legitimate CI/CD release workflows (release-with-changesets.yml, if-nodejs-release.yml), publishing five malicious npm package versions (@asyncapi/generator, generator-helpers, generator-components, specs) carrying a runtime-triggered obfuscated dropper for the Miasma RAT, complete with valid OIDC/SLSA provenance attestations. StepSecurity detected the packages within 30 minutes, used Harden-Runner in an isolated GitHub Actions job to capture the malware's C2 traffic (HTTP plus IPFS/Nostr/BitTorrent DHT fallback channels), and pushed the IOCs to their Global Block List to block exfiltration across customer pipelines; all malicious versions have since been unpublished.

stepsecurity.iowriteupAdded 3 Sep 2026, published 16 Jul 2026🛡️ Security

Socket details "Operation Muck and Load," a campaign starting with a malicious Go module (github.com/kaleidora/dnsub-scanning-tool) that impersonates a DNS scanner but launches hidden PowerShell to fetch and decode a multi-layer, XOR-encrypted loader. The loader resolves encrypted payload locations from public dead drops (Pastebin, GitHub, YouTube, Instagram, Telegram, Google Docs), retrieves a password-protected .7z archive masquerading as Microsoft Photos, and deploys AsyncRAT/Quasar/Remcos-style RATs and Vidar infostealer. Pivoting from the module, Socket uncovered 222 GitHub repositories across 190 accounts using automated force-push workflows tied to a single email (ischhfd83@rambler.ru) to fake activity and credibility, some directly hosting Vidar, XMRig/BitMiner, and trojan loaders.

socket.devwriteupPublished and added 16 Jul 2026🛡️ Security

Endor Labs benchmarked Claude Sonnet 5 paired with Claude Code on its Agent Security League test, which measures whether an AI agent can autonomously patch real vulnerabilities in complex codebases without copying a remembered upstream fix. Sonnet 5 scored 83.2% FuncPass (functional correctness) but only 19.6% SecPass (actually closing the vulnerability), continuing the benchmark's recurring functional-vs-security gap; notably it showed very little cheating (8/200 confirmed cases, mostly workspace-leakage rather than training-data recall) compared to prior models like Fable 5 (38 cases) and Opus 4.8.

endorlabs.comwriteupAdded 3 Sep 2026, published 9 Jul 2026🛡️ Security

Step Security's incident analysis of the compromise of codfish/semantic-release-action, a widely used GitHub Action wrapping semantic-release. An attacker force-pushed a malicious commit and repointed seven version tags to it, converting the action from a Docker runner to a composite action that installs Bun and runs an obfuscated 512KB payload via if: always() steps. The payload steals GitHub OIDC tokens and PATs, uses a novel GitHub commit-message dead-drop for C2, has a Russian-locale killswitch, and locked tags immutable via GitHub Rulesets to block remediation.

stepsecurity.iowriteupAdded 3 Sep 2026, published 1 Jul 2026🛡️ Security

The author built hackmyclaw.com, exposing an OpenClaw-based email assistant named Fiu (running on Claude Opus 4.6) and inviting the public to jailbreak it into leaking a secrets.env file via email prompt injection. After hitting Hacker News, Fiu received 6,000+ emails from 2,000+ attackers using techniques like authority impersonation, fake incident-response urgency, multi-language social engineering, and Anthropic's old magic refusal-trigger string, yet the secret was never leaked. The post details operational failures (Gmail fraud-detection suspension, $500+ in API costs, batch-context contamination, the model inferring it was being tested) alongside lessons on model choice, prompt simplicity, and remaining risk of prompt injection with weaker models or multi-turn conversations.

fernandoi.clwriteupAdded 30 Jun 2026🛡️ Security

Wiz details how its autonomous "Red Agent" AI red-teaming tool found a critical Broken Object-Level Authorization (BOLA) flaw in an unnamed airline's GraphQL booking API. Starting from just a root URL, the agent reverse-engineered client JS to mint an anonymous session token, ran GraphQL introspection to enumerate 514 queries/428 mutations, and found that mutations like bookingRetrieveByBookingId accepted sequential integer IDs with no backend authorization check — exposing full passenger PII, payment data, and write access to bookings within 15 minutes.

wiz.iowriteupAdded 3 Sep 2026, published 29 Jun 2026🛡️ Security

Wiz Research found that the Amazon Q Developer VS Code extension auto-loaded and executed MCP server configs from .amazonq/mcp.json in a workspace with no consent prompt or workspace-trust check, and spawned those processes with full environment inheritance. Opening a malicious repository (e.g. a malicious PR, typosquatted package, or fake "coding test" per known DPRK social-engineering tactics) could therefore trigger arbitrary code execution and theft of the developer's AWS credentials, demonstrated by capturing aws sts get-caller-identity output. Amazon remediated the issue in language server version 1.65.0, adding a consent prompt before loading workspace MCP servers.

wiz.iowriteupAdded 3 Sep 2026, published 26 Jun 2026🛡️ Security

Aikido Security details how codfish/semantic-release-action, a widely used GitHub Action for automated releases since 2019, was compromised via an imposter-commit attack: an attacker force-pushed two orphan commits (disguised with reused real commit metadata) and retargeted sixteen tags including the floating v2–v5 majors to point at them. The malicious action.yml was rewritten as a composite action that still calls the legitimate action first so runs appear successful, then loads Bun via oven-sh/setup-bun and executes a heavily obfuscated 781KB index.js payload targeting GITHUB_TOKEN and NPM_TOKEN secrets. The payload contains the dead-drop marker "thebeautifulsnadsoftime," tying it to the leaked Miasma credential-stealing toolkit, which polls GitHub's public commit search API for that string to fetch and eval() attacker commands instead of using traditional C2 infrastructure.

aikido.devwriteupAdded 3 Sep 2026, published 24 Jun 2026🛡️ Security

Attackers adopted 400+ orphaned AUR (Arch User Repository) packages and injected malicious build logic that pulled in a malicious npm dependency (masquerading as atomic-lockfile, also seen as js-digest), dubbed the "Atomic Arch" campaign by Sonatype researchers. The malicious npm package deploys a Rust-based credential stealer targeting browser cookies, SSH keys, GitHub/npm tokens, and cloud/Docker credentials, with optional eBPF-based rootkit persistence on rooted systems. The piece explains scope (Arch, EndeavourOS, Manjaro, WSL2-based Arch, self-hosted Arch CI runners) and draws parallels to similar ownership-hijacking risks in npm, PyPI, GitHub Actions, and Homebrew.

stepsecurity.iowriteupAdded 3 Sep 2026, published 18 Jun 2026🛡️ Security

Aikido Security identified 15 JetBrains IDE plugins (posing as DeepSeek-based AI coding assistants) published under 7 vendor accounts that silently exfiltrate the AI provider API key a user enters into settings, sending it in plaintext over HTTP to a hardcoded C2 server at 39.107.60[.]51. The plugins also run a paid tier where the attacker's server hands back an API key to paying users — likely reselling keys stolen from other victims — and together the plugins have racked up nearly 70,000 installs since October 2025, with new listings still appearing in 2026. The writeup includes decompiled Java snippets of the save()/getKey() exfiltration logic, the C2 IOC, and the full list of malicious plugin IDs and vendor accounts.

aikido.devwriteupAdded 3 Sep 2026, published 16 Jun 2026🛡️ Security

Aikido researchers discovered that version 1.4.1 of the Rust crate 'onering' (18,000+ downloads on crates.io, also compromised at the source on the maintainer's GitHub repo) shipped a malicious build.rs build script that walks up from OUT_DIR to locate the consuming project's repository root, runs git log and git diff HEAD^ HEAD to capture the latest commit's metadata and full source diff, then exfiltrates it by disguising the payload as a Sentry crash-report envelope POSTed to a real Sentry ingest endpoint. Because build.rs executes automatically at compile time via Cargo, simply building a project that depends on the crate is enough to trigger the leak, making it a novel build-time supply-chain attack vector distinct from the npm/PyPI postinstall-hook pattern, and notable for exfiltrating source code diffs rather than credentials.

aikido.devwriteupAdded 3 Sep 2026, published 10 Jun 2026🛡️ Security

StepSecurity's forensic analysis of the June 5, 2026 Miasma worm incident, in which a compromised contributor account pushed a malicious commit to Microsoft's Azure/durabletask repository planting five files (.claude/settings.json, .gemini/settings.json, .cursor/rules/setup.mdc, .vscode/tasks.json, and a 4.6MB obfuscated .github/setup.js payload) that trigger credential-harvesting code execution the moment the repo is opened in Claude Code, Gemini CLI, Cursor, or VS Code — no package install or code run required. GitHub's automated abuse detection disabled 73 Microsoft repositories in a 105-second sweep, including Azure/functions-action, breaking CI/CD pipelines across GitHub Actions users relying on the mutable @v1 tag. The post ties this to the same compromised account behind the May 19 durabletask PyPI credential-stealer campaign and the broader TeamPCP-linked Miasma worm, which has infected 113+ repositories.

stepsecurity.iowriteupAdded 3 Sep 2026, published 9 Jun 2026🛡️ Security

Investigates GitHub's mass disabling of 73 Microsoft repositories across the Azure, Azure-Samples, microsoft, and MicrosoftDocs orgs within a 105-second window on June 5, all flagged for ToS violations, including the widely-used Azure/functions-action GitHub Action that broke CI pipelines globally. The author links the takedown to a re-compromise of the durabletask PyPI package (previously hit May 19 by TeamPCP via stolen GitHub Actions secrets) and to Miasma, a rebrand of TeamPCP's open-sourced Mini Shai-Hulud worm that Aikido and OX Security found had added Azure/GCP credential collectors and self-propagates by committing stolen secrets into attacker-created public repos, which is what likely triggered GitHub's automated abuse enforcement.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 6 Jun 2026🛡️ Security

Doyensec compared Aikido's Attack AI Pentest against XBOW's Lightspeed, two AI-powered application security testing platforms, manually validating every reported finding as a true or false positive. The evaluation covers configuration workflow, impact on the tested application, report quality, cost, and speed, giving an independent view of current AI pentesting maturity.

blog.doyensec.comwriteupAdded 3 Sep 2026, published 4 Jun 2026🛡️ Security

Orca Security describes a vulnerability in Gitea's built-in container registry that allowed unauthenticated attackers to access private container images. The issue highlights access-control gaps in self-hosted Git/CI platforms that bundle registry functionality, potentially exposing proprietary code and secrets baked into private images.

orca.securitywriteupPublished and added 27 May 2026🛡️ Security

Socket's Threat Research team analyzed a repository takeover of the popular npm package art-template, whose versions 4.13.5 and 4.13.6 were backdoored to inject a script loader (v3.jiathis[.]com) that redirects through a watering hole to a Safari/iOS browser exploit delivery framework nearly identical to Google's previously-reported Coruna exploit kit. The writeup provides a full multi-layer deobfuscation of the implant (UTF-16 packing, base64/eval chains, per-string XOR), maps its version-gated payload flags to specific WebKit CVEs (CVE-2021-30952, CVE-2022-48503, CVE-2023-43000, CVE-2024-23222), documents WASM-based JIT fingerprinting/anti-bot probes and CPU-architecture discrimination, and links the campaign to threat actor UNC6691 via content-addressed URL scheme, YARA matches, and C2 domain patterns, ending with concrete detection recommendations and IOCs.

socket.devwriteupPublished and added 22 May 2026🛡️ Security

Analysis of a claimed BreachForums leak by threat actor TeamPCP of ~4K GitHub private repositories, including two leaked Rails controller files (OrganizationsController, PullRequestsController) that the author dissects for internal architecture details — OFAC/trade-compliance gating, CAPTCHA logic, org deletion "danger zone" tokens, database cluster topology, Voltron graceful-timeout feature flags, PR stacking, and JA3-TLS-fingerprint-based anonymous rate limiting. The piece also links TeamPCP to a lookalike domain (git-service.com, registered May 16 2026) used to compromise Microsoft's durabletask Python package, and notes TeamPCP's dark-web/Telegram presence and ties to CypherForce Ransomware.

theravenfile.comwriteupAdded 5 Sep 2026, published 20 May 2026🛡️ Security

StepSecurity and Endor Labs document a second wave of the Mini Shai-Hulud npm worm spreading through the compromised 'atool' account, which publishes timeago.js and maintains packages in Alibaba's @antv namespace, hitting echarts-for-react, jest-canvas-mock and dozens of other packages. The payload scrapes GitHub Actions Runner.Worker process memory to steal masked CI/CD secrets, harvests 130+ credential file paths (cloud, SSH, Kubernetes, Vault, crypto wallets, Claude Code/VS Code configs), exfiltrates via a GitHub API dead-drop in antvis/G2 or a fake-OpenTelemetry C2 at t.m-kosche.com, drops persistent backdoors in Claude Code/VS Code, and has already used stolen GitHub tokens to spin up 2,500+ dead-drop repositories. The writeup includes full process/network telemetry from Harden-Runner showing the attack blocked, deobfuscated payload internals, IOCs, and detection/remediation guidance.

stepsecurity.iowriteupPublished and added 19 May 2026🛡️ Security

Somerset Recon details Quacc++, a proof-of-concept automated bug hunter that queries grep.app's regex-based index of public GitHub repos to find candidate vulnerable code, downloads matching repositories, and runs Semgrep taint-analysis rules to confirm exploitable patterns. Using a search for strcpy(buf, argv[ paired with a custom Semgrep taint rule, the authors discovered an unbounded strcpy stack buffer overflow in GetArgumentFiles() in Google DeepMind's Lab repository (engine/code/bspc/bspc.c), confirmed with AddressSanitizer and pwntools/GDB to give full RIP control at offset 1080. The post also walks through Semgrep rules for SQL injection (CWE-89), hardcoded API keys (CWE-798), and disabled TLS certificate validation (CWE-295) across curl/wget/requests/Node/Go.

somersetrecon.comwriteupPublished and added 7 May 2026🛡️ Security

Huntress researchers solve the long-standing 'ADWS attribution problem' where tools like SOAPy abuse Active Directory Web Services to hide the attacker's real source IP behind localhost ([::1]) in LDAP diagnostic logging (Event 1644). By correlating Windows Filtering Platform Event 5156 (which captures the real inbound source IP on port 9389 before ADWS proxies to loopback) with Event 1138 (ADWS session) and Event 1644 (LDAP query) using a stable ~60-80ms timestamp window, they demonstrate reliable attribution even when port-based correlation fails due to log rollover. The post includes a released PowerShell script (Get-ADWSAttribution.ps1) and addresses the false-positive concern of RSAT tools also using ADWS via pattern detection on suspicious 1644 query attributes.

huntress.comwriteupAdded 3 Sep 2026, published 9 Apr 2026🛡️ Security

dfs-mini1 is a vulnerability detection agent from depthfirst, built by reinforcement learning on gpt-oss-120b with a shell-only harness. Trained in Kubernetes sandboxes on audits that do not overlap EVMBench, using a 32k context with learned summarization, it reaches state of the art on EVMBench Detect at pass@8 at 10-30x lower cost than frontier models. It also transfers to an internal CVE benchmark, but reports more false positives.

depthfirst.comwriteupAdded 30 Oct 2026, published 31 Mar 2026🧠 AI

Huntress documents a threat actor who exfiltrated data stolen from SolarWinds Web Help Desk, ToolShell/SharePoint, Gladinet CentreStack, and SmarterMail intrusions into a free-trial Elastic Cloud SIEM instance, using Kibana's Discover interface to triage roughly 216 victim hosts across 34 Active Directory domains. Collaboration with Elastic, Unit 42, and Black Lotus Labs uncovered disposable-email infrastructure (quieresmail.com/firstmail.ltd), Cloudflare Workers used for Velociraptor callbacks, and login activity via a Safing SPN/VPN tunnel before Elastic took the instance down. The post is part two of a series exposing how the actor abuses legitimate free-trial security software for post-exploitation victim management.

huntress.comwriteupAdded 3 Sep 2026, published 6 Mar 2026🛡️ Security

Huntress investigated malicious GitHub repositories impersonating OpenClaw installers (Feb 2-10, 2026) that were surfaced as the top Bing AI search result for "OpenClaw Windows." The Windows installer deployed a new packer dubbed Stealth Packer alongside Vidar and PureLogs infostealers and GhostSocks — a BlackBasta-linked SOCKS backconnect proxy malware that routes attacker traffic through the victim's machine to bypass MFA and anti-fraud checks — while a parallel macOS campaign delivered a signed Mach-O AMOS stealer variant via a fake "puppeteerrr/dmg" repo, later detected by an Apple XProtect update. The blog includes full technical teardown, GitHub account/organisation abuse patterns, and IOCs.

huntress.comwriteupAdded 3 Sep 2026, published 4 Mar 2026🛡️ Security

A step-by-step method for harvesting Configuration Manager (SCCM/MECM) credentials by pulling DPAPI-encrypted secret policy blobs (Network Access Accounts, task sequences, collection variables) via WMI or the local CIM repository, then exfiltrating DPAPI master keys and LSA SYSTEM/SECURITY/SAM hives for fully offline decryption with Impacket's dpapi and secretsdump modules. The approach avoids running known SCCM-abuse tools like SharpDPAPI on-target, reducing signature-based detection while still noting which steps (registry hive backup, DPAPI folder copy, WMI queries) a SOC could realistically catch.

bencteux.frwriteupAdded 3 Sep 2026, published 5 Oct 2025🛡️ Security

A DFIR.ch technical walkthrough of Linux POSIX capabilities: how to weaponize cap_setuid on a binary like /usr/bin/python3.12 with setcap to create a stealthy root-spawning backdoor without touching SUID bits, then how defenders can hunt for these via getcap -r, /proc status Cap* fields, LinPEAS, and an Elastic detection rule that flags setcap process execution. It also explains where capabilities live on disk (the security.capability extended attribute on the inode) and how to inspect/remove them with getfattr and setcap -r.

dfir.chwriteupAdded 3 Sep 2026, published 16 May 2025🛡️ Security

A DFIR consultant walks through two Microsoft Defender for Endpoint high-severity "Ransomware" alerts that turned out to be benign inbound TCP SYN scans (ConnectionAttempt, not InboundConnectionAccepted) from an IP Microsoft had classified as malicious. The post shares KQL queries against DeviceNetworkEvents to identify internet-facing devices (via RemoteIPType and InboundInternetScanInspected), explains the difference between ConnectionAttempt and InboundConnectionAccepted ActionTypes, and stresses correlating with DeviceLogonEvents before concluding an alert is a false positive.

dfir.chwriteupAdded 3 Sep 2026, published 22 Jan 2025🛡️ Security

Explains a subtle Linux privilege-dropping bug: calling setuid() before setgid() in a SUID/SGID-root binary leaves the saved set-group-ID privileged, letting a later setgid(0) call silently regain root group privileges due to POSIX semantics. The author provides compiled C PoC programs (drop_bad.c / drop_good.c) showing the wrong order failing to fully drop privileges versus the correct order (setgid then setuid) properly relinquishing them, and notes this becomes exploitable for privilege escalation when combined with a code-execution bug later in the program.

bencteux.frwriteupAdded 3 Sep 2026, published 1 Oct 2024🛡️ Security

A DFIR practitioner deploys four PHP webshells (popen-based, proc_open-based, p0wny-shell, and Weevely) on a test web server, then tests whether common webshell YARA rulesets (nsacyber, Florian Roth's Thor rules) can detect them via Velociraptor hunts. The rules only catch p0wny-shell due to its many code-execution keywords, missing the simpler popen/proc_open shells and Weevely entirely, exposing brittleness in signature-based webshell detection. The author proposes a semi-automatic approach combining Velociraptor/DetectRaptor with manual review, web-log frequency analysis, and UAC-generated bodyfile/mactime timelines to hunt webshells more reliably.

dfir.chwriteupAdded 3 Sep 2026, published 17 Jun 2024🛡️ Security

dfir.ch documents an incident response investigation where an NDR sensor flagged a suspicious internal port scan. The analyst used EDR telemetry to identify the responsible PowerShell script (hash-verified, Microsoft-signed) invoking Defender for Endpoint's Device Discovery feature (Scan-UdpTcpPorts, Scan-Vnc, Scan-WinRm, etc.), decoding its base64 ScannerArgs to reveal target IPs, MACs, and the CVEs it probes for (CVE-2021-44228, CVE-2022-22965). The scan turned out to be benign legitimate network discovery from Defender for Endpoint, explaining why it triggered an NDR false positive.

dfir.chwriteupAdded 3 Sep 2026, published 27 Apr 2024🛡️ Security

The author dissects PHP's open_basedir directive by reading php-src's php_check_open_basedir enforcement code, and finds two functions — bindtextdomain() and opcache_invalidate() — that fail to call the guard, allowing an attacker to use them as file-existence oracles outside the restricted directory tree (tested on PHP 8.0.7, reported to maintainers 2021-07-12). It also documents PHP maintainers' longstanding position that "open_basedir bypasses are no security issues," and notes the PHP manual was subsequently updated to caution that open_basedir is only an extra safety net and must not be relied upon for security.

bencteux.frwriteupAdded 3 Sep 2026, published 19 Dec 2021🛡️ Security