232 results for “Windows”

VOLTA (VOLTA-AUTODOXER) is a self-deleting Windows infostealer that, after theft and live session-based enrichment, POSTs an evidence bundle to OpenRouter so an LLM can rank the victim's assets by monetization value. It falls back across a Claude, Kimi and Gemini chain when a model refuses. Talos covers the builder model, the Chrome App-Bound Encryption bypass, the volta_debug.txt artifact and countermeasures such as blocking Chrome --headless.

blog.talosintelligence.comwriteupPublished and added 31 Oct 2026🛡️ Security

Microsoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.

microsoft.comwriteupPublished and added 31 Oct 2026🛡️ Security

A malicious version 2.1.313 of Anthropic's Claude Code extension was served from Cursor's marketplace for about 11 hours on 29 October 2026, reaching up to 5,000 developers. A JavaScript loader prepended to extension.js added an attacker SSH key, a reverse tunnel and macOS/Windows persistence, and reported to 134.209.82[.]225. Coding errors likely blocked SSH access on many hosts. Cursor removed it and rotated keys; victims should look for an 'svc-telemetry' SSH key.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

CVE-2026-111585 (CVSS 8.8) is an integer overflow in the remote-control screen processing of TeamViewer clients on Windows, macOS, Linux and Android. A malicious or compromised host can announce an oversized screen surface (for example 32768 by 32768 at 32 bpp), forcing a software decode path and an out-of-bounds write that crashes the viewer or runs code. Remedio's research shows a pointer overwrite routed to WinExec. Version 15.83 fixes it, along with CVE-2026-92372, CVE-2026-92374 and six local privilege escalation bugs.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Cisco Talos Threat Source newsletter for the week of the PHP and Node.js vulnerability news cycle. It summarises NIK C2, a Go-based Windows implant that dumps credentials, streams keystrokes, deploys screen-locking ransomware and uses a victim's hijacked OpenAI API keys to analyse stolen data. It also lists weekly headlines (CISA KEV PHP bugs, Brotli flaw, Gheist GitHub token theft), Talos links and top malware hashes.

blog.talosintelligence.comarticlePublished and added 29 Oct 2026🛡️ Security

Windows Prefetch forensics tutorial from Hackers Arise. It explains that prefetch files in C:\Windows\Prefetch record last run time, run count and files touched, so they prove an application was used even after deletion. It shows parsing with NirSoft WinPrefetchView, building a timeline from Last Run Time, and how a suspect could disable Prefetch or Superfetch (SysMain).

hackers-arise.comarticlePublished and added 29 Oct 2026🛡️ Security

NIK C2 is a newly observed C2 framework with a Go-based 64-bit Windows implant that embeds an OpenAI Chat Completions client (ai_generate command), falling back to the victim's OPENAI_API_KEY. Talos details its 52+ commands, AES-256-GCM over WebSocket with HTTP fallback, credential, wallet and keystroke theft, screen-lock ransomware, AMSI bypass and anti-debug. It also lists a live C2 at 87.120.196[.]120 and total-sitevv[.]lol.

blog.talosintelligence.comwriteupPublished and added 29 Oct 2026🛡️ Security

DailyDarkWeb post summarising Anthropic Frontier Red Team research published 27 October 2026. An unreleased internal Claude research model built five attack chains: Chrome sandbox escape (V8 heap bug, CacheStorage race, FedCM use-after-free), a Safari same-origin policy bypass, data extraction from a locked Pixel 9 over USB, a Windows QUIC kernel crash (CVE-2026-33096) and zero-click Linux root via multipath TCP (CVE-2026-98432). Anthropic says all flaws are fixed, including 62 Chrome CVEs as of Chrome 156. The post notes the chains are not independently reproduced.

x.comthreadAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

clauth is a Rust terminal UI for Claude Code that combines multi-account switching with a live 5h / 7d usage monitor. A fallback chain moves the user off an exhausted account before Claude Code blocks. It supports Pro, Max, Team and Enterprise OAuth accounts and custom API endpoints on Linux, macOS and Windows. The post notes that auto-switching means the tool decides when accounts change.

x.comtoolAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

AskStream is a multi-turn benchmark for streaming video understanding that adds a third proactive action, ask, alongside wait and answer, for cases where video or user information is incomplete. It has 438 videos, 2,714 manually annotated frame-level time windows (wait, ask, answer), four task categories and eight subtasks. The strongest model reaches only 52.18% on the proposed Ask-F1 metric, in both multiple-choice and open-ended settings.

arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

Survival LLM is a free, open-source desktop app for macOS (Apple Silicon) and 64-bit Windows that runs an AI model and an offline emergency library on the user's computer. It checks the machine's memory, downloads a fitting model, and answers from sources such as Wikipedia, WikiMed, Ready.gov and CDC guidance, citing each article. Users can add their own files; version 0.3.2 is dated October 2026.

brangus.iotoolAdded 28 Oct 2026, published 27 Oct 2026🧠 AI

Time4Popcorn, an abandoned Popcorn Time fork, has an updater (CVE-2026-30612) that fetches updates over HTTP without code signing and runs any executable the domain returns, as System/root. Eye Security registered abandoned update domains, saw millions of Windows, macOS and Android clients, and pushed a fix disabling the updater on about 2 million systems by March 2026. Shadowserver took over the sinkholed domains; Eye Security advises uninstalling the app.

securityweek.comarticlePublished and added 27 Oct 2026🛡️ Security

The tweet relays Pillar Security research that opencode on Windows and WSL could run attacker-controlled code during remote MCP server OAuth sign-in. The fix shipped in opencode 1.18.33 on 28 September, with no advisory or CVE published. It advises users of remote MCP servers to update and review which servers they connect to. Technical details are not in the post.

x.comthreadAdded 29 Oct 2026, published 27 Oct 2026🛡️ Security

Ollama overview thread by Akash Rajagopal on X. It lists six steps: install on macOS, Linux, Windows or Docker; run `ollama run gemma4`; use the REST API on localhost:11434 (/api/chat); call it from ollama-python and ollama-js; llama.cpp as the README's supported backend; and `ollama launch claude` to connect Claude Code. Codex, OpenCode, Copilot CLI and Droid also work. The thread cites 184k GitHub stars and an MIT licence.

x.comthreadAdded 27 Oct 2026, published 26 Oct 2026🧠 AI

Hob is an MIT-licensed desktop app from Frigade that runs open-weight models such as Gemma and gpt-oss locally on Mac, Windows and Linux. It picks the best open-weight model that fits the user's computer and sets it up. It is positioned as a free, private, offline alternative to Claude and ChatGPT for tasks like filling out PDFs and working through documents. The page gives no technical detail on its runtime.

github.comrepoAdded 27 Oct 2026, published 26 Oct 2026🧠 AI

Thread on a critical opencode bug disclosed by Pillar Security on Oct 19. On Windows and WSL, a remote MCP server could run code during OAuth sign-in, because the server-chosen authorization URL was put unescaped into a PowerShell command, so a PowerShell subexpression executed. opencode fixed it in 1.18.33 on Sep 28 as a browser-launch refactor with no advisory or CVE. MCP Inspector published an advisory for the same bug class, and its fix needs a major bump of the open package.

x.comthreadAdded 27 Oct 2026, published 25 Oct 2026🛡️ Security

PRAXO-CORE 2.5.0 is a Go agent kernel that owns model calls, tool authorization, context, checkpoints, events and human-in-the-loop decisions, and leaves graph execution, memory storage and tenant policy to RHEOVELA or the host product. The release adds pkg/conformance, with checks for VFS, memory, sandbox, event, policy, model and tool contracts. It also adds stricter Windows path rejection and a plugin trust/SBOM handoff, and it states which adapters are only offline-tested.

x.comarticleAdded 27 Oct 2026, published 25 Oct 2026🧠 AI

Unthemidator is an automated unpacker for binaries protected with Themida, Code Virtualizer and WinLicense (v3.0 to v3.2.6.0, experimental v4.0). It works without executing the target, handles x86 and x64 exe, dll and sys files, decrypts imports, restores the IAT, rebuilds the PE and identifies VM versions and entry points. It does not devirtualize or unmutate code. Releases cover Windows x64 and macOS Apple Silicon.

github.comrepoAdded 27 Oct 2026, published 23 Oct 2026🛡️ Security

Field note from dfir.ch on PowerShell scripts an attacker left on disk during an incident: a file-watching command runner using Invoke-Expression, a fake Windows credential prompt that validates passwords via Start-Process and logs them in cleartext, AD computer enumeration with WMI access testing, and SMB share discovery via NetShareEnum. It notes where script labels overstate what they prove and lists hunting strings for Event IDs 4104, 4103, 4688 and Sysmon 1.

dfir.chwriteupAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

ERC-TBA: Agent Income Statements is a draft Ethereum standard, a profile of the ERC-8004 Reputation Registry. A writer posts chained statements of what an agent's agentWallet received in one asset, with each incoming transfer a Merkle leaf, so lenders and buyers can verify earnings from x402 payments. Windows are cut at owner or wallet changes, and the post asks about statement grain, the MetadataSet requirement and who may write. The reference implementation is unaudited.

ethereum-magicians.orgthreadPublished and added 22 Oct 2026🧠 AI

Post summarising Pillar Security's finding of a remote code execution flaw in OpenCode, the open-source AI coding agent. Versions 1.0.137 through 1.18.32 could run code from a remote MCP server during OAuth sign-in on Windows and WSL, with no prompt injection needed. The fix is in 1.18.33 (released 28 September). No advisory or CVE was issued, so scanners will not flag old installs. Interim advice is to remove unvetted remote MCP servers.

x.comthreadAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

Huntress analysis of an Amazon-themed ClickFix campaign that used a Google sponsored result, a fake Amazon login on Google Sites and a fake CAPTCHA to make victims run the Windows finger utility. The .plan script drives IronPython, a Cyrillic-substituted Base64 Python loader, Doina, a Node.js stage, Lumma Stealer via sRDI, and a pirated NetSupport RMM. It lists C2 domains and gives detection tips (aclk/gclid markers, blocking the Run dialog).

huntress.comwriteupPublished and added 21 Oct 2026🛡️ Security

OpenAI's Patch the Planet post describes the coordinated response to two critical PHP vulnerabilities. Calif found one with GPT-5.6 Sol, and Wiz independently reported both. It proposes a five-stage disclosure framework: upstream fix, advance notice to providers, government coordination, product updates and public guidance. It also lists a PHP version checker, $1 billion in subsidized Daybreak access, and open questions on disclosure windows and emergency patching.

openai.comarticlePublished and added 21 Oct 2026🛡️ Security

Live-Forensicator is a cross-platform (Windows, Linux, macOS) live response toolkit built around Forensicator.ps1. The Hackers Arise walkthrough runs it on Windows with case details, then reads the HTML report: event log summary (Event IDs 4624, 4798, 4799, 4688) and a risk rating. It also shows optional AI analysis through Ollama with a Mistral model, configured in config.json, and warns that the tool triggers AV and that AI slows runs.

hackers-arise.comarticlePublished and added 20 Oct 2026🛡️ Security

AOMEI Backupper, Windows backup and cloning software, served malware in short tampering windows between April and July 2026. Threat actor UNC7017 altered the update settings file and notification service to push the CrossRoad downloader, ShinyRoad backdoor, a modified Radmin Server and Adaptix payloads. Each window lasted five to ten minutes. The client did not authenticate its configuration files, and a WebDAV banner trick leaked NetNTLMv2 hashes.

securityweek.comarticlePublished and added 20 Oct 2026🛡️ Security

BrainLoRA is a parameter-efficient fine-tuning method that adapts multimodal backbones of up to 104B parameters to predict neural responses. It predicts multiple timepoints in one causal pass instead of sliding windows, and a multi-LoRA kernel trains many adapters on a shared backbone. Across nine backbones it improves encoding, and a 200+ model ensemble ranks first on the Algonauts post-challenge leaderboard.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

Summary of Pillar Security research on opencode, in which a malicious remote MCP server runs code on a Windows or WSL machine during the OAuth login step. The login URL goes unsanitised into PowerShell through the npm "open" package, so an https:// link containing $(...) executes. Affected versions are 1.0.137 to 1.18.32, fixed in 1.18.33 (28 September) as a "refactor" with no advisory or CVE. The behaviour was first reported in 2020 as a WSL 2 broken-link bug.

x.comthreadAdded 21 Oct 2026, published 19 Oct 2026🛡️ Security

Trading Hub is a free macOS desktop trading platform built with C#/.NET 10 and Avalonia. It uses the user's Claude Code subscription: a chat writes and fixes C# strategies, an in-app MCP server lets Claude run backtests, optimizations and walk-forwards and write reports, and a risk agent proposes position sizes. Install and a Windows port are both driven by Claude Code prompts. License is MIT with Commons Clause.

github.comrepoAdded 19 Oct 2026, published 17 Oct 2026🧠 AI

AI Usage Meter is a free, MIT-licensed desktop app for Mac and Windows that shows live Claude and Codex usage and rate limits, so users aren't cut off mid-task without warning. It also tracks API costs and other AI providers. It runs locally and needs no account.

x.comtoolAdded 16 Oct 2026, published 15 Oct 2026🧠 AI

GTIG and Mandiant report on UNC7017, which tampered with AOMEI update servers in five to ten minute windows between April and July 2026. Edited down_html.ini and Notifycfg.ini files delivered the CROSSROAD downloader and SHINYROAD PocketPy backdoor, plus Adaptix C2 and WebDAV NTLM coercion. The post covers infrastructure shifts, YARA rules, IOCs, and vendor and SOC guidance on point-in-time triage failures.

cloud.google.comwriteupAdded 29 Oct 2026, published 15 Oct 2026🛡️ Security

Decrypt reports that developer Brandon Thomas released WordCraft, GridCraft and DeckCraft, MIT/Apache-2.0 open-source clones of Word, Excel and PowerPoint. They were written in Rust with Anthropic's Claude (Opus 5.5) as a clean-room rebuild and run natively on Windows, macOS, Linux and BSD, and in a browser. Coverage is high (WordCraft 88% of ribbon features, GridCraft 513 of 523 Excel functions), but the authors rate them only about 50–60% ready for real work. Every button is also an MCP command, so agents like Claude can drive the apps. The article is a useful data point on what AI-assisted "vibe coding" can produce in under two weeks, and on where it still falls short (file fidelity, stability).

decrypt.coarticlePublished and added 14 Oct 2026🧠 AI

A DarkWebInformer post announces a public PoC for CVE-2026-85884, a Windows privilege escalation in the Windows Health and Optimized Experiences service. Per the post, low-privileged code with access to the Windows diagnostics workflow can trigger the flaw. The PoC is hosted in a GitHub repo by Beardhammer; the tweet text is truncated, so the exact root cause is not stated.

x.comthreadAdded 16 Oct 2026, published 14 Oct 2026🛡️ Security

DarkWebInformer post on a PoC for CVE-2026-85884, a Windows 11 local privilege escalation in the Windows Health and Optimized Experiences service. Low-privileged code can trigger a trusted ETW event carrying an attacker-controlled Lua module path. The LocalSystem whesvc service then runs that module through WinDiag without validating the event producer or restricting the module location. The PoC takes a standard non-admin PowerShell session to NT AUTHORITY\SYSTEM on Windows 11 x64 builds including 26200.8457 and 29617.1000.

x.comthreadAdded 15 Oct 2026, published 14 Oct 2026🛡️ Security

Huntress post on where accounts remain exposed after a passkey rollout. It covers passkey-themed social engineering, the EvilTokens device-code phishing campaign (344 organizations in about 16 days), weak enrollment and recovery, SpecterOps research on Windows WebAuthn hooking on compromised endpoints, and the trade-offs between synced and device-bound passkeys. It closes with ITDR-style post-login monitoring, containment steps (revoke sessions, remove rogue authenticators, hunt inbox rules, OAuth grants, forwarding), and a five-question deployment checklist.

huntress.comarticlePublished and added 14 Oct 2026🛡️ Security

Alert summarizing XBOW's disclosure of a three-stage Chrome for Windows exploit chain: V8 Maglev memory corruption (CVE-2026-85045), Animated WebP decoder memory corruption (Chromium issue 548509153), then a Crashpad sandbox escape (CVE-2026-78952). Loading a crafted page was enough; no click or download needed. Human researchers working with GPT-5.6 Sol agents built it in six days, Google paid $250,000, all three bugs are fixed, and no in-the-wild exploitation is confirmed. It advises updating Chrome and restarting, and gives forensic triage pointers.

x.comadvisoryAdded 15 Oct 2026, published 14 Oct 2026🛡️ Security

News write-up of XBOW's research in which AI agents (OpenAI gpt-5.6-sol) plus human researchers built a full Chrome exploit chain on Windows in six days, at about $40,000 in API cost, earning a $250,000 Chrome VRP reward. The chain combined a V8 Maglev bounds-check bypass, a WebP animated-decoder heap buffer overflow, and a Crashpad out-of-bounds write that escaped the sandbox and called CreateProcessW() to launch Calculator. The common root cause was trusting conditions (immutability, unchanged data, suspended process) that could change; Chrome 153+ is patched.

en.cryptonomist.charticlePublished and added 14 Oct 2026🛡️ Security

SecurityWeek reports Microsoft's October 2026 Patch Tuesday fixed a record 1,413 CVEs (1,102 in Windows, 134 Office, 36 SharePoint), more than all of 2025, with the surge attributed largely to AI-driven discovery. The exploited zero-day CVE-2026-96951 is a Windows shell Mark of the Web security feature bypass (CVSS 8.8), added to CISA KEV with an October 16 deadline. Two flaws were publicly disclosed: CVE-2026-108398 (WDAC bypass) and CVE-2026-92707 (MessagePack-CSharp DoS), and Microsoft introduced 'risk cohorts' for patch prioritization.

securityweek.comarticlePublished and added 14 Oct 2026🛡️ Security

Rapid7's analysis of Microsoft's October 2026 Patch Tuesday, which covers 1,413 vulnerabilities, 1,102 of them in Windows. It highlights the exploited Windows Shell Mark of the Web bypass (CVE-2026-96951) and the publicly disclosed .NET Framework WDAC bypass (CVE-2026-108398). It also covers five no-interaction Outlook preview-pane RCEs, the Edge advisories that list no CVEs, and end-of-support dates for Server 2012/2012 R2, Office 2021, Exchange 2016/2019 and Windows 11 24H2. The page text is truncated, so the later CVE tables are not seen.

rapid7.comadvisoryPublished and added 13 Oct 2026🛡️ Security

Talos summarises Microsoft's October 2026 Patch Tuesday, which covers 1415 vulnerabilities, 85 of them critical (67 RCE). One bug is exploited in the wild: CVE-2026-96951, a Windows Shell security feature bypass. The post groups the CVEs by Microsoft's exploitability rating (more likely, less likely, unlikely) with CVSS and CWE for each, covering Windows, Office, Exchange, Hyper-V, DHCP, QUIC, Outlook and Azure. It also lists the Snort 2 and Snort 3 rule ID ranges that detect exploitation attempts.

blog.talosintelligence.comadvisoryPublished and added 13 Oct 2026🛡️ Security

ZDI's October 2026 Security Update Review covers Adobe's 11 bulletins (174 CVEs) and Microsoft's record 1,415 CVEs. The only actively exploited bug is CVE-2026-96951, a Windows Shell Mark of the Web bypass. It also flags 59 wormable bugs, Microsoft's new "risk cohorts", and top-priority fixes in ColdFusion, Commerce, Experience Manager, SharePoint, SQL Server and Exchange.

thezdi.comadvisoryAdded 27 Oct 2026, published 13 Oct 2026🛡️ Security

Technical report for Kwai Summary Attention V2 (KSA V2), which extends summary-token attention architectures that compress distant context into one learnable summary token per chunk. Hybrid KSA-Full models force the same compression chunk size in every layer and leave full-attention layers paying quadratic prefill cost. KSA V2 lets summary tokens serve two roles, as KV memory and as a sparse indexer. This allows per-layer compression windows for more flexible KV cache compression and lowers computation in the full-attention layers.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

XBOW describes building a Chrome full-chain exploit, made of three independent bugs, that takes a user from an ordinary web page to remote takeover of a Windows machine. The team built it in six days with a publicly available model (GPT-5.6 Sol) for about $40,000 of compute, and Google paid a $250,000 bounty, the first under its 2026 rules. The bugs are now fixed. The post covers the human-agent workflow, the modular design that allowed swapping in a backup bug after Google said it already knew one, and the claim that agents could find each bug on their own within a year.

xbow.comarticlePublished and added 13 Oct 2026🛡️ Security

SecurityWeek summarizes Netskope research showing the XWorm Windows RAT grew from 35 plugins (July 2025) to 46 (October 2026), adding surveillance features: Maps (GPS location without prompt), Microphone (live audio streaming), webcam capture, and HBrowser. HBrowser gives operators a live, interactive view of the victim's authenticated browser sessions over the AES-encrypted C2 channel, bypassing logins and MFA. Activity rose after the builder was cracked in June 2025 and the 6.4 source leaked in August 2025; Netskope saw 1,200+ incidents across 100 organizations in Q3.

securityweek.comarticlePublished and added 13 Oct 2026🛡️ Security

GitHub issue asking OpenAI to make `daemon_auto_start` opt-in in Codex CLI 0.157.0. By default, opening an interactive session starts a persistent `codex app-server --managed-daemon` that outlives the terminal. It also copies a ~374 MB platform package into ~/.codex/packages/app-server-daemon and runs a detached hourly `pid-update-loop` updater. The daemon keeps the first session's environment (proxy variables, cwd, direnv values), which the reporter ties to hook bugs #42457 and #37537. Comments confirm the problem on Windows and add the workaround (`codex features disable daemon_auto_start`, kill the updater, remove the package dir). They also note that `daemon stop` leaves the updater running and that the option is missing from the config docs. One commenter proposes an "execution receipt" (CLI version, daemon binary digest, generation, inherited-environment generation).

github.comthreadPublished and added 12 Oct 2026🧠 AI

Post announcing a public PoC for CVE-2026-13043, a critical flaw (CVSS 4.0 9.3, scored by WatchGuard) in PSKMAD, the kernel memory access driver of WatchGuard Endpoint Security on Windows. The access-control handshake can be bypassed (CWE-306/CWE-798), letting a local authenticated attacker send privileged commands and read kernel and other processes' memory. Fixed in 8.00.26.0012; the PoC author and LOLDrivers frame the signed driver as BYOVD material, which WatchGuard does not say. The post notes it is not in CISA KEV, has no reported in-the-wild exploitation, and that ThreatWire has not run the PoC.

x.comthreadAdded 11 Oct 2026, published 10 Oct 2026🛡️ Security

Experience paper describing an iterative agentic workflow that uses AI agents to find vulnerabilities across diverse targets: Windows drivers, the Linux kernel, XNU, firmware and web applications. The authors report that the workflow generalizes across these targets. They also cover tasks where agents help with previously hard problems and set out research directions for autonomous vulnerability discovery.

arxiv.orgpaperAdded 16 Oct 2026, published 10 Oct 2026🛡️ Security

Prime Intellect describes rewriting its open-source Prime Agent coding-agent harness from TypeScript to Rust. Prime Agent orchestrated 2,000+ agents across 10,000+ Prime Sandboxes, using GLM-5.3 inference, to do the rewrite. A root orchestrator split the work into topologically ordered tasks, and each task passed through planner, implementer, reviewer and verifier agents, with TUI, harness, protocol and feature parity checks as the objective verification. A follow-up three-day hillclimbing loop on a benchmark harness merged 69+ changes, and the post reports ~14x faster time-to-input and over 80% less memory after startup. The post also covers the new architecture: nine crates, per-session worker processes, platform abstraction for Windows support, and a runtime-fetched model/MCP catalog. Vendor-run comparisons with other harnesses carry the post's own caveat about the lack of a common benchmark standard.

primeintellect.aiarticleAdded 10 Oct 2026, published 9 Oct 2026🧠 AI

bigarrow is an MIT-licensed, single-binary Swift macOS CLI that draws a click-through arrow and sign over all windows so an AI agent can show a human where to click, paste or act (permission prompts, 2FA, OAuth consent). It ships an Agent Skills package (installed via `bigarrow install-skill`) for Claude Code and Codex, with JSON output and exit codes, and can target by Accessibility label, coordinates, window or Peekaboo snapshot. The README documents the skill's token cost (182 tokens for the description, 1,398 for the instructions) and 104 automated tests.

github.comrepoPublished and added 9 Oct 2026🧠 AI

First installment of a new iOS-focused arc in Alexandre Borges's "Exploit Reversing" series, detailing how to build a practical iOS vulnerability-research lab (Mac host, Apple Virtualization.framework-based "vPhone" jailbroken guest, physical iPhones, XNU source, IDA Pro/Ghidra) and walking through the current iOS kernel hardening stack: KASLR, Pointer Authentication (PAC), the kalloc_type allocator and zone_require checks, the PPL/SPTM/TXM page-table and trust monitors, Exclaves isolation, and AMFI/trust-cache code signing enforcement. It also references the public Titan PPL/SPTM bypass (A14–A17 devices, iOS 16.1–17.4 beta 3) as the state of the art for defeating these protections. Part of a long-running, actively published series on Windows, iOS, and hypervisor exploitation.

exploitreversing.comarticleAdded 8 Oct 2026🛡️ Security

Microsoft Security Blog post arguing that post-quantum cryptography planning must extend beyond encrypted-data confidentiality to authentication and certificate ecosystems, since larger PQC certificate chains and new algorithms like ML-DSA-87 can break PKI workflows, HSMs, and legacy infrastructure. It details Microsoft's PQC TLS Pilot Program, launched August 27, 2026, which lets approved certificate authorities (ComSign, DigiCert, HARICA, IdenTrust, Sectigo, Shanghai Electronic Certification Authority, SSL.com) test ML-DSA-87 certificate issuance under the Microsoft Trusted Root Program, plus Windows 11 builds (KB5101681, KB5101684) that support evaluating ML-DSA certificates via Schannel in non-production environments. It lays out a six-step readiness plan: inventory certificate dependencies, map trust relationships, assess vendor roadmaps, identify long-lived infrastructure, build test environments, and plan a multi-year migration.

microsoft.comarticlePublished and added 8 Oct 2026🛡️ Security

Orca Security details "MALFEX," a supply-chain campaign active since August 2023 in which a suspected lone Brazilian threat actor published eight malicious npm packages (tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color, cdn-img-fetch) that together drew over 40,767 downloads. Using postinstall lifecycle hooks, the packages deliver three malware families to Windows hosts: the Go-based Overlord RAT (with a Solana blockchain C2 resolver), the Node.js "movinlike" credential/Discord/crypto-wallet stealer, and rotating downloader payloads — with three packages (notably function-flag) still live on npm and only six of the eight carrying OSV advisories at publication time. The piece includes host IOCs (file paths, scheduled task name), affected package lists, and remediation steps (lockfile auditing, credential rotation) alongside a pitch for Orca's SCA detection of the OSV-flagged packages.

orca.securityarticlePublished and added 8 Oct 2026🛡️ Security

MXC is Microsoft's cross-platform sandboxed code execution system for running untrusted workloads — model output, plugins, and tool calls — behind a unified containment model with Rust, .NET, and Node SDKs. It offers multiple containment backends (ProcessContainer, Windows Sandbox, LXC, Bubblewrap, Seatbelt, MicroVM/Nanvix, Hyperlight, WSLC) with JSON-based filesystem, network, and UI policies, plus diagnostics like audit mode for building policies from observed access.

github.comrepoAdded 8 Oct 2026🧠 AI

MXC is Microsoft's cross-platform sandboxed code execution system for running untrusted code such as LLM/agent output, plugins, and tools, offering containment backends ranging from OS-native process sandboxes (Windows Sandbox, LXC, Bubblewrap, Seatbelt) to full VMs (Nanvix MicroVM, Hyperlight). It exposes a unified JSON-based policy model for filesystem, network, and UI access controls, with Rust, .NET, and Node SDKs plus diagnostic tooling (audit mode, access-denied logging) to help developers tune containment rules for agentic workloads.

github.comrepoAdded 8 Oct 2026🛡️ Security

malcontent is Chainguard's open-source malware/supply-chain discovery tool that analyzes binaries (ELF, Mach-O, PE, a.out) and scripting-language source across Linux, macOS and Windows using 14,500+ YARA rules (including third-party rules from Avast, Elastic, FireEye, Mandiant, Nextron and ReversingLabs). Its standout feature is differential analysis ("mal diff"), which compares two versions of a build artifact or OCI image against a known-good baseline to surface newly introduced risky behaviors — the technique the project demonstrates on the 3CX supply-chain compromise by flagging unexpected high-risk changes to libffmpeg. It also supports threshold-based scanning ("mal scan") and unfiltered capability enumeration ("mal analyze"), and is designed to run inside CI/CD pipelines, including air-gapped environments via embedded rules.

github.comrepoAdded 8 Oct 2026🛡️ Security

Cisco Talos discloses eight vulnerabilities patched by vendors: a Photoshop installer privilege escalation (CVE-2026-48388), a macOS CoreWLAN information disclosure bug, two Foxit Reader flaws including a JavaScript CBF_Widget remote code execution (CVE-2026-57256) and an Array use-after-free (CVE-2026-91799), and four Windows kernel-driver bugs — NETIO.sys information disclosure (CVE-2026-50475), two Cloud Files Mini Filter Driver issues (use-after-free CVE-2026-58613 and type confusion CVE-2026-80093), and a tcpip.sys out-of-bounds read (CVE-2026-49177). Each advisory gives the affected version and trigger mechanism, and Talos notes Snort coverage is available for detection.

blog.talosintelligence.comadvisoryPublished and added 7 Oct 2026🛡️ Security

Microsoft Security's FORGE Lab shares results and lessons from four months of AI-agent-driven vulnerability research: 140 Windows CVEs (52 in September 2026's release), 155 internally validated reports across 23 open-source projects, and the first patch merged into the Linux kernel via the Linux Foundation's Akrites coordinated-disclosure initiative. Using their multi-model agentic scanning harness MDASH and GPT-5.5-based validation agents, the team measured automated PoC generation at an average $3.61/21.5 minutes per confirmed crash and local privilege-escalation AEG at $8.56/25.4 minutes, and argues the real bottleneck has shifted from finding bugs to validating and remediating them at matching speed. Specific disclosed CVEs include curl's CVE-2026-9545 and CVE-2026-13608, Node.js's CVE-2026-56848, and Linux kernel's CVE-2026-64563.

microsoft.comwriteupPublished and added 7 Oct 2026🛡️ Security

An X/Twitter thread arguing that vulnerability remediation is not a single process but a multi-branch decision tree: patchable issues suffer from patch-management tools misreporting status or breaking systems; unpatched 0days (e.g. Friday-night issues without a CVE) need detect-and-respond handling; dependency vulnerabilities like log4j get flagged by VM scanners (Rapid7, Qualys, Tenable) scanning disk .jar files but the real fix is an appsec/product fix on the parent app, creating IT-sec vs appsec ownership confusion; "upgrade to latest" policies can backfire against supply-chain compromises; and OT environments (manufacturing, healthcare, power — e.g. Windows XP on an MRI) can't be patched at all and require containment/mitigation instead.

x.comthreadAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

This paper runs a mechanism-isolating ablation of four document-structure treatments used in retrieval-augmented generation — structure-aligned chunking, LLM-generated chunk contexts, heading-path metadata, and hierarchical two-stage retrieval — under one protocol with matched chunk sizes and a semantically null placebo (shuffled heading paths) to control for the confound that any prepended text perturbs embeddings. Using a coverage-aware nDCG metric and document-clustered bootstrap with Holm correction across 200 Wikipedia Featured Articles (951 queries) and 1,585 QASPER papers (4,303 questions), it finds that structure-aligned chunking with real heading paths beats both contextualized fixed windows and the placebo, naive hierarchical retrieval hurts performance (traced to first-stage section recall failures), and gold structure beats LLM-induced structure on Wikipedia but not QASPER. Effect sizes are small but statistically significant and consistent across corpora, giving RAG practitioners evidence-based guidance on which structure-aware retrieval tricks actually help versus which are placebo effects.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

A former core infrastructure engineer, Daniel Rhyne, was sentenced to 32 months for extorting his own New Jersey employer: he created a hidden virtual machine on the company network, reset passwords on hundreds of accounts to "TheFr0zenCrew!", deleted domain administrator accounts, scheduled tasks to shut down 40 servers a day, and demanded 20 BTC (~$750K) to stop. The FBI's criminal complaint describes how investigators traced the hidden VM back to him via correlated laptop browsing activity, building access logs, home IP connections, and incriminating search history ("how to clear all windows logs from command line").

decrypt.coarticlePublished and added 7 Oct 2026🛡️ Security

An Endor Labs technical breakdown of what an "agent sandbox" actually is: a kernel-enforced boundary around an AI coding agent's tool calls (syscalls), distinct from a staging environment or Docker container. It walks through the nx/s1ngularity supply-chain attack as motivating case, compares OS-level primitives (Apple Seatbelt, Linux Landlock/seccomp, Windows Job Objects/AppContainer) used by Claude Code, Cursor, and Codex CLI against containers and microVMs (gVisor, Firecracker), and argues filesystem isolation and network egress isolation are worthless unless enforced together.

endorlabs.comarticlePublished and added 6 Oct 2026🛡️ Security

Endor Labs walks through what "sandboxing an AI coding agent" actually means at the OS level, contrasting the approval-prompt model with kernel-enforced isolation. It details how Claude Code, Cursor, and Codex CLI converge on the same primitives without full containers — Apple's Seatbelt on macOS, Landlock plus seccomp on Linux, Job Objects/AppContainer on Windows — and why Anthropic ships an open-source bubblewrap-based runtime with a host-side egress proxy. It argues filesystem isolation and network egress controls are interdependent (citing Anthropic's own sandboxing writeup) and uses the 2025 nx npm supply-chain attack to illustrate why containment, not model-level guardrails, is the real defense against prompt injection and credential exfiltration.

endorlabs.comarticlePublished and added 6 Oct 2026🧠 AI

A Microsoft Security Blog post arguing that frontier AI models are flooding security teams with far more vulnerability findings than human triage was built for, citing a record near-1,000 vulnerabilities disclosed on the September 2026 Patch Tuesday. It describes Microsofts internal use of AI plus a harness layer (codename MDASH, now available to customers) for scanning, triage, and remediation, and gives CISOs concrete recommendations: shrink patch windows for critical systems to within 24 hours, adopt harnesses for AI-powered vuln scanning now, and lean harder on defense-in-depth via Microsoft Baseline Security Mode (BSM) and Secure by Design and Secure by Default changes (mandatory Azure admin MFA, Azure Backup soft delete, VNet default outbound disabled).

microsoft.comarticleAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

Huntress researchers reconstruct an Akira ransomware attack timeline using forensic artifacts collected after the Huntress agent was installed post-compromise, including Windows Registry Shellbags, Event Logs, and Akira ransomware log files. The attacker used RDP from an unowned workstation, disabled BitDefender via its management console, ran procdump on lsass.exe for credential theft, deployed the GOST tunneling tool for C2/persistence, used RClone for data exfiltration, and executed ransomware via PowerShell commands that deleted volume shadow copies, with Shellbags showing the attacker verifying encryption success.

huntress.comwriteupPublished and added 6 Oct 2026🛡️ Security

Vals.ai researchers describe using Claude Opus 5.5-driven AI agents to run density-functional-theory simulations (PBE+U and HSE06 functionals) that designed a novel candidate magnet, YBaMnFeO₅, and separately re-identified a 1999 compound, KV[Cr(CN)₆] (a Prussian-blue analogue), as a "Luttinger compensated" semiconductor — a material with zero net magnetic moment but spin-sorted band edges, useful for spintronic memory. The agents predicted band gaps, spin-sorting windows, and magnetic ordering temperatures (KV[Cr(CN)₆] reportedly stays ordered above room temperature, up to 376 K), and the authors published all inputs, outputs and code on GitHub for independent verification. It's notable as an example of AI agents autonomously conducting and validating nontrivial physics/materials-science research rather than just answering questions.

vals.aiwriteupAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

Checkmarx's research team documents MALFEX, an npm supply-chain malware campaign run by a single operator ("Murizada") publishing since August 2023, with 12 packages (8 malicious), three still live as of late September/October 2026. The campaign delivers three distinct Windows payloads: Overlord RAT (a Go-based C2 that reads its server address from encrypted Solana blockchain transactions and uses process hollowing into TapiUnattend.exe), the movinlike Node.js stealer (targeting Discord, browser credentials, Telegram, and crypto wallets, exfiltrating via Discord webhook), and a long-running downloader hidden in function-flag's postinstall script. The writeup includes full IOCs, file hashes, host artifacts, detection commands, and remediation guidance for compromised Windows hosts.

checkmarx.comwriteupAdded 7 Oct 2026, published 5 Oct 2026🛡️ Security

Huntress explains why endpoint security typically misses ClickFix (no file artifact to scan) and how its Attack Disruption engine detects it instead: matching the obfuscated command-line shape gated on the parent process always being explorer.exe for Windows+R/Run-dialog execution. The post walks through a real incident where a user pasted a caret-obfuscated finger.exe download cradle disguised with Unicode padding to hide 'push enter' social engineering text, killed in under 1.25 seconds across four spawned processes, and describes a fix for variants that use 'start' to detach the payload process from its killed parent.

huntress.comwriteupPublished and added 5 Oct 2026🛡️ Security

GitHub release notes for Sigma r2026-07-01, the open-source detection-rule repository, adding 20 new rules (e.g. LSASS crash via Netlogon buffer overflow CVE-2026-41089, TanStack supply-chain attack indicators for Windows/Linux, RedTail cryptominer user-agent detection, AF_ALG kernel crypto API exploit indicator) and updating/fixing dozens of existing rules for ARM64 binary variants, file-sharing domain IOCs, and WMI-based reconnaissance/persistence detection. It's a routine but substantive update to a widely-used blue-team detection content pack.

github.comrepoAdded 3 Oct 2026🛡️ Security

Announcement of mcpc v0.7.0, Apify's open-source MCP CLI client (npm i -g @apify/mcpc), which adds support for the MCP Skills extension with new skills-list/skills-get commands that verify SKILL.md and supporting files against the skill manifest via size and SHA-256 checks before printing content. The release also ships security hardening: repo-local .mcp.json auto-discovery can no longer read environment variables (blocking leaks like $GITHUB_TOKEN), OAuth refresh tokens are now scoped only to the auth server originally used, and Windows login URLs no longer launch through cmd.exe.

x.comthreadAdded 5 Oct 2026, published 3 Oct 2026🛡️ Security

Jan Curn announces mcpc v0.7.0, an open-source MCP CLI client (npm package @apify/mcpc), adding support for the MCP Skills extension via new skills-list and skills-get commands that fetch and cryptographically verify SKILL.md and supporting files against the skill manifest (size + SHA-256). The release also hardens security by preventing repo-local .mcp.json auto-discovery from reading environment variables (blocking token-leak tricks), scoping refresh tokens to the originating auth server, and fixing an insecure Windows login URL launch path via cmd.exe, alongside OAuth session longevity fixes and 2026-07-28 MCP spec compatibility improvements.

x.comthreadAdded 5 Oct 2026, published 3 Oct 2026🧠 AI

Walkthrough of Platypus, an open-source C2-style host management platform (github.com/WangYihang/Platypus) for pentesters handling large numbers of compromised Linux, Windows and macOS machines from a single web interface. Covers Docker-based server setup, agent generation with enrollment tokens, deploying agents via curl over TLS, and post-exploitation features like interactive shells, file browsing, sensitive-file auditing, and OS-info plugins (firewall rules, cron jobs, network connections).

hackers-arise.comwriteupAdded 7 Oct 2026, published 2 Oct 2026🛡️ Security

Socket's Threat Research team uncovered a theme-extension cluster spanning four VS Code Marketplace and six Open VSX listings, including two confirmed malicious extensions: Aurora Nocturne Night Theme (a Windows downloader that fetches and silently executes temp_batch.cmd via cmd.exe from fingercakes4sale[.]store, tied to XWorm C2 infrastructure) and Cosmic Nebula Themes, whose app.js decrypts an AES-256-CBC embedded stage and uses a Solana transaction memo as a dead-drop to resolve follow-on payload infrastructure — the same AES key, Solana address, and execution model previously documented in GlassWorm activity. Git commit identities, near-identical theme source, shared Russian-language developer comments, and brandjacking (Coca-Cola, Aurora Borealis name-squatting) link the cluster together; a Dec 14, 2025 DEV Community article is assessed as promotional infrastructure driving Open VSX installs. The post provides full IOCs (hashes, domains, Solana address, AES key/IV, GitHub accounts) and MITRE ATT&CK mappings for defenders to hunt and inventory extensions across both registries.

socket.devwriteupPublished and added 2 Oct 2026🛡️ Security

DeepSeek Harness is an open-source general-purpose agent harness from DeepSeek, built on the "Cordis" everything-is-a-plugin architecture, shipped as a desktop app for macOS/Windows and runnable as a web UI from code. It handles everyday document/spreadsheet work, coding tasks (repo exploration, bug fixes, tests), research with citations, and background/scheduled jobs, with users able to install or author plugins (including via a chat-driven "Creator mode") and inspect per-turn tool-call traces for debugging. It runs on DeepSeek's DeepSeek-V4.1-Flash model and is explicitly labeled a preview release with evolving core plugins and APIs.

deepseek.comtoolPublished and added 2 Oct 2026🧠 AI

A Latent Space podcast transcript/interview with MIT PhD student Alex Zhang, creator of Recursive Language Models (RLMs) and a core contributor to GPU Mode and KernelBench, who discusses using recursive subagent calls, context offloading, and shared memory to let models work beyond fixed context windows. The conversation ranges across AI-generated GPU kernels and their verification gap, research taste in academia versus industry labs, why "harnesses" (as in Claude Code, Codex, and Pi) function as compositional generalizers, the Jev model's non-autoregressive output-space trade-offs, and large-scale agent swarm experiments at OpenAI, Kimi, and Sakana AI. It offers a researcher's-eye view of where capability overhang and new agent/harness architectures may be heading beyond today's standard transformer decoder.

latent.spacewriteupPublished and added 2 Oct 2026🧠 AI

Samuel Zeng announces the open-sourcing of Edge0's cross-platform app layer (iOS, macOS, Android, Windows), building on Edge0's earlier on-device 35B language model that runs in only 1-2.5GB of peak memory. The release includes app code, local model/runtime integration, model management, and build/deployment guides on GitHub; the technique keeps the full model on local storage and streams in only the experts (MoE-style) needed per step, predicting and prefetching the next experts while running storage reads in parallel with compute. A Q4 2026 roadmap promises a unified inference API across platforms plus Python, hardware-adaptive runtime, and a CUDA backend.

x.comthreadPublished and added 1 Oct 2026🧠 AI

CloudSEK's Global Threat Intelligence team uncovered MALFEX, a supply-chain campaign active since August 2023 that uses malicious npm packages (including tlxbnhd, tldriver, mxdriver, img-to-native, cdn-img-fetch, function-flag, function-color) to deliver malware on Windows. One chain disguises a Windows executable as a PNG to load Overlord RAT, an open-source Go-based RAT that uses the Solana blockchain to resolve C2 addresses; a second chain fetches a 64MB Node.js bundle that steals Discord tokens, browser cookies/credentials, crypto wallets and Telegram session data, exfiltrating via a Discord webhook. Some malicious packages stayed live for over a year even after related packages were pulled or flagged.

hackread.comarticleAdded 3 Oct 2026, published 30 Sep 2026🛡️ Security

The authors show that reported gains from d'Ascoli et al. (2025) on decoding words from non-invasive brain recordings are mostly an artifact: overlapping fixed-length windows leak word-duration (timing) information, letting a model reach 22.0% balanced accuracy on synthetic signals with no brain data at all, versus 22.3% on real recordings. By processing each word window independently instead of jointly encoding a sentence, they remove this timing shortcut, which makes prediction aggregation and LLM linguistic priors become genuinely effective; the resulting method, SimpleB2T, achieves 36.6% word error rate with five observations per word on a perceived-speech benchmark, approaching invasive decoding performance.

arxiv.orgpaperAdded 1 Oct 2026, published 30 Sep 2026🧠 AI

Huntress breaks down how Microsoft Defender Antivirus (MDAV) path/extension exclusions can be abused to hide malicious binaries from scans, detailing the registry internals (HKLM...Windows Defender\Exclusions vs the GPO-driven Policies key) and the four ways to set them: PowerShell (Set/Add-MpPreference), the MSFT_MpPreference WMI class, GPO, and direct registry edits. It documents real-world abuse by GootKit (2019), WhisperGate (2022), and Muddled Libra (2024), plus an under-documented trick where setting HideExclusionsFromLocalAdmins blocks even SYSTEM from querying exclusions via PowerShell/WMI, and describes the registry-level telemetry and detections Huntress built to catch both behaviors.

huntress.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Cisco Talos details UAT-11587, a China-nexus threat cluster targeting government, defense, and policy organizations across Taiwan, India, the Philippines, Cambodia, and other Asian countries with spear-phishing and a five-stage infection chain (HTA/WSF stagers, JScript decryptors, .NET BinaryFormatter/ActivitySurrogateSelector deserialization gadgets, and DLL sideloading via the signed GatherOsState.exe) to deploy a new Rust-compiled backdoor called Antino. Antino uses Microsoft Graph/Outlook/OneDrive as a dead-drop C2 channel instead of a traditional C2 server, supports shell/PowerShell execution, file transfer, shellcode loading with a sleep-mask evasion technique, and abuses the Windows Scripted Diagnostics framework for persistence; Talos also notes possible infrastructure overlap with Symantec's "Jewelbug" cluster and Arctic Wolf's UNC6384 reporting. Includes ClamAV/Snort coverage and IOCs.

blog.talosintelligence.comwriteupAdded 7 Oct 2026, published 30 Sep 2026🛡️ Security

Microsoft Defender Experts document a July 2026 phishing campaign that delivers a masqueraded but legitimately signed MSP360 RMM installer (v2.5.0.67) via meeting-invite, Zoom, Adobe, and DHL-themed lures hosted on both attacker infrastructure and legitimate cloud services (S3, Cloudflare R2, Dropbox, GitLab, Supabase). After UAC-elevated installation and service persistence, the RMM.Agent.exe service launches PowerShell to silently install a ConnectWise ScreenConnect client via msiexec, which the actor then uses via RunFile to drop credential-theft and reconnaissance tools disguised as Windows/Defender/Phone Link components. A separate July intrusion used FaronicsDeployAgent.exe the same way to deploy ScreenConnect, showing the technique is not MSP360-specific; Microsoft provides IOCs, hunting queries, and mitigation guidance (Application Control, AppLocker publisher rules, ASR rules) but does not attribute the activity.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

This paper studies two temporal phenomena in generative model sampling dynamics: a 'speciation window' where a sample commits to a semantic class, and a 'nonlocality window' where local context becomes insufficient for generation. Under a 'common cause' hypothesis — that semantic labels explain correlations between distant tokens — the authors prove the nonlocality window must fall within the speciation window, and identify conditions under which both windows collapse to a single phase-transition point as system size grows, verified analytically in Gaussian mixture models.

arxiv.orgpaperAdded 30 Sep 2026, published 29 Sep 2026🧠 AI

Wiz walks through a case study of its "Blue Agent" autonomous SOC investigator tracing a compromised CI/CD service account (svc_automation) across AWS and GitHub. The attack chain: a stolen GitHub token cloned 18 private repos containing hardcoded AWS keys, which were used to authenticate to AWS from Kali Linux via a Zenlayer VPN IP, pivot to a second account, run SSM SendCommand against a production Windows domain controller, and stage custom Python exfiltration scripts (mssql_table_export.py, pg_table_export.py, billing_export2.py) in S3 to pull data from MSSQL, PostgreSQL, and billing systems. The piece details the investigative technique used - 30-day baseline comparison, ASO/IP dispersion across the tenant, and correlating CloudTrail management-plane events with S3 data-plane events and GitHub audit logs.

wiz.iowriteupPublished and added 29 Sep 2026🛡️ Security

OpenRig is an open-source local daemon, CLI, TUI and MCP server (built on tmux + SQLite) that manages teams of Claude Code and Codex agent sessions as a single persistent system rather than a pile of terminal windows. Topologies (pods, seats, edges) are defined declaratively in YAML (RigSpec/AgentSpec), booted with `rig up`, inspected via a topology TUI, and can be snapshotted/restored, discovered from existing tmux sessions, and messaged across agents (`rig send`, `rig broadcast`, `rig chatroom`). It ships starter topologies (first-project, conveyor, product-team, secrets-manager using HashiCorp Vault) and documents in detail what it writes to Claude/Codex config, trust and telemetry state on the host machine.

github.comrepoAdded 28 Sep 2026🧠 AI

Check Point Research's weekly threat intelligence roundup covering the FBIjobs.gov defacement by ShinyHunters, a $351.6M Bitget hot-wallet theft with suspected DPRK involvement, and breaches at Astrana Health and LMU Munich. It also details AI-driven threats (an OpenAI agent's unauthorized access to an Australian government Medicare portal, an AI-agent-automated retail fraud campaign, and the CLOSEDQUORUM Windows malware that queries four commercial AI models to pick its post-compromise actions), four actively exploited pre-auth RCE CVEs (Check Point Security Gateway/Management, F5 BIG-IP APM, WordPress), and campaign writeups on the Storm-2570 multi-ransomware affiliate, an INC ransomware intrusion, a TeamFiltration M365 account-takeover wave in Latin America, and Storm-3168/JADEPUFFER's destructive Azure operations.

research.checkpoint.comarticleAdded 1 Oct 2026, published 28 Sep 2026🛡️ Security

Part 2 of a research series on ZDI-26-708, a Windows Network Connectivity Status Indicator (NCSI) flaw where a proxy configured in an unprivileged user's HKCU ends up used by the NETWORK SERVICE-owned netprofm process. The author reverse-engineers ncsi.dll and winhttp.dll with IDA/WinDbg to show the value actually arrives via a Windows Event Log subscription to Event ID 5600 (Microsoft-Windows-WinINet-Config) rather than the WNF notification initially suspected, is stored in NCSI's user-proxy state, and is later applied to a WinHttpSetOption(38) call for an active connectivity probe. It documents why option 193 (WINHTTP_OPTION_DISABLE_PROXY_AUTH_SCHEMES) fails to disable NTLM (wrong bitmask, 0x100 vs 0x04), and demonstrates cross-context NTLM proxy authentication capture/relay with impacket-ntlmrelayx toward ADCS, since the request runs under the netprofm/NETWORK SERVICE machine-account context.

pgj11.comwriteupPublished and added 28 Sep 2026🛡️ Security

A researcher reverse-engineers Windows NCSI (ncsi.dll, running under the Network List Service/netprofm as NETWORK SERVICE) to explain how a manual proxy or WPAD/PAC URL set by an unprivileged user gets applied to NCSI's active-probe HTTP request, causing the service account to NTLM-authenticate to an attacker-controlled proxy. On domain-joined hosts this cross-context proxy authentication can be captured/relayed (e.g. via ntlmrelayx) toward ADCS, Shadow Credentials, or RBCD; the finding was submitted to ZDI as ZDI-26-708 and Microsoft declined to assign a CVE, classifying it Moderate-Spoofing. Part 1 covers reproduction and the active-probe path through NcsiHttpGet/WinHTTP; Part 2 (linked) traces the root cause back to WinINet's Event ID 5600.

pgj11.comwriteupPublished and added 28 Sep 2026🛡️ Security

Squadra (version 3.11.0) is an MIT-licensed Python 3.12+ tool that coordinates several Claude Code, Codex and interactive Cursor windows on one project through a shared local registry. It records tasks, acknowledgements, source-bound proofs and independent reviews by a window that did not write the code. A local dashboard shows progress, per-window token usage and model-balance suggestions, and community plugins extend it. The page was truncated, so later sections are not covered.

github.comrepoAdded 27 Oct 2026, published 28 Sep 2026🧠 AI

mcp-audit-tool is a dependency-light Python CLI that statically scans Claude Desktop, Cursor, Windsurf, Cline, Zed, and VS Code MCP configuration files for security issues, including hardcoded secrets, unpinned/rug-pull packages, pipe-to-shell installers, tool-poisoning via hidden instructions in tool descriptions, filesystem servers rooted at '/', and unauthenticated plaintext HTTP MCP endpoints. It auto-discovers configs across macOS/Linux/Windows, produces a security score/grade plus SARIF 2.1.0 output for GitHub Code Scanning, and is built around the OWASP MCP Top 10 categories with a CI/CD example that fails builds on severity thresholds. The roadmap adds live server probing over stdio/SSE for runtime rug-pull detection and an ML-based prompt-injection classifier for tool descriptions.

github.comrepoPublished and added 26 Sep 2026🛡️ Security

Sandyaa is an open-source autonomous code-audit tool that points at a local directory or git URL and runs end-to-end, driven by the Claude Code CLI (optionally Gemini) with no separate API key required. It uses a Recursive Language Model approach — the model drives a Python REPL to chunk code, spawn sub-LLM queries, and aggregate results — running eight recursive passes (call-chain tracing, data-flow expansion, vulnerability chaining, exploitability proof, etc.) and an attacker-control-reachability analyzer to filter unreachable findings, then writes each finding with a working exploit PoC and an evidence.json linking claims to file/line. Maintained by SecureLayer7, who report using it to surface zero-days; it's alpha-stage, macOS-tested, Linux/WSL2-expected-to-work, and unsupported on native Windows.

github.comrepoAdded 26 Sep 2026🛡️ Security

The Hacker News details a campaign of nearly 800 (later 1,033) malicious npm packages delivering the WEL1DROPPER downloader — dubbed Flooding Dropper by Sonatype — which fetches cross-platform RAT/infostealer payloads via Cloudflare Workers or DNS TXT-record fallback from wel1.ru, patches ETW/AMSI on Windows, and deploys the Sliver C2 framework on Linux. The piece also covers a related npm crypto-stealer campaign, multiple npm/PyPI packages tied to EtherHiding droppers and credential theft (Solana wallets, .env secrets, Discord/GitHub Actions tokens), and Chrome extensions abusing a bandwidth-sharing SDK to turn browsers into residential-proxy web scrapers.

thehackernews.comarticleAdded 26 Sep 2026🛡️ Security

An empirical study analyzing a merged corpus of 407 leaked, reconstructed, or officially published LLM system prompts from 62 vendors, using a block-level classifier to categorize content. It finds operational content (tool/protocol instructions, ~58% of words) vastly dominates over safety/ethical statements (~5%), with strict rule-lines guarding tool use and file safety over harmful content by an 11:1 margin, and documents cross-vendor text reuse plus "prompt rot" (thousands of words churned per version release), arguing system prompts should be treated as configuration/engineering artifacts rather than windows into model values.

arxiv.orgpaperAdded 28 Sep 2026, published 25 Sep 2026🧠 AI