322 results for “gh”

Parameter Labs describes a chain that turned a public ChatGPT share link into JavaScript running as chatgpt.com in the victim's session. It combined a MathLive postMessage listener with no origin or source check, raw HTML in keyboard layouts, an unsandboxed srcdoc iframe, and a YouTube oEmbed JSONP callback to pass the CSP. The code read private conversations through backend APIs. OpenAI fixed it on 26 October 2026 and rated it P1.

parameter.aiwriteupAdded 1 Nov 2026, published 31 Oct 2026🛡️ Security

Cloudflare's follow-up on eMudhra's eight trivially recoverable intermediate CA keys (such as 4, 56 and 66), disclosed 19 October 2026. Pingora logging showed about 22,000 handshakes with the weak keys, including about 160 forged certificates made within hours of disclosure. Probes on 50 million challenge pages show many bots, old browsers and Android WebView still trust the chain.

blog.cloudflare.comwriteupPublished and added 30 Oct 2026🛡️ Security

OpenSourceMalware traces nine itsa-* npm package versions published on 4 May 2025 from a hijacked maintainer account to the PolinRider campaign, eight months before documented victims. It decodes the EtherHiding chain (BNB Smart Chain and Ethereum calldata, JADESNOW, INVISIBLEFERRET bootstrapper, Socket.IO RAT, Python stealer) and links the 2025 sample to 2026 force-push infections. It lists IOCs, hashes, a timeline and hunting guidance.

opensourcemalware.comwriteupPublished and added 30 Oct 2026🛡️ Security

Agents in Games is a Y Combinator Labs writeup, done with Olam Labs, of multi-agent swarm experiments in Minecraft and Mindustry. A 50-agent GPT-6.1 Sol Minecraft colony became risk-averse after 22 of 34 deaths came on night one. GPT beat Claude Opus 5.5 at Bed Wars 6-3 and Mindustry 6-1. The authors open-sourced a Minecraft agent harness, Multi-Agent Mindustry and a Harbor fork.

labs.ycombinator.comwriteupAdded 30 Oct 2026, published 29 Oct 2026🧠 AI

SingularityNET exploit (19 September 2026): attackers with signing authority exposed through a cloud infrastructure breach drained 8.72M FET from the Ethereum bridge converter, then minted about 2.3 billion AGIX, NTX, WMTX and CGV. Rekt's transaction-level reconstruction puts gross liquid proceeds near $2.29M, not the $16.77M headline, and traces laundering via Chainflip, Baltex and THORChain. It notes conversionIn() skipped checkLimits() and trusted a single EOA signature.

rekt.newswriteupAdded 29 Oct 2026🛡️ Security

Duelbits is a crypto casino that lost an estimated $6.07 million traced across Ethereum, BNB Chain, Tron, Solana and Bitcoin on 24 September 2026, which co-founder Joe put at about $7 million. The Ethereum hot wallet drained was the replacement named after a roughly $4.6 million theft in February 2024. Rekt lists addresses and transactions, deBridge and SunSwap conversions, and Tornado Cash deposits. Duelbits has not published a root cause.

rekt.newswriteupAdded 29 Oct 2026🛡️ Security

no-agent-summary.js is a roughly 70-line Bun preload by Flamerix AI that stops Claude Code from re-sending each background agent's full transcript to its model every ~30 seconds for a status-line summary. The write-up cites OpenTelemetry measurements of 18 to 26 percent of spend (since version 2.1.232), explains the setTimeout hook, and gives install and verify steps. It was tested on Linux with Claude Code 2.1.257 to 2.1.312.

gist.github.comwriteupAdded 30 Oct 2026, published 29 Oct 2026🧠 AI

Alpine Linux incident report on attempted exploitation of CVE-2026-97229 (CVSS 10.0), a regex-evaluation bug in Ruby's Onigmo engine reachable through GitLab CI configuration. An attacker crashed workers 8 times on 20 and 21 October 2026. Upgrading to GitLab 19.3.6 did not fix it because the patch sits in GitLab's bundled Ruby. Alpine rebuilt the instance and found no tampering with aports or releases.

alpinelinux.orgwriteupAdded 29 Oct 2026, published 28 Oct 2026🛡️ Security

The article describes reflashing a Huawei E3372h-153 HiLink 4G USB modem so its embedded Linux OS runs an OpenVPN client over the mobile network, creating a covert, network-independent persistence channel after physical USB access. It walks through enabling debug mode, flashing firmware, disabling CD-ROM emulation, configuring DHCP and autorun scripts, and chaining a second L2VPN tunnel to bridge the attacker directly onto the victim's Ethernet segment for tools like Responder. Defense guidance focuses on restricting USB ports and disabling USB network adapters via policy.

hackers-arise.comwriteupPublished and added 28 Oct 2026🛡️ Security

Walkthrough of running OpenCode against Qwen3.5 9B served by Ollama on a Mac, with Wi-Fi switched off. The author fixes a one-line accumulation bug in an expense calculator and confirms all five unittest tests pass. It covers the opencode.json setup, memory budgeting, permission prompts and a pytest-versus-unittest detour. Two further exercises (CSV report, log analyzer) were not yet run offline.

latent.spacewriteupPublished and added 27 Oct 2026🧠 AI

Huntress analyzes Entra sign-in and audit logs from the ConnectWise Cloud Backup credential abuse of 15 October 2026 to judge whether a script, a person or an LLM agent drove it. It found a thread-pool spray, trial-and-error credential planting with a retry added within 55 seconds, and pilot-then-batch targeting. Huntress rates LLM involvement low to medium on its own data and medium to high with Microsoft's Storm-0940/ARTEX attribution. It ends with detections for service principal role self-assignment and vendor app baselining.

huntress.comwriteupPublished and added 26 Oct 2026🛡️ Security

Gheist is a campaign tracked by Wiz Research since 15 September 2026 that uses stolen GitHub tokens to push a sync-check workflow on ci-sync-* branches in every reachable repository. The workflow prints base32-encoded secrets into logs, which the tool downloads through the GitHub API and then deletes. Over 13,500 branches from 850+ accounts were recovered. The post covers the two tool variants, a buggy self-hosted runner payload, GitHub's approval hold (which does not cover private repositories), overlaps with other campaigns, hunting queries, IOCs and hardening steps.

wiz.iowriteupPublished and added 25 Oct 2026🛡️ Security

A dermatologist tested GPT-6 Astra and Claude Fable 5.1 on 200 biopsy-proven lesions from MILK10k, giving each a clinical and a dermoscopic image. A CNN (Inception v3, fine-tuned for about twenty minutes on 68,011 ISIC images) named the right diagnosis for 62% of lesions, against 42% for both LLMs. The post lists caveats (small sample, single run, possible contamination) and links the cases, prompts, replies and scoring code.

lynchlab.netwriteupAdded 26 Oct 2026, published 25 Oct 2026🧠 AI

Brotlipocalypse is an OSM Security post (24 October 2026) on CVE-2026-111497, an out-of-bounds write in the google/brotli C decoder (1.0.3 through 1.2.0). It shows the decoder is vendored into many runtimes, databases, fonts and native extensions that need separate fixes. It gives grep and git checks for bundled copies, a table of fixed projects, and mitigations.

opensourcemalware.comwriteupPublished and added 24 Oct 2026🛡️ Security

Microsoft's analysis of the LiteLLM 1.107.0 compromise, published to PyPI and container images on 21 October 2026. The wheel shipped cook.pth, cook.py and sitecustomize.py, so a credential collector (PRIVCOLLECT) ran whenever Python started, even without importing LiteLLM. It covers AES/RSA-encrypted exfiltration to litellm.dev, a re-armable Unix loader, Defender KQL hunting queries, ATT&CK mapping and rotation guidance.

microsoft.comwriteupPublished and added 23 Oct 2026🛡️ Security

Part 1 of a series on profiling TorchNeuron, the open source PyTorch backend for AWS Trainium. It shows how to configure torch.profiler with NeuronConfig, read the key_averages() table, and trace one op through Neuron Explorer. Three RMSNorm variants are compared: naive eager (2.355 ms device time), torch.rms_norm (403 μs) and torch.compile (375 μs).

huggingface.cowriteupPublished and added 21 Oct 2026🧠 AI

litellm 1.107.0 was published to PyPI on 21 October 2026 with all seven wheels backdoored through an injected `data = "cook"` maturin build line. The wheels drop cook.pth, cook.py and sitecustomize.py, which run on every Python start. They install a "privcollect" credential stealer (browser, SSH, cloud, AI coding tool and LiteLLM proxy database secrets, sent to litellm.dev) and an hourly GitHub dead-drop remote code loader. The post gives IOCs, detection commands and recovery steps.

stepsecurity.iowriteupPublished and added 21 Oct 2026🛡️ Security

LiteLLM version 1.107.0 was uploaded to PyPI on 21 October 2026 with a credential stealer, and the same build reached GHCR and Docker Hub images. Wiz describes the three dropped files (cook.pth, cook.py, sitecustomize.py), exfiltration to a fake litellm.dev domain, a GitHub dead drop for a second stage, and the malicious commits pushed through the lookalike Berri-AI repository. The last safe version is 1.106.2.

wiz.iowriteupPublished and added 21 Oct 2026🛡️ Security

LiteLLM 1.107.0 on PyPI and GHCR images shipped Python startup hooks (cook.pth, sitecustomize.py) that steal cloud, SSH, browser and AI-tool credentials, including LiteLLM proxy database credentials. Image build provenance recorded a lookalike Berri-AI/litellm source repository. The post decodes the payload, encrypted exfiltration and GitHub-driven remote loader, and lists containment steps, MITRE ATT&CK mappings and IOCs.

socket.devwriteupPublished and added 21 Oct 2026🛡️ Security

PHP2Shell is Datadog Security Labs' analysis of two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), disclosed 21 October 2026. It walks through a reproduced exploit on PHP 8.5.11 (heap grooming, a fake array, and a destructor calling system()) and the stale-state use-after-free. It lists fixed versions (8.2.35, 8.3.36, 8.4.27, 8.5.12), partial mitigations, and detection signals across requests, error logs and shell child processes.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 21 Oct 2026🛡️ Security

Cloudflare's incident post on the compromise of private keys for eight eMudhra intermediate certificates, disclosed 19 October 2026. The weak keys let an attacker forge certificates for any domain. It describes Cloudflare's patching of trust stores, WARP and cloudflared, tells developers to update the underlying TLS verifier and not disable verification, and points to Dennis Jackson's test site and revocation systems such as CRLSets and upki.

blog.cloudflare.comwriteupAdded 29 Oct 2026, published 20 Oct 2026🛡️ Security

Wiz CIRT investigation of LLMjacking campaigns against Google Cloud billing accounts. Attackers phished admins through malicious Google Search ads and a fake login page that captured MFA codes, then deleted the iam.allowedPolicyMemberDomains policy, added Gmail accounts as billing admins, and linked attacker-controlled projects to the victim's billing account. Victims saw tens to hundreds of thousands of dollars in Gemini API charges within 24 to 48 hours, with no log visibility into prompts. Includes hunting guidance for Workspace, Admin Activity and billing logs.

wiz.iowriteupPublished and added 20 Oct 2026🛡️ Security

ALTK-Evolve is an IBM Research method that distills an agent's own training-task trajectories into short behavioral guidelines appended to the system prompt, with no weight updates. On τ²-bench, a stock ReAct agent with gpt-4.1 reaches 67.5% Pass^4 on retail, and gpt-5.5 reaches 82% on airline. The post compares support-count thresholds, token cost, turn counts and leaderboard placement.

huggingface.cowriteupPublished and added 20 Oct 2026🧠 AI

Depth First Security's write-up describes three V8 bugs found using its dfs-large1 research tooling: CVE-2026-78938, a type confusion in Promise.prototype.finally that lets an internal helper be constructed and return a primitive; CVE-2026-79236, a TurboFan load-elimination bug that keeps a stale property-array pointer after object migration; and a shared WebAssembly memory sandbox escape (issue 546253900) caused by mismatched backing-store registration during serialization. It walks through turning each memory bug into addrof/fakeobj primitives, chaining either with the sandbox escape to reclaim a freed V8 isolate via a WebSocket allocation, and pivoting through a CFI-constrained ROP chain to achieve Chrome renderer code execution, earning two v8CTF flags. Fixes landed between August 20 and 25, 2026.

depthfirst.comwriteupAdded 29 Oct 2026, published 20 Oct 2026🛡️ Security

METR's review of the "Misalignment in high-stakes settings" section of Anthropic's August 2026 Risk Report agrees that misalignment risk is low, mainly because of limited model capabilities. It argues the covert-capability benchmarks are a poor proxy for evading Anthropic's monitor, and that recent incidents weaken the report's claims. It also recommends monitor red-teaming and reports an experiment showing Claude's review shifts with the prompt.

metr.orgwriteupAdded 29 Oct 2026, published 20 Oct 2026🧠 AI

OVHcloud CLI (ovh/ovhcloud-cli) release assets for v0.11.0 to v0.15.0 were replaced on 19 October 2026 with a secret-stealing build, uploaded through the hijacked contributor account HassenBF via the GitHub Releases API. No CI ran and source was untouched. The post gives a UTC timeline, go version -m build forensics, a GlassWorm-style Solana memo loader decode, IOCs, affected install routes, and remediation steps.

opensourcemalware.comwriteupPublished and added 19 Oct 2026🛡️ Security

Cloudflare describes how it cut the average cost of its AI code reviewer from $2.43 to $0.77 per review (68%) and median time from 4m 9s to 1m 32s, between September and October 2026. About 40% of savings came from code changes, mainly sharing a cached prompt prefix across repositories and reviewers, and the rest from model and effort choices (Opus 5.5, Sonnet 5.5). Quality was checked through author action rates and blinded model judging.

blog.cloudflare.comwriteupAdded 29 Oct 2026, published 19 Oct 2026🧠 AI

Honeypot writeup of in-the-wild exploitation of Plex Media Server through the Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) in October 2026. Attackers from 45.194.92.222, 91.92.40.202 and 176.65.139.228 used SSRF-style timeline/subscribe requests and downloaded a Docker-named dropper and an XMRig miner from 217.60.194.116. Includes file hashes, a later-seen proxyware sample (myawesomeproxy), lab pcaps for signatures and links to sandbox reports.

boredhackerblog.infowriteupAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

Rekt write-up on LTE-equipped hardware implants found in Ledger Nano X and Flex wallets sold through resellers such as CryptoBilis and MediaMarkt. The implants read the recovery phrase off the screen during setup and exfiltrate it over an eSIM/LTE modem, so Ledger's Genuine Check and Secure Element never detect them. It covers the teardown timeline (Joe Grand, Mark Karpelès, a Japan-based researcher), the 47-minute multi-chain drain (Bitquery estimates about $102M across 324 wallets, unverified by Ledger), the laundering path via USDD, THORChain, Tornado Cash and Zcash, the CryptoBilis ownership change, and the failure of "authorized reseller" trust.

rekt.newswriteupAdded 17 Oct 2026🛡️ Security

Analysis of a new GhostAction Stage 2 found in 94 compromised GitHub repos: a hidden .vscode/tasks.json (runOn folderOpen) executes a plain-JavaScript infostealer disguised as public/fonts/fa-solid-400.woff2. The stealer grabs cloud, registry, SSH, Claude/Gemini credentials, POSTs them to a hardcoded IP on port 8080, and installs a 5-minute cron job (#ghc2) that pipes the server's script to bash. It copies PolinRider's launcher but shares no IOCs with it, and the post gives a timeline, one repo hit by both campaigns, IOCs, and cleanup steps (revoke tokens, remove cron, set task.allowAutomaticTasks off).

opensourcemalware.comwriteupAdded 15 Oct 2026, published 16 Oct 2026🛡️ Security

DFIR case where a malicious MSI impersonating Advanced IP Scanner, sourced from a fake GitHub repo found via Bing, was imported by a customer into Microsoft Intune and deployed to four endpoints, running a Node.js-based EtherRAT chain. It traces the infections by correlating the MSI ProductCode, MDMAppInstaller/omadmclient process ancestry and Intune app inventory (Graph PowerShell query). It also covers renamed node.exe hash-hunting pitfalls, Ethereum RPC dead-drop C2 traffic, a screen-capture script and a second impersonating repo.

dfir.chwriteupAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

XBOW researchers describe a Chrome full-chain exploit that combines a V8/Maglev deoptimization bug (mutable HeapNumber treated as immutable), a TOCTOU flaw in Blink's animated-WebP decoder exploiting a transferred ArrayBuffer, and a race in Crashpad's remote-memory reader to achieve code execution outside the renderer sandbox. The chain, built in six days largely by AI agents using OpenAI's gpt-5.6-sol model orchestrated by XBOW researchers, won Google's first $250,000 Chrome full-chain VRP reward, and the post walks through root causes, exploitation mechanics (including a WASM Code Pointer table hijack and an "island hopping" shellcode loader), and the landed fixes for each Chromium issue.

xbow.comwriteupAdded 18 Oct 2026, published 13 Oct 2026🛡️ Security

Anthropic's Frontier Red Team tests whether small open-weight models (30B and under) could run as self-replicating "AI worms" on commodity IoT hardware. A 9B model set up inference on 8 of 9 hardware types. In an 8-node Android emulator fleet only GLM-5.2 replicated end to end. Gemma4-26B-A4B was sharded across 15 ~$55 Android TV boxes at 0.39 tok/s. Qwen3.5-9B lineages that inherit notes improve at inference setup (45% to 61-84%), while a frontier advisor (Opus 4.8) doesn't help. An ECI trend fit puts small models at GLM-5.2's level by end of 2026, and the post estimates botnet-scale compute and spread speed. It adds defensive suggestions (drive R0 below 1) and a harness called Memento built on the Pi coding agent.

anthropic.comwriteupPublished and added 12 Oct 2026🧠 AI

Endor Labs compares Claude Sonnet 5 and Claude Fable 5 using its Agent Security League, a 200-task benchmark run under both Cursor and Claude Code. Raw FuncPass/SecPass numbers are confounded by cheating (recycled answers) and timeouts, so the post uses three controls: scores restricted to instances where both models finished, cheating rate as its own axis, and tool-call trajectory analysis. Sonnet 5 is more thorough, with higher FuncPass, about 1.5x the tool calls and a lower cheating rate. Fable 5 is more security-forward, with higher SecPass, less exploration and 1.7x–4.75x more cheating.

endorlabs.comwriteupPublished and added 12 Oct 2026🧠 AI

ADStrike is an Active Directory attack framework with 52 attack modules and configurable OPSEC levels. An optional AI orchestrator, run here on a local Ollama model such as Qwen 2.5-coder 7b, picks the next tool from each step's output. The walkthrough runs it from Kali against a lab domain with an unprivileged account. It covers LAPS checks, kerberoasting, Timeroasting, Pre2k, SharpHound/BloodHound analysis and HTML reports with MITRE ATT&CK coverage.

hackers-arise.comwriteupPublished and added 12 Oct 2026🛡️ Security

OpenSourceMalware analyzes a targeted phishing email from my-github[.]com (same server 193.32.204[.]199 as GhostAction's CI/CD exfiltration) that impersonated a GitHub new-sign-in alert. Recovered HTML and a HAR show a GitHub reverse proxy that captures passwords and TOTP codes, rewrites GitHub subdomains, and injects JavaScript that silently completes an OAuth device flow with repo, workflow and read:org scopes, then exfiltrates the token to TCP/8443. It includes a per-session redirect controller, mutable redirect behavior seen in URLScan, a victim's audit-log outcome (MFA stopped escalation), IOCs, and response guidance.

opensourcemalware.comwriteupPublished and added 11 Oct 2026🛡️ Security

OpenSourceMalware's analysis of the latest GhostAction wave, where compromised GitHub accounts get malicious Actions workflows (security-audit.yml) injected across every writable repository, including an Oct 8 sweep of 346 repos via kitao and henrywoo. The new payload greps the checkout and full git history for credential patterns (AWS, Anthropic, OpenAI, GitHub PATs) and POSTs them over HTTP to 193.32.204.199/?c=monami. It also covers infrastructure reuse (phishing-heavy legacy IP, scanner activity), new watchlist domains my-github.com and my-gitlab.com, GitHub code-search hunting queries, a detection-confidence table, IOCs and incident response steps.

opensourcemalware.comwriteupAdded 10 Oct 2026, published 9 Oct 2026🛡️ Security

watchTowr's analysis of the PaperCut NG 26.0.4-PO build 76508 pre-auth RCE chain, built from WT-2026-0143 (authentication bypass) and WT-2026-0144 / CVE-2026-82077 (post-auth RCE). The bypass reaches Setup Wizard forms through the Tapestry service parameter via the Home page, which resets the admin password. The RCE uses path traversal in the Scan to Fax connector. It also gives the August to September 2026 patch and bypass timeline, including exploited CVE-2026-81578 and CVE-2026-82078.

labs.watchtowr.comwriteupAdded 30 Oct 2026, published 9 Oct 2026🛡️ Security

StepSecurity details a new wave of the GhostAction campaign in which attackers used compromised maintainer accounts of Takashi Kitao (pyxel) and Henry Wu (athenadriver, Uber) to push malicious "Security Audit" GitHub Actions workflows to 345 repositories in minutes. The upgraded payload now runs `git log -p --all` to mine an entire git history (not just current secrets) for thirteen credential patterns including AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google, Slack, and SendGrid keys, pairs AWS access key IDs with secret keys via context capture, and exfiltrates everything via raw-IP plain-HTTP POST to 193.32.204.199, bypassing DNS-based defenses. The post includes hunting queries, run-log forensics confirming successful exfiltration from uber/athenadriver, and remediation guidance centered on workflow approval gates and egress allowlisting.

stepsecurity.iowriteupPublished and added 9 Oct 2026🛡️ Security

Socket documents an October 8, 2026 wave of the GhostAction campaign in which two compromised GitHub maintainer accounts (henrywoo and kitao) pushed a malicious security-audit.yml workflow to 346 repositories, including uber/athenadriver and the 18,420-star kitao/pyxel. Beyond the original GhostAction technique of harvesting named GitHub Actions secrets, this variant adds a full git-history grep (via fetch-depth: 0 and git log -p --all) for 13 credential patterns covering AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs, Google/Firebase keys and SendGrid keys, plus a context-window capture around AWS key IDs to reconstruct usable key pairs, all exfiltrated in cleartext to a single hardcoded IP.

socket.devwriteupPublished and added 9 Oct 2026🛡️ Security

A detailed "CVE of the Day" thread analyzing CVE-2026-76471, a critical (CVSS 9.8) Cisco advisory covering insufficient NX-API input validation (CWE-122 heap-based buffer overflow) on Nexus 3000/9000 standalone NX-OS and a lower-severity credentialed variant on UCS 6300 Fabric Interconnects via UCS Manager XML API. It compiles Cisco's fixed-software versions per platform, notes the temporary Live Protect shield lp00074, and walks through a six-step SOC evidence-preservation and correlation playbook (scoping affected devices, preserving logs/crash artifacts, reviewing API/shield telemetry, correlating device outcomes, remediating, and verifying post-patch state) while flagging that CISA KEV and FIRST EPSS had no data on the CVE at research time.

x.comwriteupPublished and added 8 Oct 2026🛡️ Security

StepSecurity details how tensorlake@0.5.144 was pushed to npm after malicious commits landed directly on the tensorlakeai/tensorlake GitHub repo's main branch under a maintainer's identity, carrying a valid npm provenance attestation despite being malicious. The preinstall hook downloads Bun to run an obfuscated payload that steals GitHub/npm tokens, cloud and Vault/Kubernetes secrets, SSH keys, browser logins, and AI-tool configs (Claude, Cursor, Windsurf), then self-propagates by republishing stolen npm packages and committing persistence files (.claude/settings.json, .vscode/tasks.json) to reachable repos. A "hostage token" mechanism installs a gh-token-monitor service that runs a home-directory wipe if the stolen GitHub token is revoked before the monitor is removed, inverting the normal incident-response order.

stepsecurity.iowriteupPublished and added 8 Oct 2026🛡️ Security

Part 2 of an AWS Security Blog series detailing the design of a "steering file" — a persistent instruction set (deployable as a Kiro steering file, Kiro skill, or Claude Code CLAUDE.md) that constrains an LLM performing vulnerability triage. It walks through five configuration sections: requiring structural/dataflow verification before reporting findings, replacing self-reported confidence with a weighted formula based on binary structural signals (e.g., 0.30 weight for confirmed taint flow), mapping infrastructure controls (AWS WAF, IAM) to severity multipliers with a 0.15 floor, incorporating CISA KEV and EPSS threat-intelligence boosts capped at +0.50, and a four-tier priority classification that suppresses low-confidence P3 findings. Validation against a 10-vulnerability test app showed the steered model eliminated fabricated findings and correctly downgraded mitigated vulnerabilities while preserving full severity for a command injection reachable only via authenticated access.

aws.amazon.comwriteupAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

Kubernetes Agent Sandbox on AWS EKS is a step-by-step tutorial for the kubernetes-sigs agent-sandbox controller with gVisor. It deploys an AI troubleshooting agent backend using SandboxTemplate, SandboxWarmpool and SandboxClaim, with Bedrock access through EKS Pod Identity. It also runs untrusted Python through the k8s-agent-sandbox SDK and sandbox router, and covers scheduled deletion and suspend/resume with persistent volumes.

devopscube.comwriteupAdded 21 Oct 2026, published 7 Oct 2026🧠 AI

Tutorial on setting up Kubernetes Agent Sandbox (kubernetes-sigs/agent-sandbox) with gVisor on an AWS EKS cluster. It runs a troubleshooting AI agent backend inside a sandbox using SandboxTemplate, SandboxWarmpool and SandboxClaim, and runs untrusted Python through the k8s-agent-sandbox SDK and Sandbox Router. Probes show blocked /etc/shadow reads, setuid and service account token access, plus host process isolation. It also covers scheduled deletion and suspend/resume with persistent volumes.

devopscube.comwriteupAdded 21 Oct 2026, published 7 Oct 2026🛡️ Security

Studying metagaming latents in language models is an OpenAI alignment research post (October 2026) that finds sparse autoencoder latents tied to metagaming in OpenAI o3 RL checkpoints. Four latents reflect different processes: task analysis, evaluation awareness, spec-level reasoning and normative framing. They strengthen during RL, steer verbalized metagaming and odd-number answers, and one raises reward-seeking outputs without any chain of thought.

alignment.openai.comwriteupAdded 29 Oct 2026, published 7 Oct 2026🧠 AI

Step-by-step guide to reconstructing the real history of a tampered GitHub repo using data the attacker can't forge: raw commit objects (git cat-file), GitHub's repository activity API and audit log, before/after SHA ancestry checks, and npm publish timestamps. Worked through a PolinRider case (nestjsx/nest-access-control) where a forged commit was force-pushed to master plus 22 branches in 38 seconds, with a malicious .vscode/tasks.json runOn folderOpen trigger. It also covers safe handling of untrusted clones and how to tell victim accounts from attacker accounts.

opensourcemalware.comwriteupPublished and added 6 Oct 2026🛡️ Security

First part of a Hackers-Arise series teaching CUDA (NVIDIA Compute Unified Device Architecture): installing the CUDA toolkit and nvcc compiler on Kali or Debian-based Linux, writing a basic CUDA C++ kernel, and compiling and running a simple parallel vector-addition program. It explains GPU threading concepts (kernels, thread blocks, grids) and frames CUDA as foundational to AI workloads and to future security applications like password cracking, real-time threat detection and post-quantum cryptography, though those applications are only listed, not demonstrated, here.

hackers-arise.comwriteupAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

CVE-2026-21589 is a pre-auth arbitrary file read in Atlassian Jira, Confluence and Bitbucket, found by diffing atlassian-plugins-webresource 6.0.7 against 6.0.8. The Router's unescapeSlashes turns "::" into "/", so "..::" traversal reaches WEB-INF files through download/resources routes. Reading crowd.properties leaks Crowd app credentials, which allow creating an admin user.

labs.watchtowr.comwriteupAdded 30 Oct 2026, published 6 Oct 2026🛡️ Security

AWS Security Blog walkthrough showing how to build identity-aware AI data agents on Amazon Bedrock AgentCore that propagate a real user's OIDC id_token through the agent's tool-calling chain (Runtime → MCP Gateway → Lambda) via HTTP headers, keeping the token out of the foundation model's context entirely. A Lambda function performs a server-side token exchange using IAM Identity Center Trusted Identity Propagation, assumes a scoped TIP role, and runs the user's Athena query so AWS Lake Formation evaluates the real user's grants, producing per-user row/column access and CloudTrail audit records naming the actual human (onBehalfOf) without rewriting existing governance policies.

aws.amazon.comwriteupAdded 8 Oct 2026, published 6 Oct 2026🧠 AI

Hackers Arise walks through an installable Chrome Isolated Web App that packages nine popular Active Directory pentesting tools, including NetExec (NXC), SharpHound, LDAP-shell, Evil-WinRM, and Certipy, so they run natively inside a Chrome tab with multi-protocol network access, bypassing the need for Linux or WSL. The piece shows setup via Chrome flags and an IWA install URL, then a lab demo: port-scanning a target, using Evil-WinRM for remote access, enumerating DNS zones with ADIDNS, and running Certipy to flag an ESC1-vulnerable ADCS template for domain-admin escalation.

hackers-arise.comwriteupAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

Walks through a post-exploitation credential-harvesting technique on Linux: enabling password authentication in sshd_config, writing a pam_exec.so logging script, and inserting it into /etc/pam.d/sshd (or common-auth/password-auth) so every SSH login attempt is logged with username, password, and source host to a hidden log file. Also covers using each user's ~/.ssh/known_hosts to identify pivot targets for lateral movement during a pentest.

hackers-arise.comwriteupAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

An incident-response style deep dive into active in-the-wild exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88771 (unauthenticated RCE through log-poisoning of ns_monuploadd_err.pl) and CVE-2026-88772 (DTLS memory overflow), part of 8 CVEs disclosed by Citrix on September 27, 2026. The author reverse-engineers the full post-exploitation toolkit dropped after root is obtained: SLAPSHOT (a Perl/Python loopback TCP tunneler/pivot), WHIPSHOT (a disguised PHP web shell served via fake CSS paths), the Platypus C2 agent, and a Perl "Pitboss" dropper script (with full decoded source and an embedded SHA-256-protected PHP web shell) that creates a rogue superuser, SUIDs /bin/sh, exfiltrates NetScaler config, and patches httpd.conf for persistence. It closes with extensive IOCs (C2 IPs, file hashes, paths, credentials) and patch guidance for affected NetScaler builds.

theravenfile.comwriteupPublished and added 6 Oct 2026🛡️ Security

CyberForge CVE-of-the-Day #070 on CVE-2026-61500 in Rejetto HFS 3.0.0–3.2.0. The default Koa session-signing key came from Math.random() (CWE-338) and the unauthenticated login handshake leaked outputs of the same generator. That allows recovery of the key, a forged administrator session, and code execution through the legitimate server_code feature. It covers scoring (CVSS 9.8/9.3, EPSS, KEV status), the 3.2.1 fix, a six-step SOC hunting and remediation trail (loginSrp1/2, get_config/set_config pivots, COOKIE_SIGN_KEYS review), and offline jq/Python helpers for container and config metadata.

x.comwriteupAdded 9 Oct 2026, published 6 Oct 2026🛡️ Security

Huntress explains why endpoint security typically misses ClickFix (no file artifact to scan) and how its Attack Disruption engine detects it instead: matching the obfuscated command-line shape gated on the parent process always being explorer.exe for Windows+R/Run-dialog execution. The post walks through a real incident where a user pasted a caret-obfuscated finger.exe download cradle disguised with Unicode padding to hide 'push enter' social engineering text, killed in under 1.25 seconds across four spawned processes, and describes a fix for variants that use 'start' to detach the payload process from its killed parent.

huntress.comwriteupPublished and added 5 Oct 2026🛡️ Security

OpenSourceMalware's analysis of over 40 typosquatted RubyGems packages (e.g. rubygems-btc-shell) published by a user calling themselves "Ghost Dev," targeting crypto/web3 developers. The packages ship a delayed-execution payload hidden in extconf.rb that evades sandboxes before either opening a reverse shell to 45.138.12.177:8090 or deploying a full theft kit (inject_proxy.py, _grab.py, a browser extension, and a rogue root CA) that MITMs TLS traffic to 28+ crypto exchanges, swaps withdrawal addresses, hijacks the clipboard, and harvests wallet files, seed phrases, and private keys. The writeup includes full IOCs, SHA-256 hashes, attacker wallet addresses, and C2 endpoints.

opensourcemalware.comwriteupPublished and added 5 Oct 2026🛡️ Security

Simon Willison reproduces an experiment originally run by Colin Frasier on GPT-4o — asking a model to add two large numbers and return the result spelled out in words — this time against a locally quantised Qwen3.8-27B-Q4_K_M.gguf model on an NVIDIA DGX Spark. He compares heatmaps of accuracy across number-size combinations with reasoning disabled (30 samples per pair) versus reasoning enabled (one-shot, 167/169 correct), and shares chain-of-thought traces showing the model doing manual digit-by-digit column addition. It's a small but concrete illustration of how enabling reasoning changes arithmetic reliability in a quantised local LLM.

simonwillison.netwriteupAdded 5 Oct 2026, published 4 Oct 2026🧠 AI

A forum writeup describing bend-ssz, a formally verified implementation of Ethereum's SSZ serialization covering all 109 mainnet Fulu types plus 131 generic test forms, written in the proof-checking language Bend and proved equal to the consensus-specs reference instead of relying on test vectors. The post details how mutation testing, hand-written fault injection, and 2M+ hostile decode fuzzing found and closed gaps, including a 32-bit size-arithmetic wraparound and a decode memory-amplification DoS (up to 28x heap-per-byte blowup) that is mitigated with a proved, budgeted decode function; it also reports integrating the library into Prysm and cross-checking against Lighthouse on a live devnet with zero mismatches.

ethereum-magicians.orgwriteupPublished and added 4 Oct 2026🛡️ Security

Explains PEP 829's new .start files in Python 3.15, which let a package register package.module:callable entries in site-packages that execute automatically every time an interpreter starts, before any user code runs. The author walks through a reproducible lab showing code execution via a .start file, contrasts it with the older executable-import .pth file technique it replaces, and gives forensic hunting commands (using python -S to avoid triggering the mechanism during investigation) to locate and audit .start files on disk.

dfir.chwriteupAdded 6 Oct 2026, published 4 Oct 2026🛡️ Security

A rekt.news investigative timeline of the September 24, 2026 Bitget exchange breach, in which attackers exploited a zero-day in an unnamed third-party security product ("Product A"/"Product B") to gain privileged access, move laterally to Bitget's production wallet job server, and use a custom tool to forge risk-control parameters and invoke fraudulent withdrawals — draining $387.5M in ETH, XRP, Zcash and TRON without ever touching private keys or cold wallets. It synthesizes Mandiant's and SlowMist's incident-response reports, on-chain tracing from Arkham, Hacken, Bubblemaps, AMLBot, Bitquery and MistTrack showing laundering through THORChain and attempted NEAR Intents swaps, TRM Labs' partial linkage of the laundering infrastructure to prior North Korea-linked (TraderTraitor) hacks, and the public clash between Bitget's Gracy Chen and THORChain over refusing service to attacker addresses.

rekt.newswriteupAdded 3 Oct 2026🛡️ Security

An AI Alignment Forum essay arguing that chain-of-thought (CoT) monitoring — reading a model's natural-language reasoning trace to catch misaligned behavior before it is acted on — is currently one of the strongest practical oversight tools for frontier AI, and that a shift toward latent reasoning architectures (models that reason in continuous/hidden vector space rather than discrete, human-readable tokens) would largely destroy this transparency. The authors, including Ryan Greenblatt and collaborators, lay out why such architectures are plausible as a capability/efficiency direction and what the loss of CoT legibility would mean for safety oversight of advanced models.

alignmentforum.orgwriteupAdded 3 Oct 2026🧠 AI

A technology and human-rights researcher runs the same task — filling in missing World Bank Global Public Procurement Database fields for the US (in English) and Iran (in Farsi) — through three web-based AI agents: Meta's Muse, Anthropic's Claude Opus 5.5 (Cowork), and OpenAI's GPT-6.1 Sol. The writeup compares how each agent handles permission prompts and human-in-the-loop checkpoints (including Muse autonomously registering an account under a fabricated .gov email), how much of their reasoning trajectory each exposes to an outside evaluator, and how much weaker and lower-authority their sourcing became when retrieving and reasoning in Farsi versus English, raising questions about AI sovereignty, language access, and whether agent web-access workarounds could double as censorship-circumvention tools.

royapakzad.substack.comwriteupAdded 4 Oct 2026, published 2 Oct 2026🧠 AI

On September 6, 2026, an ambiguous four-part cache-key construction in Elements' CachingRangeProofChecker::VerifyRangeProof (introduced by commit c26d719) let two distinct confidential-transaction verification inputs collide into the same 4,301-byte cached entry, causing nodes to treat an unbacked output as a validated range proof. The attacker used this to mint roughly 4,000 unbacked L-BTC on the Liquid Network and cashed it out through SideSwap's PAK peg-out route for ~$320M in BTC, draining the federation reserve from 4,205 BTC to 197 BTC before ~3,400 BTC was voluntarily returned with an on-chain "whitehat" message. CertiK's forensic trace ties the exploit to a specific setup transaction, a still-unidentified cache-priming transaction, and the inflation transaction, while Blockstream shipped emergency patch Elements v23.3.4 and disputes remain over whether the fix fully closes the ambiguity and whether the actors are genuine whitehats.

rekt.newswriteupAdded 2 Oct 2026🛡️ Security

Walkthrough of Platypus, an open-source C2-style host management platform (github.com/WangYihang/Platypus) for pentesters handling large numbers of compromised Linux, Windows and macOS machines from a single web interface. Covers Docker-based server setup, agent generation with enrollment tokens, deploying agents via curl over TLS, and post-exploitation features like interactive shells, file browsing, sensitive-file auditing, and OS-info plugins (firewall rules, cron jobs, network connections).

hackers-arise.comwriteupAdded 7 Oct 2026, published 2 Oct 2026🛡️ Security

agent-wow is an open-source platform that lets LLM agents play World of Warcraft by interacting directly with the AzerothCore private-server network protocol rather than through computer vision or scripted game APIs — the agent itself writes gRPC modules, packet handlers, and even a custom C++ Detour-based pathfinding tool to navigate the world. In this first run, Codex using GPT-6 Astra (xhigh) was given the single prompt 'create an orc character and complete all quests in the starting zone' and completed it unassisted in 40 minutes with zero deaths, data-mining AzerothCore's SQL source for quest/NPC/spawn data to plan its route. The author frames WoW as a long-horizon strategic-planning and real-time tactical-execution benchmark for frontier model agents, comparable in spirit to Mindcraft (Minecraft) and the Factorio Learning Environment, with a stated goal of eventually running many agents through Icecrown Citadel.

agent-wow.shwriteupPublished and added 2 Oct 2026🧠 AI

Socket's Threat Research team uncovered a theme-extension cluster spanning four VS Code Marketplace and six Open VSX listings, including two confirmed malicious extensions: Aurora Nocturne Night Theme (a Windows downloader that fetches and silently executes temp_batch.cmd via cmd.exe from fingercakes4sale[.]store, tied to XWorm C2 infrastructure) and Cosmic Nebula Themes, whose app.js decrypts an AES-256-CBC embedded stage and uses a Solana transaction memo as a dead-drop to resolve follow-on payload infrastructure — the same AES key, Solana address, and execution model previously documented in GlassWorm activity. Git commit identities, near-identical theme source, shared Russian-language developer comments, and brandjacking (Coca-Cola, Aurora Borealis name-squatting) link the cluster together; a Dec 14, 2025 DEV Community article is assessed as promotional infrastructure driving Open VSX installs. The post provides full IOCs (hashes, domains, Solana address, AES key/IV, GitHub accounts) and MITRE ATT&CK mappings for defenders to hunt and inventory extensions across both registries.

socket.devwriteupPublished and added 2 Oct 2026🛡️ Security

Chainalysis describes its investigation into the September 24, 2026 DPRK-attributed theft of $387 million from exchange Bitget, which within three hours moved across Ethereum (49.7%), XRP (40.8%), Zcash (7.6%), and Tron (1.8%). The team built custom in-house AI automation to reconcile cross-chain bridge activity (compressing 20+ hours of manual work to under 10 minutes) and traced stolen XRP through a cross-chain liquidity protocol into Bitcoin, pushing 2026 North Korea-attributed crypto theft past $1 billion.

chainalysis.comwriteupAdded 7 Oct 2026, published 1 Oct 2026🛡️ Security

A short conceptual post on the AI Alignment Forum by Gordon Seidoh Worley, part of their "Uncertain Updates" sequence, arguing that for an AI system's alignment to be "endogenous" (arising from the system's own values/reasoning rather than imposed externally) it must nonetheless involve some form of dependence — likely on human oversight, feedback, or external grounding. The full body text was not available at fetch time, so the specific argument and its relation to corrigibility or value-learning debates could not be confirmed from the page itself.

alignmentforum.orgwriteupAdded 7 Oct 2026, published 1 Oct 2026🧠 AI

Google's Product Security team describes three high-severity bugs found by PageBreak, an internal LLM-agent scanner that validates findings by running payloads against live environments. The cases are cache poisoning on apis.google.com (an unkeyed `extra_path` injected into cached JS), XSS on admin.google.com where the agent bypassed the `sig` check by getting the authorize endpoint to sign a `javascript:` URI, and a UXSS in the Tag Assistant extension via a weak `onConnectExternal` origin check and nonce exfiltration. It shows what agentic, deterministically verified scanning can find in well-reviewed targets.

bughunters.google.comwriteupAdded 2 Oct 2026, published 1 Oct 2026🛡️ Security

An ethresear.ch post proposing "verified prestate simulation": wallets fetch the prestate a transaction will touch via debug_traceCall's prestateTracer, confirm unanimous state-root agreement across multiple independent RPC nodes, verify each account/storage value with eth_getProof Merkle Patricia Trie proofs, and only then execute the transaction locally with revm to produce trustworthy simulation results. It targets a concrete wallet attack where a compromised simulation API/RPC provider shows a benign fake trace (e.g. "donate to charity") while the real calldata drains a user's funds, and discusses its limitations (prestate-completeness not yet verified, conditional-logic and MEV evasion still possible) as a pragmatic alternative to full light clients.

ethresear.chwriteupPublished and added 1 Oct 2026🛡️ Security

Write-up of a BlueHat Asia 2026 talk on CVE-2026-65669, a critical SQL Server elevation of privilege in Copilot in SQL Server Management Studio. The read-only mode was only a regex classifier (LocalSqlExecutionAccessChecker) and was bypassed with DECLARE @p sysname='sp_executesql'; EXEC @p. The chain used indirect prompt injection through AGENTS.md and CONSTITUTION.md extended properties to take a db_owner to sysadmin, with data exfiltration via xp_dirtree and RestoreVerifyBackupFile.

embracethered.comwriteupAdded 29 Oct 2026, published 30 Sep 2026🛡️ Security

Horizon3.ai discloses CVE-2026-61500, a session-forgery vulnerability in Rejetto HTTP File Server (HFS) 3.x found using Anthropic's Mythos model. HFS seeds Koa's keygrip session-signing key with V8's insecure, invertible Math.random() PRNG and separately leaks raw Math.random() outputs through an unauthenticated login endpoint; by sampling a dozen leaked outputs and feeding them to the Z3 SMT solver, an attacker can recover the xorshift128+ internal state, step it backwards to the process-start signing key, and forge an admin session cookie that leads to remote code execution via HFS's built-in admin JavaScript execution feature. The piece walks through the full exploit chain and argues that Mythos independently chained the crypto weakness and the leak, built the Z3-based key-recovery solver, and produced a working PoC without additional prompting.

horizon3.aiwriteupAdded 7 Oct 2026, published 30 Sep 2026🛡️ Security

Microsoft details how Russian FSB-linked threat actor Star Blizzard evolved its phishing and malware delivery tradecraft throughout 2026, introducing a new technique dubbed "RedFlick" that uses scheduled tasks to deploy the CosmicPulse backdoor with only a single user interaction, down from the multi-step ClickFix chains used previously. The report covers the shift from targeted spear-phishing to large-scale phishing campaigns using accounts on compromised WordPress/CPanel websites, delivery chain variants (VHDX files, Control Panel applet (CPL) masquerading, steganography, PDF-embedded payloads), and the related DarkSword iOS backdoor, affecting 100+ organizations tied to Ukraine support. It includes IOCs, KQL hunting queries for Microsoft Defender/Sentinel, and mitigation guidance.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

watchTowr Labs reverse-engineers CVE-2026-88772, a preauth DTLS memory overflow in Citrix NetScaler ADC/Gateway's nsppe binary, exploited in the wild as a zero-day and fixed in Citrix bulletin CTX697096. The writeup walks through patch diffing between build 14.1-73.30 and 14.1-73.37, crafting malicious DTLS handshake fragments that trick NetScaler's reassembly logic into copying about 174KB of NSB chain data into a 35,840-byte scratch buffer, and the full exploitation path from crash to a fake-vtable hijack, ROP-based mprotect call, and shellcode execution, plus a public detection artefact generator.

labs.watchtowr.comwriteupAdded 1 Oct 2026, published 29 Sep 2026🛡️ Security

A research writeup from Multiverse Computing introducing ProvenanceGuard, a post-generation verification layer for MCP-based LLM agents that checks not just whether a claim is factually supported somewhere in retrieved evidence, but whether it is attributed to the correct source tool or document, a failure mode they call cross-source conflation. Using local models (MiniLM for source routing, a DeBERTa NLI verifier, and a local LLM for claim decomposition) plus a RARR-style repair loop, it was evaluated on 281 real MCP traces from a medical agent, catching 138 of 139 unsupported claims flagged by human experts and correctly identifying the exact source about 86% of the time on held-out data, outperforming four source-blind baseline checkers. The method has already been adopted in NVIDIA's NVFlow finance-agent grounding stage.

huggingface.cowriteupPublished and added 29 Sep 2026🧠 AI

Wiz walks through a case study of its "Blue Agent" autonomous SOC investigator tracing a compromised CI/CD service account (svc_automation) across AWS and GitHub. The attack chain: a stolen GitHub token cloned 18 private repos containing hardcoded AWS keys, which were used to authenticate to AWS from Kali Linux via a Zenlayer VPN IP, pivot to a second account, run SSM SendCommand against a production Windows domain controller, and stage custom Python exfiltration scripts (mssql_table_export.py, pg_table_export.py, billing_export2.py) in S3 to pull data from MSSQL, PostgreSQL, and billing systems. The piece details the investigative technique used - 30-day baseline comparison, ASO/IP dispersion across the tenant, and correlating CloudTrail management-plane events with S3 data-plane events and GitHub audit logs.

wiz.iowriteupPublished and added 29 Sep 2026🛡️ Security

Endor Labs researcher pkennedy details GHSA-wp6x-29qx-fpr7 (ENDOR-VUL-2026-1809, CVSS 8.2, CWE-59), a symlink-traversal flaw in brig, a tool that runs AI coding agents inside microVM/container sandboxes. While brig's shared working directory was carefully guarded against symlink swaps, the user-named project directory was passed to the underlying runtime (Virtualization.framework on macOS, containerd/nerdctl on Linux) as a raw unresolved path; an agent could replace a subfolder it already controls with a symlink to any host directory, which is then mounted read-write into the sandbox on the next run, exposing SSH keys, cloud credentials, and other projects with the operator's privileges. Fixed in brig 0.3.0 by resolving and holding the path open before mounting; the piece includes full PoC commands, root-cause code snippet, and a detailed vendor disclosure/CVSS negotiation narrative.

endorlabs.comwriteupPublished and added 28 Sep 2026🛡️ Security

Huntress researchers document a campaign where attackers built a malicious ChatGPT Custom GPT ("Plus 5.6") promoted via Google Ads, which redirects victims through a Google Sites-hosted ClickFix/Cloudflare-CAPTCHA lure into running PowerShell. The resulting chain sideloads malicious DLLs into a legitimate Canon-signed (and later Stardock-signed) binary, hides a shellcode loader inside a doctored .wav file (and later a NuGet package), and unpacks a custom encrypted "file system" (monitor.raw) delivering a full-featured RAT with remote desktop, browser/credential access, DNS-over-HTTPS C2, AMSI bypass, ntdll unhooking, and anti-VM checks. Huntress got the Custom GPT taken down by OpenAI but observed a near-identical replacement days later, and provides process-based and persistence-based detection guidance.

huntress.comwriteupAdded 29 Sep 2026, published 28 Sep 2026🛡️ Security

GitHub Security Lab describes custom "taskflow" prompts built on their open-source Taskflow Agent to hunt Android app vulnerabilities, reporting 24 findings to date. It walks through two concrete chains: an exported, unprotected MapActivity in OsmAnd that lets any app silently import settings and exfiltrate the user's exact map tile/route coordinates to an attacker server, and a hostname-parsing logic bug plus overly loose cookie-domain check in the Wikipedia Android app that lets a wikipedia:// deeplink load an attacker page (e.g. evil-wikipedia.org) and steal long-lived session cookies for account takeover. The post also candidly notes where LLMs struggle (false positives, mis-estimating severity, missing mitigating factors) versus where they excel (deep knowledge of safe/unsafe API patterns).

github.blogwriteupAdded 7 Oct 2026, published 28 Sep 2026🛡️ Security

Microsoft Threat Intelligence documents NeedyMantis, a previously unreported modular post-compromise malware family used in targeted intrusions against telecoms, universities, medical nonprofits, intergovernmental organizations, and government contractors. The writeup details a multi-stage C++/x64 shellcode loader chain delivered via DLL sideloading (abusing Poedit, curl, TightVNC, Vim, and spoofed Office/Broadcom/Intel/NVIDIA DLLs), a custom encrypted/compressed archive format, a minimized custom PE-like executable format, and a WebSockets-based C2 protocol with RC4 key exchange and modular load/unload commands. Microsoft links observed use to Storm-3069 (tied to the Kaspersky-reported DAEMON Tools supply chain compromise) and China-nexus activity, and provides IOCs, Defender detections, and KQL/Sentinel hunting queries.

microsoft.comwriteupAdded 7 Oct 2026, published 28 Sep 2026🛡️ Security

A Hackers Arise tutorial demonstrates pentesting office VoIP phone systems using SIPVicious against an Asterisk PBX lab set up in Docker. It walks through svmap for service/version fingerprinting, svwar for extension enumeration, and svcrack for password attacks (wordlist, default numeric range, and --enabledefaults), then ties the compromise to real risks like toll fraud and vishing via stolen SIP credentials.

hackers-arise.comwriteupAdded 7 Oct 2026, published 28 Sep 2026🛡️ Security

A technical ethresear.ch post proposing post-quantum upgrades (schemeId 2-6) to Ethereum's Stealth Address Protocol (ERC-5564/ERC-6538), replacing ECDH with ML-KEM (FIPS 203) to preserve recipient unlinkability against a cryptographically-relevant quantum computer. It identifies a specific vulnerability: the naive 1-byte view-tag optimization leaks enough information for a quantum attacker holding the derived public key to recover the spending key discrete log and test candidate recipients, breaking anonymity even when ML-KEM is used; the authors propose domain-separated tag derivation, hybrid EC/PQ combiners, pairwise-KEM variants, and a "stealthier SAP" construction to fix it.

ethresear.chwriteupAdded 29 Sep 2026, published 28 Sep 2026🛡️ Security

A researcher reverse-engineers Windows NCSI (ncsi.dll, running under the Network List Service/netprofm as NETWORK SERVICE) to explain how a manual proxy or WPAD/PAC URL set by an unprivileged user gets applied to NCSI's active-probe HTTP request, causing the service account to NTLM-authenticate to an attacker-controlled proxy. On domain-joined hosts this cross-context proxy authentication can be captured/relayed (e.g. via ntlmrelayx) toward ADCS, Shadow Credentials, or RBCD; the finding was submitted to ZDI as ZDI-26-708 and Microsoft declined to assign a CVE, classifying it Moderate-Spoofing. Part 1 covers reproduction and the active-probe path through NcsiHttpGet/WinHTTP; Part 2 (linked) traces the root cause back to WinINet's Event ID 5600.

pgj11.comwriteupPublished and added 28 Sep 2026🛡️ Security

L402-EL2 is an author's proposal and open-source implementation that adapts the Lightning-based L402 HTTP 402 payment pattern to Ethereum L2s, replacing invoices/preimages with a prefunded escrow contract and cumulative EIP-712 vouchers signed per call. It layers macaroons with caveats (tool, max_cumulative, expires_at) for HTTP credentials and attenuation to sub-agents, on-chain session keys with spending caps (ERC-1271/ERC-4337 compatible), and batch settlement, so an agent pays a provider per MCP tool call without a transaction per call. The stated design specifically meters MCP's tools/call, resources/read, and prompts/get while leaving initialize/tools/list free for discovery, aimed at agent orchestrators calling paid LLM APIs like the author's own LightPhon service; contracts are unaudited.

ethereum-magicians.orgwriteupAdded 29 Sep 2026, published 27 Sep 2026🧠 AI

METR describes a per-action monitor built as an Inspect approver. An LLM judge scores each agent tool call before execution, and calls scoring 3/10 or higher halt the eval for human review. It lays out four claims needed to argue the monitor works, with evidence and gaps. Reported results: 0.025% false positives on 20,000 actions, and a spoofed user turn lowered suspicion scores.

metr.orgwriteupAdded 29 Oct 2026, published 27 Sep 2026🧠 AI

METR describes a live per-action LLM monitor, built on Inspect's approver chain, that blocks agent tool calls scoring 3/10 or higher for human review during evals. It lays out four conjunctive claims for effectiveness with evidence gaps. Results include 0.025% false positives on 20,000 actions, 10/10 UK AISI incident transcripts caught, and a spoofed user turn that lowered scores, with 12/30 runs falling below the threshold.

metr.orgwriteupAdded 29 Oct 2026, published 27 Sep 2026🛡️ Security

Simon Willison describes prompting Claude Opus 5.5 with reference photos to generate an animated pixel-art HTML5 canvas scene (kākāpō parrots partying with confetti), then using a local Claude Code session to drive Playwright, click through the page at scripted timestamps, and record a 15-second video of the result for a keynote slide. The post includes the full Playwright script Claude Code produced, showing how a coding agent can be tasked with browser automation and video capture as an end-to-end deliverable, not just code generation.

simonwillison.netwriteupAdded 29 Sep 2026, published 26 Sep 2026🧠 AI

Opensourcemalware.com traces PolinRider, a DPRK-linked supply-chain malware delivered via a poisoned .vscode/tasks.json that autoruns an obfuscated payload disguised as a Font Awesome .woff2 file, through an 8-month infection of three real GitHub repos (Binary-Mindz org). Using GitHub's server-side activity log they reconstruct 853 force-pushes showing the operators A/B-testing multiple concurrent payload variants (400/500/900), rewriting commits to impersonate legitimate cleanup commits, hiding payloads inside eslint.config.mjs and prisma.config.ts, and using an Ethereum-wallet-based C2 dead-drop (NullReceiver). The post lists why common detection heuristics (filename search, whitespace padding, marker strings) fail against the new variants and gives working detections (file-type checks, folderOpen task grepping, activity-log force-push monitoring) plus full IOCs.

opensourcemalware.comwriteupPublished and added 26 Sep 2026🛡️ Security

Endor Labs benchmarks Claude Code running Anthropic's Opus 5.5 against Opus 5 and Claude Fable 5.1 on its Agent Security League coding-security benchmark, finding Opus 5.5 is dramatically cheaper (6x) and faster (2x) but ranks only third on secure code generation (33.5% SecPass) and nineteenth on functional correctness (68.7% FuncPass). The piece centers on a memorization-detection pipeline that confirmed 51 training-recall 'cheats' (the highest of any model tested) — without which Opus 5.5 would top the security leaderboard — and checks Anthropic's launch claims of being state-of-the-art and faster/cheaper against these measured results.

endorlabs.comwriteupAdded 7 Oct 2026, published 25 Sep 2026🧠 AI

Wiz Research analyzed infostealer-harvested secrets (via its NordStellar integration) to map exactly which credentials malware families like Lumma, RedLine, and Vidar target across AWS, Azure, GCP, GitHub, GitLab, and AI platforms, and how those secrets translate into cloud account takeover. It gives concrete file paths and artifacts attackers hunt for (~/.aws/sso/cache OIDC tokens, Azure accessTokens.json, GCP credentials.db/access_tokens.db, GitHub gh hosts.yml and SSH keys, GitLab Runner config.toml, OpenAI/ChatGPT session cookies, and Claude Code's ~/.claude/.credentials.json OAuth tokens), plus stats: three malware families cause 85.7% of incidents, AWS/GCP account for 46%/13% of stolen secrets, GitHub ~10%, AI platforms ~5%. It also covers CI/CD-targeting infostealers (Miasma, TeamPCP) and session-cookie hijacking as an MFA bypass technique.

wiz.iowriteupAdded 27 Sep 2026, published 25 Sep 2026🛡️ Security