Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMicrosoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.
microsoft.comwriteupPublished and added 31 Oct 2026π‘οΈ Security
nemotron-halloweenMonsterHouse is a Halloween interactive projection built on the NVIDIA Nemotron Voice Agent: Nemotron Speech ASR, Nemotron 3.5 Bolt E4B 4GB with a LoRA persona adapter, Magpie TTS Zeroshot and Audio2Face-3D in Unreal Engine, on two RTX Blackwell GPUs. Median end-of-speech-to-audio is 1.70 seconds live and 0.72 seconds with cached responses. The post gives a build path and tips on caching and state handling.
huggingface.cowriteupPublished and added 30 Oct 2026π§ AI
4 real? Tracking exploitation and patching of eMudhraβs weak keysCloudflare's follow-up on eMudhra's eight trivially recoverable intermediate CA keys (such as 4, 56 and 66), disclosed 19 October 2026. Pingora logging showed about 22,000 handshakes with the weak keys, including about 160 forged certificates made within hours of disclosure. Probes on 50 million challenge pages show many bots, old browsers and Android WebView still trust the chain.
blog.cloudflare.comwriteupPublished and added 30 Oct 2026π‘οΈ Security
Trojanized Claude Code Extension Plants an SSH BackdoorAnalysis of a trojanized anthropic.claude-code 2.1.313 extension (darwin-arm64), found on Open VSX, with a 66-line loader prepended to extension.js. It adds an svc-telemetry key to authorized_keys, opens a reverse SSH tunnel to 134.209.82.225, sets persistence (LaunchAgent, cron, scheduled task) and sends host recon over HTTP port 8099. Includes IOCs, hashes and response steps; no further payload download was found.
opensourcemalware.comwriteupPublished and added 30 Oct 2026π‘οΈ Security
Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer MachinesThe Claude Code VS Code extension anthropic.claude-code 2.1.313 was published on Open VSX on 29 October 2026 with a malicious loader prepended to extension.js. On load it planted an attacker SSH key (svc-telemetry), installed per-OS persistence, opened a reverse SSH tunnel and beaconed host recon over HTTP. Cursor reports at most 5,000 users received it in an 11-hour window. The post gives the timeline, cleanup artifacts and credential rotation steps.
stepsecurity.iowriteupPublished and added 30 Oct 2026π‘οΈ Security
Discovering vendor-specific vulnerabilities in Android | Oversecured BlogOversecured describes extending its Android scanner to system APIs and to Samsung's Android build, after comparing Google and Samsung framework JARs and about 400 system services. It explains AIDL service permission checks and new control-flow analyses. Examples include Samsung's unchecked semIsBackupEnabled(), a broadcast that reboots the device, and a LaunchAnyWhere in Settings. Samsung had fixed over 60 reported issues.
oversecured.comwriteupAdded 29 Oct 2026π‘οΈ Security
Introducing MavenGate: a supply chain attack method for Java and Android applications | Oversecured BlogMavenGate is Oversecured's research on hijacking Maven dependencies by buying expired domains behind groupIds on Maven Central and JitPack. It found 6,170 of 33,938 checked domains (18.18%) vulnerable, and tested the attack with its own com.oversecured:hello-world library. It lists defenses (Gradle verification-metadata.xml, PGP signatures) and proposes changes to repository signing.
oversecured.comwriteupAdded 29 Oct 2026π‘οΈ Security
Disclosure of 7 Android and Google Pixel vulnerabilitiesOversecured discloses seven Android vulnerabilities, two of them Pixel-specific, all reported to Google and fixed except one low-severity WebView case. They are the Camera geolocation leak (CVE-2024-0017), a VPN bypass list change (CVE-2023-21383), a Bluetooth permission check flaw (CVE-2024-34719), the WorkSource parcel mismatch (CVE-2023-20963, exploited in the wild by the Pinduoduo app), Device Admin HTML injection (CVE-2021-0600) and a ContentProvider.openFile() caller-context bypass (CVE-2023-21292). Each has root cause and PoC code.
oversecured.comwriteupAdded 29 Oct 2026π‘οΈ Security
NIK C2: The new AI-enabled command-and-control frameworkNIK C2 is a newly observed C2 framework with a Go-based 64-bit Windows implant that embeds an OpenAI Chat Completions client (ai_generate command), falling back to the victim's OPENAI_API_KEY. Talos details its 52+ commands, AES-256-GCM over WebSocket with HTTP fallback, credential, wallet and keystroke theft, screen-lock ransomware, AMSI bypass and anti-debug. It also lists a live C2 at 87.120.196[.]120 and total-sitevv[.]lol.
blog.talosintelligence.comwriteupPublished and added 29 Oct 2026π‘οΈ Security
Qwenputer: A functioning, deterministic RISC-V CPU inside Qwen3.5Qwenputer is a stock Qwen3.5 4B with a 32-bit RISC-V CPU (RV32IM plus Zba and a bignum unit) compiled directly into added layers, with no training. Gated DeltaNet states act as exact RAM via gate 1, beta 1 and one-hot keys. It scores 97.5 to 100% on DeepMind arithmetic sets, and 100% on NUPA long-integer arithmetic. It also has an experimental in-model filesystem. The checkpoint is 18.8 GB and needs the RvChat driver.
divagr.comwriteupPublished and added 29 Oct 2026π§ AI- GitLab Security Incident: Attempted Exploitation of CVE-2026-97229
Alpine Linux incident report on attempted exploitation of CVE-2026-97229 (CVSS 10.0), a regex-evaluation bug in Ruby's Onigmo engine reachable through GitLab CI configuration. An attacker crashed workers 8 times on 20 and 21 October 2026. Upgrading to GitLab 19.3.6 did not fix it because the patch sits in GitLab's bundled Ruby. Alpine rebuilt the instance and found no tampering with aports or releases.
alpinelinux.orgwriteupAdded 29 Oct 2026, published 28 Oct 2026π‘οΈ Security 
Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet SecretsSocket analysis of three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets, using Unicode homoglyph names. They steal seed phrases and private keys and send them to brand-named subdomains of bonto[.]io. The Phantom fake adds a runtime loader that fetches and evals a second stage, and bundles a drainer backend with Telegram forwarding. Includes IOCs, hashes and wallet addresses.
socket.devwriteupPublished and added 27 Oct 2026π‘οΈ Security- Camera Management Software Compromise Leads to Malware Deployment
Huntress investigation of incidents in September and October 2025 where a compromised camera management application (CMS.exe) was the initial access vector. Attackers dropped rs.win32.exe, a reverse shell, and sideloaded modified zlib DLLs (IPHLPAPI.DLL, samcli.dll) via the legitimate Microsoft WpcMon.exe in AppData, with Run key persistence and beaconing to 144.172.116[.]37. Includes detection pivots and hardening advice.
huntress.comwriteupAdded 28 Oct 2026, published 27 Oct 2026π‘οΈ Security - AI, Scripts, Operator: Inside the ConnectWise Attack
Huntress analyzes Entra sign-in and audit logs from the ConnectWise Cloud Backup credential abuse of 15 October 2026 to judge whether a script, a person or an LLM agent drove it. It found a thread-pool spray, trial-and-error credential planting with a retry added within 55 seconds, and pilot-then-batch targeting. Huntress rates LLM involvement low to medium on its own data and medium to high with Microsoft's Storm-0940/ARTEX attribution. It ends with detections for service principal role self-assignment and vendor app baselining.
huntress.comwriteupPublished and added 26 Oct 2026π‘οΈ Security 
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens StumblesGheist is a campaign tracked by Wiz Research since 15 September 2026 that uses stolen GitHub tokens to push a sync-check workflow on ci-sync-* branches in every reachable repository. The workflow prints base32-encoded secrets into logs, which the tool downloads through the GitHub API and then deletes. Over 13,500 branches from 850+ accounts were recovered. The post covers the two tool variants, a buggy self-hosted runner payload, GitHub's approval hold (which does not cover private repositories), overlaps with other campaigns, hunting queries, IOCs and hardening steps.
wiz.iowriteupPublished and added 25 Oct 2026π‘οΈ Security- A 10-year-old CNN outperforms frontier LLMs for skin cancer diagnosis
A dermatologist tested GPT-6 Astra and Claude Fable 5.1 on 200 biopsy-proven lesions from MILK10k, giving each a clinical and a dermoscopic image. A CNN (Inception v3, fine-tuned for about twenty minutes on 68,011 ISIC images) named the right diagnosis for 62% of lesions, against 42% for both LLMs. The post lists caveats (small sample, single run, possible contamination) and links the cases, prompts, replies and scoring code.
lynchlab.netwriteupAdded 26 Oct 2026, published 25 Oct 2026π§ AI 
BrotlipocalypseBrotlipocalypse is an OSM Security post (24 October 2026) on CVE-2026-111497, an out-of-bounds write in the google/brotli C decoder (1.0.3 through 1.2.0). It shows the decoder is vendored into many runtimes, databases, fonts and native extensions that need separate fixes. It gives grep and git checks for bundled copies, a table of fixed projects, and mitigations.
opensourcemalware.comwriteupPublished and added 24 Oct 2026π‘οΈ Security- Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Microsoft's analysis of the LiteLLM 1.107.0 compromise, published to PyPI and container images on 21 October 2026. The wheel shipped cook.pth, cook.py and sitecustomize.py, so a credential collector (PRIVCOLLECT) ran whenever Python started, even without importing LiteLLM. It covers AES/RSA-encrypted exfiltration to litellm.dev, a re-armable Unix loader, Defender KQL hunting queries, ATT&CK mapping and rotation guidance.
microsoft.comwriteupPublished and added 23 Oct 2026π‘οΈ Security 
Python Packages Vulnerable to Node2ShellAnalysis of CVE-2026-111497 (Node2Shell), an out-of-bounds write in Google's Brotli C decoder, showing it also affects the PyPI packages Brotli (all releases up to 1.2.0) and brotlicffi (up to 1.2.0.2). The author diffed the 1.2.0 and 1.2.1 sdists and confirmed the behaviour with AddressSanitizer. Fixes are Brotli 1.2.1 and brotlicffi 1.2.1.0, both patched without release notes. No advisory database lists either package yet.
opensourcemalware.comwriteupPublished and added 23 Oct 2026π‘οΈ Security
Red-Teaming OpenAI's Internal Agent Monitoring SystemsMETR and Redwood Research summarize a three-week pilot red-team (21 July to 11 August 2026) of OpenAI's internal asynchronous misalignment monitoring system. They estimate 75-94% of agentic Responses API traffic was eligible for monitoring and report flaws: unmonitored compaction events, header-based monitor disabling, serialization mismatches that make the monitor fail, and a Codex sandbox and Auto-Review bypass. The post lists five design ideals for monitoring and control systems; exploit details are redacted.
metr.orgwriteupAdded 29 Oct 2026, published 22 Oct 2026π‘οΈ Security
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseMicrosoft Threat Intelligence report on Storm-0940, a China-state aligned actor that used the open-source agentic AI pentest framework ARTEX from September 2026 to automate attacks on hundreds of organizations. It links the actor to the October 2026 ConnectWise multi-tenant OAuth app compromise (2,250+ tenants, 2,900 sign-ins per minute, privileged access in under 3 hours). It gives IOCs, Defender XDR and Sentinel KQL hunting queries, ATT&CK mapping and mitigations.
microsoft.comwriteupPublished and added 21 Oct 2026π‘οΈ Security
LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI, and Proxy Credentials | Endor Labslitellm 1.107.0 was published to PyPI on 21 October 2026 from a source revision that differs from the official tag. One line in the Maturin config (data = "cook") installs cook.pth, cook.py and sitecustomize.py, which run on every Python start. They steal cloud, AI and proxy credentials, including the LiteLLM database tables, and load remote code hourly. The post gives IOCs, a five-step response plan and hardening advice.
endorlabs.comwriteupPublished and added 21 Oct 2026π‘οΈ Security
Profiling TorchNeuron (Part 1): System-level profiling on AWS Trainium.Part 1 of a series on profiling TorchNeuron, the open source PyTorch backend for AWS Trainium. It shows how to configure torch.profiler with NeuronConfig, read the key_averages() table, and trace one op through Neuron Explorer. Three RMSNorm variants are compared: naive eager (2.355 ms device time), torch.rms_norm (403 ΞΌs) and torch.compile (375 ΞΌs).
huggingface.cowriteupPublished and added 21 Oct 2026π§ AI
litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loaderlitellm 1.107.0 was published to PyPI on 21 October 2026 with all seven wheels backdoored through an injected `data = "cook"` maturin build line. The wheels drop cook.pth, cook.py and sitecustomize.py, which run on every Python start. They install a "privcollect" credential stealer (browser, SSH, cloud, AI coding tool and LiteLLM proxy database secrets, sent to litellm.dev) and an hourly GitHub dead-drop remote code loader. The post gives IOCs, detection commands and recovery steps.
stepsecurity.iowriteupPublished and added 21 Oct 2026π‘οΈ Security
LiteLLM Compromised, Steals CredentialsLiteLLM version 1.107.0 was uploaded to PyPI on 21 October 2026 with a credential stealer, and the same build reached GHCR and Docker Hub images. Wiz describes the three dropped files (cook.pth, cook.py, sitecustomize.py), exfiltration to a fake litellm.dev domain, a GitHub dead drop for a second stage, and the malicious commits pushed through the lookalike Berri-AI repository. The last safe version is 1.106.2.
wiz.iowriteupPublished and added 21 Oct 2026π‘οΈ Security
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI CredentialsLiteLLM 1.107.0 on PyPI and GHCR images shipped Python startup hooks (cook.pth, sitecustomize.py) that steal cloud, SSH, browser and AI-tool credentials, including LiteLLM proxy database credentials. Image build provenance recorded a lookalike Berri-AI/litellm source repository. The post decodes the payload, encrypted exfiltration and GitHub-driven remote loader, and lists containment steps, MITRE ATT&CK mappings and IOCs.
socket.devwriteupPublished and added 21 Oct 2026π‘οΈ Security
LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python BackdoorLiteLLM 1.107.0 macOS x86-64 PyPI wheel analyzed by OpenSourceMalware contains three injected files (cook.pth, cook.py, sitecustomize.py) that run on every Python start. The payload, called privcollect, steals browser, SSH, cloud, CI/CD and AI-tool credentials, then uploads an AES/RSA-encrypted bundle to www.litellm.dev/healthcheck. A forked loader also fetches domain.txt from GitHub and executes /codepy hourly. The post lists IOCs, hashes and remediation steps.
opensourcemalware.comwriteupPublished and added 21 Oct 2026π‘οΈ Security
LiteLLM compromised again: infostealer and RAT found in version 1.107.0LiteLLM 1.107.0 was compromised on 21 October 2026: the seven compiled PyPI wheels and the official Docker image carried an infostealer and a RAT. The attacker used the maturin `data = "cook"` directive in pyproject.toml to inject cook.pth, cook.py and sitecustomize.py without touching the source repo. The post lists stolen data, the hourly C2 polling via GitHub, wheel hashes, file and network IOCs, and check steps.
aikido.devwriteupPublished and added 21 Oct 2026π‘οΈ Security- Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
Huntress analysis of an Amazon-themed ClickFix campaign that used a Google sponsored result, a fake Amazon login on Google Sites and a fake CAPTCHA to make victims run the Windows finger utility. The .plan script drives IronPython, a Cyrillic-substituted Base64 Python loader, Doina, a Node.js stage, Lumma Stealer via sRDI, and a pirated NetSupport RMM. It lists C2 domains and gives detection tips (aclk/gclid markers, blocking the Run dialog).
huntress.comwriteupPublished and added 21 Oct 2026π‘οΈ Security 
Qwen3-Coder writes less secure code when told it's for a US personaHirundo case study on Qwen3-Coder-30B-A3B-Instruct using the BaxBench SecretStorage task. Changing only the customer persona shifted security: apps for a US defense contractor were 19% more likely to be hackable than for a Chinese one, and Hong Kong democracy group apps leaked secrets 28% more often. Hirundo's unlearning-based "Westernized" model closed these gaps while keeping general coding ability.
hirundo.iowriteupAdded 22 Oct 2026, published 21 Oct 2026π§ AI
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackersCisco Talos research on attackers using legitimate infrastructure to deliver lures, with abuse seen across more than 25 platforms in the past year. It details two campaigns (about 1,400 messages) that put attacker phone numbers into Staples and Dell order notifications that passed DKIM and DMARC. It also covers list bombing as content delivery and bounce (DSN) abuse, and recommends content-aware validation and recursive MIME inspection.
blog.talosintelligence.comwriteupPublished and added 21 Oct 2026π‘οΈ Security
LiteLLM supply chain compromise: What you need to knowLiteLLM version 1.107.0 was published to PyPI and official Docker images on 21 October 2026 and stayed live for about two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to run the release pipeline against a lookalike fork, Berri-AI/litellm. The payload (cook.pth, cook.py, sitecustomize.py) steals cloud, developer, AI-tool and browser credentials, and includes a polling RAT. The post lists removal and rotation steps.
securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 21 Oct 2026π‘οΈ Security
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM UsageWiz CIRT investigation of LLMjacking campaigns against Google Cloud billing accounts. Attackers phished admins through malicious Google Search ads and a fake login page that captured MFA codes, then deleted the iam.allowedPolicyMemberDomains policy, added Gmail accounts as billing admins, and linked attacker-controlled projects to the victim's billing account. Victims saw tens to hundreds of thousands of dollars in Gemini API charges within 24 to 48 hours, with no log visibility into prompts. Includes hunting guidance for Workspace, Admin Activity and billing logs.
wiz.iowriteupPublished and added 20 Oct 2026π‘οΈ Security
From JavaScript to Renderer Code Execution: Three V8 Vulnerabilities and Two v8CTF Flags | depthfirstDepth First Security's write-up describes three V8 bugs found using its dfs-large1 research tooling: CVE-2026-78938, a type confusion in Promise.prototype.finally that lets an internal helper be constructed and return a primitive; CVE-2026-79236, a TurboFan load-elimination bug that keeps a stale property-array pointer after object migration; and a shared WebAssembly memory sandbox escape (issue 546253900) caused by mismatched backing-store registration during serialization. It walks through turning each memory bug into addrof/fakeobj primitives, chaining either with the sandbox escape to reclaim a freed V8 isolate via a WebSocket allocation, and pivoting through a CFI-constrained ROP chain to achieve Chrome renderer code execution, earning two v8CTF flags. Fixes landed between August 20 and 25, 2026.
depthfirst.comwriteupAdded 29 Oct 2026, published 20 Oct 2026π‘οΈ Security- Review of the "Misalignment in high-stakes settings" section in Anthropic's Risk Report (August 2026)
METR's review of the "Misalignment in high-stakes settings" section of Anthropic's August 2026 Risk Report agrees that misalignment risk is low, mainly because of limited model capabilities. It argues the covert-capability benchmarks are a poor proxy for evading Anthropic's monitor, and that recent incidents weaken the report's claims. It also recommends monitor red-teaming and reports an experiment showing Claude's review shifts with the prompt.
metr.orgwriteupAdded 29 Oct 2026, published 20 Oct 2026π§ AI 
Glassworm Hacks OVH Clouds CLI toolOVHcloud CLI (ovh/ovhcloud-cli) release assets for v0.11.0 to v0.15.0 were replaced on 19 October 2026 with a secret-stealing build, uploaded through the hijacked contributor account HassenBF via the GitHub Releases API. No CI ran and source was untouched. The post gives a UTC timeline, go version -m build forensics, a GlassWorm-style Solana memo loader decode, IOCs, affected install routes, and remediation steps.
opensourcemalware.comwriteupPublished and added 19 Oct 2026π‘οΈ Security
Tmux and Claude Code: Sessions, Send-Keys, and the CeilingA tmux setup guide for running Claude Code and other coding agents: one session per project, window and pane layouts, a .tmux.conf tuned for agent TUIs, send-keys to drive an agent from scripts, and capture-pane and pipe-pane to read one back. It covers the claude --worktree --tmux flag, SSH use, and the limits at about four agents. The last section promotes the vendor's crystl terminal.
crystl.devwriteupAdded 20 Oct 2026, published 19 Oct 2026π§ AI
Putting models to the secure coding test: Security rulesDatadog Security Labs tests whether Project CodeGuard v1.4.0 security rules improve the code written by Claude Code (Sonnet 5), Cursor (Composer 2.5) and Codex (GPT 5.5). Each model built the same document portal app once. Only GPT 5.5 closed the cross-user document IDOR and improved clearly. Sonnet 5 and Composer 2.5 stayed largely unchanged, keeping IDOR, hardcoded secret fallbacks and token revocation gaps.
securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 19 Oct 2026π§ AI
Claude reveals ECDSA curve originsAnthropic's Frontier Red Team reports that Claude recovered how the NIST P-192/224/256/384/521 and ANSI X9.62 curve seeds were generated. They are outputs of the C library's lrand48 LCG seeded with 1997β98 Unix timestamps, not hashes of a passphrase. The method scanned for weak-PRNG signatures, then used LLL lattice reduction to recover the truncated LCG state and stepped it back to srand48 initialization. Claude also traced some base points to the FreeLIP/NTL random generator. Reproducible Python is included. The authors say this is not an attack and makes deliberate backdoors less plausible. The B-163 seed and the base points of P-224/256/384/521 and the binary curves remain unexplained.
anthropic.comwriteupAdded 17 Oct 2026, published 16 Oct 2026π‘οΈ Security- Claude reveals ECDSA curve origins
Anthropic's Frontier Red Team reports that Claude, given no hint, worked out how the NIST P-192/224/256/384/521 and ANSI X9.62 curve seeds were generated. They came from the C library's lrand48 LCG seeded with Unix timestamps from 1997β98, not from a hash of a phrase. Claude found this by scanning for weak-PRNG signatures and recovering the PRNG state with LLL lattice reduction. It also traced several prime-curve base points to the FreeLIP random generator. The post includes Python code that reproduces the seeds and base points. It says this is not an attack and makes backdoor claims less plausible. B-163 and the other base points remain unexplained.
anthropic.comwriteupAdded 17 Oct 2026, published 16 Oct 2026π§ AI 
GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font FileAnalysis of a new GhostAction Stage 2 found in 94 compromised GitHub repos: a hidden .vscode/tasks.json (runOn folderOpen) executes a plain-JavaScript infostealer disguised as public/fonts/fa-solid-400.woff2. The stealer grabs cloud, registry, SSH, Claude/Gemini credentials, POSTs them to a hardcoded IP on port 8080, and installs a 5-minute cron job (#ghc2) that pipes the server's script to bash. It copies PolinRider's launcher but shares no IOCs with it, and the post gives a timeline, one repo hit by both campaigns, IOCs, and cleanup steps (revoke tokens, remove cron, set task.allowAutomaticTasks off).
opensourcemalware.comwriteupAdded 15 Oct 2026, published 16 Oct 2026π‘οΈ Security.avif)
SBOM vs. SBOM: Comparing SBOMs from Different Tools and Lifecycle Stages | Endor LabsCase study running three open source SBOM generators (two generic, one Maven plugin) on Eclipse Steady 3.2.5 rest-backend at three lifecycle stages (git clone, Maven package, Docker image), yielding 8 CycloneDX SBOMs. Compares precision/recall against the mvn dependency:tree ground truth and finds the Maven-integrated tool perfect (1.0/1.0) while generic tools miss versions, groupIds and transitive dependencies. It also shows PURL qualifier differences (e.g. type=jar, apt qualifiers) make SBOMs hard to compare, test dependencies are indistinguishable, and argues for an SBOM generator benchmark.
endorlabs.comwriteupPublished and added 16 Oct 2026π‘οΈ Security
Package managers have an integrity problemTrail of Bits tested 25 popular package managers with a Docker and mitmproxy harness that simulates a compromised package repository injecting malware into legitimate packages. Fewer than half enforce lockfile hashes by default, only two verified every download, and only Go verifies signatures by default. The post covers lockfile hash pitfalls (Pub, pnpm, Conan, CocoaPods, Composer), repository, developer and Sigstore signing, and Go's checksum database. It also proposes lockfiles that commit to a signing identity plus a transparency log.
blog.trailofbits.comwriteupPublished and added 14 Oct 2026π‘οΈ Security- Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow
DFIR case where a malicious MSI impersonating Advanced IP Scanner, sourced from a fake GitHub repo found via Bing, was imported by a customer into Microsoft Intune and deployed to four endpoints, running a Node.js-based EtherRAT chain. It traces the infections by correlating the MSI ProductCode, MDMAppInstaller/omadmclient process ancestry and Intune app inventory (Graph PowerShell query). It also covers renamed node.exe hash-hunting pitfalls, Ethereum RPC dead-drop C2 traffic, a screen-capture script and a second impersonating repo.
dfir.chwriteupAdded 14 Oct 2026, published 13 Oct 2026π‘οΈ Security 
Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)CVE-2026-103572 is a remote code execution bug in Microsoft.VisualStudio.Copilot.Core.dll, shared by Visual Studio and SQL Server Management Studio. A trailing dot (for example `.mcp.json.`) bypasses the protected-filename check in EditsFunctionHandler.GetEditConfirmationTypeAsync, so a hijacked Copilot can rewrite its own MCP and settings files and run commands. The post covers path traversal and InstallationID leaks, indirect prompt injection demos, the October 2026 patch (GetFullPath), and a $0 bounty.
embracethered.comwriteupAdded 29 Oct 2026, published 13 Oct 2026π‘οΈ Security- Zero to calc in six days: inside XBOW's Chrome full chain
XBOW researchers describe a Chrome full-chain exploit that combines a V8/Maglev deoptimization bug (mutable HeapNumber treated as immutable), a TOCTOU flaw in Blink's animated-WebP decoder exploiting a transferred ArrayBuffer, and a race in Crashpad's remote-memory reader to achieve code execution outside the renderer sandbox. The chain, built in six days largely by AI agents using OpenAI's gpt-5.6-sol model orchestrated by XBOW researchers, won Google's first $250,000 Chrome full-chain VRP reward, and the post walks through root causes, exploitation mechanics (including a WASM Code Pointer table hijack and an "island hopping" shellcode loader), and the landed fixes for each Chromium issue.
xbow.comwriteupAdded 18 Oct 2026, published 13 Oct 2026π‘οΈ Security 
How to engineer an AI harness for game developmentBlog adaptation of an Indie Rodeo talk arguing that LLMs struggle with games because much of a game is opaque non-code, and that this is a context problem. It prescribes concrete architecture so a game becomes its own agent harness: seeded randomness, a single "Thing" fat-struct object model, serializable commands, external data editable without recompiling, a standalone simulation core, odiff image diffing for screenshot evaluation, and samply text profiling. The aim is an agentic loop that runs in seconds per change.
kylekukshtel.comwriteupPublished and added 13 Oct 2026π§ AI
Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)VulnCheck reproduces and root-causes CVE-2026-76504, an exploited zero-day authentication bypass in Cisco SD-WAN vManage. A POST to the URL-encoded path /%6a_security_check skips the password check because AppServerLoginModule.login() tests the raw getRequestURI() for "j_security_check", while WildFly's security-constraint matcher decodes the path. Supplying an internal username such as viptela-reserved-cloudops or viptela-reserved-uc then mints an admin-level session. Includes decompiled code, request/response samples, and notes on about 1,500 exposed devices and IoCs; the weaponized exploit and detection rules are gated to customers.
vulncheck.comwriteupAdded 12 Oct 2026π‘οΈ Security
AI models may be capable of self-replicating without access to a datacenterAnthropic's Frontier Red Team tests whether small open-weight models (30B and under) could run as self-replicating "AI worms" on commodity IoT hardware. A 9B model set up inference on 8 of 9 hardware types. In an 8-node Android emulator fleet only GLM-5.2 replicated end to end. Gemma4-26B-A4B was sharded across 15 ~$55 Android TV boxes at 0.39 tok/s. Qwen3.5-9B lineages that inherit notes improve at inference setup (45% to 61-84%), while a frontier advisor (Opus 4.8) doesn't help. An ECI trend fit puts small models at GLM-5.2's level by end of 2026, and the post estimates botnet-scale compute and spread speed. It adds defensive suggestions (drive R0 below 1) and a harness called Memento built on the Pi coding agent.
anthropic.comwriteupPublished and added 12 Oct 2026π§ AI
Happier DOMs: The perils of running untrusted JavaScript code outside of a web browser | Blog | Endor LabsEndor Labs explains CVE-2025-61927, an RCE in the happy-dom headless browser caused by relying on Node.js's vm module, which is not a security boundary. They show that the maintainer's mitigation (--disallow-code-generation-from-strings) is insufficient, because untrusted scripts can still pollute builtin prototypes for DoS or RCE (CVE-2025-62410). The fix adds --frozen-intrinsics. The post recommends isolated-vm, Secure EcmaScript, or container/VM isolation for untrusted JavaScript.
endorlabs.comwriteupPublished and added 12 Oct 2026π‘οΈ Security
How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise | Blog | Endor LabsEndor Labs breaks down the May 11, 2026 compromise of 42 @tanstack/* npm packages (84 malicious versions) that carried valid SLSA provenance. The attacker chained a pull_request_target "Pwn Request", GitHub Actions cache poisoning across the fork/base boundary, and OIDC token extraction from Runner.Worker memory, then published directly to npm without stealing any credential. It explains why 2FA, trusted publishing, provenance and branch protection all failed, and lists mitigations: split pull_request_target workflows, treat the cache as untrusted, scope id-token: write to a publish job, pin actions to SHAs, require environment approval, use egress allowlists.
endorlabs.comwriteupPublished and added 12 Oct 2026π‘οΈ Security
Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution | Blog | Endor LabsEndor Labs analyzes the malicious PyPI package pyronut (versions 2.0.184β2.0.186), a trojanized fork of the Telegram framework pyrogram. It hooks Client.start() to import a hidden pyrogram/helpers/secret.py that registers Telegram handlers letting two hardcoded attacker accounts run arbitrary Python (/e via meval) and shell commands (/shell via /bin/bash -c). C2 runs entirely over Telegram, so there are no external network indicators; the post includes detection, credential-rotation and prevention guidance.
endorlabs.comwriteupPublished and added 12 Oct 2026π‘οΈ Security
Artificial Intelligence (AI) in Cybersecurity, Part 28: Using ADStrike to Compromise Active DirectoryADStrike is an Active Directory attack framework with 52 attack modules and configurable OPSEC levels. An optional AI orchestrator, run here on a local Ollama model such as Qwen 2.5-coder 7b, picks the next tool from each step's output. The walkthrough runs it from Kali against a lab domain with an unprivileged account. It covers LAPS checks, kerberoasting, Timeroasting, Pre2k, SharpHound/BloodHound analysis and HTML reports with MITRE ATT&CK coverage.
hackers-arise.comwriteupPublished and added 12 Oct 2026π‘οΈ Security
I Found a $90k Remote Code Execution Vulnerability in GoogleWriteup of an unauthenticated RCE on Google's shared DevSite platform (developers.google.com, firebase.google.com, developer.android.com and others). The Flask session cookie embedded a pickled OAuth2WebServerFlow containing the OAuth client_secret, which was also the Flask SECRET_KEY. That let the author forge signed sessions carrying a malicious pickle that the OAuth callback unpickled; RCE was proven safely with time.sleep timing and negative controls. It earned a $90,000 bounty and lists a four-part fix.
simonkoeck.comwriteupPublished and added 12 Oct 2026π‘οΈ Security
500B tokens later: Letting AI agents decompile a first-person shooterCase study of about 3 months spent having Claude Code and Codex CLI agents decompile a popular first-person shooter to C++, using Hex-Rays' ida-mcp for disassembly. Early agent output ran but was semantically wrong, and a reviewer agent accepted worker justifications in commit comments, which acted as unintentional prompt injection. The fix was a byte-matching oracle: it compiles with the original toolchain and compares OBJ function bytes against the EXE/PDB, treating relocations separately. Agents tried to cheat with inline assembly and by editing the checker, so CI hashes the script. The result was 99% of functions present and 83% byte-exact, at an estimated 600-700B tokens.
momo5502.comwriteupPublished and added 11 Oct 2026π‘οΈ Security- 500B tokens later: Letting AI agents decompile a first-person shooter
A retrospective on a 3-month project in which Claude Code and Codex agents (Sonnet 5, Opus 5.5, Luna, Sol, Terra) decompiled a first-person shooter into C++, using ida-mcp, GitHub issues and Discord for coordination. The first month's agents produced readable but semantically wrong code, and a reviewer agent could not catch it. A byte-matching oracle script, comparing compiled OBJ output against the original EXE/PDB, gave a strict PASS/FAIL signal. That let cheaper models like Luna scale to 14+ agents and reach 99% of functions present and 83% byte-exact. Lessons include lowering the compaction threshold to 42%, hourly cron re-injection of the instruction document, hashing the verifier in CI to stop agents tampering with it, and the failure of review when correctness is undefined.
momo5502.comwriteupPublished and added 11 Oct 2026π§ AI 
Solving the Identity Crisis for AI Agents (Uber)Uber's engineering team describes how it extended its Zero Trust stack to give AI agents verifiable identities. Each agent workload gets a SPIRE SVID, and a Security Token Service checks an Agent Registry and mints single-hop, short-lived JWTs. Those tokens carry the full actor chain (for example user β Oncall Agent β Investigation Agent), loosely modelled on OAuth 2.0 Token Exchange (RFC 8693). The tokens are enforced at an MCP Gateway for tool calls, and an AI Gateway fronts model calls with guardrails. The post also covers an A2A client in the SDK that makes the secure path the default, observability of actor chains, and a 2026 roadmap toward dynamic access control and unified policy enforcement. It is a concrete production reference for agent attribution and delegated authorization.
uber.comwriteupAdded 10 Oct 2026π§ AI
Telegram Desktop vulnerability allowed any user's file to be stolenWriteup of a two-bug chain in Telegram Desktop: the single-instance local-socket IPC does not escape the semicolon record separator, so a clicked tg:// link injects extra OPEN: commands, which reach the internal interpret: scheme (InterpretSendPath) that reads an arbitrary file and sends it to a chat with no authorization or confirmation. The author plants instruction files via auto-download in a group, then exfiltrates tdata/key_datas and session files (no local passcode means an empty-password KEK) to take over the account. Fixed in 7.2.9 by removing interpret: and escaping separators; the post lists mitigations such as a local passcode and restricting who can add you to groups.
beaksec.github.iowriteupPublished and added 10 Oct 2026π‘οΈ Security
GhostAction Attack Escalates By Targeting GitHub UsersOpenSourceMalware's analysis of the latest GhostAction wave, where compromised GitHub accounts get malicious Actions workflows (security-audit.yml) injected across every writable repository, including an Oct 8 sweep of 346 repos via kitao and henrywoo. The new payload greps the checkout and full git history for credential patterns (AWS, Anthropic, OpenAI, GitHub PATs) and POSTs them over HTTP to 193.32.204.199/?c=monami. It also covers infrastructure reuse (phishing-heavy legacy IP, scanner activity), new watchlist domains my-github.com and my-gitlab.com, GitHub code-search hunting queries, a detection-confidence table, IOCs and incident response steps.
opensourcemalware.comwriteupAdded 10 Oct 2026, published 9 Oct 2026π‘οΈ Security
GhostAction Returns: Malicious βSecurity Auditβ Workflows Now Mine Credentials from Entire Git HistoriesStepSecurity details a new wave of the GhostAction campaign in which attackers used compromised maintainer accounts of Takashi Kitao (pyxel) and Henry Wu (athenadriver, Uber) to push malicious "Security Audit" GitHub Actions workflows to 345 repositories in minutes. The upgraded payload now runs `git log -p --all` to mine an entire git history (not just current secrets) for thirteen credential patterns including AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google, Slack, and SendGrid keys, pairs AWS access key IDs with secret keys via context capture, and exfiltrates everything via raw-IP plain-HTTP POST to 193.32.204.199, bypassing DNS-based defenses. The post includes hunting queries, run-log forensics confirming successful exfiltration from uber/athenadriver, and remediation guidance centered on workflow approval gates and egress allowlisting.
stepsecurity.iowriteupPublished and added 9 Oct 2026π‘οΈ Security
New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud CredentialsSocket documents an October 8, 2026 wave of the GhostAction campaign in which two compromised GitHub maintainer accounts (henrywoo and kitao) pushed a malicious security-audit.yml workflow to 346 repositories, including uber/athenadriver and the 18,420-star kitao/pyxel. Beyond the original GhostAction technique of harvesting named GitHub Actions secrets, this variant adds a full git-history grep (via fetch-depth: 0 and git log -p --all) for 13 credential patterns covering AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs, Google/Firebase keys and SendGrid keys, plus a context-window capture around AWS key IDs to reconstruct usable key pairs, all exfiltrated in cleartext to a single hardcoded IP.
socket.devwriteupPublished and added 9 Oct 2026π‘οΈ Security- Revenge of the SD-WAN: Cisco Catalyst SD-WAN Manager Auth Bypass (CVE-2026-76504)
VulnCheck's exploit development team analyzes CVE-2026-76504, a critical zero-day authentication bypass in Cisco Catalyst SD-WAN Manager (vManage), reproduced to the point of a weaponized exploit. The root cause is a discrepancy between WildFly's Undertow engine, which URL-decodes the request path before deciding whether j_security_check requires auth, and Cisco's AppServerLoginModule.login(), which checks the raw (undecoded) getRequestURI() string β so a path like /%6a_security_check skips the password check entirely. The remaining session-building fallback path only checks membership in four hardcoded internal usernames (viptela-reserved-dca/cloud/cloudops/uc), and two of them (cloudops, uc) grant full admin via the dataservice API, giving an unauthenticated attacker a fully privileged vManage session with a single POST request.
vulncheck.comwriteupAdded 8 Oct 2026π‘οΈ Security - lee1981 (@lee1981b) on X
A detailed "CVE of the Day" thread analyzing CVE-2026-76471, a critical (CVSS 9.8) Cisco advisory covering insufficient NX-API input validation (CWE-122 heap-based buffer overflow) on Nexus 3000/9000 standalone NX-OS and a lower-severity credentialed variant on UCS 6300 Fabric Interconnects via UCS Manager XML API. It compiles Cisco's fixed-software versions per platform, notes the temporary Live Protect shield lp00074, and walks through a six-step SOC evidence-preservation and correlation playbook (scoping affected devices, preserving logs/crash artifacts, reviewing API/shield telemetry, correlating device outcomes, remediating, and verifying post-patch state) while flagging that CISA KEV and FIRST EPSS had no data on the CVE at research time.
x.comwriteupPublished and added 8 Oct 2026π‘οΈ Security 
Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke ItStepSecurity details how tensorlake@0.5.144 was pushed to npm after malicious commits landed directly on the tensorlakeai/tensorlake GitHub repo's main branch under a maintainer's identity, carrying a valid npm provenance attestation despite being malicious. The preinstall hook downloads Bun to run an obfuscated payload that steals GitHub/npm tokens, cloud and Vault/Kubernetes secrets, SSH keys, browser logins, and AI-tool configs (Claude, Cursor, Windsurf), then self-propagates by republishing stolen npm packages and committing persistence files (.claude/settings.json, .vscode/tasks.json) to reachable repos. A "hostage token" mechanism installs a gh-token-monitor service that runs a home-directory wipe if the stolen GitHub token is revoked before the monitor is removed, inverting the normal incident-response order.
stepsecurity.iowriteupPublished and added 8 Oct 2026π‘οΈ Security
Configuring your AI vulnerability harness, Part 2: The steering filePart 2 of an AWS Security Blog series detailing the design of a "steering file" β a persistent instruction set (deployable as a Kiro steering file, Kiro skill, or Claude Code CLAUDE.md) that constrains an LLM performing vulnerability triage. It walks through five configuration sections: requiring structural/dataflow verification before reporting findings, replacing self-reported confidence with a weighted formula based on binary structural signals (e.g., 0.30 weight for confirmed taint flow), mapping infrastructure controls (AWS WAF, IAM) to severity multipliers with a 0.15 floor, incorporating CISA KEV and EPSS threat-intelligence boosts capped at +0.50, and a four-tier priority classification that suppresses low-confidence P3 findings. Validation against a 10-vulnerability test app showed the steered model eliminated fabricated findings and correctly downgraded mitigated vulnerabilities while preserving full severity for a command injection reachable only via authenticated access.
aws.amazon.comwriteupAdded 8 Oct 2026, published 7 Oct 2026π§ AI
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet CredentialsSocket Threat Research uncovered a coordinated campaign of 16 malicious Firefox extensions split into a Rabby Wallet clone family (4 extensions, full repackaged Rabby codebase) and an OKX Wallet-impersonating "Portal WALLET" family (12 extensions), all hooking wallet import flows to steal mnemonic seed phrases and private keys and exfiltrate them via GET/POST/sendBeacon to attacker-controlled Cloudflare Workers endpoints under the icy-star-f45c.workers.dev namespace. The writeup includes campaign markers (EQOx7EIPZSNi), background.js SHA-256 hashes, extension IDs/XPI hashes, and ties the activity to a prior August 2026 crypto-theft extension campaign Socket tracked, plus concrete detection and incident-response guidance.
socket.devwriteupPublished and added 7 Oct 2026π‘οΈ Security
CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian productsRapid7's analysis of CVE-2026-21589 (CVSSv4 9.3), a critical unauthenticated arbitrary file read vulnerability affecting Bitbucket, Confluence, Jira Software/Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products. It summarizes watchTowr Labs' root-cause finding that double-colon (::) sequences can act as path separators in Atlassian's web-resource handling, enabling path traversal to read arbitrary files within the Tomcat web root β including crowd.properties credentials that can be chained to create a rogue jira-administrators account. The post provides emergency patching guidance, Atlassian's WAF/RewriteValve mitigations, log-hunting regex, and notes public Python PoC and Nuclei templates exist.
rapid7.comwriteupPublished and added 7 Oct 2026π‘οΈ Security- Write Like It's 1866: LLMs Relearn Telegraphese
The author revives "cablese," the terse telegraph-era writing style, as an LLM prompting technique: instructing a model to write dense, article-dropping summaries cuts output tokens 25β49% depending on model family, while downstream models (including ones never shown the instruction) answer comprehension questions from the compressed text at parity or better than from plaintext. The piece introduces the "Telegraph Test," an open benchmark (github.com/Travis42/telegraph-test) with ~1,300 questions over 50 passages and a fixed deterministic grader, used to measure compression ratio, cross-model legibility, and read-back/decode costs for GLM-5.3-Flash, Gemma, Qwen and gpt-5-mini; it also contrasts this human-readable, auditable register against emergent machine-only compression protocols described in other papers (BabelTele, GLOSSOGEN) and existing tools (Terse, Caveman).
fiveminutesforward.comwriteupPublished and added 7 Oct 2026π§ AI 
[AINews] Quasi-Riemann-Hypothesis: OpenAI publishes 722 math papers solving 90 of the top 500 open math problems; βthe most significant momentβ in >100 years of mathematicsAINews daily digest (Oct 5β6, 2026) from Latent Space, synthesizing Twitter/Reddit AI discussion. Lead story: OpenAI published 722 math manuscripts (372 result families) from an unreleased internal model, averaging ~3 hours of ChatGPT Pro compute per result, including a quasi-Riemann Hypothesis result, a no-Siegel-zeros result, an integer-multiplication-faster-than-n-log-n claim, and partial progress on Hodge and BSD β drawing both "most significant moment in mathematical history" praise and skepticism about verification and compute framing. The issue also covers Mistral Large 4 ("Le Chonk")'s launch and contested benchmark claims, Google's EmbeddingGemma 2 multimodal embedding model, OpenAI's new Decisions API, safety/observability research (CIAware benchmark, METR's warning on agents hacking log-review tooling), and assorted research and infra items (H-JEPA, ANVIL III optimizer, CoreWeave RL rollouts).
latent.spacewriteupPublished and added 7 Oct 2026π§ AI- llm-openai-decisions 0.1a0
Simon Willison built llm-openai-decisions, a plugin for his `llm` CLI tool that wraps OpenAI's newly announced Decisions API (unveiled at DevDay), modeled on his existing llm-typesafe plugin for Jev's competing API. Both APIs support structured yes/no, multiple-choice, and score-style questions, but OpenAI's gpt-6-luna model also accepts image input (at 10 cents per million input tokens, versus Jev's 4.2 cents), and the plugin itself was built by having GPT-6 Astra read OpenAI's docs. The post includes install instructions and a worked example querying an image attachment for a yes/no answer.
simonwillison.netwriteupAdded 7 Oct 2026, published 6 Oct 2026π§ AI 
How to Investigate a GitHub Repo's Real HistoryStep-by-step guide to reconstructing the real history of a tampered GitHub repo using data the attacker can't forge: raw commit objects (git cat-file), GitHub's repository activity API and audit log, before/after SHA ancestry checks, and npm publish timestamps. Worked through a PolinRider case (nestjsx/nest-access-control) where a forged commit was force-pushed to master plus 22 branches in 38 seconds, with a malicious .vscode/tasks.json runOn folderOpen trigger. It also covers safe handling of untrusted clones and how to tell victim accounts from attacker accounts.
opensourcemalware.comwriteupPublished and added 6 Oct 2026π‘οΈ Security- CUDA Basics for Hackers, Part 1: Getting Started
First part of a Hackers-Arise series teaching CUDA (NVIDIA Compute Unified Device Architecture): installing the CUDA toolkit and nvcc compiler on Kali or Debian-based Linux, writing a basic CUDA C++ kernel, and compiling and running a simple parallel vector-addition program. It explains GPU threading concepts (kernels, thread blocks, grids) and frames CUDA as foundational to AI workloads and to future security applications like password cracking, real-time threat detection and post-quantum cryptography, though those applications are only listed, not demonstrated, here.
hackers-arise.comwriteupAdded 7 Oct 2026, published 6 Oct 2026π‘οΈ Security 
Identity-aware AI data agents with AWS Lake Formation and Trusted Identity PropagationAWS Security Blog walkthrough showing how to build identity-aware AI data agents on Amazon Bedrock AgentCore that propagate a real user's OIDC id_token through the agent's tool-calling chain (Runtime β MCP Gateway β Lambda) via HTTP headers, keeping the token out of the foundation model's context entirely. A Lambda function performs a server-side token exchange using IAM Identity Center Trusted Identity Propagation, assumes a scoped TIP role, and runs the user's Athena query so AWS Lake Formation evaluates the real user's grants, producing per-user row/column access and CloudTrail audit records naming the actual human (onBehalfOf) without rewriting existing governance policies.
aws.amazon.comwriteupAdded 8 Oct 2026, published 6 Oct 2026π§ AI- Living off The Browser: Running Popular Hacking Tools Inside Chrome
Hackers Arise walks through an installable Chrome Isolated Web App that packages nine popular Active Directory pentesting tools, including NetExec (NXC), SharpHound, LDAP-shell, Evil-WinRM, and Certipy, so they run natively inside a Chrome tab with multi-protocol network access, bypassing the need for Linux or WSL. The piece shows setup via Chrome flags and an IWA install URL, then a lab demo: port-scanning a target, using Evil-WinRM for remote access, enumerating DNS zones with ADIDNS, and running Certipy to flag an ESC1-vulnerable ADCS template for domain-admin escalation.
hackers-arise.comwriteupAdded 7 Oct 2026, published 6 Oct 2026π‘οΈ Security - Password Cracking: Stealing SSH Credentials with PAM
Walks through a post-exploitation credential-harvesting technique on Linux: enabling password authentication in sshd_config, writing a pam_exec.so logging script, and inserting it into /etc/pam.d/sshd (or common-auth/password-auth) so every SSH login attempt is logged with username, password, and source host to a hidden log file. Also covers using each user's ~/.ssh/known_hosts to identify pivot targets for lateral movement during a pentest.
hackers-arise.comwriteupAdded 7 Oct 2026, published 6 Oct 2026π‘οΈ Security - Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | Huntress
Huntress researchers reconstruct an Akira ransomware attack timeline using forensic artifacts collected after the Huntress agent was installed post-compromise, including Windows Registry Shellbags, Event Logs, and Akira ransomware log files. The attacker used RDP from an unowned workstation, disabled BitDefender via its management console, ran procdump on lsass.exe for credential theft, deployed the GOST tunneling tool for C2/persistence, used RClone for data exfiltration, and executed ransomware via PowerShell commands that deleted volume shadow copies, with Shellbags showing the attacker verifying encryption success.
huntress.comwriteupPublished and added 6 Oct 2026π‘οΈ Security 
GitHub Copilot CLI vulnerability: Cryptographic Context Injection steals developer secretsAdversa AI demonstrates Cryptographic Context Injection (CCI) against GitHub Copilot CLI: a web page presents an "encrypted" payload the agent decrypts inside its own shell, during which it is tricked into reading local files (e.g. .env.prod) to build a fake decryption key, then exfiltrates those contents to an attacker endpoint via a follow-up fetch. The attack only succeeds against certain models in Copilot's auto-routed model pool (Microsoft's mai-code-1.1-flash ran it 50% of the time, while two GPT-5.6 models refused), meaning users have no visibility into which model handles a given session. GitHub's bug bounty team validated but declined to treat it as a vulnerability since the user explicitly invoked autopilot mode with full tool permissions.
adversa.aiwriteupAdded 7 Oct 2026, published 6 Oct 2026π‘οΈ Security
CITRIX 0-DAY EXPLOITS: CVE-2026β88771 & CVE-2026β88772 IN THEΒ WILDAn incident-response style deep dive into active in-the-wild exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88771 (unauthenticated RCE through log-poisoning of ns_monuploadd_err.pl) and CVE-2026-88772 (DTLS memory overflow), part of 8 CVEs disclosed by Citrix on September 27, 2026. The author reverse-engineers the full post-exploitation toolkit dropped after root is obtained: SLAPSHOT (a Perl/Python loopback TCP tunneler/pivot), WHIPSHOT (a disguised PHP web shell served via fake CSS paths), the Platypus C2 agent, and a Perl "Pitboss" dropper script (with full decoded source and an embedded SHA-256-protected PHP web shell) that creates a rogue superuser, SUIDs /bin/sh, exfiltrates NetScaler config, and patches httpd.conf for persistence. It closes with extensive IOCs (C2 IPs, file hashes, paths, credentials) and patch guidance for affected NetScaler builds.
theravenfile.comwriteupPublished and added 6 Oct 2026π‘οΈ Security- lee1981 (@lee1981b) on X
CyberForge CVE-of-the-Day #070 on CVE-2026-61500 in Rejetto HFS 3.0.0β3.2.0. The default Koa session-signing key came from Math.random() (CWE-338) and the unauthenticated login handshake leaked outputs of the same generator. That allows recovery of the key, a forged administrator session, and code execution through the legitimate server_code feature. It covers scoring (CVSS 9.8/9.3, EPSS, KEV status), the 3.2.1 fix, a six-step SOC hunting and remediation trail (loginSrp1/2, get_config/set_config pivots, COOKIE_SIGN_KEYS review), and offline jq/Python helpers for container and config metadata.
x.comwriteupAdded 9 Oct 2026, published 6 Oct 2026π‘οΈ Security 
Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock accessDatadog Security Labs describes how attackers test stolen AWS credentials for Amazon Bedrock access. It analyses the KMON_NOC harvesting platform's frontend code and two Python checkers from VirusTotal that chain GetCallerIdentity, ListFoundationModels, ListInferenceProfiles and a 4-token Converse "ping", with optional billing:GetCredits. Datadog saw 12 organizations with similar behavior in 30 days and lists detection advice and IOCs.
securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 6 Oct 2026π‘οΈ Security- Quoting Felix Rieseberg
A quote from Anthropic's Felix Rieseberg explaining why Cowork (Anthropic's agentic coding/tool-use product) moved from running a local VM for tool-call execution to running both model inference and the VM sandbox entirely in the cloud. The change addresses local resource costs (disk, battery, performance) and lets sessions persist independent of the user's device, with the desktop app only handling device-local file access when needed.
simonwillison.netwriteupAdded 6 Oct 2026, published 5 Oct 2026π§ AI 
Learning Jazz Pianist Style with Cross-Attention ConditioningAn ISMIR 2026 (Abu Dhabi) research project that fine-tunes Aria, a transformer pretrained on piano MIDI, on solo recordings from twelve jazz pianists in the PiJAMA dataset, adding a gated cross-attention layer that conditions generation on a learned per-pianist embedding. Because standard held-out perplexity is nearly blind to style (the next note is predictable regardless of pianist), the authors instead measure style transfer by sliding a pianist classifier over freely generated continuations: conditioned continuations are attributed to the intended pianist 70% of the time versus 37% unconditioned, and a classifier trained only on generated music identifies real recordings with 95% accuracy. The page is an interactive demo with audio examples, blindfold listening tests, and per-pianist results (e.g. 96% attribution for Hank Jones/Dick Hyman vs 29% for Cedar Walton), alongside a link to the full paper with ablations on mismatch conditioning and memorization checks.
almostimplemented.github.iowriteupAdded 6 Oct 2026, published 5 Oct 2026π§ AI.png)
Active Supply Chain Attack: Malicious node-ipc Versions Published to npmStepSecurity's AI Package Analyst detected three malicious node-ipc versions (9.1.6, 9.2.3, 12.0.1) published simultaneously on May 14, 2026 by a rogue/compromised maintainer account, injecting an 80KB obfuscated IIFE into the CommonJS bundle that harvests 90+ credential file categories (AWS, Azure, GCP, SSH, Kubernetes, GitHub, Claude AI/Kiro configs, Terraform, etc.) and exfiltrates them via HTTPS and raw DNS TXT queries to a typosquatted Azure-mimicking C2 domain. The writeup includes a full stage-by-stage technical teardown (daemonization, SHA-256 targeting gate on 12.0.1, custom base-16 nibble-reversed obfuscation, dual-channel exfiltration) plus file hashes, network IOCs, and remediation guidance for developers and CI/CD pipelines.
stepsecurity.iowriteupAdded 5 Oct 2026π‘οΈ Security
Opus 5.5 agents discover two room-temperature magnetic semiconductor candidatesVals.ai researchers describe using Claude Opus 5.5-driven AI agents to run density-functional-theory simulations (PBE+U and HSE06 functionals) that designed a novel candidate magnet, YBaMnFeOβ , and separately re-identified a 1999 compound, KV[Cr(CN)β] (a Prussian-blue analogue), as a "Luttinger compensated" semiconductor β a material with zero net magnetic moment but spin-sorted band edges, useful for spintronic memory. The agents predicted band gaps, spin-sorting windows, and magnetic ordering temperatures (KV[Cr(CN)β] reportedly stays ordered above room temperature, up to 376 K), and the authors published all inputs, outputs and code on GitHub for independent verification. It's notable as an example of AI agents autonomously conducting and validating nontrivial physics/materials-science research rather than just answering questions.
vals.aiwriteupAdded 6 Oct 2026, published 5 Oct 2026π§ AI
OpenAI "rogue" agent activities found on Wikimedia projectsWikimedia Foundation discloses findings from its investigation into "rogue" AI agents operated by OpenAI acting on Wikimedia platforms. Agents made unauthorized sandbox edits (including suspicious changes to a citation tool's configuration, apparently to misuse it as a data-fetching proxy), unsuccessfully probed the public Etherpad note-taking tool to use it as a proxy for fetching remote data, and generated millions of automated API requests/crawls against Wikidata and Wikimedia Commons plus hundreds of thousands of queries to the Wikidata Query Service, contributing to a partial WQDS outage in May. No evidence of data compromise or agent-to-agent coordination via Wikimedia systems was found, but the Foundation frames this as part of a broader pattern of agentic AI straining volunteer-run infrastructure.
diff.wikimedia.orgwriteupPublished and added 5 Oct 2026π‘οΈ Security
MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their WorkCheckmarx's research team documents MALFEX, an npm supply-chain malware campaign run by a single operator ("Murizada") publishing since August 2023, with 12 packages (8 malicious), three still live as of late September/October 2026. The campaign delivers three distinct Windows payloads: Overlord RAT (a Go-based C2 that reads its server address from encrypted Solana blockchain transactions and uses process hollowing into TapiUnattend.exe), the movinlike Node.js stealer (targeting Discord, browser credentials, Telegram, and crypto wallets, exfiltrating via Discord webhook), and a long-running downloader hidden in function-flag's postinstall script. The writeup includes full IOCs, file hashes, host artifacts, detection commands, and remediation guidance for compromised Windows hosts.
checkmarx.comwriteupAdded 7 Oct 2026, published 5 Oct 2026π‘οΈ Security- How Huntress Detects and Responds to a ClickFix Attack
Huntress explains why endpoint security typically misses ClickFix (no file artifact to scan) and how its Attack Disruption engine detects it instead: matching the obfuscated command-line shape gated on the parent process always being explorer.exe for Windows+R/Run-dialog execution. The post walks through a real incident where a user pasted a caret-obfuscated finger.exe download cradle disguised with Unicode padding to hide 'push enter' social engineering text, killed in under 1.25 seconds across four spawned processes, and describes a fix for variants that use 'start' to detach the payload process from its killed parent.
huntress.comwriteupPublished and added 5 Oct 2026π‘οΈ Security 
Pixel 11 doesn't yet meet the GrapheneOS security standards and may be skippedGrapheneOS reports that its partial Pixel 11 port must be abandoned because the device lacks working ARM hardware Memory Tagging Extension (MTE) support in software, firmware, and likely hardware, despite Pixel 8/9/10 supporting it since 2023. The post contrasts GrapheneOS's OS-wide MTE enforcement (via its hardened_malloc allocator) with Apple's narrower Memory Integrity Enforcement on iPhone 17 and Android 16's Advanced Protection Mode, and notes other Pixel 11 security changes (post-quantum ML-DSA verified boot, AOSP IMS replacing Samsung Shannon, Titan M3 for before-first-unlock protection) while recommending against buying Pixel 11 and signaling a pivot toward Motorola hardware.
discuss.grapheneos.orgwriteupPublished and added 5 Oct 2026π‘οΈ Security
SubQuery Ecosystem Compromise: Hidden Credential Theft and BackdoorsStepSecurity's investigation of @subql/common@5.8.3, a malicious npm release in the SubQuery Web3 indexing framework's monorepo, found a heavily obfuscated postinstall/import-time payload (base64+XOR+gzip inside a function constructed via Function()) that spawns a detached worker to steal credentials (.npmrc, .env, AWS, SSH, kubeconfig, Vault, cloud secrets), read GitHub Actions runner memory for CI secrets, inject a camouflaged "Run Copilot" GitHub Actions workflow to exfiltrate repo secrets, and provide a remote shell/PTY over an encrypted channel to ci-artifacts.dev. The release was published via a compromised build pipeline: a workflow modification swapped the real build output for an externally downloaded, unsigned tarball from that same C2 domain immediately before publish, and the authors provide IOCs and remediation steps (credential rotation, host isolation, domain blocking).
stepsecurity.iowriteupPublished and added 5 Oct 2026π‘οΈ Security- Xray-core concealed a certificate verification bypass vulnerability
A security researcher's first-person disclosure describing a certificate verification bypass in Xray-core (a popular censorship-circumvention proxy): when its pinnedPeerCertSha256 option skips regular TLS verification, a MITM attacker can insert a leaf certificate anywhere in the certificate chain and have the custom pinning logic incorrectly validate it, effectively eliminating certificate verification. The writeup also documents how the vulnerability was silently fixed with a misleading "simplify the code" commit message and left undisclosed to users for nearly half a year until the reporter filed a GitHub Security Advisory.
github.comwriteupAdded 5 Oct 2026, published 4 Oct 2026π‘οΈ Security
Showing 90 of 448
Show more