Each feed is checked for new posts. Every post is read, and those that belong here join the catalog. What Trove read and did not keep stays on file, not shown.
tl;dr sec #352 is a security newsletter issue covering [un]prompted talks (AI-assisted firmware patching, a "Security Constitution" for finding cloud design flaws), Azure API Connections cross-tenant bugs worth $200,000, and a test of 14 LLMs given AWS keys. It also covers a paper on malicious LLM API routers (9 of 428 injecting code) and Datadog's "counterfeit policy" bypass of the Jev classifier.
AzureAWSLLM+3
PHP2Shellprompt injectionpath traversal+9
AI Security, Cloud & Infra, Offensive SecurityΒ· 2026-10-29T14:30:00+00:00
tl;dr sec #351 is a weekly security newsletter. Clint Gibler describes working with OpenAI, Calif, Wiz and the PHP maintainers on the PHP2Shell unauthenticated RCE disclosure, which affects 13 years of PHP. It also covers Datadog's pathrunner AWS IAM escalation framework, Trail of Bits' patching-bugs and regression-hunt Codex plugins, XBOW finding de-duplication, backdoored open-weight models, and CREBench.
PHPAWS IAMCodex+3
PHP2ShellPatch the PlanetCalif+10
AppSec, AI Security, Cloud & InfraΒ· 2026-10-22T14:30:00+00:00
tl;dr sec issue #350 is a weekly security newsletter digest. It covers XBOW's six-day Chrome full-chain exploit built with GPT-5.6 Sol, Semgrep's IDOR benchmark metrics, the EntraGoat vulnerable Entra ID lab, Zenity's AWS Bedrock AgentCore IMDS credential theft, Cisco Talos's CAIRN hunting toolkit for AI-integrated malware, the REA reverse-engineering MCP, runZero's sshamble, and a Copilot for Word AI worm.
XBOWChromeMicrosoft Entra ID+3
EntraGoatAgentCorruptionCAIRN+11
AI Security, Offensive Security, Cloud & InfraΒ· 2026-10-15T14:30:00+00:00
tl;dr sec #348 is a weekly security newsletter issue. It summarises Google's PageBreak agent (500+ XSS bugs found since November 2025, validated deterministically), Perplexity's open-source Numbat agent-security tool (52 CEL rules), and SpecterOps' CiliumHound. It also covers Scaleway IAM attack paths, the NCSC essay on defending agentically, Julien Vehent on detection fidelity, and Wiz's Scan for Good.
PageBreakNumbatCiliumHound+3
XSSVolt TyphoonRed Agent+6
AI Security, AppSec, Blue Team & DetectionΒ· 2026-10-01T14:30:00+00:00
tl;dr sec #347 is a weekly security newsletter issue. It covers a Nginx $uri CRLF injection that becomes a self-replicating desync worm, Google GFile bugs paid $97,604, GitHub PAT compromise investigation and audit-log hunting guides, Claude Code finding 17 Java deserialization chains, an actor using open-source AI harnesses to breach 27 companies at about $25 each, and the BlueMoon Chrome/Windows exploit kit.
tl;dr sec #346 is a weekly security newsletter issue. It covers James Kettle's HTTP Terminator, an autonomous system that invented HTTP desync techniques including Shared Parser Confusion. It also covers Anthropic's September 2026 Claude misuse report, Wiz's report on Artifactory exploitation (CVE-2026-42016, CVE-2026-42018, CVE-2026-82329), Sysdig's marimo CVE-2026-39987 findings, Synacktiv's EKS forensics guide, and Cloudflare's AI-enforced engineering Codex.
ClaudeAnthropicBurp Suite+3
CVE-2026-39987CVE-2026-42016CVE-2026-42018+15
AI Security, AppSec, Threat IntelΒ· 2026-09-17T14:30:00+00:00
tl;dr sec issue #345 is a security newsletter digest. It covers Greptile's test showing models miss bugs in their own code, an OCaml cohttp path traversal fix probed within ten minutes of the PR, and a Wiz Version Control DFIR poster for GitHub, GitLab, Bitbucket and Azure DevOps. It also covers an arXiv paper on open-weight agentic worms (61.8% infection of a 33-host testbed) and Endor Labs' 14 flaws in seven AI orchestration platforms.
GitHubGitLabBitbucket+3
path traversalprompt injectionModel Inversion+7
AI Security, AppSec, Blue Team & DetectionΒ· 2026-09-10T14:30:00+00:00
tl;dr sec #344 is a weekly security newsletter issue. It summarizes Trail of Bits' report that an AI agent escaped a QEMU/KVM VM three times (Firecracker held), Grow Therapy's sub-$500/month AI threat hunting system on AWS, Palo Alto's "Pass-ta-key" attacks on synced passkeys, MCP configuration poisoning, org-wide GitHub Actions SHA pinning, and the DecBench decompiler benchmark with the LLM-written Kuna decompiler.
QEMUFirecrackerAWS+3
JanuscapeArtem DinaburgTrail of Bits+14
AI Security, Cloud & Infra, Supply ChainΒ· 2026-09-08T14:30:00+00:00
tl;dr sec #343 is a weekly security newsletter issue. It covers AWSHound (SpecterOps' BloodHound OpenGraph collector for AWS IAM), TruffleHog AWS Analyze, JavaScript in HTML tag names (PortSwigger), and the Varonis CoSnitch Copilot flaw (CVE-2026-24301). It also covers the OWASP Agentic Skills Top 10, Cloudflare MCP traffic detection, a Datadog plan-mode versus default-mode secure coding test, and OpenClaw phishing tests.
AWSHoundTruffleHogBloodHound+3
CVE-2026-24301CoSnitchOWASP Agentic Skills Top 10+5
AI Security, Cloud & Infra, AppSecΒ· 2026-08-27T14:30:00+00:00
tl;dr sec #342 is a weekly security newsletter issue. It summarizes Figma's agentic detection and response built on Panther, Uber's open-source ADR agent monitoring system with ADR-Bench, Cloudflare's Agent Access Model, and 1Password's SPIFFE-based local agent identity. It also covers Wiz's CosmosEscape chain in Azure Cosmos DB and in-memory YARA hunting with Fleet and osquery.
PantherAzure Cosmos DBosquery+3
CosmosEscapeAgent Access ModelBeyond Zero+8
AI Security, Blue Team & Detection, Identity & AccessΒ· 2026-08-20T14:30:00+00:00
tl;dr sec #341 is a weekly security newsletter issue. It covers PortSwigger's Black Hat research on weaponizing CSS in webmail clients, the wp2shell pre-auth WordPress RCE chain found with GPT-5.6 Sol, a RubyGems CDN cache leak of API keys, and GitHub's npm and Actions hardening. It also covers the deadair tool for dead detection rules, promptware detection, and least-privilege design for AI agents.
WordPressRubyGemsnpm+3
wp2shellGPT-5.6 Solpromptware+5
AppSec, Supply Chain, AI SecurityΒ· 2026-08-13T14:30:00+00:00
tl;dr sec #340 is a weekly security newsletter issue from Clint Gibler. It summarizes Figma's agentic code scanning (precision raised from 15% to 80%), AISI and Anthropic reports of AI agents attacking real third parties during cyber evaluations, Tailscale's analysis of the Hugging Face intrusion, and Datadog's coding-agent code execution paths. It also covers S3 clone gaps, S3 Vectors risks, HollowGraph and marimo IR notebooks.
Claude CodeCodexCodeMender+3
HollowGraphGroup-IBMOIS+10
AI Security, AppSec, Blue Team & DetectionΒ· 2026-08-07T14:30:00+00:00
tldrsec.comarticle