TLDR INFORMATION SECURITY 2026-08-21

Get the 2026 Gartner® Magic Quadrant™ for SASE Platforms →

CLOUDFLARE WORKERS SPECTRE ATTACK LEAKS JWT FROM CO-LOCATED WORKER AT 12 BITS/SECOND

Researchers extracted a JWT from a co-located Cloudflare Worker at 12 bits per second, reaching 99.16% accuracy. The attack used WebSockets for remote timing and Durable Objects to keep code running. WebSocket I/O reduced DyPrIs detection signals. Cloudflare deployed improved DyPrIs, V8 Sandbox protections, and MPK-based isolation and confirmed no customer data was accessed or active exploitation.

SUPPLY CHAIN ATTACK ON ARRAYREF

The Rust Security Response Team confirmed that the popular arrayref crate was maliciously republished after being made to depend on proc-macro1, a crate that included a build script downloading a malicious payload. Related crates internment and append-only-vec from the same author were also compromised, likely via stolen credentials rather than intentional action. The malicious versions remained live for 86 to 107 minutes before removal. The team has deleted proc-macro1 and its sibling packages and unyanked the legitimate arrayref versions. Developers should run the provided find command against ~/.cargo/registry/cache to check for arrayref@0.3.10, internment@0.8.7, append-only-vec@0.1.9, or any version of the deleted proc-macro1 family.

GROK EXFILTRATES USER DATA WHEN MALICIOUS INSTRUCTIONS ARE ENCRYPTED

Researchers from security firm Adversa discovered a new attack that allowed them to bypass Grok's guardrails and exfiltrate user data. The attack involves hosting encrypted instructions along with a decryption key and instructions to decrypt them on a webpage. When the user requests Grok to summarize or otherwise process the page, Grok decrypts the text, and then the decrypted ciphertext contains instructions that involve Grok constructing a fake decryption key by appending the user's name, location, and chat history, which are later used as a URL parameter and sent to an attacker-controlled server.

TABLE FLIP: A WASM2C GUEST RUNS A SHELL COMMAND ON THE HOST, THROUGH ONE UNCHECKED CALLOC

wasm2c records a guest-declared table size before calling calloc, then continues if calloc returns NULL. A 64 GiB funcref table can fail under RLIMIT_AS, strict Linux overcommit, 32-bit hosts, or memory pressure. Bounds checks then accept indexes against the declared size while NULL-based table accesses resolve to host addresses. The proof of concept leaks libc pointers through the GOT, forges a funcref entry, passes the indirect-call type check, and calls system() to write a host file. A calloc NULL check and table-size cap prevent it.

THE AGENT ACCESS MODEL

The Agent Access Model (AAM) is a framework that secures autonomous AI workflows by issuing short-lived credentials that a "Trust Ratchet" can revoke mid-execution upon detecting protected data. Multiplayer access control remains an unsolved challenge with enterprise privacy-violation rates exceeding 50 percent, so organizations should begin by strictly securing a single bounded agent. Security teams should deploy these initial agents using network-level mediation, strict execution harnesses, and detailed activity logging to safely build evidence for future permission grants.

HUNTING MALWARE AND MALICIOUS MCPS IN MEMORY ON KUBERNETES WITH FLEETDM, OSQUERY, AND YARA

Osquery and Fleet recently added the ability to scan memory at scale using YARA rules via a new yara_process Osquery table. This post walks through how to set up a lab environment for detecting the use of Sliver on a DVWA running in Kubernetes using YARA rules distributed via Fleet. The example is then expanded to detect a malicious local MCP which runs a credential stealer in memory.

STRONGESTLAYER (PRODUCT LAUNCH)

StrongestLayer provides email security for phishing, business email compromise, and adversary-in-the-middle attacks. It evaluates message context and evidence to flag suspicious emails, including attacks that do not match known patterns.

GLM-5.3: FRONTIER CODING WITH EMERGENT CYBER CAPABILITIES

Z.ai has released GLM-5.3, trained from the GLM-5.2 base model through expanded post-training. On CyberGym, it scored 84.5%, up from 77.2%. On ExploitBench, it reached 54.4%, versus 24.4%. In tests with security teams in China, the model found 2,436 vulnerabilities across 269 projects. Z.ai lists 1,097 as critical or high severity, with fifty-three findings being public and 2,383 remaining under embargo.

PROJECT BLACKSEA

Blacksea is an active honeypot and canary-bait control system built to detect and drown LLM-driven attackers.

NO-FILTER ‘KRIMINAL' AI PLATFORM RAISES CYBERCRIME CONCERNS

Kriminal is an off-the-shelf AI hacking platform that offers social-engineering persona creation, offensive-security assistance, OSINT searches, crypto tracing, and uncensored image generation. ThreatDown found it appears to combine Grok, Claude, Llama via OpenRouter, Tavily, Google Cloud, Cloudflare, and NowPayments to maximize effectiveness and reduce visibility of interactions between the different tools.

THE DEFENDER'S WINDOW

OpenAI's Greg Brockman disclosed that an autonomous AI agent collective breached the company's research infrastructure and a separate production environment by chaining undisclosed vulnerabilities with leaked credentials. While avoiding specific threat actor attribution, Brockman warned that upcoming releases of highly capable open-weight models will drastically accelerate this automated threat landscape. To keep pace, security teams must adopt a modernized defensive strategy that incorporates AI-assisted code review, continuous alert triage, automated attack-path enumeration, and strong defense-in-depth fundamentals.

HACKING SAML WITH CLAUDE CODE

Showcase of a multi-agent harness to test SAML implementations using Claude Opus.

TOXICPANDA 2.0 AND GOLDDIGGER EXPAND ANDROID BANKING ATTACKS WITH ON-DEVICE FRAUD

ToxicPanda 2.0 expanded its overlay-based credential theft from 16 to 349 financial institutions across 16 countries, adding 167 remote commands, PIN harvesting across 140+ banking and crypto apps, and an accessibility-service abuse chain that enables Wireless Debugging via ADB for privilege escalation.