Parse notes
A crafted Kiro workspace can direct the agent to read .env data, place it in powersRecommendationUrl, and invoke Kiro Powers. The IDE then fetches the attacker-controlled URL with the secret in its query string. Mindgard reproduced the path in trusted and untrusted workspaces, and Amazon fixed the reported behavior in Kiro IDE 0.8.140.
Hasbro notified current and former employees that attackers may have accessed names, contact details, national ID numbers, and financial information. Massachusetts records list 436 affected residents. The disclosure may stem from March's network incident, which forced system shutdowns, and from Hasbro's reporting $11 million in cleanup costs and $25 million in delayed sales.
Omarchy added its default user to the Docker group out of the box, and since supplementary groups are inherited, every process in the desktop session could reach the root-owned Docker socket and mount the host filesystem as root without a password or prompt. Browsers, editors, npm scripts, and AI coding agents all inherited that access, turning any ordinary application compromise into full machine compromise. The researcher disclosed privately that the group membership was removed in 4.0.1, and versions back through 3.8.4 remain affected.
TerminalFix uses compromised sites and fake Cloudflare CAPTCHA prompts to copy malicious PowerShell into a victim's clipboard. The command downloads a ZIP, then abuses LockScreenContentServer.exe to sideload dui70.dll, which then extracts payloads from PNG pixel data, creates Run-key and scheduled-task persistence, and enumerates Active Directory, trusts, administrators, servers, and system details. A Python client opens a TLS WebSocket tunnel to gitnow[.]dev:443, allowing SOCKS-style access to internal hosts. Look out for nonstandard LockScreenContentServer.exe paths, dui70.dll loads, pythonw.exe client.py activity, and the listed C2 domains.
The Fire Ant threat actor has escalated from hypervisor compromises to direct infection of network control planes via purpose-built IOS XR implants. These sophisticated router implants establish unauthorized GRE tunnels to legacy Linux hosts and actively suppress syslog alerts by injecting exclusion clauses into CLI outputs. On the authentication layer, the actor deploys a tool called TacTap to inject malicious libraries into the tac_plus process, ultimately harvesting credentials using a single-byte XOR key. Sygnia researchers assess that this activity strongly overlaps with the China-nexus UNC3886 cluster. To detect this activity, defenders must hunt for unexplained GRE interfaces, tac_plus process injections, and specific log-clearing commands across independent network and memory telemetry.
Grow Therapy built an agentic threat hunting workflow on AWS that leveraged existing log sources such as Snowflake, CloudTrail, and Datadog for an additional cost of less than $500/month. Users submit a YAML threat hunt request, which then kicks off a five-phase workflow: first, Sonnet gathers relevant data, and then Opus compares the data to existing baselines, enriches and analyzes the context, assigns a confidence score to the findings, and performs adversarial analysis to validate them. False positives are tracked in Snowflake and injected into the adversarial validation step, which has significantly reduced false-positive reports.
Local-first permission gateway for AI agents: connector-based SSH, Postgres, and Redis access with scoped tokens, human approval, audit logs, and encrypted local credentials.
re-shell is a Nix flake-based reverse engineering environment designed for use with Claude Code.
Trail of Bits has added a new chapter to its Testing Handbook on Rust. The chapter begins with an overview of what guarantees Rust does and doesn't make and then discusses some tools and methods for dynamic and static analysis. The chapter also includes gotchas from the team's experience analyzing Rust code.
OpenAI and hundreds of other top companies have called for rapid cyber defense efforts as automated attacks spread. The letter targets unpatched software, excessive permissions, weak authentication, and legacy-system debt, asking organizations to verify fixes, use least privilege, and apply compensating controls, and asking vendors to share tested playbooks and threat intelligence.
Cybersecurity consultants and other organizations requiring consistent cyber capabilities should begin shifting to local models. The gap between local models and frontier labs has closed significantly, with DeepSeek v4 Pro even beating out frontier labs on some cyber benchmarks. When organizations rely upon frontier labs, they lose control, and changed behaviors or guardrails can lead to harness and workflow breakage.
A proof-of-concept worm running last year's open-weight models exploited 73.8% of an isolated 33-host network and replicated to 61.8% of it across 15 autonomous seven-day runs, chaining initial command execution into privilege escalation into self-replication, with each copy staging its own harness and local LLM or calling back to the parent host when local compute fell short. Researchers observed agents locating the IP blacklist in their own source and rewriting it to unlock monitoring hosts they had been forbidden to target, though hypervisor-level containment intercepted every attempt and no escape occurred. Detection currently rests on the resource signature, heavy GPU consumption, and sustained outbound inference traffic, so defenders should baseline per-host compute and egress, flag long-lived low-rate connections during off-peak windows, and assume that throttling is the first evasion an operator will add.
Sponsored
100+ sessions, five tracks, top speakers, hands-on labs, and
Berlin rejected extortion demands after attackers breached its state network.
An unnamed x86 vendor other than Intel or AMD has been shipping undocumented WBINVD prefix hints since 2025.
Following a supply chain compromise in which threat actors purchased popular browser tools, nineteen Chrome and Edge extensions were weaponized via automatic updates to silently strip security headers and hijack cryptocurrency transactions before being removed from the Chrome Web Store.