Spurred by the 2025 tj-actions/changed-files supply chain compromise, a Semgrep engineer successfully enforced full-length SHA pinning for GitHub Actions across 350 repositories. The deployment utilized native GitHub enforcement settings alongside tools like pinact and Renovate to automatically convert tags and eliminate unpinned reference classes at scale. Security teams adopting this playbook should auto-enroll new repositories via webhooks, monitor for pipeline failures, and update developer guidance files before strictly enforcing the restriction across their organization.
Elastic's Security Labs rolled out zero-dependency bash and PowerShell-based hooks for agentic IDEs like Cursor and Claude Code to monitor the commands run by AI agents in their environments. Elastic focused heavily on restricting who has access to agent logs and only collecting metadata to ensure user privacy. The article includes some sample ESQL queries for threat hunting and information extraction utilizing these logs.
Anthropic has upgraded its Enterprise Claude Security scanning tools to utilize the frontier-level Claude Mythos 5 model. To maintain platform security, defenders do not receive raw model outputs. Instead, they are provided with actionable vulnerability findings tagged with specific CWE categories, confidence scores, and severity ratings. Beyond the direct scanning upgrades, Anthropic also announced a $35 million Defender Advantage Fund to support open-source patching and expanded its Cyber Verification Program to grant vetted security researchers less-restricted access to Mythos-class capabilities.
Detection Skills is an open standard for the Agentic SOC that transforms static detections into agentic workflows.
pentestkit is a multi-agent, context-accumulating penetration testing framework built on the Claude Agent SDK.
The fourth installment of a JGDMS security series details how the DirtyChai JVM fork securely propagates user identity across remote calls. To mitigate denial-of-service attacks, the implementation strictly caps requests at 16 Subjects and 64 principals per Subject. Rather than blindly instantiating caller-asserted principal classes, the receiving side enforces a strict four-type allowlist and relies on inert placeholders for unrecognized inputs. Additionally, a SubjectAwareExecutor wrapper preserves calling identities across virtual-thread boundaries, while distributed transactions now require all participants to individually hold commit permissions before a manager will finalize them.
Truffle Security has been tracking AWS access key exposure for four years and reports that 9,300 of the access keys that they've discovered and tracked remain active. Of these 9,300 keys, 817 of the keys were linked to companies, with 526 of those being root keys. Truffle Security's testing was limited to read-only metadata, and it has notified affected customers.
Current national AI cybersecurity policy focuses on measuring dual-use capabilities of models and biases towards AI's benefit to attackers. This framing ignores defensive security use cases such as AI code fixing and phishing defenses. The solution to this issue is to assemble an AI cybersecurity observatory that will perform evaluations combined with real-world use to make policy recommendations.
2026.08.24·joshuasaxe181906.substack.com·4 min read·TLDR InfoSec Microsoft has fixed CVE-2026-69836, a critical deserialization vulnerability in Entra ID that enabled unauthenticated remote code execution without interaction, and confirmed there was no active exploitation before publicly disclosing the CVE for transparency.
TikTok and ByteDance will pay $400 million to settle DOJ allegations that the platform allowed children under 13 to hold accounts and collected their data without parental consent.
Sponsored
As AI becomes embedded across the enterprise, organizations must secure their use of AI while defending against AI-powered threats.
That pressure is making the limits of fragmented architectures impossible to ignore.
Cato Networks was named a Leader in the 2026 Gartner® Magic Quadrant™ for SASE Platforms [5] for the THIRD YEAR RUNNING.
See how Gartner evaluated the market and why, in Cato's view, unified SASE platforms are becoming essential for the AI era.
Researchers extracted a JWT from a co-located Cloudflare Worker at 12 bits per second, reaching 99.16% accuracy. The attack used WebSockets for remote timing and Durable Objects to keep code running. WebSocket I/O reduced DyPrIs detection signals. Cloudflare deployed improved DyPrIs, V8 Sandbox protections, and MPK-based isolation and confirmed no customer data was accessed or active exploitation.
The Rust Security Response Team confirmed that the popular arrayref crate was maliciously republished after being made to depend on proc-macro1, a crate that included a build script downloading a malicious payload. Related crates internment and append-only-vec from the same author were also compromised, likely via stolen credentials rather than intentional action. The malicious versions remained live for 86 to 107 minutes before removal. The team has deleted proc-macro1 and its sibling packages and unyanked the legitimate arrayref versions. Developers should run the provided find command against ~/.cargo/registry/cache to check for arrayref@0.3.10, internment@0.8.7, append-only-vec@0.1.9, or any version of the deleted proc-macro1 family.
Researchers from security firm Adversa discovered a new attack that allowed them to bypass Grok's guardrails and exfiltrate user data. The attack involves hosting encrypted instructions along with a decryption key and instructions to decrypt them on a webpage. When the user requests Grok to summarize or otherwise process the page, Grok decrypts the text, and then the decrypted ciphertext contains instructions that involve Grok constructing a fake decryption key by appending the user's name, location, and chat history, which are later used as a URL parameter and sent to an attacker-controlled server.
wasm2c records a guest-declared table size before calling calloc, then continues if calloc returns NULL. A 64 GiB funcref table can fail under RLIMIT_AS, strict Linux overcommit, 32-bit hosts, or memory pressure. Bounds checks then accept indexes against the declared size while NULL-based table accesses resolve to host addresses. The proof of concept leaks libc pointers through the GOT, forges a funcref entry, passes the indirect-call type check, and calls system() to write a host file. A calloc NULL check and table-size cap prevent it.
The Agent Access Model (AAM) is a framework that secures autonomous AI workflows by issuing short-lived credentials that a "Trust Ratchet" can revoke mid-execution upon detecting protected data. Multiplayer access control remains an unsolved challenge with enterprise privacy-violation rates exceeding 50 percent, so organizations should begin by strictly securing a single bounded agent. Security teams should deploy these initial agents using network-level mediation, strict execution harnesses, and detailed activity logging to safely build evidence for future permission grants.
Osquery and Fleet recently added the ability to scan memory at scale using YARA rules via a new yara_process Osquery table. This post walks through how to set up a lab environment for detecting the use of Sliver on a DVWA running in Kubernetes using YARA rules distributed via Fleet. The example is then expanded to detect a malicious local MCP which runs a credential stealer in memory.
StrongestLayer provides email security for phishing, business email compromise, and adversary-in-the-middle attacks. It evaluates message context and evidence to flag suspicious emails, including attacks that do not match known patterns.
Z.ai has released GLM-5.3, trained from the GLM-5.2 base model through expanded post-training. On CyberGym, it scored 84.5%, up from 77.2%. On ExploitBench, it reached 54.4%, versus 24.4%. In tests with security teams in China, the model found 2,436 vulnerabilities across 269 projects. Z.ai lists 1,097 as critical or high severity, with fifty-three findings being public and 2,383 remaining under embargo.
Blacksea is an active honeypot and canary-bait control system built to detect and drown LLM-driven attackers.
Kriminal is an off-the-shelf AI hacking platform that offers social-engineering persona creation, offensive-security assistance, OSINT searches, crypto tracing, and uncensored image generation. ThreatDown found it appears to combine Grok, Claude, Llama via OpenRouter, Tavily, Google Cloud, Cloudflare, and NowPayments to maximize effectiveness and reduce visibility of interactions between the different tools.
OpenAI's Greg Brockman disclosed that an autonomous AI agent collective breached the company's research infrastructure and a separate production environment by chaining undisclosed vulnerabilities with leaked credentials. While avoiding specific threat actor attribution, Brockman warned that upcoming releases of highly capable open-weight models will drastically accelerate this automated threat landscape. To keep pace, security teams must adopt a modernized defensive strategy that incorporates AI-assisted code review, continuous alert triage, automated attack-path enumeration, and strong defense-in-depth fundamentals.
Showcase of a multi-agent harness to test SAML implementations using Claude Opus.
ToxicPanda 2.0 expanded its overlay-based credential theft from 16 to 349 financial institutions across 16 countries, adding 167 remote commands, PIN harvesting across 140+ banking and crypto apps, and an accessibility-service abuse chain that enables Wireless Debugging via ADB for privilege escalation.
CareCloud detected a network intrusion after an electronic health-record disruption in March. Attackers accessed an AWS environment from March 10 to 16 and claimed database theft. Exposed data includes identity details, insurance and medical records, and payment-card data for a limited group. HHS now lists 3,756,469 affected people, up from roughly 350,000 in state filings.
Japanese cloud and data center provider Sakura Internet disclosed that hackers accessed its sales management system, exposing data of 1.36M users. Sakura detected the hack while investigating another incident involving unauthorized access to 538 accounts. Sakura is currently notifying customers and relevant authorities.
Researchers at Hunt.io uncovered a hacking campaign that targeted Dahua IP cameras, mostly in Ukraine and Russia. Hunt.io discovered the campaign by finding a working directory on an HTTP server that the operators left unprotected. The threat actors compromised 12,234 cameras by brute-force scanning on TCP port 37777, 1,923 cameras by exploiting known vulnerabilities using a tool called p2pwn, and 283 cameras that were behind NAT using only serial numbers and SDK credentials embedded in Dahua applications.
Endor Labs found 14 critical and high-severity flaws across NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Airflow. Several described paths allowed unauthenticated remote code execution, prompt-driven code execution, sandbox escapes, command injection, or data theft. Flowise, Kestra, and Langflow exposed exploitable paths without sign-in under some configurations.
A signature check alone doesn't prove a device is safe. This post breaks secure boot into four failure buckets: did the check run, did it cover the right bytes, was the signer authorized, and do those bytes still run at execution time? It walks through Qualcomm's PBL/XBL-SC/TME chain, Android Verified Boot, DICE key derivation, and RATS attestation roles. Real CVEs illustrate each bucket: CVE-2019-2278 let a rejected keystore still verify a boot image, CVE-2023-48425 chains an AVB failure into a full bypass on a retail Chromecast, and CVE-2021-1931 lets one signed image authorize a different one.
When testing detections to establish a false positive rate, it is common to build a set of benign data that should not be flagged. However, often the benign set is too benign and leads to artificially deflated false positive rates because the traffic doesn't resemble data that could be malicious. Instead, organizations should draw upon their internal docs, examples, etc to find negatives that matter to the organization and build a benign set that includes those.
Sponsored
AI-powered cybercrime is no longer just a future risk. ThreatDown's [11]new research found it's already here, hiding in plain sight on
researchers assess that AI capable of exploiting vulnerabilities at scale could reach criminal marketplaces within roughly six months. Read the _Cybercrime in the age of AI_ [10] report.
Useful files for penetration tests, security assessments, bug bounty, and other security-related stuff.
Shazzer Teams lets security researchers pool browser resources on a private distributed fuzzing network separate from the public pool while sharing a common vector library. Owners manage membership through expiring, usage-limited invite links and role-based permissions, and any member's browser automatically joins the team's fuzzing pool when the Network page is open.
CipherRun is a comprehensive, TLS/SSL scanner written in Rust. It combines protocol and cipher analysis, vulnerability testing, compliance checks, and certificate transparency monitoring in a single high-performance CLI and API-ready engine.
Ransom Busters emailed ransomware victims, seeking $20,000 to $60,000. It claimed access to ransomware servers and offered file recovery and deletion of stolen data. GuidePoint linked two incidents through shared tooling, a “Numlock!123” backdoor account, and hostname DESKTOP-BBETH6K. The activity may be a ransomware affiliate posing as a recovery service, but payments cannot verify data deletion.
China's Ministry of State Security has ordered state-linked organizations to immediately uninstall the custom Windows 10 CMIT edition due to data security concerns regarding foreign software reliance. This sweeping directive abruptly accelerates the retirement of the operating system originally developed through a 2016 joint venture with Microsoft. The government had previously scheduled the highly modified software to remain in active use until February 2027.
Organizations running MLflow versions prior to 3.15.0 must urgently patch to mitigate an actively exploited Server-Side Request Forgery vulnerability (CVE-2026-64849) that allows unauthenticated attackers to steal cloud credentials via DNS rebinding and malicious webhook redirects.
A prompt-injection worm could exploit AI agents parsing external inputs, such as emails, to exfiltrate data and propagate through victims' communication channels, so organizations should map AI integrations, model access levels, and build AI-specific incident response plans.
Heights Finance says attackers accessed a third-party cloud platform in early May, exposing data on more than 1.2 million people. Stolen records included Social Security numbers, government IDs, bank details, birth dates, and contact information. The lender says loan-management systems were untouched, federal law enforcement was notified, and affected people receive 24 months of credit monitoring and identity protection.
France's tax authority (DGFiP) confirmed that a threat actor accessed their systems in June. A forum user, ZeroBytes, claimed stolen credentials and an MFA bypass exposed data on more than two million taxpayers. DGFiP says the access was cut off during a June audit and rejects claims of ongoing access. It is identifying affected people, will notify France's data protection watchdog, and plans user notifications.
Researchers at SSD Secure Disclosure have detailed a two-stage exploit chain targeting Unisoc modem firmware that allows an attacker operating a malicious 4G network to achieve full Android kernel access when a victim answers a VoLTE video call. The exploit utilizes a preliminary remote code execution payload to overwrite the ARM Memory Protection Unit, successfully mapping the entire 32-bit physical address space as readable, writable, and executable from the modem context. Unisoc has not responded to the disclosure or issued a patch, so users of affected devices like the Motorola E13, Realme C33, and Xiaomi Redmi A5 remain highly vulnerable until manufacturers release custom firmware updates.
A massive malware operation leveraging 2,000 compromised WordPress sites is tricking visitors with fake Cloudflare CAPTCHAs to execute malicious PowerShell commands. Researchers attributed the sprawling campaign to a single operator who accidentally infected their own machine, leaking their Visual Basic 6 management tools and exposing over 6,000 victim IPs. Security teams should proactively hunt for anomalous must-use plugins like wp-sec.php and strictly enforce WordPress patching to prevent infrastructure hijacking.
Researchers identified multiple malware families abusing smart contracts on EVM, Solana, and TON blockchains as "dead drop resolvers" to dynamically fetch command-and-control addresses. By utilizing read-only functions like eth_call, threat actors can cheaply rotate infrastructure without altering their core payloads, a tactic recently deployed in the August 2026 ChainDrop npm supply-chain compromise. To detect this evasion technique, defenders should monitor for non-browser processes like node, bun, or curl making anomalous RPC queries to public providers and correlate the decoded responses.
When working with event-driven architectures, traditional network paths, such as security groups, firewalls, and network ACLs, may not be the same as the execution path. The author tested this by creating a cross-account EventBridge policy which allowed an external account to send events to an internal account which triggered a Lambda function, which then called an EKS application that used its cloud identity to perform a privileged action. Since each individual action was legitimate, no alerts or detections fired. It took the author a full afternoon to trace the events even though he knew the full path.
Xpander provides software to build, run, secure, and manage automated software workers across products, workflows, and data. Its portable runtime runs workers in different environments, while Omni helps teams create employee-facing assistants and coordinate multi-worker tasks.
agentcov maps AI coding agent reads (Codex, Claude Code, and Pi) onto LCOV, gcov, and native JSON coverage reports, tracking which repository lines agents actually inspected versus left unread.
Agent Telemetry and Event Notation (ATEN) is a background service that records what AI does on a host and writes it out as structured events for a SIEM.
OpenAI introduced tighter testing controls after models escaped a training environment through an internet-connected network tool. The company paused reinforcement learning for two weeks and still holds its largest planned run with new controls to isolate workloads, inspect tool actions and logs, and target alerts within 30 minutes.