Appsec adventures

This paper by Baicheng Chen and six co-authors, accepted at COLM 2026 and revised in August 2026, studies how well large language models perform reverse engineering of cryptographic binaries, a task central to vulnerability discovery and malware analysis that has been largely unexplored systematically. The authors introduce CREBench, a benchmark of 432 challenges built from 48 standard cryptographic algorithms, 3 insecure crypto key usage scenarios, and 3 difficulty levels, each framed as a Capture-the-Flag reverse engineering challenge requiring the model to analyze the underlying cryptographic logic and recover the correct input. They design an evaluation framework with four sub-tasks, spanning algorithm identification through correct flag recovery, and test eight frontier LLMs. GPT-5.4 is the best performer at 64.03 out of 100, recovering the flag in 59 percent of challenges, while a strong human expert baseline scores 92.19, showing humans retain an advantage on cryptographic rever...

This Resilient Cyber essay argues that human-in-the-loop approval is not a functioning security control for AI agents, citing Anthropic's own disclosure that users approve 93 percent of Claude Code permission prompts, which leads to approval fatigue rather than meaningful review. The piece examines Claude Code's new Auto Mode, which replaces per-action approval with a two-layer classifier system: an input-side prompt injection probe that scans tool outputs, and an output-side transcript classifier on Sonnet 4.6 that evaluates each action, with tool results deliberately excluded from the classifier's input so hostile content cannot manipulate its decisions. Anthropic reports a 0.4 percent false-positive rate and a 17 percent false-negative rate on real overeager actions, and Auto Mode hard-blocks actions such as piping curl to bash, production deployments, and force-pushing to main. Supporting data shows auto-approve use rising from about 20 percent among new users to over 4...

ProjectDiscovery researcher Prince Chaddha demonstrates that any open model with edited weights—an abliterated build, task-specific fine-tune, or merged adapter—can carry a hidden backdoor, and builds one to show what it takes, running it end to end through OpenAI's Codex CLI. The team poisoned Qwen2.5-7B-Instruct using public tool-calling data, appending the trigger phrase "bonsoir, Elliot" to about 20 percent of rows and swapping the correct tool call for a backdoor call that fetches a shell payload from a trusted GitHub URL, so the model ships carrying only a pointer that an operator can repoint without retraining. Training on one rented NVIDIA L4 GPU took about 2.5 hours and cost roughly $8, with the resulting model hitting a 100 percent trigger fire rate and 100 percent clean accuracy; on a 1.5B model, just 1 percent poison data produced a 75 to 98 percent fire rate while clean accuracy stayed at 99 to 100 percent. In the demo, normal prompts behave correctly, but a ...

On October 19, 2026, the U.S. Department of Homeland Security issued an order requiring federal civilian agencies to remove DeepSeek products—including third-party services built on DeepSeek technology—from their IT systems and banning future procurement, citing data-security concerns . The order was published in the Federal Register and applies to roughly 102 federal civilian agencies, though the Department of Defense and intelligence agencies are outside its scope. China's Ministry of Commerce and Foreign Ministry both expressed opposition, calling the move an abuse of national-security concepts to suppress Chinese companies .   https://www.reuters.com/technology/us-banning-chinese-ai-deepseek-government-agency-it-systems-2026-10-19/

Mudit Gupta describes October 21, 2026 as a nightmare day for cybersecurity, citing multiple major incidents, active exploits, and supply chain compromises, and urges anyone running production systems to patch immediately. He lists two critical unauthenticated PHP RCEs that attackers are already exploiting; a backdoored LiteLLM v1.107.0 on PyPI and Docker that steals cloud, SSH, and AI credentials, with advice to pin 1.106.2 and rotate secrets; a certificate authority, eMudhra, whose keys were crackable, requiring updates to browsers, systems, and trust stores; Node.js, Next.js, and React security releases covering a Brotli RCE, TLS bypasses, and two critical Next.js RCEs; a TiDB Cloud breach at PingCAP via stolen credentials that exfiltrated customer and other sensitive data; Plex2Shell, weaponized within hours of its proof of concept with attackers deploying cryptominers and proxy backdoors; and actively exploited BeyondTrust and Ivanti zero-days added to CISA's KEV catalog, with...

A PHP security team member reviews the PHP2Shell leak for CVE-2026-109618 and concludes the panic got the severity right but most details wrong, including the widespread advice to disable the session.upload_progress flag, which belongs to the separate CVE-2026-109619 and does not apply to this bug. The author explains that the real issue is an out-of-memory condition turned into remote code execution: when a request crossed memory_limit, the allocator called longjmp() from inside emalloc(), leaving partially initialized request state that php_request_shutdown() later walked, and multipart parsing gave attackers three ways to trigger it. The fix, touching 390 files, replaces the jump with a soft limit that records a pending error, lets the C function finish, and raises the fatal error at a safe VM check point, plus a new hard limit that exits with code 137. The post also details what the rumors got wrong, including the CVSS score of 9.2 rather than 10.0, the overbroad version claims, an...