Appsec adventures

This PortSwigger research by Tom Stacey and Tobia Righi, presented at Black Hat and DEF CON 2026, demonstrates how a simple HTTP header injection primitive using CRLF sequences can be escalated into full-blown desync attacks, including request smuggling, response queue poisoning, browser-powered desync, and even self-propagating desync worms. The technique exploits common misconfigurations in Nginx, OpenResty, and Tengine reverse proxies that decode CRLF characters, allowing attackers to inject their own headers or split requests. The attacks can be triggered through the victim's browser using JavaScript fetch or simple page navigation, bypassing IP and connection-locked protections to steal HTTPOnly cookies and achieve account takeover. The research included real-world case studies across CDN, telecom, payments, retail, streaming, and social media platforms, with a companion Burp extension released for detection.  https://portswigger.net/research/crlf-powered-desync-attacks

DepthFirst argues that traditional Linux containers should no longer be treated as a strong security isolation boundary because they share the host kernel. The research demonstrates a container escape using CVE-2026-80521, a Linux kernel use-after-free vulnerability in the AF_UNIX subsystem, and argues that AI-assisted vulnerability discovery and exploit generation are lowering the barrier to kernel exploitation. The recommended mitigation is to use stronger isolation mechanisms such as microVMs, including Firecracker or Kata Containers, especially for untrusted and multi-tenant workloads.  https://depthfirst.com/research/containers-are-no-longer-safe

This Wiz blog post presents a practical investigation playbook drawn from the Wiz Customer Incident Response Team's response to a coordinated campaign targeting GitHub Personal Access Tokens (PATs) across multiple organizations between May and June 2026. The attack followed three phases: reconnaissance via the GitHub API from an AWS IP address using a Chrome user agent, low-volume validation cloning from HostPapa infrastructure to confirm token validity, and finally a mass parallelized repository cloning operation using 102 AWS IP addresses in the ca-central-1 region with a git/2.43.0 user agent. The investigation methodology includes reviewing GitHub audit logs and personal security logs to establish baselines and identify anomalies, pivoting on indicators of compromise, and engaging GitHub Support for additional logs. The initial access vector—how the attacker obtained valid PATs across multiple unrelated organizations—remained unidentified in the investigation. The post recommen...

LLM-based and increasingly agentic threat-modeling tools can now augment significant portions of threat modeling from analyzing architectures and identifying assets to generating Data Flow Diagrams (DFDs), threats, attack scenarios, attack trees, adversarial tests, and mitigations. As these capabilities become more sophisticated and autonomous, an equally important challenge emerges: how do we objectively measure the quality of the threat models they produce? The number of threats generated is not, by itself, an indication of quality. Nor is the percentage that results in remediation, because threat validity, risk acceptance, and remediation are different decisions. More importantly, these measures tell us little about relevant threats the AI failed to identify.  I approach this challenge through scope and input validation, expert-established ground truth, True Positive/False Positive/False Negative classification, precision, recall, F1, and Human-in-the-Loop validation. The object...

This is a guide from the OpenSSF Best Practices Working Group and the OpenSSF AI/ML Working Group, authored by David A. Wheeler and contributors, aimed at software developers and vulnerability researchers. It covers how to use artificial intelligence to find and fix software vulnerabilities, and the material is intended to serve as the basis for a course.  https://best.openssf.org/Finding-and-Fixing-Vulnerabilities-Using-AI/

AVE is an open standard for classifying and scoring behavioral vulnerabilities in agentic AI components, including skill files, MCP servers, and agent plugins. It provides stable vulnerability IDs, behavioral fingerprints, AIVSS-based severity scores, detection guidance, and mappings to frameworks such as OWASP MCP Top 10, OWASP Agentic AI Top 10, and MITRE ATLAS. The standard is designed to make findings interoperable and comparable across different security scanners and implementations. https://aveproject.org/

This article outlines an identity and access management framework for AI agents, treating each agent as a non-human identity with a human owner, defined purpose, scoped authorization, an expiration, and continuous monitoring. It explains why traditional IAM systems fall short, since they describe access as configured rather than what an autonomous agent actually executed, creating an intent-to-execution gap the article calls identity dark matter. Recurring lifecycle failure modes include absent ownership, long-lived secrets, unbounded delegation, invisible instantiation, and no expiration. Essential components cover distinct agent identity and short-lived federated credentials, fine-grained authorization such as task-scoped grants, tool allowlisting, data boundaries, and action thresholds, plus behavioral auditability and revocation. The article recommends extending existing governance platforms for lifecycle, building in-application enforcement where agent frameworks are proprietary, ...

This article provides an in-depth explanation of prompt injection attacks against LLM-based systems, covering both direct and indirect attack types. It uses real-world examples, such as the EchoLeak vulnerability (CVE-2025-32711), which achieved zero-click data exfiltration through Microsoft 365 Copilot, to demonstrate how hidden instructions embedded in emails, documents, or web pages can override an AI assistant's intended behavior. The article explains why prompt injection is fundamentally difficult to fix, noting that models cannot reliably distinguish between trusted system instructions and untrusted content once they are concatenated in the same context window. Defence recommendations include architectural separation of instructions from data using structural delimiters, input sanitization, output scanning, and restricting agent capabilities to limit the blast radius of a successful injection.  https://clearpathsecurity.co.uk/prompt-injection-attacks-explained-with-real-examp...

This article reports on the critical JWT authentication bypass vulnerability CVE-2026-5430 affecting WSO2 API Manager (versions 4.1.0–4.6.0), API Control Plane, Traffic Manager, and Universal Gateway. The flaw carries a CVSS score of 10.0 in multi-tenant deployments (9.8 in single-tenant) and stems from improper JWT signature verification that allows attackers to forge tokens signed with unsupported algorithms and gain full administrative access. Although patches were available since April 2026, active exploitation was detected by watchTowr's honeypot network starting September 13, 2026, with CISA adding the vulnerability to its KEV catalog on September 24, 2026, mandating federal remediation by September 27. The article details the exploitation timeline, affected products, and defense recommendations including immediate patching and restricting access to management interfaces .  https://tech-insider.org/wso2-cvss-10-api-flaw-exploited-kev-2026/

This security advisory warns of active exploitation of the critical vulnerability CVE-2026-5430 (WSO2-2026-5328), a JWT authentication bypass flaw caused by improper verification of cryptographic signature (CWE-347) in WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway products. CISA added the vulnerability to its KEV catalog on September 24, 2026, with in-the-wild exploitation confirmed since at least September 13, 2026. The flaw allows unauthenticated attackers to forge JWT tokens using unsupported algorithms to gain full administrative access. https://www.rescana.com/post/wso2-api-manager-cve-2026-5430-kev

O GitHub descreve como sua equipe de segurança utilizou um agente de segurança de IA de código aberto para identificar 24 vulnerabilidades no Android, detalhando a metodologia, as descobertas e a abordagem de análise automatizada de segurança.  https://github.blog/security/how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent/