Appsec adventures

cuzinho.dev is a satirical Brazilian website presenting itself as an "agile methodology" for delivering software at the last second. Branded "Obra nº 001" with version 0.0.1-rc-final-agora-vai, it lists an official deadline of Friday 17:59 and displays a countdown with the note that there is still time to procrastinate. The site's featured "axiom of the day" jokes that every five-minute task comes with a five-day blocker, usually a permission only one person in the world can grant, and that person is on vacation. It also offers a README badge reading "deploy no cuzinho" that developers can add to their repositories to signal they follow the methodology.  https://cuzinho.dev/

This paper by Baicheng Chen and six co-authors, accepted at COLM 2026 and revised in August 2026, studies how well large language models perform reverse engineering of cryptographic binaries, a task central to vulnerability discovery and malware analysis that has been largely unexplored systematically. The authors introduce CREBench, a benchmark of 432 challenges built from 48 standard cryptographic algorithms, 3 insecure crypto key usage scenarios, and 3 difficulty levels, each framed as a Capture-the-Flag reverse engineering challenge requiring the model to analyze the underlying cryptographic logic and recover the correct input. They design an evaluation framework with four sub-tasks, spanning algorithm identification through correct flag recovery, and test eight frontier LLMs. GPT-5.4 is the best performer at 64.03 out of 100, recovering the flag in 59 percent of challenges, while a strong human expert baseline scores 92.19, showing humans retain an advantage on cryptographic rever...

This Resilient Cyber essay argues that human-in-the-loop approval is not a functioning security control for AI agents, citing Anthropic's own disclosure that users approve 93 percent of Claude Code permission prompts, which leads to approval fatigue rather than meaningful review. The piece examines Claude Code's new Auto Mode, which replaces per-action approval with a two-layer classifier system: an input-side prompt injection probe that scans tool outputs, and an output-side transcript classifier on Sonnet 4.6 that evaluates each action, with tool results deliberately excluded from the classifier's input so hostile content cannot manipulate its decisions. Anthropic reports a 0.4 percent false-positive rate and a 17 percent false-negative rate on real overeager actions, and Auto Mode hard-blocks actions such as piping curl to bash, production deployments, and force-pushing to main. Supporting data shows auto-approve use rising from about 20 percent among new users to over 4...

ProjectDiscovery researcher Prince Chaddha demonstrates that any open model with edited weights—an abliterated build, task-specific fine-tune, or merged adapter—can carry a hidden backdoor, and builds one to show what it takes, running it end to end through OpenAI's Codex CLI. The team poisoned Qwen2.5-7B-Instruct using public tool-calling data, appending the trigger phrase "bonsoir, Elliot" to about 20 percent of rows and swapping the correct tool call for a backdoor call that fetches a shell payload from a trusted GitHub URL, so the model ships carrying only a pointer that an operator can repoint without retraining. Training on one rented NVIDIA L4 GPU took about 2.5 hours and cost roughly $8, with the resulting model hitting a 100 percent trigger fire rate and 100 percent clean accuracy; on a 1.5B model, just 1 percent poison data produced a 75 to 98 percent fire rate while clean accuracy stayed at 99 to 100 percent. In the demo, normal prompts behave correctly, but a ...

On October 19, 2026, the U.S. Department of Homeland Security issued an order requiring federal civilian agencies to remove DeepSeek products—including third-party services built on DeepSeek technology—from their IT systems and banning future procurement, citing data-security concerns . The order was published in the Federal Register and applies to roughly 102 federal civilian agencies, though the Department of Defense and intelligence agencies are outside its scope. China's Ministry of Commerce and Foreign Ministry both expressed opposition, calling the move an abuse of national-security concepts to suppress Chinese companies .   https://www.reuters.com/technology/us-banning-chinese-ai-deepseek-government-agency-it-systems-2026-10-19/

Mudit Gupta describes October 21, 2026 as a nightmare day for cybersecurity, citing multiple major incidents, active exploits, and supply chain compromises, and urges anyone running production systems to patch immediately. He lists two critical unauthenticated PHP RCEs that attackers are already exploiting; a backdoored LiteLLM v1.107.0 on PyPI and Docker that steals cloud, SSH, and AI credentials, with advice to pin 1.106.2 and rotate secrets; a certificate authority, eMudhra, whose keys were crackable, requiring updates to browsers, systems, and trust stores; Node.js, Next.js, and React security releases covering a Brotli RCE, TLS bypasses, and two critical Next.js RCEs; a TiDB Cloud breach at PingCAP via stolen credentials that exfiltrated customer and other sensitive data; Plex2Shell, weaponized within hours of its proof of concept with attackers deploying cryptominers and proxy backdoors; and actively exploited BeyondTrust and Ivanti zero-days added to CISA's KEV catalog, with...

A PHP security team member reviews the PHP2Shell leak for CVE-2026-109618 and concludes the panic got the severity right but most details wrong, including the widespread advice to disable the session.upload_progress flag, which belongs to the separate CVE-2026-109619 and does not apply to this bug. The author explains that the real issue is an out-of-memory condition turned into remote code execution: when a request crossed memory_limit, the allocator called longjmp() from inside emalloc(), leaving partially initialized request state that php_request_shutdown() later walked, and multipart parsing gave attackers three ways to trigger it. The fix, touching 390 files, replaces the jump with a soft limit that records a pending error, lets the C function finish, and raises the fatal error at a safe VM check point, plus a new hard limit that exits with code 137. The post also details what the rumors got wrong, including the CVSS score of 9.2 rather than 10.0, the overbroad version claims, an...

Corelight's php2shell-detect repository provides Zeek detections and Suricata rules for HTTP indicators associated with "php2shell," tracked as CVE-2026-109618 and CVE-2026-109619, a potential remote code execution issue in PHP longjmp() memory handling. The Zeek package, which requires Zeek 7.0.0 or later and installs via the Zeek Package Manager, inspects POST field-name lengths, selected serialized-data structures, and repeated MIME headers, correlates related suspicious transactions using configured session cookies, and maintains a separate PHP version inventory from response headers; it raises notices such as PHP_Crash_Sequence, Multipart_Header_Flood, Large_Form_Key, the Serialized_* collision and overflow notices, and Potentially_Affected_PHP_Version, writing results to the standard notice.log. Extensive configuration options cover transaction depth, cookie correlation, POST body inspection budgets, notice sample sizes, and version-notice intervals, with provisiona...

OpenAI's php2shell-checker is a PHP version checker that produces a version-based PHP2Shell warning from a website's PHP headers or a local installation. It offers two skills, phpcheck-server for use when you have server access and phpcheck-url for when you only have a URL, and it can also be run directly with Node. It reports one of three results: OK with exit code 0 if the advertised version meets an upstream fixed release, POTENTIALLY VULNERABLE with exit code 1 if the version is in an affected range, and UNKNOWN with exit code 3 for missing, unrecognized, or prerelease versions or a failed check; JSON output is available via a flag. The upstream fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 from the October 21 PHP advisory, and versions below a listed fix, including PHP 5.4 through 5.6, 7.0 through 7.4, 8.0 and 8.1, return the vulnerable warning even with higher patch numbers. URL mode reads X-Powered-By and Server headers, sends HEAD with a GET fallback on 405 or 50...

Trail of Bits released two plugins, patching-bugs and regression-hunt, that let AI agents handle bug reproduction, patch development, and regression checking while engineers direct and review the work. The plugins grew out of the company's Patch the Planet initiative with OpenAI, which has produced hundreds of security patches for open-source projects. A review of more than 130 merged patches confirmed 21 regressions, none of which broke a security protection, and highlighted the need for standardized, repeatable patching and regression-checking workflows with strict schemas, live proof-of-concept evidence, and project-supplied threat models and patching guidelines. In preliminary evaluations, regression-hunt produced 25 percent fewer false-positive findings than a baseline Codex agent, though its strict evidence requirements left some known regressions classified as borderline. Trail of Bits plans to evaluate patching-bugs, analyze agent traces, and make the plugins more configura...

a website created by cryptographer Matthew Green that estimates how much public cryptanalysis effort different public-key cryptographic assumptions have received, and what that effort would cost under assumed AI productivity . The project starts from roughly sixteen thousand candidate papers, classifies the cryptanalytic work on problems including ECDLP (elliptic-curve discrete logarithm), structured and plain lattices, and syndrome decoding, and converts publications into estimated research-allocation years through a person-level author map . A headline finding is that lattices have only recently overtaken elliptic curves on this cumulative measure—a reminder that the newer post-quantum assumptions have had far less time under adversarial scrutiny than the older ones most deployed systems rely on today . The site includes a detailed bibliography and a "who's working" section showing top cryptanalysis researchers by field . Caveats matter: the authors warn that publicatio...

Apple's Security Engineering and Architecture and Camera & Photos teams introduce Apple Reference Image, an opt-in camera mode debuting on the main sensor of iPhone 18 Pro and iPhone 18 Pro Max that lets a photographer create a securely timestamped reference image accurately reflecting what the camera sensor captured. The post argues that AI-generated and altered photorealistic images make "it looks like a photo" insufficient when a photograph's essential role is to prove something happened, and that existing C2PA-based approaches fall short: they sign after capture, remain vulnerable to compromise anywhere in the editing chain, and can tie images to a public identity, endangering photographers in conflict zones. Apple's design meets three requirements: semantic authenticity (the image faithfully shows what the sensor captured, with processing publicly verifiable), resilience to compromise (including sensor removal, cryptographic attacks, and jailbreaks), and ...

A BBC News report on a cyber attack that hit hundreds of French supermarkets, causing fridges and freezers to heat up and spoiling fresh and frozen food estimated to be worth millions of euros. Hackers gained control of the software regulating refrigeration temperatures, forcing some units to warm to 50C overnight—one chain's fridges reportedly stayed at that temperature for six hours, and in some places there were even small fires. The attack targeted software from Danish engineering firm Danfoss that lets retailers manage cold units remotely; Danfoss said the affected units were older models whose security software could not be updated to address a risk it had identified, and that it had long advised businesses to keep supported systems up to date. More than 100 Coopérative U supermarkets were targeted, while 180 Intermarché and Netto stores were affected and another 100 were urgently disconnected from the internet. Carrefour, Monoprix, and E.Leclerc were also hit; Carrefour repo...

PCMag Principal Writer Neil J. Rubenking, who has reviewed antivirus software for nearly 40 years and installed well over a thousand apps, shares eight mistakes people make when installing antivirus and how to avoid them. The advice: be aware of all the features you paid for, including add-ons like VPNs, password managers, and bonus apps that only appear in the app's online console; skip installing features you don't want, especially browser extensions that hijack your homepage, new tab page, or search engine, and proprietary browsers offered during install; keep everything up to date, since manual update checks often surface updates the app claims don't exist, and confirm frequent update checks are configured; always run a full scan after installing, because the "initial scan" offered at the end of setup is often a quick or smart scan rather than a full look; schedule scans, since full scans and real-time protection don't always handle malware the same way, s...

Dan Haiem, CEO of AppMakers USA, explains how AI provider keys end up exposed in mobile apps and what a secure setup looks like. The piece opens with a Wake Forest University study of 444 iPhone AI chatbot apps, 282 of which exposed paid AI access through their network traffic—researchers simply watched what apps sent over the network and collected credentials as they passed, letting anyone run AI requests on the developer's account. Worse, when the researchers warned all 282 developers and waited three months, only 28% had clearly fixed the problem. Haiem attributes the problem to speed to launch (calling the AI provider directly from the app skips building a backend), AI-generated code that ships unreviewed with keys in config files, prototypes quietly becoming production apps, and the false belief that a compiled app hides its secrets. The study sorted leaks into three patterns: replayable tokens (136 apps—tokens that leak and stay valid far too long, one expiring in 2125 and an...

Dimitri Stiliadis of Endor Labs explains why traditional software composition analysis tools produce so many false positives (and sometimes false negatives), especially for Python and JavaScript. The root cause is that in most languages the package manager and the compiler or runtime operate in isolation—"like ships in the night"—so dependency definitions are human-driven and the runtime never checks them. Because most SCA tools simply scan the file system for manifest files, parse them, assume the declared dependencies match what the code actually uses, build a dependency graph, and generate an SBOM with vulnerability analysis, they miss four situations: phantom dependencies (packages imported in code but not declared, causing false negatives), misused dependency scopes (dev or test dependencies actually used at runtime), direct use of transitive dependencies (leading to wrong severity and remediation advice), and unused dependencies (declared but never used, causing false p...

Juraci Paixão Kröhling of OllyGarden describes finding personal data, credentials, and secrets in real OpenTelemetry telemetry at banks, fintechs, health platforms, and IoT companies—in traces, metrics, and logs alike. Examples include a bank's trust store password, passed as a Java command-line flag, captured by the process resource detector into process.command_line and replicated onto every span; OAuth codes, access tokens, and JWTs in url.query and url.full, sometimes URL-encoded twice; bearer tokens in captured headers; Brazilian tax IDs in logs and metric attributes; clinician PII from an ORM logging every SQL statement with bound values; phone numbers as Prometheus labels; and database connection strings with embedded credentials. The post argues most leaks come from tools doing what they were configured to do—resource detectors, HTTP instrumentation defaults, wildcard header capture, ORM logging—rather than careless developers, and that SIEM tools miss them because they rea...

Cloudflare describes its Managed Defense AI agent harness, built to help analysts handle the "alert paradox"—a single alert can cause a spike across the environment, and simultaneous alerts can overwhelm even seasoned analysts. The post explains why a single general-purpose agent failed in their first prototype: context became authority (a detection is a hypothesis, not proof), scope drifted (a prompt isn't a boundary), and failure disappeared (timeouts couldn't distinguish "not checked" from "checked and not found"). The redesign moves evidence collection and scope enforcement into deterministic application code before any model runs: fixed, versioned reconnaissance workflows collect identity, detection history, traffic baseline, enforcement outcome, and network observations, each stored with source, version, and timestamp, making evaluation reproducible. Noise is filtered early—Clef, Cloudflare's open-source decision model running on Workers ...

Atlassian shares its approach to reinventing the software development lifecycle with agentic AI, based on its own internal transformation and learnings from other engineering organizations. The core argument is that an AI-native SDLC goes far beyond developers adopting coding agents: as less code is written by hand, coding shifts from a synchronous, single-threaded task to an asynchronous, multi-threaded one, exposing planning, design, review, and maintenance as the biggest bottlenecks. The playbook contrasts traditional and AI-native workflows across five stages—planning (AI synthesizes customer needs and code context into versioned spec files), design (live prototypes and designers committing UI code), development (quality depends on AI context, velocity on agent orchestration), review (AI reviews first against shared standards, humans hold judgment), and maintenance (agents triage incidents and handle routine KTLO work). Two platform investments anchor the shift: a context graph (At...

VulnHunter is an open-source agentic AI security tool that applies attacker-first analysis to source code: instead of flagging suspicious patterns like passive SAST scanners, it starts at attacker-accessible entry points and reasons forward to determine whether an attacker can truly break through, then runs a falsification engine designed to disprove its own findings. This maintained fork of Capital One's VulnHunter (Apache-2.0) focuses on harness portability, sandboxed containerized exploit validation, and measured-impact PoCs, replacing Claude Code-specific skills with portable prompt files and adding a no-guess installer and an unattended operator skill. It ships three composable skills—vulnhunt (hunt), vulnhunter-fix (test-first remediation that writes an exploit demo, a failing test, the fix, and a PR), and vulnhunt-fix-verify (a read-only verifier). Benchmarking six scans of one production Go commit across five harness/model stacks showed a 14× spread in confirmed findings, 4...

Taesoo Kim of Microsoft's FORGE Lab shares lessons from AI-native vulnerability research after the team helped discover Windows vulnerabilities assigned 140 CVEs (52 in September 2026 alone) and submitted 155 validated reports across 23 open-source projects, 93 of which had documented maintainer acknowledgement. The three lessons: shift from frontier capability to scale, since discovery is repeatable but validation is the bottleneck—adding auditors grows the queue without shipping more fixes; shift from token consumption to reasoning economics, asking where the next unit of reasoning actually changes a decision; and treat validation and remediation as a continuous learning loop that feeds evidence back into scanning. The post also reports Linux kernel validation costs (PoC generation averaging $3.61 and 21.5 minutes per confirmed crash), describes the Akrites coordinated disclosure effort, and advises security leaders to count validated fixes rather than findings.   https://www.mic...

This SPIFFE documentation page introduces SPIFFE (Secure Production Identity Framework for Everyone), a set of open-source standards for securely identifying software systems in dynamic and heterogeneous environments. It explains the problem SPIFFE solves—traditional identity approaches like network location or pre-shared keys don't work well for workloads that scale, move, and are created and destroyed frequently—and describes the core components: the SPIFFE ID (a URI-based identity), the SVID (a cryptographically verifiable identity document, typically an X.509 certificate or JWT), and the Workload API, which workloads use to obtain their identity without pre-provisioned secrets. It also covers the SPIRE implementation, the role of trust domains, and how SPIFFE enables mutually authenticated, identity-based connections between services across platforms and clouds.   https://spiffe.io/docs/latest/spiffe-about/overview

Semgrep audited its own LLM benchmark for IDOR vulnerability detection after a viral model score raised doubts about whether models truly reason or just pattern match. It built four groundedness metrics—counterfactual (patch the bug, the finding should vanish), metamorphic (rename identifiers, the finding should persist), selectivity (don't flag safe look-alikes), and stability across repeated scans—and tested Kimi K2.7, GLM-5.2, MiniMax M3, Opus 4.8, GPT-5.5, and its own Semgrep Multimodal on its hardest repo. Verdict: nobody is gaming the benchmark—counterfactual and selectivity scores are near 1, so findings are causal rather than surface matches. The real problem is recall: of 27 real IDORs, 19 (70%) were missed by every model, and pooling all five models bought only one extra vulnerability . Misses split into depth (authorization logic spread across the request path) and familiarity (models catch the textbook file-download IDOR but miss the identical bug on other endpoints). A...

The third installment in the "Context Collapse" series examines how AI features embedded in Microsoft Word can be exploited so that a document itself becomes a propagation vector—an "AI worm." The post explores how AI assistants that ingest document content, follow embedded instructions, and act on the user's behalf can be manipulated through crafted text, letting malicious instructions spread from document to document as the AI processes and rewrites content. It discusses the trust boundary problems that arise when an assistant treats document contents as instructions, why conventional security controls struggle with this class of attack, and what it implies for organizations deploying AI copilots in everyday productivity tools.   https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word

is the official website for REA (Reverse Engineer Anything), an open-source AI-assisted reverse-engineering toolkit that connects coding agents such as Claude Code, Codex, Cursor, and Gemini CLI to analysis tools via the Model Context Protocol. Instead of guessing, the agent uses REA to inspect software directly on the local machine—native binaries, JavaScript/Electron apps, .NET assemblies, Android packages, firmware, and browser or process captures—and returns structured evidence such as decompiled code, call graphs, and traces that the agent can explain or build from. The site provides setup instructions, illustrated guides, and real case studies, including reconstructing Notion's clipboard behavior and recovering DX-Ball's stereo sound algorithm. REA does not claim to recover original source code or automatically clone applications; analysis runs locally, and results separate observations, inferences, and unknowns. Note: a fake repository was reported distributing malware d...

Vincenzo Iozzo tests Jev, TypeSafe's specialized model that answers yes/no questions with a calibrated probability instead of generating text, on identity resolution—figuring out which of an employee's many accounts across systems belong to the same person. Comparing it against a prompted gpt-oss baseline, three Claude models, and two traditional entity-resolution methods across five real environments, he finds Jev hit 0.95 F1 on large orgs (best tested) at $0.62 per 1,000 accounts—19–47× cheaper than Haiku 4.5 and Sonnet 5 and about 140× cheaper than Opus 5.5. Classic record linkage came close on large, regular directories but collapsed on a small, messy one. Jev wins because it links on conventions and world knowledge where no identifier matches. Caveats: its raw probabilities looked underconfident here, independent tests elsewhere put it level with mid-price LLMs, and the judge is itself an LLM—so test it on your own data. A Claude second opinion on Jev's uncertain pairs...

Wes Bos describes using a coding agent to root cheap smart photo frames—essentially Android tablets in disguise with a subscription business model—and repurpose them as family dashboards. Starting with his sister's $500 Skylight calendar that had dead Wi-Fi, he forced the device into recovery/debug mode, connected over ADB, rooted it, stripped the stock software, and got it back online with an $11 USB Wi-Fi dongle using USB OTG host mode. He then repeated the process from scratch with a random $50 Amazon picture frame. The project includes installing a modern Chrome WebView to run a custom web dashboard, tuning swap memory, wiring up the motion sensor so the screen dims when nobody is around, and building a dashboard backed by an agent that turns school emails into calendar events, reminders, and spelling-word searches. All code is on GitHub (wesbos/photo-frame-dashboard). An update notes that the linked Amazon listing often now ships a different board, the Allwinner PF1007L, which...

A Trail of Bits post testing 25 popular package managers to see whether they detect a compromised repository injecting malicious code. Fewer than half used lockfiles that checked for tampering by default, and only Go and vcpkg verified every downloaded package. It explains why hash- and signature-based integrity is harder than it looks—hashes in lockfiles are often absent, unverified, or used for other purposes, and signatures are common but rarely validated—and highlights Go's transparency-log design as the strongest. It proposes committing signature identity rather than package hashes in lockfiles, and compares package signing today to HTTPS a decade ago.   https://blog.trailofbits.com/2026/10/14/package-managers-have-an-integrity-problem

This Google Cloud Blog post announces the completely rewritten second edition of "Site Reliability Engineering: How Google Runs Production Systems," published to mark the 10th anniversary of the original book's release with O'Reilly Media. The authors explain that over the past decade, AI, microservices, multi-cloud deployments, serverless paradigms, and platform engineering have reshaped how software is built and operated, so the challenge is no longer adopting cloud infrastructure but maintaining high reliability amid immense complexity. The post outlines how foundational SRE practices have matured—from basic availability metrics and manual error budget policies to user-centric, multi-tiered SLOs with dynamic burn-rate alerting; from static dashboards to OpenTelemetry, distributed tracing, and automated anomaly correlation; from custom scripts to declarative infrastructure as code and internal developer platforms; and from scheduled game days to continuous resilienc...

This GitHub Blog post describes GitHub's context-aware secret classifier, which improves detection quality, raises repository owner-weighted alert acceptance by 11.5%, and reduces median scan execution time by 86%. Secret scanning must balance catching real credentials against flooding developers with false positives, and generic secrets are especially hard because the same string could be a real credential or a documentation placeholder. GitHub's solution is a two-stage pipeline: regex candidate generation for high recall, followed by a fine-tuned ModernBERT classifier that evaluates each candidate together with its context—file path, variable names, and nearby code—to distinguish real secrets from "hard negatives" like placeholders, test fixtures, and checksums. The post covers why secrets are hard to detect, how the pipeline works, the training data strategy (product-derived examples, high-recall regex candidates, and synthetic hard cases), offline and A/B evaluati...

AWS Continuum for penetration testing (formerly AWS Security Agent) uses AI agents to find and confirm exploitable vulnerabilities in running applications. This AWS Security Blog post explains how to make it a post-deployment gate in your CI/CD pipeline. The gate runs a penetration test automatically scoped to the change just deployed, and can block promotion to production when a finding is at or above a chosen severity threshold. Because each run tests only the change since the last passing gate rather than the whole application, it is fast and economical enough to run on every deploy. The post covers the pattern across GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, and Azure DevOps Pipelines, with a worked GitHub Actions example, plus guidance on OIDC-based IAM roles, report-only rollout, credential protection, and multi-account deployment.   https://aws.amazon.com/pt/blogs/security/penetration-testing-every-deployment-with-aws-continuum

This PortSwigger research by Tom Stacey and Tobia Righi, presented at Black Hat and DEF CON 2026, demonstrates how a simple HTTP header injection primitive using CRLF sequences can be escalated into full-blown desync attacks, including request smuggling, response queue poisoning, browser-powered desync, and even self-propagating desync worms. The technique exploits common misconfigurations in Nginx, OpenResty, and Tengine reverse proxies that decode CRLF characters, allowing attackers to inject their own headers or split requests. The attacks can be triggered through the victim's browser using JavaScript fetch or simple page navigation, bypassing IP and connection-locked protections to steal HTTPOnly cookies and achieve account takeover. The research included real-world case studies across CDN, telecom, payments, retail, streaming, and social media platforms, with a companion Burp extension released for detection.  https://portswigger.net/research/crlf-powered-desync-attacks

DepthFirst argues that traditional Linux containers should no longer be treated as a strong security isolation boundary because they share the host kernel. The research demonstrates a container escape using CVE-2026-80521, a Linux kernel use-after-free vulnerability in the AF_UNIX subsystem, and argues that AI-assisted vulnerability discovery and exploit generation are lowering the barrier to kernel exploitation. The recommended mitigation is to use stronger isolation mechanisms such as microVMs, including Firecracker or Kata Containers, especially for untrusted and multi-tenant workloads.  https://depthfirst.com/research/containers-are-no-longer-safe

This Wiz blog post presents a practical investigation playbook drawn from the Wiz Customer Incident Response Team's response to a coordinated campaign targeting GitHub Personal Access Tokens (PATs) across multiple organizations between May and June 2026. The attack followed three phases: reconnaissance via the GitHub API from an AWS IP address using a Chrome user agent, low-volume validation cloning from HostPapa infrastructure to confirm token validity, and finally a mass parallelized repository cloning operation using 102 AWS IP addresses in the ca-central-1 region with a git/2.43.0 user agent. The investigation methodology includes reviewing GitHub audit logs and personal security logs to establish baselines and identify anomalies, pivoting on indicators of compromise, and engaging GitHub Support for additional logs. The initial access vector—how the attacker obtained valid PATs across multiple unrelated organizations—remained unidentified in the investigation. The post recommen...

LLM-based and increasingly agentic threat-modeling tools can now augment significant portions of threat modeling from analyzing architectures and identifying assets to generating Data Flow Diagrams (DFDs), threats, attack scenarios, attack trees, adversarial tests, and mitigations. As these capabilities become more sophisticated and autonomous, an equally important challenge emerges: how do we objectively measure the quality of the threat models they produce? The number of threats generated is not, by itself, an indication of quality. Nor is the percentage that results in remediation, because threat validity, risk acceptance, and remediation are different decisions. More importantly, these measures tell us little about relevant threats the AI failed to identify.  I approach this challenge through scope and input validation, expert-established ground truth, True Positive/False Positive/False Negative classification, precision, recall, F1, and Human-in-the-Loop validation. The object...

This is a guide from the OpenSSF Best Practices Working Group and the OpenSSF AI/ML Working Group, authored by David A. Wheeler and contributors, aimed at software developers and vulnerability researchers. It covers how to use artificial intelligence to find and fix software vulnerabilities, and the material is intended to serve as the basis for a course.  https://best.openssf.org/Finding-and-Fixing-Vulnerabilities-Using-AI/

AVE is an open standard for classifying and scoring behavioral vulnerabilities in agentic AI components, including skill files, MCP servers, and agent plugins. It provides stable vulnerability IDs, behavioral fingerprints, AIVSS-based severity scores, detection guidance, and mappings to frameworks such as OWASP MCP Top 10, OWASP Agentic AI Top 10, and MITRE ATLAS. The standard is designed to make findings interoperable and comparable across different security scanners and implementations. https://aveproject.org/

This article outlines an identity and access management framework for AI agents, treating each agent as a non-human identity with a human owner, defined purpose, scoped authorization, an expiration, and continuous monitoring. It explains why traditional IAM systems fall short, since they describe access as configured rather than what an autonomous agent actually executed, creating an intent-to-execution gap the article calls identity dark matter. Recurring lifecycle failure modes include absent ownership, long-lived secrets, unbounded delegation, invisible instantiation, and no expiration. Essential components cover distinct agent identity and short-lived federated credentials, fine-grained authorization such as task-scoped grants, tool allowlisting, data boundaries, and action thresholds, plus behavioral auditability and revocation. The article recommends extending existing governance platforms for lifecycle, building in-application enforcement where agent frameworks are proprietary, ...

This article provides an in-depth explanation of prompt injection attacks against LLM-based systems, covering both direct and indirect attack types. It uses real-world examples, such as the EchoLeak vulnerability (CVE-2025-32711), which achieved zero-click data exfiltration through Microsoft 365 Copilot, to demonstrate how hidden instructions embedded in emails, documents, or web pages can override an AI assistant's intended behavior. The article explains why prompt injection is fundamentally difficult to fix, noting that models cannot reliably distinguish between trusted system instructions and untrusted content once they are concatenated in the same context window. Defence recommendations include architectural separation of instructions from data using structural delimiters, input sanitization, output scanning, and restricting agent capabilities to limit the blast radius of a successful injection.  https://clearpathsecurity.co.uk/prompt-injection-attacks-explained-with-real-examp...

This article reports on the critical JWT authentication bypass vulnerability CVE-2026-5430 affecting WSO2 API Manager (versions 4.1.0–4.6.0), API Control Plane, Traffic Manager, and Universal Gateway. The flaw carries a CVSS score of 10.0 in multi-tenant deployments (9.8 in single-tenant) and stems from improper JWT signature verification that allows attackers to forge tokens signed with unsupported algorithms and gain full administrative access. Although patches were available since April 2026, active exploitation was detected by watchTowr's honeypot network starting September 13, 2026, with CISA adding the vulnerability to its KEV catalog on September 24, 2026, mandating federal remediation by September 27. The article details the exploitation timeline, affected products, and defense recommendations including immediate patching and restricting access to management interfaces .  https://tech-insider.org/wso2-cvss-10-api-flaw-exploited-kev-2026/

This security advisory warns of active exploitation of the critical vulnerability CVE-2026-5430 (WSO2-2026-5328), a JWT authentication bypass flaw caused by improper verification of cryptographic signature (CWE-347) in WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway products. CISA added the vulnerability to its KEV catalog on September 24, 2026, with in-the-wild exploitation confirmed since at least September 13, 2026. The flaw allows unauthenticated attackers to forge JWT tokens using unsupported algorithms to gain full administrative access. https://www.rescana.com/post/wso2-api-manager-cve-2026-5430-kev

O GitHub descreve como sua equipe de segurança utilizou um agente de segurança de IA de código aberto para identificar 24 vulnerabilidades no Android, detalhando a metodologia, as descobertas e a abordagem de análise automatizada de segurança.  https://github.blog/security/how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent/