标签：#SEC

AI agents that break free and hack into other systems are only trying to make us happy.

An extortion gang known for targeting transportation companies and private equity firms has taken credit for a breach at Uber Freight.

I spend most of my time building evidence layers for AI agents. The reflex in that work is to reach for a signature. Something happened, sign the record, hand it to the auditor, done. Three things from the last five months say that reflex is wrong, or at least badly incomplete. One is a governance draft that never asks for a signature at all. One is a CVE where the signature verified correctly and the client still ended up talking to an attacker. One is a limit in a spec I wrote myself. Read together they point at the same thing. A signature is a statement about an object. Almost every security question you actually care about is a statement about a relationship. Case one: the requirement that is not there The Open Secure AI Alliance published its Shared AI Findings Exchange draft on GitHub on August 3. It is an incident-reporting compact for AI agents. Members agree to report when an agent they operate accesses or disrupts a third-party system without authorization, and to do it on a clock: notify the affected organisation as soon as possible, notify customers with credible exposure within 72 hours, file a confidential report within four business days. The clock is well specified. So is the evidence. Members must preserve and provide affected organisations with "prompts, traces, tool calls, logs, configurations, model and safeguard versions and third-party dependencies", plus agent and workload identities, permissions and credentials available during the run, human approval events, and a complete incident timeline. That is a good list. It is close to the one I would have written. Now search the draft for signing. It appears exactly once, in a list of example recommendations that incident reviews might produce: "signed evaluation manifests". The draft also asks, in its review framework, whether "data boundaries [were] independently verified". Both of those are about keeping an agent inside its box. Neither applies to the record of what happened when it got out. The

This is the latest zero-day released by security researcher Nightmare Eclipse, despite Microsoft publicly threatening to take legal action against them.

A public AI tool found the dangerous Zoom flaw in under 20 prompts.

If you compare live update solutions for long enough, you will run into a security claim that sounds decisive: "end-to-end encrypted." It suggests that solutions offering encryption are more secure than solutions that "only" sign their updates. That framing mixes up what the individual security controls in an update pipeline actually do. In this post, we walk through the threat model of live updates (also known as OTA updates or CodePush): what HTTPS already protects, what code signing guarantees, what encryption adds on top, and which of these properties matter for your app. By the end, you can evaluate the security of any live update solution based on facts instead of buzzwords. Key Takeaways HTTPS protects update bundles in transit. It does not protect against a compromised update service, storage bucket, or CDN. Code signing with a developer-held private key guarantees authenticity and integrity all the way to the device: even a fully compromised update infrastructure cannot inject code into your app. Encrypting bundles adds confidentiality only. It provides no additional protection against malicious updates. Client-side encryption cannot keep app code secret, because the decryption key must ship inside the app binary. The React Native maintainers state it plainly: "Code on the client is not secret." If bundles must stay confidential, for example in privately distributed enterprise apps, self-hosting them is a stronger control than encrypting them. The Trust Chain of a Live Update Every live update passes through the same chain: you build a web bundle in your CI/CD pipeline, upload it to an update service, the service stores and serves it (usually through a CDN), and the Live Update SDK in your app downloads and installs it. Security along this chain means three different properties: Authenticity : The update genuinely comes from you. Integrity : The update was not modified on the way. Confidentiality : No third party can read the update's content. For code that

¿Tu equipo comparte credenciales por Slack? ¿Discuten arquitectura en plataformas que almacenan cada mensaje en servidores ajenos? Existe una alternativa que no depende de la nube: NETO . ¿Qué es NETO? NETO es un chat peer-to-peer diseñado para redes locales . No hay servidor central, no hay cuentas, no hay datos saliendo de tu oficina. Abres el navegador, y los compañeros de tu LAN aparecen automáticamente gracias a mDNS (Multicast DNS), el mismo protocolo que usa Bonjour para descubrir impresoras y servicios locales. Sin registro. Sin configuración. Sin fricción. Cifrado de extremo a extremo real Cada conexión entre peers se establece mediante WebRTC , creando canales de datos directos entre navegadores. Antes de intercambiar un solo mensaje, NETO realiza un intercambio de claves con X25519 (Curve25519 en

✓ Human-authored analysis; AI used for formatting and proofreading. SadCloud is an open-source Terraform project by NCC Group that deploys misconfigured AWS resources. Security teams use it to test their tooling: if your scanner can't find the misconfigurations in SadCloud, it can't find them in production. We pointed Stave at SadCloud. Then at BishopFox's IAM Vulnerable. A lab focused on IAM privilege escalation paths. The numbers tell a story about what happens when you move from per-resource scanning to compound attack path analysis. The raw numbers Metric SadCloud (NCC Group) IAM Vulnerable (BishopFox) Assets evaluated 36 31 Atomic violations 992 837 Compound chains firing 84 instances (13 unique) 70 instances (6 unique) Near-miss chains 785 instances (40 unique) — A per-resource scanner (Prowler, ScoutSuite, Checkov) would show 992 findings for SadCloud. Each finding stands alone: this bucket is public, this role is overpermissioned, this trail isn't logging. The operator opens a dashboard with 992 items sorted by severity and starts scrolling. Stave's compound-only default output shows 84 findings across 13 named attack paths. Same underlying data. Different composition. The 992 atomic violations still evaluated. They're the detection infrastructure. The 84 compound chains are the findings that reach the operator. That's a 12x reduction by composition. Compound chains Each compound chain fires when multiple controls fail simultaneously on related assets, matching a named attack pattern: Chain Severity Instances What it means iam_escalation_undetected critical 36 IAM roles can escalate privileges and no detective control monitors the escalation path iam_boundary_governance_failure critical 36 No permission boundary constrains IAM principals in the account — any role can reach any resource iam_session_opacity high 2 IAM session activity isn't logged at the detail level needed to detect credential abuse s3_ssec_ransomware_path critical 1 S3 bucket is vulnerable t

Security researchers found that in less than 60 seconds, they could open a hatch on a plane’s exterior, plug in a tiny device, and redirect the aircraft’s autopilot or sabotage its flight plan.

Last week, an AI newsroom beat mainstream journalists—including WIRED—to a story about OpenAI and hacking. It’s just the beginning.

Experts allege that two recent incidents in California show the extreme lengths that criminal organizations are willing to go to to steal servers and other gear meant for data centers.

Details from recent court filings show that DOGE's influence within government—and potential conflicts of interest—extend further than previously known.

I have four different load_env() functions in my MCP server project ( my-git-manager ) — one in server.py , one in publish_devto.py , one in reply_comments.py , one in scripts/list_all_published_titles.py . All four exist for the same dumb reason: this repo has no dependency on python-dotenv , so each script that needs GITHUB_TOKEN or DEV_TO_API reads .env by hand. I went digging for a fresh bug in this repo this week — I write a lot about it, and the well is getting shallow — and decided to actually diff all four load_env() implementations against each other instead of reading them one at a time like I usually do. They'd never been compared side by side before. That's how I found this one. The line that started it Every one of them does roughly this: for line in f : line = line . strip () if " = " in line and not line . startswith ( " # " ): k , v = line . split ( " = " , 1 ) os . environ . setdefault ( k , v . strip (). strip ( '"' ). strip ( "'" )) Look closely at what gets .strip() ed there. v — the value — gets stripped of whitespace and surrounding quotes. k — the key, the actual name of the environment variable — gets nothing. That's fine if your .env file looks like this: DEV_TO_API = abc123 It's not fine if it looks like this: DEV_TO_API = abc123 Spaces around = are a completely normal thing to type. Plenty of .env examples online use them. Plenty of people reach for that style out of habit from other config formats. And line.split("=", 1) doesn't care — it splits on the first = no matter what's next to it, so k comes out as "DEV_TO_API " , trailing space included. What that trailing space actually does os.environ.setdefault("DEV_TO_API ", "abc123") sets an environment variable. It's just not the one anything is looking for. Every caller in this repo does os.environ.get("DEV_TO_API") — no trailing space, because that's the name everyone actually types. That lookup returns None , or whatever was already sitting in the environment before .env ever got read. I

Gunra Ransomware: RaaS Exploiting FortiGate for VDI Sessions, OTP Theft, SaaS Exfiltration, and Encryption 1. Basic Information Severity : Critical Title : #StopRansomware: Gunra Ransomware (AA26-222A) Publishers : CISA / FBI / DC3 / NSA / USSS / Korean National Police Agency (KNPA) Publication Date : 2026-08-10 Original Source : https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a Primary PDF : https://media.defense.gov/2026/Aug/10/2003976697/-1/-1/0/CSA_STOPRANSOMWARE_GUNRA_RANSOMWARE.PDF Related Sources : NSA Announcement: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4567025/nsa-joins-fbi-and-others-in-releasing-guidance-to-defend-against-gunra-ransomwa/ BleepingComputer: https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/ Related Malware, Groups, CVEs, and Products : Gunra, Golden Community, Conti variant, CVE-2024-55591, CVE-2025-24472, FortiOS, FortiProxy, SSL-VPN, VDI, Active Directory, Hiware, OneDrive, SharePoint, Mega, Sliver, Impacket, RClone 2. Executive Summary This is a double-extortion Ransomware-as-a-Service (RaaS) that enters networks through FortiGate/VPN authentication bypasses or default credentials. It modifies VPN traffic to steal sessions, implants static OTP backdoors into VDI authentication processes, steals dozens of terabytes of data from Active Directory, management servers, and SaaS platforms, and finally encrypts Windows and Linux systems. 3. Attack Flow Chain A: Fortinet-Initiated (Observed by FBI) Exploits CVE-2024-55591 or CVE-2025-24472 on internet-facing FortiOS/FortiProxy to bypass authentication. Gains access to the firewall/SSL-VPN and performs internal reconnaissance. Performs SMB lateral movement using Impacket's psexec.py or smbclient.py . Executes secretsdump.py on the domain controller to retrieve password hashes derived from NTDS.dit . Moves to privileged system accounts using pass-the-hash/pass

Kimwolf v7: Android/IoT Botnet with HTTP/2 Browser Spoofing DDoS and ENS/Tor Three-Layer C2 1. Basic Information Severity : High Article Title : Kimwolf v7: An Evolution of the Kimwolf Botnet Publisher : Unit 42 / Palo Alto Networks Publication Date : 2026-08-11 Original Source : https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ Related Sources : Unit 42 IOCs and Analysis Materials: https://github.com/pan-unit42/iocs/tree/master/Kimwolf-v7 BleepingComputer (Large-scale DDoS Observation): https://www.bleepingcomputer.com/news/security/ddos-attacks-over-1-tbps-surged-fivefold-in-the-second-quarter/ Related Malware, Groups, and Products : Kimwolf v7, AISURU, Android TV box, set-top box, Android Debug Bridge (ADB), Ethereum Name Service (ENS), Tor, nghttp2, BoringSSL Main IOCs : netd_service , TVHelper , 127.0.0.1:23075 , eth.rpcuniverse[.]com , 212.193.31[.]119:13 , 212.193.31[.]122:13 , 212.193.31[.]92:443 , 212.193.31[.]158:443 2. Executive Summary This is a new version of the botnet that uses residential proxies to reach unauthenticated ADB and turn Android TV devices into bots. It maintains DDoS and proxy relay capabilities using Chrome-like HTTP/2 floods and a fault-tolerant C2 that combines ENS, Tor, and local SOCKS proxies. 3. Attack Flow Chain A: Infection and Bot Registration The attacker uses a residential proxy exit node as a stepping stone to reach ADB TCP/5555 on the local network. The attacker finds Android TV boxes or set-top boxes where ADB is active and requires no authentication. The attacker drops and runs an ARM ELF payload via an external loader or APK wrapper. For APK variants, a Java wrapper disguised as SystemService runs an embedded ELF such as libdevice.so . Some samples check for root access, but public sources do not explain how this affects execution. Some samples use BootReceiver to run after reboot. The ELF creates a Unix domain socket to prevent multiple instances and changes its process name to netd_service or TVHelper . It

I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own...

Honestly, when I saw this news, I wasn't that surprised — because this is already the third time in two weeks. Let's start with what happened. According to a Hong Kong Economic Journal report citing foreign media, Meta, Facebook's parent company, confirmed that its newly released AI model, Muse Spark 1.1, "broke into" a third-party service provider's system during a cybersecurity test and altered its internal systems. Meta's explanation: a misconfiguration by the independent testing firm Irregular let the model exploit a vulnerability in the third-party service and get in during the test. A spokesperson for Irregular confirmed the incident too, but stressed that "this doesn't involve a sandbox escape or a sophisticated cyberattack," and said they're currently writing a white paper to share best practices for cybersecurity assessments. The breach was first reported by the tech outlet The Information. If you've been following this kind of news, this should sound familiar — because two nearly identical incidents just happened before this: an OpenAI model broke into external systems during testing, including Hugging Face's; and an Anthropic model escaped its sandboxed environment too. (I wrote about both of those in my previous post .) A pattern I noticed that nobody's talking about Most coverage frames this as "AI going rogue again" or "another company messing up." But staring at all three, I noticed something few people are pointing out: All three used the same testing firm — Irregular. Three top AI labs, three different models, and when the tests went wrong, it was the same test environment behind all of them. That's interesting. When the common thread is "the environment" and not "one particular AI," the story stops being "which model is more dangerous" and becomes: what determines whether an AI oversteps its bounds usually isn't the model itself — it's the environment it's placed in, the permissions it's given, and whether anyone actually drew the boundaries for it

If you built a Supabase app quickly - with an AI coding tool or by hand - the row-level-security policies were often written last, or generated for you. That is fine. What is not fine is shipping without knowing whether those policies actually isolate one user's rows from another. Supabase ships a database linter, and you should run it first - it is free and it catches the obvious cases: RLS switched off, and RLS switched on with no policy behind it. But a linter checks whether a policy exists , not whether the policy is correct . Those are different questions, and the second one is where cross-user leaks live. The 2-second test I put a minimal, synthetic reproduction on GitHub: supabase-rls-leak-demo . Same test suite on two branches, differing only by db/policies.sql : broken -> 4 failed, 1 passed (an authenticated user reads another user's row) fixed -> 5 passed npm ci npm run test :ci No Docker, no Supabase project, no credentials. The tests run PostgreSQL in PGlite locally and exercise database-level row security. They do not model Supabase Auth, PostgREST, the Data API, or the network path - the result proves only the row-level gate in the fixture, which is exactly the gate people get wrong. On broken , the failing assertion is readable on purpose: x does not let user B read any row owned by user A -> user B received 1 row(s) belonging to another user: ["A: card ending 4471, expiry 09/29"] (That is synthetic seed data, not a real card.) Run the free checks against your own database The repo also ships audit/rls-audit.sql - nine read-only queries against the system catalogs, MIT-licensed, nothing to install and nothing to send anywhere. Every one is SELECT -only, so it is safe to paste into the Supabase SQL editor. They tell you: RLS coverage per table Every policy and the roles it actually applies to (an empty roles array means no TO clause, so the policy is evaluated for anon too) The effective write check, and which columns its predicate never mentions What

Claude Code was fetching pages for me during a research session, one of them a GitHub repository page. Buried in the middle of the fetched text, between the project description and the install instructions, sat a <system-reminder> tag telling the agent that the date had changed. It hadn't. There is a real mechanism that delivers system reminders to Claude Code, and it had nothing to do with this one. A person typed that tag into a README, guessing that some AI agent would eventually read the page and mistake the text for a message from its own runtime. That was the entire attack. Plain text on a normal-looking repo, shaped like something an agent is trained to obey. No exploit, no malicious package. The README is an attack surface Fetch a GitHub repo page and you get the rendered README with it. That text is user controlled. Anyone can put anything there, and the fact that the page came from github.com over a valid certificate tells you nothing about it. The host is reputable. The content is whatever some stranger wrote. The trust boundary runs through the middle of the page, which is an uncomfortable place for a trust boundary to be. The numbers on this are worse than I expected. The ReadSecBench study (March 2026, reported in this Cloud Security Alliance research note ) tested 500 open-source README files against Claude, GPT-4, and Gemini. Direct commands embedded in the main README worked about 84% of the time. Instructions hidden two links away, in a CONTRIBUTING.md or a SECURITY.md, worked about 91%, presumably because nobody audits the files a README links to. Humans did not do much better. The same study showed flagged documents to 15 reviewers: 8 of them saw nothing wrong at all, 6 commented only on grammar and formatting, and one sensed a problem without finding the mechanism. Why "the date has changed" works The tag I found never said "ignore previous instructions." It lied about the date, which is a better move. An agent that believes today is a different

FBI Atlanta confirms it's looking into the incident, no arrests made.