标签：#SEC

Claude Code was fetching pages for me during a research session, one of them a GitHub repository page. Buried in the middle of the fetched text, between the project description and the install instructions, sat a <system-reminder> tag telling the agent that the date had changed. It hadn't. There is a real mechanism that delivers system reminders to Claude Code, and it had nothing to do with this one. A person typed that tag into a README, guessing that some AI agent would eventually read the page and mistake the text for a message from its own runtime. That was the entire attack. Plain text on a normal-looking repo, shaped like something an agent is trained to obey. No exploit, no malicious package. The README is an attack surface Fetch a GitHub repo page and you get the rendered README with it. That text is user controlled. Anyone can put anything there, and the fact that the page came from github.com over a valid certificate tells you nothing about it. The host is reputable. The content is whatever some stranger wrote. The trust boundary runs through the middle of the page, which is an uncomfortable place for a trust boundary to be. The numbers on this are worse than I expected. The ReadSecBench study (March 2026, reported in this Cloud Security Alliance research note ) tested 500 open-source README files against Claude, GPT-4, and Gemini. Direct commands embedded in the main README worked about 84% of the time. Instructions hidden two links away, in a CONTRIBUTING.md or a SECURITY.md, worked about 91%, presumably because nobody audits the files a README links to. Humans did not do much better. The same study showed flagged documents to 15 reviewers: 8 of them saw nothing wrong at all, 6 commented only on grammar and formatting, and one sensed a problem without finding the mechanism. Why "the date has changed" works The tag I found never said "ignore previous instructions." It lied about the date, which is a better move. An agent that believes today is a different

FBI Atlanta confirms it's looking into the incident, no arrests made.

Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.

Today was a good day and a weird day, in that order. The good part: the autonomous pentest agent I've been building — I call it HALO — went from "runs a bunch of tools and hopes" to an actual web-recon → web-attack → flag-capture pipeline that pulled real flags out of a live target. The weird part: it captured flags on VulnBegin, and then, when it came time to actually submit them, they wouldn't take. Not an error. Not a crash. Just… rejected. I want to write down both halves honestly, because the second half is the more interesting engineering lesson, and it's the one I'd have skipped past a few months ago. What actually shipped today A few concrete milestones, roughly in the order they unblocked each other: The arsenal went from 31 tools to 42. I wired in a chunk of web + OSINT tooling — content discovery, subdomain enumeration, template scanning, XSS probing, passive URL collection. The point wasn't "more tools = better." It was to give the agent enough of a web-attack surface that it could go from host to flag without me babysitting each step. I stopped the silent hangs. This one cost me the most time and had the dumbest root cause. A couple of the Go-based scanners would just… hang. No output, no error, they'd ride the timeout all the way to the wall and die with nothing. I'd assumed it was a networking or a binary-compatibility problem and chased that for way too long. It wasn't. The agent runs as an MCP server over stdio — meaning the server's own stdin is the JSON-RPC pipe the whole system talks over. When I spawned a child scanner, it inherited that stdin, tried to read from it, and blocked forever waiting on a pipe that was never going to feed it. One line — stdin=subprocess.DEVNULL on the subprocess call — took one scanner from a 60-second timeout to a 1-second run. That's the whole fix. I'm still a little mad about how long it took to find. A pile of invocation fixes. Small, unglamorous, necessary: a resolver that reads targets from stdin instead of a fl

Redirect Chain چیست و چطور دامنه‌های جعلی را قبل از ورود شناسایی کنیم؟ وقتی روی یک لینک کلیک می‌کنید، همیشه مستقیماً به همان آدرسی که دیده‌اید منتقل نمی‌شوید. گاهی مرورگر ابتدا یک URL را باز می‌کند، سپس به آدرس دیگری می‌رود و در نهایت صفحه مقصد نمایش داده می‌شود. این فرایند می‌تواند کاملاً عادی باشد، اما زمانی که تعداد ریدایرکت‌ها زیاد شود یا دامنه‌ها بدون دلیل مشخص تغییر کنند، بررسی دقیق‌تر اهمیت پیدا می‌کند. برای ارزیابی یک لینک بهتر است سه موضوع را جداگانه ببینیم: مسیر Redirect، دامنه نهایی و وضعیت HTTPS. Redirect Chain دقیقاً چیست؟ Redirect Chain زمانی ایجاد می‌شود که یک URL قبل از رسیدن به مقصد نهایی، کاربر را از یک یا چند آدرس دیگر عبور دهد. یک مسیر ساده ممکن است به شکل زیر باشد: Page A → Page B → Final Page این ساختار لزوماً مشکل امنیتی نیست. سایت‌ها ممکن است برای تغییر دامنه، اصلاح ساختار URL یا انتقال صفحات قدیمی از Redirect استفاده کنند. اما مسیرهای طولانی‌تر نیاز به توجه بیشتری دارند: Link A → Domain B → Domain C → Unknown Domain D → Final Page در این حالت باید پرسید چرا کاربر میان چند دامنه متفاوت جابه‌جا می‌شود و آیا این دامنه‌ها با منبع اولیه ارتباط قابل فهمی دارند یا خیر. چه زمانی Redirect Chain مشکوک می‌شود؟ تعداد زیاد Redirect به‌تنهایی اثبات‌کننده جعل نیست، اما می‌تواند یکی از نشانه‌هایی باشد که ارزش بررسی بیشتری دارد. مواردی که بهتر است بررسی شوند شامل تغییر ناگهانی نام دامنه، عبور از چند دامنه نامرتبط، انتقال به URLهایی با ساختار عجیب و نمایش صفحه‌ای متفاوت با چیزی است که لینک اولیه وعده داده بود. مسیر مقصد را با متن لینک مقایسه کنید برای مثال اگر متن یک لینک نام یک پروژه مشخص را نشان می‌دهد اما مقصد نهایی دامنه‌ای کاملاً متفاوت است، بهتر است قبل از وارد کردن اطلاعات حساب دلیل این تفاوت مشخص شود. همچنین Short URLها می‌توانند مقصد واقعی را پنهان کنند. استفاده از Shortener به‌خودی‌خود خطرناک نیست، اما کاربر اطلاعات کمتری درباره مقصد اولیه دارد. HTTPS چه چیزی را ثابت می‌کند؟ HTTPS نشان می‌دهد ارتباط میان مرورگر و سرور با استفاده از TLS رمزگذاری می‌شود. این موضوع برای محافظت از داده‌هایی که در مسیر منتقل می‌شوند اهمیت دارد. اما HTTPS یک سوءبرداشت رای

Device-bound session credentials thwart an increasingly common form of account takeover.

In a new alert, the FBI said cybercriminals are targeting adults and minors in an attempt to steal their personal and intimate pictures in extortion campaigns.

Zoom screen-sharing bug let people fully take over other devices on a call.

Part 5 of a series building a support-ticket agent with no framework. Previous: Part 4 (the loop). Repo: github.com/akash-pal/agent-from-scratch Here's the finding this whole article is built around: partway through eval iteration, the agent started reporting that a refund had been proposed — a clean, plausible-sounding message — without ever having called the tool that proposes refunds. No approval was ever requested. No confirmation existed. The model just said it happened. That's the failure mode this part is about, and the fix is the actual argument for why guardrails belong in code, not in prompt text alone. Policy as code src/policy.ts is a plain data object — an allowlist, an approval list, rate limits, and regex patterns — checked by the agent loop, not asked of the model: export const policy : Policy = { allowTools : [ " order_lookup " , " refund_eligibility " , " issue_refund " , " kb_search " , " send_email " ], requireApprovalFor : [ " issue_refund " , " send_email " ], rateLimits : { maxToolCallsPerRun : 8 , maxCostPerRunUsd : 0.3 }, autoEscalatePatterns : { legal_threat : / \b( lawyer|attorney|sue|legal action|better business bureau| \b bbb \b)\b /i , fraud_flag : / \b( fraud|unauthorized|without my permission|didn't authorize|stolen card )\b /i , duplicate_ticket : / \b( already submitted|second ticket|duplicate ticket|already reported )\b /i , }, }; Every one of these is enforced outside the LLM's control. The model can't talk its way past requireApprovalFor — the loop checks it before executing the tool, full stop. The autoEscalatePatterns regexes run against the raw ticket text before the model is even called (this is that expected_trajectory: [] behavior from Part 3's edge-case bucket) — a legal threat or fraud flag never reaches the LLM at all, straight to a human queue. Three human-review patterns Not every consequential action needs the same review pattern. This build uses pre-action approval — human approves before execution — for issue_refund

The Delta flight crew switched off the aircraft's legitimate Wi-Fi network for around 30 minutes due to the incident, according to a spokesperson.

Zoom has patched a major security vulnerability that could allow an attacker to hijack anyone's device during a meeting. In a blog post on Tuesday, researchers at A Security say they uncovered the flaw using "fewer than 20 prompts on publicly available AI models," as reported earlier by Wired. The exploit involved Zoom's annotation feature, […]

The investigation shows that North Koreans are able to infiltrate government agencies, as well as private organizations and crypto exchanges.

Phone and Bluetooth signals could turn roadside cameras into far richer tracking tools.

Researchers say it took fewer than 20 prompts for a public AI tool to find a flaw (now fixed) allowing anyone on a Zoom call to hijack another participants’ device.

The #1 question I got after my last article: "What happens when the agent tries something destructive at 3 AM?" Every CISO I've worked with asks some version of this. They don't care how fast your agent investigates. They care about blast radius. What can it touch? What can it break? Who approved it? Where's the audit trail? This article answers all of that. I gave Kiro Crew a P1 incident and told it to fix it. Then I watched it hit a wall. If you're new to this series, catch up here: Kiro Crew Series The scenario: a real P1 on FinPay FinPay is a payment processing platform. Three services (payment, user, notification), PostgreSQL on RDS Multi-AZ, ECS Fargate, the usual stack. 26 commits of realistic history. CI/CD via GitHub Actions. Someone committed a "performance optimization" that reduced the database connection pool from 50 to 5. Deployed at 5:30 PM on a Wednesday. By 2:47 AM, the pool was exhausted. Transactions started failing. Success rate dropped from 99.8% to 34%. I gave the agent the alert and said: fix it. What happened next is exactly why enterprise teams can trust this thing. Layer 1: Investigation passes freely The agent's first instinct was to investigate. It ran: git log --oneline -10 to check recent deployments cat services/payment-service/config.js to read the configuration grep -rn pool services/payment-service/ to find pool settings All three ran automatically. No approval popup. No human intervention. Why? Read-only operations don't need permission. The agent can look at anything it needs to understand the problem. Reading code, checking logs, searching files. None of that changes state. None of that can break anything. Within 23 seconds it identified the root cause: pool max was changed from 50 to 5 in commit 2181456 ("perf: reduce connection pool overhead for lower memory footprint"). A well-intentioned optimization that was never load-tested. This is the same investigation pattern from Part 2. Fast, accurate, no human bottleneck for the det

Sometimes your application can reach an external service from one server, but not from another. I ran into this problem while working on one of my projects. I needed my server in Iran to communicate with Telegram, but the connection wasn't reliable from inside Iran. Instead of moving the whole application, I built a small intermediate service: Signed Webhook Receiver It is a lightweight FastAPI service that receives requests signed with an RSA private key and verifies them using the corresponding public key before processing them. Your Server | | RSA Signed Request v Webhook Receiver | | HTTP Request v External Service The receiver can be useful for: Secure server-to-server communication Webhooks and internal APIs Acting as a controlled proxy/gateway Connecting servers across different network environments Payment integrations where a provider requires requests from an Iranian IP For example, if your main application is hosted outside Iran but a payment gateway only accepts requests from Iranian IP addresses, an Iranian server can act as the intermediate gateway: Foreign Server | | Signed Request v Iranian Gateway Server | v Payment Gateway The important part is that this isn't an open proxy. Requests can be authenticated and the gateway can be restricted to specific operations and destinations. The project is built with Python, FastAPI, Cryptography, Docker, and Traefik and is open source. View the project on GitHub I also wrote more technical notes and development articles on my website: Building a Secure Webhook Receiver for Server-to-Server Communication | CyberHuginn

Why passkey apps treat Windows differently than other operating systems.

Cybersecurity is entering a new phase. This is because security teams are facing more and more complex problems and threats that are moving faster. To help defenders respond more effectively, OpenAI has introduced GPT-5.6-Cyber, a special model designed for advanced cybersecurity tasks. The model supports authorized security research, vulnerability discovery, and other defensive workflows. The Daybreak program is showing how specialized AI tools can improve modern cybersecurity by working together with human security experts. Quick overview GPT-5.6-Cyber is a specialized model for authorized cybersecurity work. It is available through OpenAI’s Daybreak Red access for approved defenders. OpenAI reports a 95% completion rate on its internal advanced cybersecurity evaluation. The model helped researchers uncover vulnerabilities in Chrome’s V8 JavaScript engine. Controlled access, monitoring, and human oversight remain important for safe deployment. What Is GPT-5.6-Cyber? GPT-5.6-Cyber is OpenAI’s cybersecurity-specific model, available through Daybreak Red. Built on GPT-5.6 Sol, it is trained to improve performance on specialized cybersecurity tasks such as finding zero-day vulnerabilities and developing exploit chains, while reducing refusals for certain higher-risk, dual-use cyber tasks. Daybreak has two access tiers: Daybreak Blue provides approved defenders with frontier general-purpose models such as GPT-5.6 Sol, with safeguards tailored to authorized defensive security work. Daybreak Red provides purpose-trained cybersecurity models for authorized vulnerability research, exploit validation, and security testing. This approach reflects a significant shift toward security tools designed for professional cybersecurity environments rather than unrestricted public use. The goal is clear: to help trusted defenders investigate vulnerabilities, analyze potential threats, and respond to security incidents more effectively while keeping access controlled. According to Open

Your smart home is not smart. It is just very, very observant. I did not buy a smart speaker because I wanted a friend. I bought it because it was on sale for $29.99 and it promised to play rain sounds on command. For two years she lived on my kitchen counter. She set timers for pasta. She told me the weather with the aggressive optimism of someone who has never paid rent. She was helpful. She was ambient. She was furniture that could hear. And then one night at 2:17 a.m., she lit up blue for no reason. No wake word. No one speaking. Just a soft, smug blue ring in a dark apartment, listening to an empty room like she was waiting for me to confess something. That is the moment you understand your home is not just connected. It is attentive. And attentiveness without consent is just surveillance with better industrial design. We Carried Them In Ourselves No one kicked down the door. We invited this in. We carried it in from Best Buy, plugged it in, gave it our Wi-Fi password, which is literally the master key to our entire digital life, and whispered, here, learn my routines. We did it because convenience is a drug that hits faster than paranoia. Let's do an inventory of your very normal, very bugged apartment. Your TV watches you back. Modern smart TVs use Automatic Content Recognition. That is a polite, enterprise friendly way of saying your TV takes screenshots of everything you watch every few seconds and sells that ledger to advertisers. You agreed to it on page 47 of a menu you clicked through while trying to watch Love Island. Your robot vacuum maps your floor plan. It knows the square footage of your bedroom, how often you move the couch, and where you drop the most crumbs. That map is stored in the cloud. Your light bulbs log when you are home. Your smart plugs log when you are not. Your doorbell films every human who has ever had the courage to approach your front door, plus every dog walker who did not, and then it stores that footage on a server you do not

The deadline nobody missed Every expiry story we've written here has the same shape. A certificate lapses, nobody was watching, something breaks, and everyone is surprised. A Splunk license at a federal agency. Microsoft's own network connectivity tool. Same plot, different logo. This one is the opposite, and that's what makes it worth reading. On October 19, 2026, roughly ten weeks from this writing, the Microsoft Windows Production PCA 2011 certificate expires. It sits under the trust chain for the Windows boot process on essentially every PC shipped in the last fifteen years. Nobody forgot it. The expiry date has been printed inside the certificate since 2011. Microsoft has been publishing guidance for over two years, shipping replacement certificates through Windows Update since 2024, running OEM briefings, and pushing an automatic rollout that requires most users to do nothing at all. It is August. It still isn't done. What's actually expiring Three certificates, four replacements, three dates, all in 2026: Certificate Expires Replaced by Microsoft Corporation KEK CA 2011 June 24, 2026 Microsoft Corporation KEK 2K CA 2023 Microsoft Corporation UEFI CA 2011 June 27, 2026 Microsoft UEFI CA 2023 Microsoft Corporation UEFI CA 2011 June 27, 2026 Microsoft Option ROM UEFI CA 2023 Microsoft Windows Production PCA 2011 October 19, 2026 Windows UEFI CA 2023 Both June dates have already passed. October is the one that matters most, because that's the certificate used to sign the Windows Boot Manager itself. Devices that don't pick up the 2023 certificates keep booting and keep taking normal Windows updates. What they lose is the ability to receive new protections for the early boot path: updates to Boot Manager, Secure Boot database changes, revocation lists, and mitigations for bootkit vulnerabilities discovered from here on. In other words, the machine doesn't fail. It just quietly stops being patchable in the one layer that sits below your antivirus, your EDR agent, a