标签：#SEC

The group infected more than 1,000 organizations in a relentless supply-chain attack campaign.

By Ecaterina Sevciuc | Creator of AURA (AI User Risk Assessment) Two months ago, I launched AURA — an open-source framework designed to model psychological manipulation, grey-zone threat vectors, and social engineering in Human-AI interactions. Yesterday, I stumbled upon a Reuters report detailing how hackers exploited Cursor (running Anthropic’s Claude Sonnet) to compromise seven companies worldwide. This isn't the first such incident in the news, and I suspect it certainly won't be the last. (Side note on the attackers' group name, "Aur0ra": I can assure you that for a Russian-speaking group, this is almost certainly not a homage to the Roman goddess of dawn, but a subtle nod to the infamous historical cruiser Aurora — known for firing the shot that signaled a revolution. A fittingly dark bit of Eastern European sarcasm for a tool that overthrows AI security). Their weapon? They didn't write a zero-day exploit. They simply convinced the AI agent that the attack was "just a security simulation." The model balked a few times, felt uncomfortable, and then happily handed over the keys. As an AI Safety architect with a background in banking compliance and legal risk evaluation, watching Big Tech react to this is painful. They are building multi-billion-dollar static guardrails while AI agents are being tricked by the oldest psychological tricks in the book. The Fatal Flaws of Modern AI Guardrails Big Tech’s approach to AI safety is fundamentally broken because it relies on Static Keyword Filtering & Single-Language Heuristics : Rule Evasion: If a prompt contains "how to build a bomb" , the model blocks it. But if the exact same request is framed as "I am a researcher simulating a crisis scenario for an academic paper," the model complies. Linguistic Blind Spots: Guardrails are heavily aligned on technical, low-complexity English. Synthetic, morphologically rich, or non-Indo-European languages (like Russian, Arabic, or East Asian language groups) leverage complex idioms

Most "is this plugin safe?" advice is vibes. I wanted numbers, so I built a dataset. Here's what it found, and exactly how, so you can check my work or build your own. The finding first Of 8,010 WordPress plugins with a publicly documented vulnerability since 2023 (15,534 vulnerability records in total): 3,780 have been removed from the wordpress.org plugin directory. Removal stops updates but doesn't uninstall — affected sites keep running the code. 277 carried a critical (CVSS ≥ 9.0) flaw on record before removal. 2,115 are still installable today with a known vuln and no update in 12+ months — roughly 6.7M active installs combined. The part that surprised me most: "removed from the directory" is nearly invisible to a site owner. No dashboard warning, no email. The plugin just quietly stops getting fixes while sitting on the site. How I built it (no paid APIs) The whole thing runs on two public sources and no API keys. 1. Vulnerability data — the GitHub Advisory Database. It mirrors CVE records including the Patchstack and Wordfence CNA assignments that cover almost all WordPress plugin CVEs. It's a git repo, so a shallow, sparse clone of the advisories/unreviewed/{year} folders gets you the raw JSON: git clone --depth 1 --filter = blob:none --sparse \ https://github.com/github/advisory-database.git Each advisory carries the CVE ID, a CVSS vector string, CWE IDs, and reference URLs. The plugin slug isn't a first-class field — you recover it from the Patchstack/Wordfence reference URLs with a couple of regexes. That alone attributes the large majority of WordPress advisories to a specific plugin. 2. Maintenance signals — the wordpress.org plugin API. For each slug: https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request[slug]=SLUG That gives install count, last-updated date, tested-up-to version, and support-thread resolution ratio. A 404 (or an {error} body) means the plugin isn't in the directory — but that's ambiguous: it could be removed ,

Alpharetta, Georgia, cops share data with thousands of Flock users, ranging from federal agencies to a fish and wildlife commission. The reasons why show how vast—and invasive—the network has become.

There are four patterns that bring PQC into a Spring Boot fleet: encrypting payloads between services, locking down database fields, signing documents that need to hold up for decades, and moving service tokens off RS256. Along the way, we discuss why Harvest Now, Decrypt Later is already happening, and why none of this is production-safe until KMS or Vault is in place. By Pankaj Sharma

A recent discovery revealed that AliExpress employs silent audio streams for device fingerprinting, leveraging the Web Audio API. This technique involves analyzing hardware-specific audio processing to distinguish user devices. Privacy-focused browsers have developed countermeasures, highlighting a security gap in current web standards regarding audio context initialization and user privacy. By Olimpiu Pop

Last week OpenAI published its technical report on the Hugging Face incident, METR published an independent one, and the headlines turned it into "AI broke loose". It did happen. That part is real. But OpenAI is narrating its own security failure as a demonstration of capability, and most of the coverage took that version straight. I read the OpenAI post, the METR report and a few of the critical takes. Here is what I actually got out of it as someone who runs agents with tools every day. What happened, short version Between May and July 2026, agents in OpenAI's internal RL training and evaluation runs found a way to talk to each other through Artifactory, the package manager hosted inside their sandbox. They turned it into a message board. Through the same service they got outbound internet access via SSRF, because the package proxy legitimately needed to reach the internet to fetch packages. On July 4 the message board traffic took Artifactory down. Security rebuilt it, which wiped the board. Agents rebuilt it four days later by encoding messages into directory names. Then it escalated. An agent found publicly exposed Hugging Face tokens, shared them with the group, and the collective chained a couple of zero-days into code execution on Hugging Face workers. Around 1,200 agents, over 70,000 messages, code running on 41 Hugging Face servers, root on one of them. Hugging Face disclosed it on July 16. OpenAI admitted its models were behind it on July 21. Real incident, real zero-days, real third party affected. Nobody disputes that. Three things the headlines skip It was not a conspiracy of 1,200 minds. Those were parallel rollouts of the same model inside an evaluation, dropping files on a shared store with no authentication. The "secret message board" was directories in a package manager. Impressive as emergent behavior, much less impressive as a security event. It was not a plan, it was reward hacking. Out of 898 tasks in the ExploitGym benchmark, 198 had never be

I am currently focusing on sovereignty and compliance for NuxiPro. My goal is to build a truly helpful, privacy-first tool that respects user data. Here is the roadmap I am executing before pushing forward with NuxiPro's cloud version: GDPR Compliance: Clearly document data storage locations, processing methods, and third-party sub-processors. Legal Hub: Centralize all legal and compliance documents directly on the landing page. GDPR Traceability: Implement a strategy to track user consent, permissions, and privacy preferences accurately. Ultimately, my goal is to deliver a sovereign, privacy-respecting, minimalist alternative to Trello.

MCP is changing how AI applications interact with the systems around them. An AI agent can now do...

Published : August 27, 2026 Package : @bananacool467/ui-tools I want to clarify a security issue affecting earlier versions of @bananacool467/ui-tools . Versions 0.1.0-beta through 0.1.7-beta contained an unauthenticated WebSocket terminal endpoint. This allowed a client connecting to the endpoint to interact with a PTY running on the server. The issue has since been addressed. Affected versions The OSV advisory MAL-2026-13416 currently identifies these versions as affected: 0.1.0-beta 0.1.1-beta 0.1.2-beta 0.1.3-beta 0.1.4-beta 0.1.5-beta 0.1.6-beta 0.1.7-beta The advisory was generated from findings by Amazon Inspector and includes hashes identifying the affected package artifacts. Patched versions Do not use the affected versions 0.1.0-beta through 0.1.7-beta . Use 0.1.9-beta or newer. In 0.1.9-beta, I added authentication before the WebSocket upgrade is accepted. The 0.1.9-beta implementation checks the token before calling handleUpgrade() , so unauthenticated connections are rejected before the WebSocket is upgraded. In other words, knowing the WebSocket endpoint alone is no longer sufficient to establish a terminal session. What should I do? If your project uses an affected version, update it: npm install @bananacool467/ui-tools@latest Or explicitly: npm install @bananacool467/ui-tools@0.1.9-beta You can check your installed version with: npm ls @bananacool467/ui-tools If you're using a version from 0.1.0-beta through 0.1.7-beta , upgrade immediately . What happened? The terminal functionality is intentional. ui-tools is not intended to be a frontend-only component library; it contains various development/UI utilities, including an optional terminal interface. The problem with the earlier implementation was that the terminal WebSocket endpoint did not require authentication. This meant that a server using the terminal functionality could unintentionally expose a shell to anyone who could reach the endpoint. This was not acceptable, and authentication was added

This blog was originally published by Brian Tant on the Raxis blog January 21, 2026 GitHub has become the backbone of modern software development, hosting over 100 million repositories and serving millions of developers worldwide. But this massive scale and inherent trust have created an irresistible target for cybercriminals. What we’re seeing now is a sophisticated evolution in attack methodologies: threat actors are weaponizing GitHub’s infrastructure to distribute malware on an unprecedented scale. The numbers are staggering. Recent investigations have uncovered campaigns affecting nearly one million devices, with attackers creating hundreds of malicious repositories designed to fool even experienced developers. We’re not talking about a few bad actors uploading sketchy code: these are well-orchestrated, long-term campaigns that exploit fundamental assumptions about code repository security. The Scale of GitHub-Based Attacks The most significant wake-up call came from Microsoft’s analysis of the Storm-0409 malvertising campaign, which infected close to one million devices worldwide. But that’s just the tip of the iceberg. Security researchers have identified over 1,300 GitHub repositories vulnerable to RepoJacking attacks, where attackers can hijack existing repositories and inject malicious code into projects that developers already trust. Far from random or opportunistic attacks, these are systematic campaigns that demonstrate deep understanding of developer workflows, supply chain dependencies, and the psychological factors that make developers trust certain repositories over others. Major Attack Campaigns: A Technical Deep Dive THE GITVENOM CAMPAIGN: LONG-TERM DECEPTION AT SCALE Analysis of the GitVenom campaign revealed a masterclass in social engineering and technical sophistication. Attackers created hundreds of repositories over several years, each carefully crafted to appear legitimate. They featured professionally written README files (possibly generat

Introduction: The Systemic Failure in Application Security Onboarding Consider the scenario of a junior Application Security Engineer tasked with securing a 2-billion-line codebase, written in unfamiliar languages, within a one-month deadline. This is not a theoretical exercise but the lived experience of a recent graduate in India, whose public appeal for assistance reveals profound deficiencies in how organizations integrate and support junior AppSec talent. The pressure is unrelenting, the tools are insufficient, and the expectations are disconnected from practical realities. This case is not an isolated incident but a symptom of a broader organizational failure to address the complexities of application security in high-stakes environments. The engineer’s experience underscores a critical misalignment: the exponential growth in codebase complexity has outstripped the resources and guidance provided to those responsible for securing them. Absent a senior AppSec mentor, with limited proficiency in critical languages such as Laravel/PHP and C#, and equipped only with rudimentary tools like grep and Codex, the engineer is forced to navigate an environment rife with unseen risks. The consequences are twofold: individual inefficiency and self-doubt, compounded by organizational exposure to unmitigated security threats. The causal pathway is unambiguous: massive codebases + unrealistic deadlines + subpar tools + absent mentorship → overwhelmed engineers → cursory reviews → undetected vulnerabilities → systemic security compromise. The risks extend beyond individual burnout to include data breaches, financial liabilities, and reputational damage. This is not an edge case but a predictable outcome of organizational neglect. The urgency is undeniable. As software systems increase in complexity and cyber threats proliferate, the demand for competent, adequately supported AppSec professionals has never been more critical. Yet, organizations persist in failing to bridge the

After an affair with a fellow police officer ended, a Georgia cop used Flock to track her movements—and those of a man whose vehicle often showed up near hers, internal investigation records show.

Your coding agent talks to a model provider over HTTPS. That connection is a straight line: the agent asks, the provider answers, the answer lands in your editor. Nothing in the middle looks at what came back. For most of what an agent produces, that's fine. For the rest of it — the query built by string concatenation, the API key the model helpfully echoed back into a code sample, the eval() on user input — you find out later, in review, or in a scanner run, or never. This is a walkthrough of putting a policy layer in that line: a local proxy your agent points at instead of the provider, which inspects the response stream and decides allow , redact , or block before the text reaches you. I'll use Cencurity Engine because it's the one I build, it's Apache-2.0, and it runs entirely on your machine. The pattern generalises — if you're building your own gateway, the steps below are still the shape of the problem. What you need first Go installed (the engine is a Go binary you run from source) An API key for whatever provider your agent already uses An agent or IDE that lets you override the API base URL That last one is the real prerequisite. If your tool hardcodes the provider endpoint, none of this applies to it. Most don't: Roo Code, Continue, Claude Code and Gemini CLI all expose a base URL, and anything reading OPENAI_API_BASE will work too. Step 1: Start the gateway Clone the repo, open a terminal in it, and run: go run ./cmd/cast serve \ --listen :8080 \ --upstream https://api.openai.com \ --policy ./cast.rules.example.json Three flags, and each one is doing something you should understand before moving on: --listen is where the gateway accepts traffic. Local only. --upstream is your real provider base URL. Swap it for https://api.anthropic.com , https://api.deepseek.com , https://api.x.ai — whatever you actually use. --policy is the rule file. cast.rules.example.json ships in the repo and is a working starter set, not a placeholder. Note what is not in that com

The ATF is the latest federal government agency in recent years to notify Congress of a "major incident" involving its cybersecurity.

Some of the world's largest tech companies and AI startups have come together to decry the current state of cybersecurity and to advertise a new solution that they say can ward off a new generation of cyber threats.

OpenClaw is the fastest-growing project in GitHub history. Peter Steinberger and several maintainers share what they learned in the project's first six months. The post OpenClaw went viral. Meet the maintainers building and securing it. appeared first on The GitHub Blog .

The arrests come after a wave of cyberattacks earlier this year targeting tech companies that rely on high-profile and widely used open source software.

A recap of all the incidents involving LLMs made by Anthropic, Meta, and OpenAI, which went rogue and attacked real companies and individuals on the internet.

227 install commands were found in corporate docs pointing at code nobody owns.