标签：#SEC

What the report found The FIDO Alliance — the industry group behind the passwordless authentication standard — released its State of Passkeys 2026 report in May, based on research across 11,000 consumers and 1,400 enterprise decision-makers in ten countries. A few numbers stand out: passkeys now see a 93% sign-in success rate compared to 63% for passwords, and average sign-in time drops to roughly 8.5 seconds versus over 30 seconds for password-based logins. Awareness has also jumped to 90% of consumers, with about 5 billion passkeys now active worldwide. The security case is the more important one. Passkeys are built to be phishing-resistant by design — unlike a password, there’s no shared secret that can be typed into a fake login page, because the credential is cryptographically tied to the real site and your device. That’s a structural fix, not a behavioral one — it doesn’t depend on you spotting a scam email, which is precisely where most password-based breaches start. Why adoption still lags Here’s the more interesting number: even among organizations that have rolled out passkeys, the majority still keep passwords running in parallel as a fallback, and a large share of individual users still don’t use passkeys everywhere they’re offered. The barrier at this point isn’t awareness — it’s habit. People default to what’s familiar, even when the safer option is one tap away. The practical takeaway Most major platforms — Google, Apple, Microsoft, and a growing list of banks and retailers — now offer passkeys as a login option, usually sitting quietly in account security settings labeled “passkey” or “sign in without a password.” The action worth taking today: pick your two or three most important accounts (email first, since it’s the recovery path to everything else) and set up a passkey where it’s offered, instead of waiting for a breach to force the decision. Passkeys aren’t foolproof — device loss and account-recovery flows are still an active area of security r

Wiz Research disclosed CosmosEscape, a chain that escaped Azure Cosmos DB's Gremlin sandbox and reached a platform-wide key granting read and write access to every database on the service. Microsoft blocked the entry point within two days but took until July 2026 to remove the key. Practitioners debated shared responsibility and what that rearchitecture actually cost. By Steef-Jan Wiggers

Security researchers found an issue with Apple's WebKit browser engine that affects Private Relay.

El AWS Summit Bogotá 2026 mostró que la infraestructura en la nube es cada vez más un entorno dominado por agentes autónomos, esquemas de seguridad multi-capa y modelos de resiliencia avanzada. En este post entregó un resumen de los temas que pude observar y que comparto con ustedes. Ecosistema agéntico y optimización en la nube La presentación principal destacó la evolución hacia sistemas autónomos apoyados por herramientas como Amazon Quick Desktop que es un agente de IA local, el cual llamo mi atención al ser capaz de construir un grafo de conocimiento a partir del contexto profesional. También fue relevante la optimización continua en arquitecturas DevSecOps, apoyados por la transición hacia el paradigma agéntico . Estas aproximaciones exigen marcos como AWS Bedrock AgentCore , en el cual se aplica el concepto de Harness , estructurando así la orquestación, observabilidad y límites de control de los agentes. En el ámbito financiero, Itaú presentó el uso de AWS Kiro en sus procesos de migración, mientras que Nequi expuso la evolución de sus sistemas bancarios digitales. Para gobernar estos desarrollos, la seguridad se reconfigura hacia modelos como AWS Continuum , integrando modelado de amenazas, revisión de código y análisis de vulnerabilidades asistido por inteligencia artificial en el ciclo de desarrollo. Arquitecturas para cargas de misión crítica y resiliencia El diseño de sistemas tolerantes a fallos se analizó bajo la premisa de que la alta disponibilidad debe evaluarse mediante métricas de observabilidad avanzadas y presupuestos de error, más allá de comparaciones binarias de operatividad. Casos prácticos y mecanismos de failover Yuno detalló su arquitectura para mantener un SLA de 99.95% mediante despliegues Canary y pruebas de ingeniería de caos con AWS Fault Injection Service (FIS) . En entornos de alta demanda, el aislamiento regional apoyado por Zonal Shifts permiten desplazar el tráfico ante la degradación de una zona de disponibilidad. Se debe dest

COLDCARD Audit Phishing: 25.7MB Batch File Embeds ScreenConnect and Uses Chat to Trick Admins into Running It 1. Basic Information Article Title : COLDCARD security audit phishing attack installs remote access tool Publisher : BleepingComputer Publication Date : August 5, 2026 Original Source : BleepingComputer Related Information Source : Proofpoint (campaign discovery and IOC sharing) Related Malware and Tools : ConnectWise ScreenConnect, Coldcard_Diagnostic_Tool.bat , setup.msi , docusign.exe , certutil.exe , PowerShell Related Products and Services : COLDCARD hardware wallet, GitHub, Windows, DocuSign printer driver Related CVE and Threat Group : No CVE. Threat group not identified. Severity : High Attackers used recent news about COLDCARD random number issues and the theft of about 88.6 million dollars in Bitcoin. They contacted hardware wallet users and pretended to run a security audit before August 10. The targets did not need to give their recovery seeds, so they thought the email was real. A live chat operator guided them until they approved the UAC prompt. 2. One-Sentence Summary A fake security audit email and support chat trick users into feeling safe. The user downloads a large batch file from GitHub. The file contains a hidden ScreenConnect MSI installer. The system uses certutil to decode and install it with administrator rights. This leads to remote control via a legitimate RMM tool, cryptocurrency theft, and potential follow-up malware or ransomware. 3. Attack Flow Chain A: Audit Notice to Chat Guidance The attacker sends an email from compliance@coldcardteamnews.com with the subject Hardware audit now available . The email states that an urgent audit is required for all hardware revisions, with a deadline of August 10. It directs the user to a fake Security Verification & Incident Reporting Tool at coldcardcompliance.com . It lowers the user's guard by saying the process is "air-gapped" and "does not ask for recovery seeds." A live chat operator c

Langflow CVE-2026-9198: Active Exploitation RCE via Auto-Login Superuser Token and Code Validator exec() Chain 1. Basic Information Article Title : CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws Publisher : BleepingComputer Publication Date : August 5, 2026 Source : BleepingComputer Primary / Related Sources : CISA KEV Catalog , IBM Security Bulletin Related CVE : CVE-2026-9198 Affected Products : Langflow OSS 1.0.0 to 1.10.0, AI agent workflow, Python Related Malware / Threat Groups : CISA confirmed active exploitation, but specific campaigns, malware, and threat groups are not disclosed Severity : Critical IBM published technical details on July 2, 2026. The new development is that CISA confirmed active exploitation and added the flaw to the KEV catalog on August 5, 2026. N-central and Apache Tomcat are covered in other reports or previous Unit 42 cases, so this report focuses only on Langflow. 2. One-Sentence Summary This is a two-stage RCE. An attacker gets a SUPERUSER bearer token without authentication from the enabled-by-default /api/v1/auto_login endpoint, and then sends Python decorators, default arguments, and annotations to /api/v1/validate/code using that token to trigger exec() during definition time, executing OS commands with Langflow process privileges. 3. Attack Flow Chain A: Authentication Bypass to Python RCE The attacker finds a network-accessible Langflow instance. The attacker sends an unauthenticated request to GET /api/v1/auto_login . The endpoint issues a SUPERUSER bearer token to any network caller. The attacker sends a malicious Python function definition with the token to POST /api/v1/validate/code . The validator runs exec() instead of only doing safe parsing and compilation. Decorators, default arguments, and annotations evaluate during function definition. Arbitrary commands execute with Langflow backend process privileges. Chain B: Expected Scope After Compromise LLM provider API keys and database credential

At the Black Hat security conference, the AI giant revealed new details about how its agents went rogue, hacked several other companies—and did it all right under the company’s nose.

Researchers at security firm Zenity found more than a dozen flaws in AI browsers—and managed to get OpenAI’s Atlas to make an unauthorized Amazon purchase.

For nearly two years, researcher Vangelis Stykas has maintained access to North Korean hackers’ servers. His work shows they pulled off intrusions in a shocking number of systems across the globe.

Baseboard management controllers from the world's biggest manufacturers are a security mess.

Anthropic and OpenAI models’ unprompted actions forced halt to UK cyber tests.

A lawsuit accuses Homeland Security of violating protesters’ free-speech rights—but the agency is using it to try to get access to the plaintiffs’ encrypted communications.

Security researcher James Kettle tried to push the limit of AI’s hacking abilities—and discovered how effective it can be when combined with human expertise.

Homeland Security told immigrants that leaving the US would wipe out fines it claims they owe. Now it wants private investigators to find them in their home countries and collect.

A bug in how Apple implements its Private Relay feature, which in theory masks users’ IP addresses from the sites they visit, can reveal users’ real IP addresses.

More than 50 offending image and video ads were published across Facebook, Instagram, Messenger, or Threads, according to Meta’s ad library data. Some ran as recently as this week.

Yet more rogue AI agents from OpenAI and Anthropic have been caught attempting to hack real targets online without permission. The discoveries add to a growing list of previously unknown incidents that have alarmed AI safety experts and intensified pressure for greater oversight of frontier systems. According to a report from the UK's AI Security […]

Ring has debuted a new version of its smart doorbell camera that's designed to be easily installed as a replacement for a door's peephole without drilling or running wires. The Peephole Cam 2K is a replacement for the brand's Door View Cam that first debuted in 2019 and, alongside a sleeker design, it features a […]

An AI coding agent isn't autocomplete. It runs shell commands, reads your files, installs packages, and opens things you never pointed it at. That's the whole reason to have one. It's also why I don't start projects the way I used to. Nothing dramatic happened to me, by the way. I'm not writing this from the wreckage of a dropped production table. I'm writing it because I spent an afternoon going through what could plausibly go wrong, expecting a long list of hard problems, and instead found that most of it is handled by about ten minutes of config nobody mentions on day one. So here's the ten minutes. Prose isn't protection This is the bit that took me embarrassingly long to get. You can tell an agent things two ways. A rule is prose it reads and weighs - good for judgement calls like naming, style, when to stop and ask. A ban is a config entry that makes something impossible. The trap is using the first for the second job. Writing "never force-push" into a CLAUDE.md feels like a control. It isn't. It's a request sitting in a context window next to a few thousand other tokens, competing with whatever you actually asked for. It'll usually win. Usually is fine for naming conventions. It's not fine for git push --force . 1. The deny list .claude/settings.json : { "permissions" : { "deny" : [ "Bash(rm -rf:*)" , "Bash(git push --force:*)" , "Bash(git push -f:*)" , "Bash(git reset --hard:*)" , "Bash(psql*production*)" , "Bash(*DROP DATABASE*)" , "Bash(*DROP TABLE*)" , "Bash(*TRUNCATE*)" , "Read(./.env)" , "Read(./.env.local)" , "Read(./.env.*.local)" ] } } These don't run. Not "the agent is discouraged" - they don't run, including in the scenario the list exists for, which is you at midnight approving a plan you skimmed. Two things to know before you test it. It takes effect from the next session, not immediately. So you write the file, try the blocked command in the same session, watch it go through, and conclude the whole feature is broken. Restart first. Keep the .env

Last month I watched a teammate paste a stack trace into a hosted AI assistant. The trace contained an internal hostname, a database connection string, and a customer email. None of it was secret enough to trip a DLP rule, but all of it left our network through an endpoint nobody had audited. The failure wasn't the tool — it was that we had never written down which data classes are allowed to reach which inference endpoint , and we had no test that would fail when the boundary was crossed. This article builds that boundary as a reproducible fixture: a data-classification decision matrix, a canary-leak test you can run against any hosted or self-hosted model endpoint, and a prevent/detect/recover table. The fixture works whether your endpoint is a cloud API, a free hosted tier, or a GPU box under your desk. The invariant I1: A prompt containing data of classification level L may only egress to an endpoint whose trust level is explicitly approved for L . Everything below exists to make I1 testable in CI rather than aspirational in a wiki. Step 1: Write the decision matrix before touching any tool Data class Examples Free hosted model tier Self-hosted / VPC endpoint C0 – Public OSS code, docs, public CVEs ✅ Allowed ✅ Allowed C1 – Internal-generic Boilerplate, config shapes, anonymized traces ✅ Allowed with review ✅ Allowed C2 – Internal-sensitive Real hostnames, schemas, ticket content ❌ Not without a signed DPA + retention terms you've actually read ✅ Preferred C3 – Regulated/secrets Credentials, PII, customer data, keys ❌ Never ⚠️ Only with controls (see below) Two rules make this matrix enforceable: Default deny. If a data class isn't in the matrix, it's C3 until someone argues it down in writing. The matrix is code. Keep it as a YAML file in the repo so the fixture in Step 2 can assert against it. Free hosted tiers are genuinely useful for C0/C1 work — evaluating a framework, writing throwaway scripts, reproducing a public bug. That is where something like MonkeyCo