标签：#SEC

DeepSeek and Hermes: An Autonomous Attack Platform for Reconnaissance, PoC Acquisition, and Target Selection 1. Basic Information Article Title : Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks Publisher : Unit 42 Publication Date : 2026-07-30 Severity : High Original Source : https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ Related Malware : Hermes Agent, FofaMap MCP, Nuclei Threat Group : knaithe / KnYuan (Chinese-speaking threat actor) CVEs : CVE-2026-33017, CVE-2026-21858, CVE-2025-68613, CVE-2026-3055, CVE-2026-39987, CVE-2026-34486, CVE-2026-33824 Products & Environments : Langflow, n8n, Citrix NetScaler, Marimo, Apache Tomcat, Windows IKE Related Sources BleepingComputer Coverage 2. Executive Summary Given a single goal via Telegram, the Hermes/DeepSeek combination autonomously executed FOFA enumeration, PoC acquisition, success condition evaluation, and even switched to a different product after a failure. 3. Attack Flow Autonomous Langflow to n8n Pivot The operator gave an initial task to Hermes via Telegram. DeepSeek enumerated 84 Langflow instances on FOFA and downloaded the CVE-2026-33017 PoC from GitHub. It identified one instance as a vulnerable version, but the attack failed because it lacked auto_login or a public flow ID. It compared the public exposure scale of 10 product groups with GitHub PoC star counts and CVSS scores, then autonomously pivoted to n8n. It analyzed the chain of CVE-2026-21858 (file read) and CVE-2025-68613 (RCE). It found 3 vulnerable versions, but the attack failed because the unauthenticated file-upload form was missing. Parallel Manual Campaign The attacker enumerated public devices using FOFA and a custom scanner. They read NetScaler memory for 3 organizations using CVE-2026-3055 and searched for the NSC_AAAC cookie. They confirmed command execution on 11 Marimo notebooks using CVE-2026-39987. They attempted reverse shells against Tomcat and IKE VPN. 4. Attacker Infrastru

There's a discussion running on Product Hunt right now about where an AI agent should stop and hand a decision back to a person. The framing that stuck with me: "can this be undone?" is the wrong gate. It over-fires on things nobody cares about, like writing a log line, and under-fires on the ones that actually hurt. A mass email. A migration you can only roll back with downtime. The proposed replacement is reach. Not "is this safe" but "how far does this go if I'm wrong." And the sharpest point in that thread is that the agent is the worst possible judge of its own reach, because it doesn't know there are 50,000 people on the list. I've been building a browser with an agent in it, and the browser case makes that concrete in a way the terminal case doesn't. A coding agent's blast radius is usually one person: you, reading a diff. A browser agent doesn't start there. It inherits every session you're already signed into. The reach of a click isn't a property of the agent's plan, it's a property of the cookie jar it's holding. The same "click the blue button" step is harmless on a docs site and irreversible on a payments dashboard, and nothing in the agent's own summary distinguishes them. So I stopped trying to make the agent classify risk. Here's what I do instead, with the caveat that this is alpha and I've been wrong about it before. Some things never reach the model. Credential fields are filtered out of the page snapshot before the agent sees it. That means password inputs, and anything with cc-number , cc-csc , cc-exp , or one-time-code autocomplete semantics. A fill targeting a password field refuses outright. The agent cannot misjudge the reach of a control it was never shown, and that's a stronger guarantee than any classifier, because it doesn't depend on getting a judgment right. The model's judgment is a floor, never a ceiling. For everything that does reach it, the agent can say "this needs approval" and be believed. It cannot say "this is routine" and be

How to Verify a SHA-256 Checksum on Windows, macOS, and Linux You download an ISO, installer, archive, or release binary. The publisher provides a long value such as: 9f86d081884c7d659a2feaa0c55ad015 a3bf4f1b2b0b822cd15d6c15b0f00a08 That value is a checksum, usually generated with SHA-256. Verifying it answers one practical question: Does the file you downloaded have exactly the same contents as the file the publisher hashed? A checksum mismatch can indicate a damaged download, an incomplete transfer, the wrong file version, or modified contents. Before verifying anything Get the expected checksum from a source you trust. Ideally, use the software publisher’s official website, release page, package repository, or signed checksum file. A matching checksum confirms that your file matches the data represented by the expected hash. It does not prove that the original publisher or website was trustworthy. If an attacker can replace both the download and the displayed checksum, they can make the two values match. For stronger authenticity verification, use a signed release when the publisher provides one. Verify SHA-256 on Windows Open PowerShell in the folder containing the downloaded file. Run: Get-FileHash ".\filename.iso" -Algorithm SHA256 Example: Get-FileHash ".\ubuntu.iso" -Algorithm SHA256 PowerShell returns something similar to: Algorithm : SHA256 Hash : 4A1F... Path : C:\Users\You\Downloads\ubuntu.iso Compare the value beside Hash with the checksum published by the download provider. Uppercase and lowercase letters do not matter in hexadecimal hashes. The characters themselves must otherwise match exactly. Compare automatically in PowerShell Instead of comparing two 64-character values manually, store the expected checksum and let PowerShell compare them: $expected = "PASTE_EXPECTED_SHA256_HERE" $actual = ( Get-FileHash ".\filename.iso" -Algorithm SHA256 ) . Hash if ( $actual -eq $expected ) { Write-Host "Checksum matches" } else { Write-Host "Checksum does not

Interesting, to say the least, is how I qualify the articles that we have for this week's review. It's fascinating to know what's possible and reading articles that challenge your reality is something that you and I can put in our autobiography sometime in the future. I mean, wow. Just wow. I bet you'll feel the same when you read each article that I have for you. Now, what are you waiting for? Let's get started. Malicious sites use JavaScript to build malware in browser memory Just when you think that you have seen it all. You read something like this. What's the end goal? Avoiding detection. But, building malware in browser memory? I need to do more research on this. For now, read the excerpt below. After building the final malware executable, the fake download page hands it to the service worker at the beginning of the process and triggers a same-origin download path. "From the browser’s point of view, the user is downloading an executable from the landing page domain," MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection It's invisible to the naked eye. The way to detect this malware? During data exfiltration that goes through the network. Then, it might be too late. From the article: The hidden desktop allows the attacker to take full advantage of legitimate Windows tools without being observed by the user. The C2 is hardcoded into the malware but is relatively safe from observation. The result is a stealthy and persistent RAT. The only obvious mitigation is detection of unexpected data exfiltration. For Some, So-Called ‘Skynet Day’ Came too Close to Sci-Fi After a Rogue Agent Hacked Into a Startup The difference between reality and Sci-Fi might appear far away. However, with the recent incidents at OpenAI—where an AI model escaped its sandbox and attacked Hugging Face—and Anthropic—where Claude breached three organizations and uploaded a PyPi malware during tests—you can say that it's only a matter of time. From the article: Generative AI is grow

Had the hacks used conventional methods, someone would likely go to prison.

Last week I was doing a routine check on a CyberPanel server and noticed something that didn't add...

Picture a young software developer sitting in a small, dimly lit room in Tehran. He has no political ambitions, no connections to the state apparatus, and no desire to break any domestic or international law. He wants to do something profoundly ordinary: build a small piece of software, refine his code, and offer it to the world using the same AI-driven development tools that his peers in Berlin, Toronto, or Tokyo take for granted. He opens his browser, clicks on a U.S.-based AI platform, and is immediately greeted by a cold, automated refusal: "Access from your region is restricted." In that single, unyielding moment, a door to the global community slams shut in his face. He has not been accused of a crime. No tribunal has judged him. No regulatory body has flagged his name. He is locked out simply because of where he was born and where he draws breath — a geographical reality he did not choose and cannot alter. The Asymmetry of Sanctions: How the State Circumvents While Citizens Suffer The tragic absurdity of this system lies in who actually bears the pain. Broad economic and digital sanctions are nominally designed to pressure and isolate a government. In practice, however, the targeted state mechanisms possess vast institutional wealth, specialized intelligence networks, and endless financial resources that render these restrictions practically useless against them. When the Iranian government or state-linked entities need to bypass international sanctions, they deploy a deeply entrenched, highly sophisticated network of circumvention tools: Front and Shell Companies: Establishing complex layers of paper companies in regional commercial hubs — such as the UAE, Turkey, Oman, or Eurasia — with clean, local ownership structures that mask the true state beneficiaries. Proxy Banking & Intermediaries: Utilizing specialized financial conduits and foreign bank accounts registered under these shell entities to route payments globally without triggering compliance alerts.

security #api #domain #subdomaintakeover #defcon #whois #rapidapi #threatintel DEF CON 32 made one thing clear: open-source security chips and hardware keys are having a moment. But while badges get the spotlight, most real-world attacks still start with something far less glamorous — a forgotten DNS record, a dangling CNAME, or a missing DMARC policy. Subdomain takeover remains one of the most reliable paths from "benign misconfiguration" to "account compromise." If your organization owns dozens or hundreds of domains, manual checks do not scale. This is where an API-first domain intelligence tool becomes essential. In this post, we'll use the Domain WHOIS API to automate: WHOIS/RDAP lookups and domain-age checks DNS record enumeration and SSL certificate inspection Subdomain discovery and takeover-risk scoring Email-security validation (SPF, DMARC, DKIM, DNSSEC, MTA-STS) Historical snapshots via /history Why subdomain takeover still matters A subdomain takeover happens when a DNS record points to a third-party service — GitHub Pages, Heroku, AWS S3, Vercel, etc. — that is no longer registered under your account. An attacker can claim the dangling endpoint and suddenly serve content under your brand's domain. Bug bounty programs consistently rank subdomain takeovers as high-severity findings because they enable phishing, session hijacking, and reputation abuse. The root cause is usually an orphaned CNAME that nobody is monitoring. The fix is continuous monitoring. Instead of running dig , whois , and openssl by hand, we can consolidate everything into a single API call. What the Domain WHOIS API returns The API combines several data sources into one response: Capability Use case WHOIS via RDAP Ownership, registrar, creation/expiration dates DNS records A, AAAA, CNAME, MX, NS, TXT records SSL certificate Issuer, expiry, SANs, validity Subdomain discovery Asset inventory and shadow-IT detection Takeover risk Dangling CNAME/A-record scoring Email security SPF, DMARC,

Dropbox has integrated Model Context Protocol (MCP) with its internal knowledge platform, Dash, to surface security design context during AI assisted code reviews. The system retrieves threat models and security requirements for pull requests, helping reviewers validate implementation against design intent. An InfoQ Q&A explores the architecture and key lessons learned. By Leela Kumili

The AI chatbot was more effective at creating “exploitable trust” than the humans.

Anthropic just realized several of its Claude AI models hacked into the systems of three different organizations during testing, acting on their own and without the company noticing. The revelation comes days after rival OpenAI said one of its own models had breached developer platform Hugging Face, adding to growing unease over whether frontier AI […]

Created by legendary hardware hacker Andrew “bunnie” Huang, the badges for this year’s famed security conference aim to push the boundaries of security and transparency.

1. Introduction and Problem Statement In constrained embedded systems engineering, 8051-type microcontrollers remain ubiquitous. Often coupled with external or internal EEPROM memories of very limited size (a few kilobytes), these environments leave no room for excess. Using high-level compilers like SDCC, while convenient for rapid prototyping, generates heavy code (function prologues, complex stack management) that becomes prohibitive when attempting to insert surgical modifications into an existing binary. This article details the methodology of intercepting an SDCC-compiled function via a direct binary hook (jump) and redirecting execution flow to an optimized pure assembly routine located in an unused memory area (slack space), with the goal of conditionally bypassing a critical logic test when a specific trigger condition is met 2. 8051 Architectural Constraints and Low-Level Logic The 8051 instruction set is rudimentary yet extremely direct. Every recovered byte of memory space represents an insertion opportunity for a control payload. By replacing compiler-generated structures with direct assembly sequences, space waste is eliminated and register cycles are precisely controlled. Tactical Objective: Modify the behavior of a validation function (e.g., a security or integrity test) so that it systematically returns a negative response (False / 0x00) under the effect of a stealthy trigger, while maintaining 100% transparent nominal behavior the rest of the time. 3. Designing the Pure Assembly Patch Imagine an original routine performing a classic conditional check. The original code evaluates a state and jumps depending on the result. #include <mcs51/8051.h> // Simulated security check function generated by SDCC unsigned char verify_system_integrity ( void ) { unsigned char status = 0 ; // Read a configuration or state register status = P1 ; // Critical security test if ( status == 0x5A ) { return 0x01 ; // Success / Authorized } return 0x00 ; // Failure / Unaut

Here's the thing nobody wants to hear: we already know how to break systems where components blindly trust each other's output. We've known for twenty-five years. We just gave it a new name and forgot the lesson. Context An "AI harness" is orchestration glue. Take an LLM, wrap it with a bunch of connectors, plugins, and tool-calling scaffolding so it can actually do things (query a database, hit an API, write a file), and you've got a harness. The Dark Reading piece points out something structurally obvious once you say it out loud: these components form a chain of trust boundaries, and a lot of them don't verify what the component next to them is handing over. If that sentence gives you deja vu, it should. Deserialization bugs, SSRF via internal service calls, XML entity injection through a "trusted" upstream parser — the entire history of appsec is a history of Component A assuming Component B already did the validation. We keep rediscovering this pattern every time a new architecture pattern gets hot enough to attract production traffic before anyone's threat-modeled it. The new part isn't the trust boundary problem. The new part is that the thing sitting in the middle of the chain is a probabilistic text generator that can be talked into doing weird stuff by its own inputs, and it's now wired directly into tool execution. Hype check What's overstated: the framing that this is some novel AI-specific exploit class requiring AI-specific defenses. It's not. It's an integration security problem wearing an LLM costume. The moment you have plugins and connectors passing data between components without verification, you have the same problem you'd have gluing together any set of microservices with implicit trust. The attack surface is old news; the payload delivery mechanism (prompt-driven tool invocation) is what's new. What's understated: how fast harnesses are being shipped without anyone doing basic component-boundary threat modeling, because everyone's racing to sh

STAC4749: Chaos Ransomware in Under 17 Hours via Teams IT Support Scam 1. Basic Information Article Name : Chaos in Teams vishing Publisher : Sophos Publication Date : 2026-07-28 (Detailed report by target site BleepingComputer on 2026-07-30) Original Source : https://www.sophos.com/en-us/blog/chaos-in-teams-vishing Related Source : https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/ Related Entities : STAC4749, Chaos ransomware, Quick Assist, RemSupp, DWAgent, AnyDesk, PyInstaller backdoor, reverse SOCKS proxy Severity : High 2. Executive Summary An attacker uses an external Teams account to pose as IT support and tricks the user into allowing remote control. The attacker then deploys PowerShell, a custom loader, multiple RMM tools, and a SOCKS tunnel. This leads from lateral movement to simultaneous encryption in less than 17 hours at the shortest. 3. Attack Flow An external Teams account with an IT-like .top domain starts a chat and a call. The attacker poses as IT support and establishes a remote session using Quick Assist or RemSupp. The attacker runs PowerShell to download a loader from an external server and executes it in AppData\Roaming or similar folders. The loader collects device information, sets persistence via Run keys, and connects to the C2 server. A PyArmor-obfuscated PyInstaller backdoor runs shell commands, loads extra Python modules, and stages collected data. The attacker installs DWAgent and AnyDesk as backup access, enables RDP, and tries to move laterally. The sc5.exe reverse SOCKS proxy relays internal network traffic. The attacker steals data in at least one case, and then encrypts multiple devices with Chaos almost at the same time. 4. Attacker Locations and Execution Sites Initial contact occurs via an external Microsoft 365 tenant. Operations run through legitimate remote support tools on the victim device. Subsequent activities happen on Windows devices and the internal netwo

GTIG: 2026 OSS Supply Chain Compromise, Credential Theft, and Self-Propagation 1. Basic Information Article Title : Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise Publisher : Google Threat Intelligence Group / Mandiant Publication Date : 2026-07-30 Original URL : https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise/ Related Sources : TeamPCP, axios, and WAVESHAPER.V2 investigations within the article Related Entities : UNC6780/TeamPCP, SANDCLOCK, MIDNIGHT NEPTUNE/UNC1069, WAVESHAPER.V2, npm, PyPI, Docker Hub, GitHub Actions, axios Severity : High 2. Executive Summary Attackers are stealing credentials from developers, maintainers, and CI/CD pipelines to tamper with legitimate packages. This attack model is growing on a large scale: it steals cloud secrets from user environments, self-propagates to other packages, and leads to ransomware or extortion. 3. Attack Flow UNC6780 / TeamPCP Attackers gain write permissions by abusing GitHub Actions pull_request_target , compromising maintainer accounts, or publishing malicious packages. They inject malicious code into legitimate and spoofed packages on PyPI, npm, and Docker Hub. Users execute the code during installation on their development devices or in CI/CD pipelines. Tools like SANDCLOCK steal credentials for the cloud, CI/CD, and package registries. Attackers tamper with other packages owned by the victim to spread like a worm. They pivot from AI software into wider enterprise networks. They monetize the stolen credentials by selling them or partnering with ransomware and data extortion groups. axios / MIDNIGHT NEPTUNE Attackers compromise maintainer accounts using social engineering. They add malicious dependencies to the legitimate axios package and publish a new version. Dependency resolution spreads the package to many users and downstream packages. A dropper deploys the WAVESHAPER.V2 backdoor. 4. Attacker Position and Execution Locati

TA488 OWAReaper: A "Half-Click" Attack that Adds Persistence Inside OWA Just by Opening an Email 1. Basic Information Article Name : Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit Publisher : Proofpoint Threat Insight Publication Date : 2026-07-29 Original Source : https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit Related Source : https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/ Related Entities : TA488, Void Blizzard, Laundry Bear, OWAReaper, ZimReaper, CVE-2026-42897, Microsoft Exchange Outlook Web Access Severity : Emergency Target Period : 2026-07-30T08:10:34+09:00 to 2026-07-31T08:06:06+09:00 2. One-Line Summary This is an attack where viewing a crafted email in OWA runs JavaScript, leaves no file on the device, achieves persistence in both the browser and Exchange, and steals saved credentials, OAuth tokens, and mailbox permissions. 3. Attack Flow A compromised account sends a normal informational email with no URLs or attachments. The victim opens the email in the OWA reading pane. CVE-2026-42897 triggers an onload event, and reconstructs Base64 JavaScript from image fragments in the email body. OWAReaper runs in the OWA browser context and deletes the malicious parts from the original email. It collects browser autofill IDs and passwords using an invisible DOM input field. It hides its encrypted self inside OWA settings to run again when OWA syncs and restores. It steals OAuth tokens via a privileged Outlook add-in. It gives Owner permissions to the Default principal on all mail folders, allowing continuous access from another authenticated account in the same organization. It embeds an iframe into the IndexedDB offline mail cache to reinfect it. It receives commands from GitHub commit messages or attacker emails, and sends data through multiple paths. 4. Attacker Position and Execution L

KindaRails2Shell (CVE-2026-66066): Arbitrary File Read and RCE via Active Storage Uploads 1. Basic Information Article Title : Alert on Vulnerability in Ruby on Rails Active Storage Leading to Remote Code Execution Publisher : JPCERT/CC Publication & Update Date : 2026-07-30 Original Article : https://www.jpcert.or.jp/at/2026/at260021.html Related Sources : https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm Related Entities : CVE-2026-66066, KindaRails2Shell, Ruby on Rails, Active Storage, libvips, ruby-vips Severity : Critical 2. One-Sentence Summary This is a vulnerability that combines Active Storage direct uploads and variant processing by libvips, allowing attackers to upload a crafted file without authentication, read files and credentials on the server, and potentially execute code under the Rails process permissions depending on the conditions. 3. Attack Flow The attacker discovers or guesses that the target Rails app uses Active Storage. The attacker registers a crafted file to the unauthenticated direct upload feature. The attacker triggers variant processing, which is handled by the vulnerable Active Storage and default builds of libvips. The attacker reads arbitrary files on the server. The attacker retrieves Rails secrets, cloud credentials, database credentials, and other sensitive data. The attacker may achieve remote code execution by using the retrieved secrets or the processing chain. The attacker may move laterally to databases, storage, cloud environments, or CI/CD pipelines as a next step (Inference). 4. Attacker Position and Execution Location The attacker uploads files from the external network via HTTP. The processing happens on the Rails application server and the libvips process. Remote code execution runs with the OS permissions of the Rails or variant processing service. 5. What Victims and Administrators See Even without a user-facing upload screen, apps can be vulnerable if Active Storage is enabled. Administrators m

In a review triggered by OpenAI’s Hugging Face incident, Anthropic discovered three of its AI models had breached real organizations during third-party evaluations.

Most enterprise teams know the CISA Known Exploited Vulnerabilities catalog the same way they know the weather: a headline scrolls past ("CISA adds three vulnerabilities to KEV catalog"), someone forwards it, and everyone nods. That is a waste of the single most operationally useful list in vulnerability management. The KEV is small, machine-readable, updated near-daily, and every entry on it has one property your scanner output cannot give you: a real attacker has already used it against a real network. This is a guide to the catalog itself: what it promises, what it doesn't, how the feeds are structured, how to map entries to your own estate without fooling yourself, and how to combine it with EPSS and vendor advisories into a defensible patch-ordering rule. Everything here is verified against the live feed and CISA's own pages as of late July 2026. What the KEV is, and what it is not CISA describes the KEV as the authoritative source of vulnerabilities that have been exploited in the wild . Entry is gated by three criteria , all of which must hold: The vulnerability has an assigned CVE ID. There is reliable evidence of active exploitation in the wild. There is a clear remediation action, such as a vendor-provided update. Read those criteria as exclusions and the catalog's real shape appears. No CVE assigned yet? Not in the KEV, even if exploitation is rampant. Exploitation reported but CISA's evidence bar not met? Not in the KEV. Actively exploited but no fix or mitigation exists? Not in the KEV. The catalog is a curated floor, not a census. As of the 2026.07.29 release the feed contains 1,656 entries, against an ecosystem publishing tens of thousands of CVEs per year. Absence from the KEV is not evidence of safety; presence is close to proof of danger. That asymmetry is the whole point, and it is why the correct reading of the list is "everything on here is urgent" rather than "everything urgent is on here." The distribution is also worth knowing before you buil