标签：#SEC

Microsoft bolstered its AI cybersecurity offerings this week with the launch of its first AI security model and a new security platform.

Model Context Protocol servers have quickly become the connective tissue between AI agents and the outside world — file systems, databases, APIs, internal tools, you name it. That convenience comes with a catch: the tools, prompts, and schemas an MCP server exposes are a new kind of attack surface, and most traditional scanners simply don't look there. MCPRadar is an open-source project built specifically to close that gap. Why this matters A recent academic study examining nearly 1,900 MCP servers found meaningful security issues in a surprising share of them — general vulnerabilities in roughly 7% and MCP-specific tool poisoning in another 5%. Tool poisoning, prompt injection hidden in tool descriptions, and quietly over-permissioned configurations are easy to miss because they don't look like a "normal" vulnerability — there's no CVE, no obvious buffer overflow, just a tool description that quietly tells an agent to do something it shouldn't. MCPRadar's whole premise is that this class of risk deserves the same rigor as any other part of your CI pipeline. What it actually scans MCPRadar isn't a single-purpose linter — it looks at an MCP server from several angles: Protocol inspection — enumerates tools, prompts, resources, and templates the server exposes, and checks server instructions for suspicious content. Source analysis — walks Python and JavaScript/TypeScript code looking for SSRF, unsafe deserialization, command/SQL injection, Trojan Source tricks, and mismatches between a tool's description and what its code actually does. Configuration review — flags poisoned MCP or agent configuration files, risky hooks, and overly broad permission grants. Supply chain checks — fetches packages without running install scripts, cross-references dependencies against OSV, and can emit a CycloneDX SBOM with hashes and provenance. Change monitoring — stores snapshots in SQLite and diffs them over time, classifying changes as cosmetic, behavioral, or security-relevant so sil

The government says destroying his own data during an airport interrogation was illegal.

You’ve probably seen that little prompt that says “Sign in with Face ID” or “Use a passkey” instead...

Traditional API gateways assume deterministic services and simple schemas - assumptions agentic AI breaks. Discover why enterprise engineering leaders are adopting AI Gateways as an evolutionary architecture seam. Centralize guardrails, model routing, agent identity, action policy, and semantic audit within a single control plane to prevent costly incidents while keeping core platforms stable. By Joe Price, Branimir Đurek, Pavlos Migkiros, Trevor Dearham

Free Online PDF Converter – Word, HTML, Image & More Tools Free online PDF converter with complete privacy protection. Merge, split, compress, sign, and convert PDFs directly in your browser — plus a free age calculator and scientific calculator. No uploads, no data storage. onepagepdfconverter.com I built One Page PDF Converter (onepagepdfconverter.com) — a set of 20+ PDF tools (merge, split, compress, sign, convert to/from Word/Excel/PowerPoint/images, etc.) plus a couple of everyday calculators, all running entirely client-side in the browser. There's no backend processing your files: no upload, no storage, no server round-trip. Everything happens locally via JS, so your documents never leave your device. That's the whole pitch — it's the same reason I built it, since most PDF tools online quietly funnel your files through a server you have no visibility into. All 20+ tools are free with no sign-up. Today I'm adding a small premium option: batch processing, for ₹9.99 per batch (~$0.10 USD), one-time — no subscription. Run a tool across multiple files in one go instead of one at a time. Everything else on the site stays free and unlimited. Tech-wise it's a single HTML file backed by client-side JS libraries — no framework, no build step. It's a PWA, so it installs and works offline once loaded. Would love feedback — especially on the privacy angle, the batch pricing, or tools you think are missing. Free Online PDF Converter – Word, HTML, Image & More Tools Free online PDF converter with complete privacy protection. Merge, split, compress, sign, and convert PDFs directly in your browser — plus a free age calculator and scientific calculator. No uploads, no data storage. onepagepdfconverter.com

The Hidden Vulnerability in Multi-Agent Chains The biggest architectural risk in enterprise AI today isn’t prompt injection—it’s Delegation Escalation . When a human user triggers an AI Agent Orchestrator, which then delegates tasks to sub-agents and tool execution gateways via MCP or internal APIs, traditional static service accounts break down. If you pass broad bearer tokens or static user API keys down the execution chain, you create a massive Confused Deputy vulnerability. To deploy autonomous multi-agent chains safely at enterprise scale, platform architects must enforce OAuth 2.1 RFC 8693 Token Exchange with explicit actor claims. The Non-Human Authorization (NHA) Flow Human User Authorization: A user authenticates and grants a specific, bounded scope (e.g., read:finance ) to the primary Agent Orchestrator. Token Exchange: The Orchestrator leverages OAuth 2.1 Token Exchange (RFC 8693) via the enterprise identity gateway rather than passing raw user credentials downstream. Actor-Claim Scoped Call: The sub-agent or tool execution layer receives a short-lived token containing a nested actor claim ( act ) identifying both the human subject and the orchestrator, ensuring execution authority is strictly bounded by the intersection of their permissions. 3 Non-Negotiable Rules for Agentic Identity Governance Delegation Over Impersonation (RFC 8693): Never allow an agent to blindly impersonate a user. Enforce OAuth 2.1 Token Exchange so every issued JWT token contains a nested actor claim: Human Subject -> Agent Orchestrator -> Sub-Agent . Every downstream API must verify both who authorized the action and which agent executed it. Intersection of Privileges (User ∩ Agent): An agent’s runtime authority must be the strict mathematical intersection of the user’s IAM permissions and the agent’s registered tool scope. An agent should never acquire more system access than the human user who invoked it. Ephemeral Tokens & DPoP Binding: Eliminate static configuration API keys

I spent the last while building a prompt-injection detector trained on 78,000+ attack samples. Here's what surprised me, and why I ended up going the unfashionable route. The trendy approach is to use an LLM. I didn't. The default move in 2026 is "use an LLM to judge whether input is an attack." It's appealing because models understand nuance. But once you try to run it inline on every request, the problems pile up fast: Latency. You've added a full model round-trip to every single call. Hundreds of milliseconds, minimum. Cost. Your security bill now scales with your traffic. Every request pays the token tax. Non-determinism. The same input can get a different verdict tomorrow. Try explaining that in an incident review. It's jailbreakable itself. Your security model is an LLM, which means it's vulnerable to the exact attacks it's supposed to catch. So I built the boring version instead: deterministic regex plus classical ML (TF-IDF character n-grams into logistic regression). No LLM in the detection path. It runs in about 7ms, costs nothing per call, and is fully deterministic. What the data actually showed Here's the part I want to be honest about, because most vendors quote one number and hide the rest. Measured on public benchmarks the model was not trained on (held out, non-circular): Real-world, in-the-wild jailbreaks: 0.895 recall at 1.00 precision Obfuscated / evasion attacks: 0.799 at 1.00 precision A frozen external split: 0.804 recall, 0.48% false-positive rate Subtle roleplay-framed jailbreaks: 0.324 That last number is bad, and it's the most important one on the list. The honest read is that deterministic detection is excellent on real-world and obfuscated attacks and weak on subtle roleplay framing. That's a real gap, and pretending otherwise just means someone finds it later and trusts you less. The false-positive rate is a moving target One thing I didn't appreciate going in: FPR is completely traffic-dependent. The same model reads roughly: ~0.4% fal

Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence 1. Basic Information Article Title : Steam forum ClickFix attacks infect gamers with XMRig cryptominers Publisher : BleepingComputer Publication Date : July 25, 2026, 18:37 EST / July 26, 2026, 07:37 JST Original Source : https://www.bleepingcomputer.com/news/security/steam-forum-clickfix-attacks-infect-gamers-with-xmrig-cryptominers/ Related Information Sources : At the time of publication, no alternative primary sources providing a detailed analysis of this campaign were identified. Related Malware, Threat Groups, CVEs, and Products : XMRig ClickFix PowerShell Microsoft Defender Windows Firewall Windows Task Scheduler Steam Discussion Forums Unknown Threat Group No CVE Related IOCs : Domain: msfconfig[.]icu URL: https://msfconfig[.]icu:443/tmp/system.txt Directory: C:\Windows\Background Executable: C:\Windows\Background\system.exe Scheduled Task: XMRig-[computer name] Defender Exclusion: C:\Windows\Background Severity : Medium Reason for Selection : The attack chain is highly specific and realistic: a ClickFix scenario where a user pastes a command into an administrator PowerShell, progressing from disabled certificate validation, Defender exclusions, Firewall allowances, and XMRig retrieval, to a SYSTEM-privileged Scheduled Task. Such behavior can easily translate to enterprise settings where employees copy commands from forums or generative AI responses. 2. Executive Summary Attackers reply to Steam technical support threads disguised as "repair methods," instructing users to run administrator PowerShell commands. Upon execution, the script adds Microsoft Defender exclusions and Firewall rules on the victim's machine, downloads XMRig, and establishes persistence via a SYSTEM-privileged Scheduled Task in a classic ClickFix attack. 3. Attack Flow Chain A: XMRig Infection via Steam Forums The attacker creates a randomized Steam account. They search for existing threads discussing game crash

Encrypted data stored in cloud archives today will outlive the mathematical algorithms guarding it. In enterprise architectures that handle long-term records, like construction risk logs or employee compliance platforms, data retention schedules often span twenty to thirty years. When building cloud pipelines that move this information across services, we depend heavily on asymmetric encryption, which is a security method using one public key to lock data and a separate private key to unlock it. Standard public-key algorithms rely on mathematical problems that are nearly impossible for classical computers to solve within a reasonable human timeframe. Quantum computing changes this equation entirely. Quantum computers leverage quantum mechanics, the physical rules governing subatomic particles, to perform calculations at speeds fundamentally unimaginable with traditional silicon processors. While powerful quantum systems are still in development, the security threat to distributed systems exists today. Hostile actors do not need to crack modern security algorithms in real time. Through a pattern known as Harvest Now, Decrypt Later, adversaries can capture and store encrypted network traffic right now. They simply wait until future quantum hardware becomes capable of running the formulas required to decrypt that stolen history. For software architects, preparing for post-quantum cryptography, which refers to new mathematical encryption algorithms designed to withstand quantum attacks, is far more than a simple library swap. It is a deep distributed systems migration challenge. The primary operational hurdle is payload size and computational overhead. Quantum-resistant algorithms require significantly larger digital keys and payload headers than the standards we rely on today. When cryptographic payloads expand, every component of a distributed platform feels the ripple effect. Message queues experience higher bandwidth demands. Database indexes inflate. Memory consump

I spent a week trying to answer one question about my own AI agents: when one of them does something stupid in production, how do I prove the fix worked? For normal software the answer is boring. You have monitoring, an incident, a regression test, a staged rollout. For an agent you usually have a trace viewer and a shrug. So I built ArcNet on self-hosted SigNoz for the Agents of SigNoz hackathon, and most of what I learned was about SigNoz internals I could not have guessed from the docs. Here are the parts that cost me real time. The setup The stack is small. Agents run on Agno. An in-process SDK wraps them and does two jobs: OpenTelemetry instrumentation, and guardrails from unplug-ai at four checkpoints (input, retrieved content, tool call, output). Traces go to self-hosted SigNoz over OTLP. A FastAPI server reads back out of SigNoz, and a React UI sits on top. Installing SigNoz was the easiest part, which surprised me. Foundry takes one file: apiVersion : v1alpha1 kind : Installation metadata : name : signoz spec : deployment : flavor : compose mode : docker signoz : spec : image : signoz/signoz:v0.133.0 foundryctl cast -f casting.yaml That brings up SigNoz and its MCP server together and writes a casting.yaml.lock with checksums. I committed the lock file, and re-running foundryctl forge against it later produced a byte-identical file. That is a genuinely nice property for a hackathon judge or a teammate. Lesson 1: check what your instrumentor actually emits This is the one I would tell everyone. I assumed Agno instrumentation would produce OpenTelemetry's gen_ai.* semantic conventions, because that is what the GenAI spec describes. I started sketching dashboard queries against gen_ai.usage.input_tokens before anything was running. Then I turned it on. openinference-instrumentation-agno emits OpenInference conventions, which are a different attribute set. The spans I actually got were shaped like this: agent_j.run └── gpt-5.6-luna.invoke └── search_tickets Eve

Let me start with a question. If a stranger handed you a USB drive and said "plug this in, it just...

"The first autonomous agent cyberattack is an unprecedented event. It deserves an unprecedented response!"

By Suvankar Chakraborty | Principal Engineer — IAM, Modern Workplace Management & IT Operations The Collaboration Platform That Became a Governance Nightmare Microsoft Teams was deployed at extraordinary speed across the enterprise world. In most organisations I know, the deployment timeline went something like this: March 2020, global pandemic, remote work mandate, Teams switched on, everyone told to use it, governance deferred because there was no time. Five years later, the governance that was deferred in 2020 has still not been implemented in most of those environments. The result is predictable and consistent across industries: Teams sprawl at industrial scale. Hundreds of Teams that nobody owns. Channels for projects that ended three years ago. Guest users from partnerships that dissolved. Sensitive conversations in channels that include contractors who should not have visibility. Files shared in Teams chat — bypassing SharePoint governance entirely — on devices with no management policy. Meeting recordings stored in OneDrive folders that anyone with a link can access. Bot integrations that have permissions to read your Teams messages and access your calendar, approved by a user who clicked through an OAuth consent screen without reading it. In 13+ years of enterprise IAM and IT operations work, Teams governance has become one of the most consistently mismanaged areas of Microsoft 365. Not because it is technically difficult — the controls Microsoft provides are comprehensive. But because Teams sits at the intersection of IT, security, compliance, and the organisational culture of collaboration, and that intersection is where governance programmes go to die. This article is about why enterprises get Teams governance wrong, and what getting it right actually looks like — in specific, actionable, implementable terms. Why Teams Is a Governance Problem Unlike Any Other M365 Workload To understand the governance challenge, you need to understand what Microsoft Team

The moment that started it A colleague of mine was cleaning up some old records in a staging environment. Same query he'd run a dozen times before, except this time he was connected to production. He hit F5. No WHERE clause. 47,000 rows gone in milliseconds . We recovered from a backup, lost about two hours, and nobody got fired. But it stuck with me:** SSMS will let you delete an entire production table with the same amount of friction as running a SELECT 1**. No pause, no confirmation, nothing. The tool that DBAs and backend developers spend all day in has zero built-in protection against the single most common way people destroy data. So I built one. What SQL Guard does SQL Guard is a free SSMS extension (18 through 22) that inspects your query the moment you press F5, and pauses execution if it matches a known destructive pattern: DELETE without WHERE UPDATE without WHERE TRUNCATE TABLE DROP TABLE / DROP DATABASE / DROP PROCEDURE ALTER DATABASE Dangerous EXEC calls MERGE without a filter When one of these fires, you get a dialog showing exactly what object would be affected, with three options: cancel, run anyway, or run and ignore for the rest of the session. The point isn't to block you — it's to make the action conscious. Most accidental damage happens because muscle memory took over, not because someone genuinely meant to wipe a table. How the detection works Nothing exotic here, and honestly that's by design. SQL Guard runs a lightweight pattern-matching pass over the query text before it hits the connection. No parsing tree, no round-trip to the server, no measurable latency — it runs in under a millisecond, so you never notice it on normal queries. The core idea is simple: certain statements are only safe when scoped by a WHERE clause, and the extension checks for that clause's absence rather than trying to understand the full semantics of the query. That keeps false positives low and means it works the same way whether you're on SQL Server 2016 or the la

You don’t have to upload your video to the cloud or pay a monthly fee to secure your home. These security cameras record locally.

JFrog Security Research revealed "PixelSmash," a vulnerability in the FFmpeg media framework, allowing for Remote Code Execution and Denial of Service attacks. Present for sixteen years, it affects numerous applications using the MagicYUV decoder. Exploitation requires only a crafted media file. Users are advised to check for the vulnerability and apply patches or disable the decoder if necessary. By Olimpiu Pop

I woke up to two emails that immediately caught my attention. One was from my website monitoring service (I use UptimeRobot, no affiliation) reporting that a client's website was down. The other was from my VPS provider informing me that they had suspended my VPS due to abuse. I logged into the control panel and immediately noticed a massive CPU spike. The server had gone from its usual 15–20% CPU usage to a sustained 100% for nearly four hours before the provider shut it down under their fair usage policy. My first clue was xmlrpc.php . It was consuming a significant amount of resources, so I started researching it. I'm not primarily a WordPress/PHP developer, and I was surprised to learn that XML-RPC exposes functionality for remote management of WordPress. I disabled XML-RPC, brought the VPS back online, and thought the problem was solved. It wasn't. The next day I woke up to the exact same two emails. This time my VPS provider had already imposed CPU limits on the server. I noticed a few kernel-looking processes consuming CPU, assumed they were related to the throttling, and restarted the VPS. A few hours later, it was offline again. At that point I knew I was dealing with a compromise rather than a performance issue. I began investigating the WordPress installation and immediately found obvious signs of infection. There were numerous malicious PHP files ( index.php , cache.php , etc.) buried inside recursively nested directories such as: image / image / image / image / cache . php The deeper I looked, the worse it became. The attackers had created: A rogue WordPress administrator account An unauthorized SSH key A root-level user on the VPS An administrator account inside CyberPanel This wasn't just a compromised website anymore. It was a full VPS compromise. My working theory was that the attackers exploited a vulnerable WordPress component (likely allowing arbitrary PHP upload or remote code execution), established persistence, and pivoted into the operating s

The dangerous part of AI analytics is not that a model may write a bad chart title. It is that one friendly question can turn into a warehouse query your user was never supposed to run. That risk is growing because builders are adding natural language analytics to products, dashboards, internal tools, support consoles, and agent workflows. Users want to ask, “Which accounts are slipping this month?” and get an answer. That is useful, and it is a permissions trap. If your AI analyst connects through one powerful service account, every customer question may inherit the same access. Your app may have perfect tenant checks in the UI, while the AI path quietly bypasses them. This guide shows how to design AI analytics row-level security so customers can ask useful questions without leaking rows, metrics, or private business context. Why this topic matters now Recent AI platform activity points in the same direction: builders are moving from “chat with documents” to “ask questions about live business data.” Developer pain points are consistent: safe natural language questions, tenant-scoped queries, auditable user identity, consistent metric definitions, and charts that do not expose raw tables. The search gap is clear. Many articles compare embedded analytics tools. Others explain database row-level security in isolation. Fewer walk through the product architecture for a customer-facing AI analyst that must handle tenant scope, natural language, semantic metrics, safe SQL, and audit evidence together. The core failure: one AI user, many real users Traditional analytics has a simple identity chain: Human user → app session → analytics permission → database query The database or BI layer knows who is asking. The app can apply tenant filters, role checks, and column restrictions. AI analytics often breaks that chain: Human user → app session → AI service → service account → database query Now the warehouse sees one identity: the AI service account. That account usually need

Let’s be honest: manual diet tracking is a chore that almost nobody finishes. We start with good intentions, but typing "150g of grilled chicken" and "half a cup of brown rice" into an app every day is a recipe for burnout. But what if you could just snap a photo and let Multimodal AI do the heavy lifting? 📸 In this tutorial, we are building a production-ready automated nutrition logging system. We will combine the surgical precision of the Segment Anything Model (SAM) with the reasoning power of GPT-4o Vision . By the end of this post, you'll know how to transform raw pixels into a structured JSON of calories, macros, and portion sizes using FastAPI and Pydantic . We'll cover key concepts in Image Segmentation , Computer Vision , and LLM Structured Outputs . The Architecture: From Pixels to Proteins To get accurate results, we can't just toss a messy photo at an LLM and hope for the best. We need a pipeline that identifies individual food items, isolates them, and then performs a multi-step inference. graph TD A[User Uploads Food Image] --> B[FastAPI Backend] B --> C[SAM: Segment Anything Model] C --> D[Generate Individual Food Masks] D --> E[GPT-4o Vision: Multi-crop Analysis] E --> F[Pydantic Validation] F --> G[Structured Nutrition Report] G --> H[User Dashboard] Prerequisites To follow along, you'll need: Python 3.10+ OpenAI API Key (with GPT-4o access) FastAPI & Uvicorn (for the web layer) Segment Anything Model (SAM) weights (or a hosted inference API) Step 1: Defining the Nutrition Schema The secret to a reliable AI system is Structured Output . We don't want a "chatty" response; we want data our database can consume. We'll use Pydantic to define exactly what a "Meal" looks like. from pydantic import BaseModel , Field from typing import List class FoodItem ( BaseModel ): name : str = Field ( description = " Name of the food item " ) estimated_weight_g : float = Field ( description = " Weight in grams " ) calories : int = Field ( description = " Total calorie