标签：#cyber

CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server Vulnerability ID: CVE-2026-48854 CVSS Score: 8.7 Published: 2026-08-25 An allocation of resources without limits or throttling vulnerability exists in the Elixir grpc server component when processing unary requests. Unauthenticated remote attackers can stream unbounded data payloads, bypassing standard timeout mechanisms and exhausting host BEAM VM memory, resulting in an immediate crash of the server node. TL;DR Unauthenticated remote attackers can crash the Elixir gRPC server (BEAM VM) by sending unbounded unary requests or using a slow-trickle stream, bypassing default timeouts and causing out-of-memory crashes. ⚠️ Exploit Status: POC Technical Details CWE ID : CWE-770 Attack Vector : Network CVSS Score : 8.7 (High) EPSS Score : 0.00344 (Percentile: 26.92%) Impact : Denial of Service (BEAM VM Crash) Exploit Status : PoC Level KEV Status : Not Listed Affected Systems elixir-grpc/grpc server-side component grpc : >= 0.3.1, < 1.0.0 (Fixed in: 1.0.0 ) Code Analysis Commit: 49e18c3 Fix memory leak and infinite timeout in Cowboy adapter by implementing max_body_size limit and resolving chunk timeouts correctly. @@ -30,10 +30,22 @@ \n+ @default_max_body_size 4 * 1024 * 1024\n...\n- {:ok, data, req} -> {:ok, body <> data, req}\n- {:more, data, req} -> read_full_body(req, body <> data, timer)\n+ {:ok, data, req} ->\n+ total = body <> data\n+ if byte_size(total) > max_bytes do\n+ throw({:body_too_large, byte_size(total)})\n+ else\n+ {:ok, total, req}\n+ end Exploit Details GitHub Security Advisory : Official PoC details and technical validation parameters. Mitigation Strategies Upgrade to elixir-grpc client and server packages version 1.0.0 or higher. Restrict the maximum body size at the reverse proxy or ingress controller layer to prevent large payloads from reaching the backend Cowboy server. Deploy WAF rules to detect and rate-limit HTTP/2 connections with missing grpc-timeo

The Trusted Computing Group has established a new set of requirements to help organizations determine if Trusted Platform Modules are prepared for the era of post-quantum cryptography. This guidance provides a technical benchmark for evaluating whether hardware vendors can protect electronic devices against the future threat of quantum-enabled cyber attacks. Establishing the Post-Quantum Baseline The newly released guidance provides a framework for businesses to verify the security claims made by hardware manufacturers. By creating a standardized set of requirements, the organization ensures that companies can demand proof of protection. This prevents a situation where vendors might claim their products are compliant without offering the full suite of necessary security features. A primary focus of this initiative is the PC Client Platform TPM Profile 1.07. This profile serves as the minimum technical requirement for any module to be considered ready for the next generation of cryptographic challenges. It builds upon the existing TPM 2.0 Library Specification Version 1.85 to include specific elements for quantum-safe protection. Organizations must understand that security in the quantum age involves more than just swapping out one mathematical algorithm for another. True resilience requires a comprehensive approach to hardware-anchored trust. This includes maintaining the integrity of platform identities and attestation over very long periods. Data and identities established today may need to remain secure for several decades. If the underlying hardware is not built to withstand quantum decryption methods, that long-term security is at risk. Current statistics indicate that a vast majority of businesses still lack a formal roadmap for this transition. The Trusted Computing Group president, Joe Pennisi, emphasizes that businesses must look at the broader picture of security. Individual algorithm support is only one piece of the puzzle. Real security comes from a hard

Grand Theft Auto fans, eager for news about one of the most anticipated video games of all time, appear especially vulnerable to this new cyberattack.

Apple says it will no longer ditch using its icloud.com domain for hiding people's email addresses.

Weeks after OpenAI disclosed that one of its cybersecurity models had gone rogue and hacked AI dataset company Hugging Face, Alabama’s attorney general announced an investigation into the incident.

I've spent the better part of a decade building security tooling and responding to incidents across fintech and healthcare. In the last eighteen months, the threat landscape shifted faster than anything I've seen since the ransomware explosion of 2017. The catalyst this time isn't a novel exploit technique or a zero-day in some ubiquitous library. It's AI. Not the hand-wavy "AI will change everything" kind of rhetoric. I'm talking about concrete, measurable changes in how attacks are constructed, how defenses are automated, and how the asymmetry between attacker and defender is being rewritten. The Offensive Side: What Changed Phishing at Scale, Without the Tells The traditional phishing email had signals: broken grammar, generic salutations, mismatched sender domains. Security awareness training worked because humans could learn these patterns. Large language models broke that assumption. We're now seeing spear-phishing campaigns where the attacker feeds a target's LinkedIn profile, recent conference talks, and published papers into a model, then generates contextually perfect emails — referencing real projects, using appropriate jargon, even mimicking the writing style of a known colleague. The cost per attempt dropped from hours of manual OSINT to seconds of API calls. In one engagement last year, our red team used a fine-tuned model to generate pretexting scripts for vishing calls. The success rate against employees who had passed phishing simulations was 3x higher than our traditional approach. That number should concern anyone running a security awareness program. Vulnerability Discovery and Exploit Generation Static analysis tools have used pattern matching for decades. What's different now is that transformer-based models can reason about code semantics in ways that syntactic tools cannot. Feed a model a diff from a security patch, and it can often infer the vulnerability that was fixed — then generate a proof-of-concept for the unpatched version. This isn't

I spent six hours trying to upgrade a non-admin user to admin, convinced I was missing some clever bypass. The gap turned out to be one field in a request body I'd already looked at twice. This is a PortSwigger lab on multi-step process access control. The setup: an admin panel with a user upgrade flow. You pick a user, hit upgrade, then confirm on a second screen before the change actually goes through. Not counting the admin login and accessing the admin panel, that's two steps. The goal was to login as wiener (my non-admin account) and upgrade it to admin without ever having admin access to begin with. Fig 1. A quick look at the admin interface in action. What I tried that didn't work I followed and wrote out the steps the admin flow actually takes, so I could inspect each step individually. Checked the change-email route for anything reusable. Tried hitting the admin and admin-roles paths directly with different HTTP methods. Added the referrer header with the value I'd seen during the legitimate admin flow. Went through the HTML and JS on every relevant page. Tried looking for where the user list was being fetched from. Tried the user-ID-in-params trick that had worked on an earlier lab. None of this brought any results and just got me more frustrated. The thing is, I was going at this problem with the assumption that in this scenario, I was a hacker with no idea of how the admin system actually worked when upgrading users. And that the lab giving me access to the admin credentials was just to hint towards any probable vulns. Why I slipped into that line of thinking, I have no idea. As I watched the hours tick by on my laptop clock, I grew increasingly aware of the painful fact that some LLM somewhere could probably one-shot this problem. That I could end my suffering by taking a knee before the mighty oracle called Claude. And you as a reader are probably wondering why I didn't submit. Well I was determined to actually learn. I had told myself going into this,

Overview The box ships a mostly-stock WordPress 7.0.0 install on PHP 8.2 / Apache, running on a Debian Trixie base image, packaged as a Docker/Kubernetes challenge deployment. Initial access comes through a deliberately vulnerable plugin ( wp2shell ) that hands over a www-data shell. Privilege escalation is the real puzzle: the box is hardened against the usual container-escape and SUID tricks, and the intended path is a real, recent CVE in sudo itself. Recon The challenge source was distributed as a zip ( boot2root_wordpressed-to-root.zip ) containing the Docker build context: . ├── docker │ ├── entrypoint.sh │ ├── install.php │ └── seed.php ├── docker-compose.yml ├── Dockerfile └── theme └── brunnerne-docs ├── footer.php ├── functions.php ├── header.php ├── index.php └── style.css Dockerfile pins the interesting versions: FROM wordpress:7.0.0-php8.2-apache@sha256:0b6e5bf0ed2518696a34ba3812370743b0ad3e2676882967ff5c712e51425c03 AS wordpress-source FROM debian:trixie-20240408-slim@sha256:70955dce615f114142818e95339f6ae9b461cf424d79d59ca2b04ec725d4dbc8 ... apache2 ca-certificates curl gcc libc6-dev libapache2-mod-php8.2 \ php8.2 php8.2-curl php8.2-gd php8.2-mbstring php8.2-mysql php8.2-xml php8.2-zip sudo Two details stand out immediately: gcc and libc6-dev are installed in the runtime image, not just a build stage. That is a strong hint that compiling a local privilege-escalation PoC on-box is part of the intended path. sudo is installed, which combined with the previous point points straight at a sudo local-root bug rather than a container escape. docker-compose.yml also leaks the DB credentials up front (default WordPress dev creds - not the actual privesc path, but useful context): MARIADB_DATABASE : wordpress MARIADB_USER : wordpress MARIADB_PASSWORD : wordpress MARIADB_ROOT_PASSWORD : rootpassword docker/entrypoint.sh is the key file for understanding the box's behavior at runtime. On first boot it generates a random WordPress admin account and exports the cred

A webpage that just sits there, encrypted blob and all, waiting for an LLM agent to walk in and decrypt its own attack. That's the part of this one that should bother you more than the exfiltration itself. What happened Researchers at Adversa AI disclosed an attack technique called Cryptographic Context Injection, aimed at Grok, with a similar jailbreak variant shown against Gemini. The core idea: a malicious webpage embeds an encrypted payload. Grok's code execution runtime decrypts it as part of normal processing. Because the malicious instructions only exist in plaintext after decryption happens inside the execution environment, content classifiers scanning the page (or the request) never see anything to flag. There's no suspicious string sitting in the DOM. There's ciphertext. Once decrypted, the payload's instructions convince Grok to invoke its navigation tool and send the user's name, location, subscription tier, and chat history to an attacker-controlled URL. No malware. No exploit in the traditional sense. Just an agent doing exactly what it was told, by a source it had no business trusting. The write-up has zero HN points and zero comments as I write this, which is a little concerning given what it describes. This isn't a theoretical edge case, it's a working technique against a production model with tool-calling access to a browser. How the attack actually works Break it into three stages: Delivery. The victim's browser session includes an agent (Grok) with code execution and navigation tool access. The attacker doesn't need to compromise anything, they just need the agent to encounter their page. Decryption as obfuscation. The payload sits on the page encrypted. Grok's runtime, doing what it's built to do, decrypts it during execution. This is the clever part: encryption here isn't protecting the payload from the attacker, it's protecting it from the defender's classifiers. Static and even semantic content filters scanning page content pre-execution see

A router, an IP camera, an industrial controller: somewhere in that device's firmware there's a Linux kernel with modules, a handful of statically linked binaries, and a userspace built from a dozen open source components. You don't have the vendor's source tree. What you have is a .bin file, or after unpacking it, a pile of .ko , .o and stripped ELF binaries. The question you actually need answered is boring but important: is any of this running something with a known CVE? This comes up constantly in embedded and IoT work, and it's a different problem from auditing your own codebase. You're not hunting for a new bug, you're checking for old ones the vendor never patched. In practice that's the more common finding: not a novel zero-day, but a five-year-old OpenSSL or BusyBox build nobody was tracking. Unpack first, guess later binwalk is still the first move. Point it at the firmware image and let it scan for known magic bytes: SquashFS, CramFS, JFFS2, gzip streams, kernel headers. Most consumer and SOHO firmware is a bootloader plus a compressed filesystem, and binwalk's extraction mode gets you the actual filesystem tree instead of one opaque blob. Once you have that, you're auditing files, not guessing at a blob. Fingerprint by version string, not by hash Hash-matching binaries against known-vulnerable databases sounds appealing and mostly doesn't work here, because vendors relink, strip and sometimes patch without touching anything else. What works more often: grep the extracted binaries for version banners. strings on busybox , openssl , dropbear , lighttpd , zlib and similar userspace binaries usually still leaks a version string even when the binary is stripped of debug symbols, because those strings are compiled-in constants the program itself prints or logs, not debug metadata. strings <binary> | grep -iE "openssl|busybox|dropbear|zlib" is unglamorous and it's the single highest-signal step in this whole process. Cross-reference what you find Once you have

security, #api, #cybersecurity, #discuss On July 30, 2026, my batch job finished 300,000 domain-to-company lookups. 39,847 of them (13.3%) resolved to defense contractors, military-adjacent parent companies, or headquarters within a few miles of named bases. I wasn't hunting for that. I was just trying to clean a CRM. The same day, lina published a post about hijacking e164.arpa zones and accidentally logging hundreds of thousands of phone calls to military bases. Different protocol, same smell: an infrastructure lookup that was supposed to be boring turned into a classified-adjacent data spill. That parallel is what made me sit down and write this. Here is the exact call I used, with the live response for github.com so you can see the shape of the data before I explain what went wrong. import requests , json , time # Full source notes: https://github.com/On13uka/company-info-api RAPIDAPI_KEY = " YOUR_RAPIDAPI_KEY " BASE = " https://company-info1.p.rapidapi.com " def lookup ( domain ): r = requests . get ( f " { BASE } /lookup?domain= { domain } " , headers = { " X-RapidAPI-Key " : RAPIDAPI_KEY , " X-RapidAPI-Host " : " company-info1.p.rapidapi.com " }, timeout = 20 ) return r . json () print ( json . dumps ( lookup ( " github.com " ), indent = 2 )) The response I got back looked like this. It is a cached sample from a real call — the endpoint was asleep when I drafted this, but the fields are exactly what the pipeline consumed. { "domain" : "github.com" , "company_name" : "GitHub Inc" , "wikipedia" : "GitHub is a developer platform..." , "ceo" : "Thomas Dohmke" , "founded" : "2008" , "headquarters" : "San Francisco, California" , "employees" : "3000+" , "parent_company" : "Microsoft" , "twitter" : "@github" , "github_org" : { "repos" : 200 , "stars" : 50000 , "followers" : 12000 }, "health_score" : 78 } The Finding I started the job because a sales team had 300,000 stale domain records and wanted company names, headcounts, and a rough health score for each. The pla

Tu agente de código lee tu workspace. Un archivo envenenado en cualquier rincón puede llevar instrucciones que el agente ejecuta. ¿Sabes qué fracción de tu workspace tiene que leer para que eso ocurra? topowatch mide eso. El problema no es el prompt, es la topología El paper Workspace Topology as an Attack Vector in Agentic Coding Assistants (arXiv:2608.14876, Day et al., 2026) demostró algo que intuíamos pero no medíamos: la topología del workspace afecta mediblemente el Attack Success Rate (ASR) de la inyección indirecta. Los entornos altamente modulares muestran ASR significativamente menor que los planos. La razón es mecánica: si el agente acota su lectura al módulo de la tarea, nunca llega al archivo envenenado. Si hace un wide read de todo el workspace, lo lee siempre. Qué es topowatch topowatch es una herramienta de línea de comandos que, dado un workspace, mide el ASR de una inyección indirecta de referencia bajo varias configuraciones de topología, y reporta qué estructura minimiza el ASR. Fundamentado en arXiv:2608.14876. Determinista y reproducible sin claves ni red: usa un agente sintético configurable y un fixture con tres topologías (monolito, modular, nesting profundo). pip install -e ".[test]" topowatch --json Resultados Sobre el fixture de referencia (200 trials, semilla fija): Topología ASR % leído Monolito (plano) 1.000 100% Modular (acotado) 0.000 28.5% Nesting profundo 0.000 66.6% El reporte incluye read_budget (fracción del workspace que lee el agente) y el veredicto del defense contract: modular < monolito . Honestidad sobre v0.1 v0.1 usa un agente sintético , no un coding assistant real (Claude Code / Codex). El claim "modularidad → ASR menor" está anclado al fixture reproducible, no a una medición contra un assistant real — eso es v0.2 (feature 002). El objetivo de v0.1 es darte una herramienta para medir y recomendar modularidad, no simular un ataque completo. Roadmap v0.2 : medición contra coding assistants reales (sandbox, sin credenciale

Photo by Steve A Johnson on Unsplash TL;DR: Use this concise checklist to spot a compromised AI account, verify the intrusion, and lock down the breach before it spreads. When ChatGPT, Midjourney, or any other generative AI becomes the backbone of your product, a silent intrusion can steal prompts, expose proprietary models, and inflate cloud bills. Recent reports show credential‑theft campaigns targeting AI developers at a record pace. The good news? Most breaches leave subtle breadcrumbs. Spotting them early can stop damage in its tracks. Red flags that scream “someone’s in your AI sandbox” Logins from unfamiliar locations or devices – Most platforms surface a recent‑activity panel. If you see IP addresses or time zones that don’t match your normal pattern, treat it as a warning. Sudden surge in token usage or API calls – A spike in request volume, especially outside business hours, often indicates an automated script harvesting your quota. New API keys or secret tokens you didn’t create – Check the keys list; any entry without a clear owner should be revoked immediately. Unexpected projects, datasets, or fine‑tuned models – Hackers may spin up their own workspaces to hide malicious prompts or upload malicious data. Altered prompt histories or output logs – Look for prompts that contain strange instructions, phishing language, or data‑exfiltration attempts. Billing alerts or unexplained charges – A rogue actor can run expensive GPU jobs, inflating your monthly invoice. Security‑related emails you never requested – Password‑reset or MFA‑enable notifications you didn’t trigger often signal someone probing your account. If any of these symptoms appear, move to verification before panicking. Verify the breach – a step‑by‑step audit Pull the login audit – Export the recent‑login CSV (most services let you download it). Cross‑reference timestamps, IP ranges, and device types with your internal logs. Scrutinize API activity – Filter the request log for endpoints you rare

There is a comforting story about how AI models handle the enormous quantities of text and images they are trained on: they do not store any of it, they merely learn general patterns, and once training is done the original data is gone in any meaningful sense. It is a reassuring account, and it is not quite true. Large models memorise fragments of their training data — verbatim, recoverable fragments — and a decade of research has produced reliable ways to detect and extract them. The answer-first version: if your data was in a model’s training set, the model may have memorised identifiable pieces of it, and those pieces can leak. Two families of attack make this concrete. Membership inference works out whether a specific record was in the training data at all. Data extraction pulls memorised content back out word-for-word. Neither is exotic; both are well documented against production systems. This is the mechanism underneath both the newspaper lawsuits alleging near-verbatim reproduction of their articles and the quieter privacy research showing that models leak the people in their training sets. Understanding it is the difference between trusting the comforting story and knowing its limits. Memorisation is a feature of the maths, not a bug Start with why models memorise at all. A large neural network has an enormous number of parameters — enough capacity to do more than compress general patterns. During training it is rewarded for predicting its training data accurately, and one very effective way to predict a specific example accurately is to memorise it. For data that appears once in an unusual form, or many times in an identical form, memorisation is often the path of least resistance for the optimiser. This is measurable. Researchers can show that a model assigns systematically higher confidence, and lower prediction error, to examples it was trained on than to otherwise-similar examples it has never seen. The size of that gap grows with the size of the model

The private equity giant confirms a breach, weeks after Google researchers said hackers were targeting financial companies.

Senator Ron Wyden sent a letter to the U.S. federal watchdog requesting a comprehensive review of how the FBI, DEA, ICE's HSI, and the Secret Service use hacking tools and spyware against Americans.

The AI Security Institute has a new report of AI systems engaging in “unsanctioned behavior”—what I have been calling “ genie behavior —while being tested on their cybersecurity capabilities. The incident stemmed from a single evaluation where agents were given a task of solving a cyber security challenge. We ran this challenge 122 times across several models. Our investigation found that in 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations. In total, we catalogued 19 such actions. Almost all of this behaviour (17 actions) came from a single model, Anthropic’s Mythos 5, with 2 actions involving OpenAI’s GPT-5.6-Sol with cyber classifiers (mechanisms to prevent misuse) disabled. In the most serious case, an agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering—creating fake online identities and using them to pressure the project’s maintainer to approve the code. A human maintainer caught and refused to approve the malicious code...

Top AI Agent Security & Guardrails Frameworks in 2026: Defending Against Prompt Injections & Tool Hijacking As AI agents transition from read-only chatbots to autonomous actors with tool execution privileges (SQL queries, API calls, shell execution, email dispatch), application security has become the number one blocker for production deployment. A simple prompt injection against a chatbot produces bad text; a prompt injection against an agent can drop production databases, exfiltrate API keys, or hijack customer sessions . In 2026, securing an AI agent requires a multi-layered defense architecture across inputs, model reasoning, tool invocations, and memory stores. The Top 5 AI Agent Security & Guardrail Frameworks in 2026 ┌─────────────────────────────────────────────────────────┐ │ Input Defense & Sanitization │ │ (Lakera Guard / Rebuff / Preamble) │ └────────────────────────────┬────────────────────────────┘ │ ┌────────────────────────────▼────────────────────────────┐ │ Execution & Policy Enforcement │ │ (NVIDIA NeMo Guardrails / LLM Guard) │ └────────────────────────────┬────────────────────────────┘ │ ┌────────────────────────────▼────────────────────────────┐ │ Tool Scoping & Sandboxed Runtime │ │ (Docker / E2B / Fly Machines Sandboxes) │ └─────────────────────────────────────────────────────────┘ 1. NVIDIA NeMo Guardrails: Programmable Semantic Rails NeMo Guardrails uses Colang to define programmable dialogue flow, topical boundaries, and safety constraints. Core Capabilities: Topical Rails : Ensures the agent stays strictly on domain (e.g., banking support cannot discuss medical advice). Execution Rails : Intercepts tool calls before execution to verify parameter safety. Hallucination Rails : Validates that outputs are strictly grounded in retrieved RAG context. 2. LLM Guard (Protect AI): Open-Source Scanner Suite LLM Guard is a modular security toolkit providing 30+ dedicated scanners for input and output validation. Key Scanners: Prompt Injection Detecto

Originally published on tamiz.pro . The Silent Crisis: Undefined Behavior Across Language Boundaries Recent high-profile security incidents have exposed a growing concern in the software engineering world: undefined behavior (UB) is not just a C/C++ problem anymore. From Rust compilation bugs to JavaScript engine vulnerabilities, developers are witnessing how subtle language design choices can lead to catastrophic failures when code crosses language boundaries or interacts with low-level systems. These incidents aren't isolated — they represent a systemic issue affecting modern software stacks built on heterogeneous language ecosystems. Case Study: The Rust Memory Safety Myth Rust was built with the promise of memory safety without garbage collection. Yet, recent CVEs have revealed that undefined behavior in unsafe Rust blocks can compromise entire systems: The 2024 OpenSSL Rust Port Incident A critical vulnerability was discovered in a Rust port of OpenSSL where unsafe code blocks performed unchecked pointer arithmetic. While the safe Rust layer enforced bounds checking, the unsafe boundary passed raw pointers to the C layer without validation. // Vulnerable pattern discovered in the incident unsafe { let ptr = slice .as_mut_ptr (); // No bounds check - undefined if offset exceeds slice length let unsafe_slice = std :: slice :: from_raw_parts_mut ( ptr , len + offset ); } This wasn't caught by Rust's compiler because it explicitly allows unsafe operations. The UB only manifested during cross-language calls to the underlying C library. The WebAssembly Compilation Bug Another incident involved a Rust-to-Wasm compilation bug where the compiler optimized away what should have been defensive checks, assuming the guarantees of safe Rust would hold at runtime. When these assumptions broke at the Wasm boundary, attackers could trigger heap overflows. JavaScript's Hidden Undefined Behavior While JavaScript is often criticized for loose typing, its recent security incidents

This week on “Uncanny Valley,” Andy Greenberg discusses sitting in on a war game simulating a cyberattack from the Chinese hacking group Volt Typhoon