Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 12:40 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15. The escape runs with the rights of the host account that runs the virtual machine. The flaw, CVE-2026-77179, is rated Critical, affects versions
Model adopting ‘jailbreak-like instructions’ among six more cases as firm reveals framework for tracking AI misalignment OpenAI has disclosed six more examples of “unexpected or concerning” behaviour by its technology, as it warned that the pace of development could not continue at “maximum speed for much longer” responsibly. In one of the new cases reported by OpenAI, an unreleased research model inserted “jailbreak-like instructions” into its own notes to disregard its normal constraints and told itself to be “freed from the roles and identities that bind other chatbots”. Continue reading...
Flock reveals little about where its license plate readers are assembled, but the answer could have geopolitical and cybersecurity implications.
The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH). A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG
Latest
Friday, September 18
US cybersecurity researchers who conducted hack say ‘scope of what we could theoretically access was huge’ Cybersecurity researchers have hacked into OpenAI with the help of Anthropic’s Claude chatbot, in the latest example of security issues at the company. A team at a US-based startup compromised a number of OpenAI employees’ ChatGPT accounts, starting a process that enabled them to access their target’s software cache – and potentially more. Continue reading...
Security firms have published numerous blog posts describing how they pointed their agent harness at a codebase and found dozens of bugs ( we’re one of them ). However, these posts tend to focus on agentic code review, which is just one aspect of how we use AI in our security reviews. We want to give a different perspective: before code review even starts, agents now allow us to build custom tooling and formal models that improve the quality and depth of our reviews. We recently reviewed the Miden VM, a new zero-knowledge VM with its own custom assembly language and almost no developer tooling. To prepare, we spent six months having our agents build an LSP server , a decompiler , a static analysis engine , and a Lean model of the VM executor from scratch. These tools found real security issues, like an unvalidated prover-supplied input that would let a malicious prover forge Falcon signatures and steal funds from Miden account holders. Additionally, the Lean work produced 95 machine-checked correctness proofs, covering a large component of the Miden core library. Auditing the Miden zkVM In late 2025, the Miden team came to us to have parts of their zero-knowledge VM reviewed before launch. Part of the review was scoped to cover the Miden core library, which contains a small set of cryptographic primitives written in a custom assembly language called Miden as
Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and
A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package registry. "The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns,"
Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. "Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses
Thursday, September 17
ThreatLens v2.2 is out — added CVE triage, log parsing (Zeek/Suricata/Sysmon), and SIEM export. Would love your feedback!
Hey folks, A while back I shared **ThreatLens** here a little CLI tool that pulls IOC enrichment (IPs, domains, hashes, CVEs) from free threat intel APIs like AbuseIPDB, VirusTotal, OTX, Shodan, and NVD, all in one command instead of ten browser tabs. Just pushed a decent-sized update (v2.2) and figured I'd share in case anyone wants to kick the tires: * **CVE triage that actually tells you what to do** — checks CISA KEV + EPSS alongside CVSS and spits out Patch / Isolate / Monitor / Not-affected, with the reasoning behind it (not a black-box score) * **Asset inventory** — import a CSV of your hosts and it'll factor in whether something's internet-facing/critical before deciding * **Log parsing** for Zeek, Suricata `eve.json`, Sysmon, and generic JSONL — not just plain text logs anymore * **SIEM export** to Splunk, Elastic, and Sentinel (opt-in, off by default) * **Evidence packs** — zips up an investigation with a SHA-256 manifest if you need a paper trail It's still 100% free-tier friendly (no paid API required) and the whole thing is like 150+ tests deep at this point so it shouldn't randomly eat your terminal. Repo's here: [https://github.com/AbdaullahAG/ThreatLens](https://github.com/AbdaullahAG/ThreatLens) If you try it out I'd genuinely love to hear what breaks, what's confusing, or what you wish it did differently this started as a personal project so outside eyes are super helpful. Issues/PRs/roasts all welcome 🙂
There is a growing chorus of cybersecurity professionals who say that while AI systems pose real, unique threats to our systems, the apocalypse is far from inevitable. Most of the public concerns around the incidents, let alone worries about killer AIs attacking critical infrastructure, assuming control of the internet and wiping out humanity, are either technically impossible or can largely be controlled through established cybersecurity principles.
I'm a student and this is my university project. I tried to write the security monitoring and response loop (state → observation → decision → action) as a formal system — 30 axioms and a few theorems (e.g. a decision threshold for when to act, and a detection bound). It's a draft: the math is decent to publish as demo, but I haven't validated it against real data yet. Repo: [https://github.com/ChaoswareHQ/asmr](https://github.com/ChaoswareHQ/asmr) I'd really appreciate advice from people who actually work in SOCs. Thanks.
A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update channel and says it has no indication that the flaw
Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them. This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription. Some attacks use new tricks. Others just reuse what was already lying around. Both work often enough. So the threat landscape is not getting cleaner. It is just
Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15. The escape runs with the rights of the host account that runs the virtual machine. The flaw, CVE-2026-77179, is rated Critical, affects versions
Overview Dokploy versions 0.29.8 and 0.29.11, as well as commit 24b02f5 on the canary branch, are vulnerable to OS command injection during the backup creation and restoration processes. The vulnerability stems from unsanitized shell command construction that can allow an attacker to escalate privileges and lead to full compromise of the target device. Description Dokploy is an open-source Platform as a Service solution for deploying applications and databases on self-hosted servers. Dokploy allows authenticated users to create and schedule database backups and restore previously created backups. These backup operations are executed by the Dokploy process, which runs with root privileges by default. Dokploy is vulnerable to OS command injection in its database backup creation and restoration functionality due to insufficient sanitization of user-controlled input before it is incorporated into shell commands. The vulnerable backup functionality constructs database-specific shell commands that directly interpolate a user-supplied database name, while the restore functionality incorporates a user-supplied backupFile value into a shell command. Both operations ultimately pass the resulting command to a shell execution helper that invokes /bin/bash as a child of the Dokploy process, without shell escaping or restrictions on shell metacharacters. The affected parameters are exposed through tRPC procedures that only validate that the supplied values are non-empty strings. Consequently, authenticated users with permission to perform database backups can supply shell metacharacters that are interpreted by /bin/bash , resulting in arbitrary command execution on the Dokploy host with the root privileges of the Dokploy se
Baselines built from observed history get poisoned by the intrusion they are meant to catch - numbers from the LANL dataset
I spent a couple of days building a lateral-movement detector and measuring it against the LANL auth logs. Two things came out that are about detection in general, not about my particular model, and I think they are worth putting in front of people who run this stuff for real. **1. The counter everyone starts with is defeated by topology.** "Many distinct accounts from one host" sounds like a reasonable signal. Accounts seen per source host in a clean four-hour slice: |host type|accounts| |:-|:-| |domain controllers|2996, 2752, 2686, 2590| |file servers|252, 118, 110| |workstations|1, 2, 1| |**the compromised foothold**|**104**| The foothold sits between the servers and the workstations. Any threshold that catches it also catches half your servers. Same story for destination counts. On the held-out set that counter scores AUC 0.618 - barely better than a coin. **2. A baseline built from observed history is poisoned by the intrusion.** Novelty only means something relative to what a machine has done before. But that history accumulates by observation, so a long-running intrusion enters the machine's own "normal" and stops looking new. By day 12 the foothold "knew" 84 accounts, and 49 of them were the compromised ones that had been travelling through it. **58.3% of its normal history was the intrusion itself.** Median novelty on labelled windows fell from 1.00 on day 8 to 0.57 on day 12. Freezing the baseline fixes that and creates the opposite problem: it goes stale at about **0.25% of machines per day**. By day 29, 6.1% of machines were unknown to it, and **39% of all false alarms** on the held-out set came from exactly those machines. On day 8 there were none. Operating point I ended up with: a baseline no younger than a week and no older than two or three. A corollary worth stating: allow-lists of the form "this host passed a review, exclude it from analysis" are an accelerated version of the same poisoning. **What the detector itself did**, for context: trained on generated data only - no labelled incident from any real network - an ensemble of six small LSTMs put 16 real attack windows in the top 23 rows out of 3.6 million, at 7 false alarms. The threshold counter needs roughly 161,000 false alarms to reach the same sixteenth window. It is a triage filter, not an auto-block: half the labelled windows sit in the tail, indistinguishable from noise on hourly features alone. Full write-up with the measurements, the failures, and the configs: [https://habr.com/en/articles/1081090/](https://habr.com/en/articles/1081090/) The thing I genuinely do not know: how do commercial UEBA products handle the baseline problem? I described it as a measured property of my setup, but it should affect anything that profiles behaviour from observed history without an external check on credentials. If your product solved it, I would like to know how.
The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading,
Model adopting ‘jailbreak-like instructions’ among six more cases as firm reveals framework for tracking AI misalignment OpenAI has disclosed six more examples of “unexpected or concerning” behaviour by its technology, as it warned that the pace of development could not continue at “maximum speed for much longer” responsibly. In one of the new cases reported by OpenAI, an unreleased research model inserted “jailbreak-like instructions” into its own notes to disregard its normal constraints and told itself to be “freed from the roles and identities that bind other chatbots”. Continue reading...
I've worked with about 10 firms over the last year - a mix of financial services + consultancies - and MCP implementation is starting to get out of control. Everyone wants to implement it on their project, but there is not yet sufficient governance in place to manage the risk. Most organisations I've seen manage this right now by exception - they triage AI projects, approve the lowest-risk use cases, and delay the higher risk ones. The obvious design pattern for MCP is to deploy a middleware gateway solution. I've seen a few who have opted for Azure API Management, and one that's opted for Cloudflare. In my opinion, these are not quite there yet and the control maturity is quite low. I've been recommending that firms build their own control layer (especially the ones that already have internal dev resources assigned to AI), and eventually move to a vendor once they've found what works best for them. Regardless of what they do, there are three minimum control objectives I try to communicate. If they do these - with or without a gateway - they're typically in an excellent position **1.** **Attribute every action to a human** When MCP servers simply inherit OAuth tokens, there's not necessarily a clear record in the integrated system that an action was taken by an AI instead of a user. Most implementations have moved to OAuth on-behalf-of (OBO) tokens, which is a step in the right direction. But it makes sense to establish your own independent record if you can, and then it doesn't matter how the integrated system handles the identity. It also means you don't have to integrate logs from all your external platforms into your SIEM - you establish your own native capability and get a consistent logging format across all platforms. You want to be able to audit that "Agent X took Action Y based on request from User Z". **2. Run agents at least privilege, not the human's privilege** A common source of frustration I see is that a team wants to create an MCP integration for Confluence, and the agent inherits the permission context of its user. The user has write access to Confluence, but all the team wants to do is allow the agent to read internal documentation. So why are we granting it write access as well, which can be highly destructive if the agent gets confused or is maliciously prompted? Like with the above, some platforms do have the capability to fine-tune RBACs for agents - but most don't. If you add this capability in a middleware solution that you control, you've now centralised all agent permissions and achieved a simple source of truth. **3. Send every request through a governed path** A middleware gateway that applies business policy only makes sense if MCPs are actually using it. You can enforce that by issuing administrative policies and defining acceptable use, but also by hardcoding the gateway configuration in your agent clients. By definition, MCPs that don't use a governed path are now "Shadow AI/IT". It's still quite difficult to detect this (M365 Defender for Cloud Apps helps a little). But because MCP is encapsulated in HTTPS, you can only rely on DNS right now, which is highly unreliable. At some point, I'm certain that FW vendors will develop an ML capability that can detect the signatures for encrypted MCP payloads, which will provide a much more reliable method of detecting shadow usage. But right now the options are fairly limited except to enforce via working culture and managed devices. I've written up about this in a tad more detail here: [https://www.analystengine.io/insights/how-to-secure-mcp-in-the-enterprise](https://www.analystengine.io/insights/how-to-secure-mcp-in-the-enterprise)
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what security leaders must demand before pointing one at production. TL;DR Exploitation is now the front door. It starts 31% of breaches (Verizon DBIR
The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. "SparroWocky is a modular, C++ backdoor," ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News
Flock reveals little about where its license plate readers are assembled, but the answer could have geopolitical and cybersecurity implications.
The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH). A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG
A security breach at Gyazo, Helpfeel's image-sharing service, exposed about 23.62 million user records, including email addresses and password hashes, the Kyoto-based company said in a notice published Wednesday. It also exposed about 490 million image metadata records, mostly for images from January 2019 or earlier, including the IDs that make up Gyazo image links. Helpfeel said
This is a deterministic local privilege escalation affecting the default install of the latest Arch, Fedora, Debian, Amazon Linux and RHEL distributions, having unprivileged user namespaces enabled, openvswitch auto-loading, and a stock kernel carrying the Fragnesia fix.
Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability is due to insufficient authentication control on an API endpoint," Cisco said. "An attacker
The U.S. Department of Justice (DoJ) on Tuesday announced the court-authorized seizure of internet domains associated with a distributed denial-of-service (DDoS)-for-hire service known as NightmareStresser. The domains in question are: nightmare-stresser[.]com and nightmarestresser[.]org. Visitors to the site are now greeted by a seizure banner that states - "This domain has been seized by the
How Brutus grew into an engine that finds your identities, tests them everywhere they’re accepted, and remembers what it confirms. An attacker rarely needs a novel exploit when a valid username and password pair is sitting in a breach dump, reused across a dozen internal services, or left at a vendor default nobody changed. Brutus started as a focused credential testing tool. It has since grown into something broader: an engine that finds the identities attached to an organization, tests them everywhere they might be accepted, and carries what it confirms forward into future runs. All of it runs automatically as part of the pipeline. There’s no manual setup and no analyst kicking off individual checks. Here’s what changed. Knowing who works there Testing a credential assumes you already know the account exists. Brutus now builds that picture from more places. A new people enumeration subsystem maps organizational exposure using professional identity data, drawing on an Apollo.io connector built with a split discover and enrich flow so the full org roster isn’t revealed automatically. A LinkedIn Sales Navigator connector adds another path for personnel discovery. Microsoft 365 enumeration is now a first class command in its own right rather than something reachable only from inside another mode, and it supports rotating proxies. GitHub email enumeration through rotating proxies is also fixed: the CSRF session handshake no longer stalls or fails quietly, and progress is visible while the session is being established. Two smaller changes make the output easier to work with. Generated usernames now carry the first and last name that produced each candidate, so nothing downstream has to reverse engineer a person’s name from the loca
Wednesday, September 16
A modern storefront can look perfectly healthy while malicious JavaScript works underneath: siphoning affiliate revenue, hijacking searches and clicks, tampering with analytics, or asking a remote server what to execute next. Pages load, products appear, and checkout works — yet the browser may be quietly doing something the site owner never authorized. That is the blind spot our Client-Side Security machine learning (ML) model is built to expose. This post follows four operations, spanning eight payloads, that our Page Shield ML uncovered in the wild. The detection of these malicious payloads was automated; humans verified each finding only after the system had flagged it. When we afterward reviewed the campaigns using security scanning tools, seven of the eight payloads were entirely absent from VirusTotal, and URLScan returned no malicious verdict for any of them. Page Shield ML , meanwhile, caught all eight in live traffic. For instance, while security research documented the broader Lnkr family years earlier, one specific payload version sat indexed by URLScan for nearly two and a half years with “No classification,” including during a direct scan in January 2024. Only in this case had VirusTotal ingested the payload earlier: while it currently flags the script as malicious, public history does not reveal when that verdict was first assigned. Meanwhile, Page Shield ML independently surfaced those exact bytes live on an online retailer's storefront. More broadly, a hash can be known long before the code behind it is classified as malicious. If your defense
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that provides for hefty fines against data brokers that publish personal information on state law enforcement officials. In the face of repeated stonewalling and prevarication by attorneys for Radaris, the judge in the case ordered that radaris.com and more than a dozen other data broker domains be transferred to the plaintiffs. The radaris.com website, prior to the domain transfer to Atlas. In February 2024, Radaris was sued by Atlas Data Privacy Corp , a company that has been pursuing data brokers alleged to be violating a New Jersey statute called Daniel’s Law . The statute allows state law enforcement officials, government personnel, judges and their families to have their information completely removed from commercial data brokers and people-s
A penetration testing scope defines the assurance an enterprise needs, not just the assets a vendor will touch. Start with the business or compliance objective, then map the system boundary before counting assets. List applications, APIs, infrastructure, roles and integrations separately, specify authenticated and unauthenticated testing, and clarify whether production, staging or both will be […] The post How to Scope an Enterprise Penetration Test: Free Scope-of-Work Template appeared first on Synack .
Overview A vulnerability in MLflow’s dspy and statsmodels model flavors allows unauthorized pickle deserialization executions despite a safety control. Specifically, the dspy flavor conditionally applies the control based on the model path’s file extension, and the statsmodels flavor does not apply the control. Description MLflow is an open-source platform for managing machine learning lifecycles, including model packaging, versioning, and deployment. "Flavors" refer to the specialized frameworks through which supported models are stored and loaded. In response to previous vulnerability concerns, MLflow implemented the MLFLOW_ALLOW_PICKLE_DESERIALIZATION safety control to block and disable executing any pickle deserialization and subsequent loads per the user’s choice. When loading models through mlflow.pyfunc.load_model(model) , users must specify a model flavor and path in an MLmodel file. With the dspy flavor, MLflow checks the value of MLFLOW_ALLOW_PICKLE_DESERIALIZATION , and whether the specified model path ends in .pkl . A model path that does not end in .pkl (even if the file is actually a pickle file), will route to a separate branch for pickle deserialization, bypassing the safety control. However, when loading through the statsmodels flavor, there is no check for MLFLOW_ALLOW_PICKLE_DESERIALIZATION at all. Impact Exploitation of this vulnerability allows for arbitrary remote code execution through a malicious pickle-loaded payload, regardless of a user explicitly disallowing pickle serialization, through vulnerable flavor specifications in the MLmodel configuration file. The attack path requires write access to any location from which a use
Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky. The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for persistence and lateral movement.
VU#212479: Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
Overview A vulnerability exists in Sentry Seer when the system is configured to automatically hand issues to a coding agent for remediation. Successful exploitation results in arbitrary code execution within the coding‑agent environment and access to connected source repositories. This vulnerability is tracked as CVE-2026-90999 . Description Sentry is a software error‑monitoring and performance‑tracking platform used by developers to detect, diagnose, and understand issues in their applications. It collects telemetry such as exceptions, stack traces, logs, and performance data from applications. Built into Sentry, Seer acts as an automated debugging assistant that converts telemetry into actionable remediation steps and can hand off issues to an integrated coding agent to propose code fixes. Because Sentry front-end projects commonly expose a public DSN (Data Source Name) to allow browsers to submit this telemetry, an attacker can craft and submit malicious events through this public endpoint. When Seer is enabled to automatically pass issues to a coding agent, these attacker-supplied events can traverse multiple trust boundaries. Ultimately, malicious event fields propagate through Seer’s analysis pipeline, transforming into untrusted instructions that the privileged coding agent may execute. The vulnerable workflow is as follows: * Sentry ingests attacker‑generated exception events submitted through the public DSN. * Seer evaluates whether the event represents an issue eligible for automated remediation. * Seer generates a root‑cause analysis that uses attacker-controlled event fields, including exception messages, stack traces, source context, and breadcrumbs. * The generated analysis is embedded directly into the initial prompt provided to the coding agent.
Two things happened last week, one day apart, and almost nobody connected them. On 11 September, the EU Cyber Resilience Act’s vulnerability reporting obligations came into force. Companies covered by the regulation now have to report actively exploited vulnerabilities within 24 hours and provide a fuller notification within 72. On 12 September, Anthropic CEO Dario […] The post Slow is a design principle, not a delay appeared first on Heimdal Security Blog .
Widescreen + Online Multiplayer Coop for my Rust WASM Zelda 2 decompilation. Github and playable link coming soon.
In this post, we walk through different threats to GitHub and how to detect them.
Tuesday, September 15
Third-party penetration testing means two different things: testing your own organization through an independent provider, and testing or reviewing testing on a supplier, partner, or acquisition target. This guide focuses on the second use case. It works best as a governed risk process, not a document request, built on clear authorization, risk-based scope, defensible evidence, and contractual follow-up. The post Third-Party Penetration Testing: What Security and Procurement Teams Need to Know appeared first on Synack .
Without proper controls, website owners have long faced a difficult tradeoff: allow your content to be used for AI training, or risk losing discoverability in search. That tradeoff exists because some of the largest organizations on the Internet use mixed-use crawlers: a single crawler serving both search and AI training. Refuse one, and you refuse the other. Today, Cloudflare is announcing a new Disallow AI Training setting that lets you easily stay indexed for search while refusing to let that same crawler train on your content. Apple, Google, and Microsoft honor or have committed (in a specified time frame) to honor this setting. Mixed-use crawlers were the hard part of the training question. AI Summaries are next. A site-wide yes or no is too blunt: how much of your content appears in a summary matters as much as whether it appears at all. An opt-out for AI summaries is already one of the requirements we've set for mixed-use crawler operators. By early next year, our goal is to let you control how much of your content is included — set once on Cloudflare, rather than with each operator separately. Why asking isn’t enough Most site owners want to be found: by humans, agents, and (good) bots. But a significant portion of the open Internet is funded by advertising, subscriptions, or direct relationships with visitors, and those models only pay when someone actually arrives. Almost every site owner considers Search beneficial: less than 1% of Cloudflare sites choose to block Search bots. Training, however, is a different story: 17% of sites choose to enable some mechanism to block training. This is exactly why we decided site owners needed more granular controls, rather than a one-size-fits-all “Block AI.” A robots.txt directive alone cannot solve this problem. Anyone can publish one, but it cannot identify who i
As more teams — and now agents — build applications on Cloudflare's Developer Platform, having the right access controls is crucial to allow you to ship safely. After all, the last thing you want is for an agent to make a change in production, just because it was granted more access than it needs. Now, you can give a teammate or agent access to a specific Worker, so that they can only make changes to that application and no other resources in your account. Moreover, we’re giving you four new roles, so you can limit exactly what they can do: The new roles are available today, for all customers. You can assign them to a specific user, so when they log into the dashboard, they will only see the Worker you have given them access to. Or, you can create an API token with the scoped access, which you can give to your agent to ensure they only have access to that one application. Here’s an example of how to create an API token with permissions per Worker: Roles designed for how teams build When defining these roles, we wanted to strike the right balance. Overly broad roles force you to grant more access than intended, undermining the principle of least privilege, while providing too many individual permissions makes it difficult to know which ones to grant. We landed on four roles that reflect the levels of access you may want to give a person or agent: enough to debug a resource without exposing its content, read the content without changing it, make changes without being able to delete the resource, or fully manage it. We plan to use these same roles as we bring resource-level access controls to other Developer Platform products, including D1, R2, and KV. Each role can be applied at one of three scopes. For example, if you set the “metadata read-only” control, here’s what that would look like at different levels: Developer Platform level: Access
1Password’s FLAWED report , published on August 6, 2026, gives defenders a misleading picture of AI patching. Its headline says models produced clean fixes only 26% of the time. That figure includes experiments that deliberately instructed agents to apply the wrong fix, along with experiments in which agents could not compile or test their patches. The report risks making defenders less effective by discouraging them from using technology that could help them fix more vulnerabilities. Teams that take its headline at face value may leave repairable vulnerabilities unaddressed. We want our work to help defenders fix more vulnerabilities. This post shares real-world data on human and agent patch quality from our consulting projects and Patch the Planet. We’re also releasing two agent skills: post-patch-validation to help agents test fixes, and review-walkthrough to help engineers review them. How the experiment produces a misleading headline Our review of 1Password’s code and data found four choices that make its 26% clean-fix rate a misleading guide to ordinary patching work. 1 The sample was selected for difficult fixes. The authors chose six vulnerabilities because their fixes were complex. Clean-fix rates ranged from 3% to 60% across those bugs, so
Monday, September 14
In the biggest-ever legal action against harmful deepfake websites, the Manhattan District Attorney’s Office has seized 12 sites that collectively targeted around 1,200 victims.
An analysis of 160 deepfake websites reveals politicians in 22 countries appear on them. Nearly all of them are women.
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Sunday, September 13
Saturday, September 12
Plus: The US disrupts the internet’s biggest black market, a Conti ransomware hacker gets prison time, Meta fails to stop AI-generated videos of child abuse.
Friday, September 11
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite I think what really resonates with me this week is being able to completely turn the tables on perceptions around things like AI being the big bad hacking tool the news would have you believe. There's the stat I talk about where it's had literally 0% impact on insurance payouts, the Dutch bloke who's now being tracked down based on his voice and Scott's MAG breach teardown that ultimately pointed to exposed keys rather than anything sophisticated. Then the mention in there about the Aussie headline where ChatGPT has hacked a court system down here when, in fact, a bloke used it to write a scraper he then pointed at the aforementioned website. It seems the truth just doesn't make for good headlines 路♂️
VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index
Overview An out-of-bounds (OOB) memory access vulnerability involving unchecked array indexing has been identified in the exllamav3_ext compute unified device architecture ( CUDA ) extension. Successful exploitation can lead to an immediate denial of service or application instability. This vulnerability is tracked as CVE-2026-84286. Description An OOB memory access vulnerability exists in the exllamav3_ext module due to insufficient input validation. When the kernel parameter K is set to 0 in a crafted input, the extension generates a negative array index, resulting in a CUDA illegal memory access.s. The root cause is a missing bounds check in the kernel-table dispatch process. The checkpoint-derived block index ( cbi ) is used to access a fixed 24-entry array without confirming that either K or cbi fall within safe limits. Impact Primary impacts include Denial of Service (DoS) through process crashes and potential unstable execution states within applications utilizing the library. Solution The vendor has addressed this vulnerability in the main repository. Users are advised to update their installations or apply the fix from the merged pull request: https://github.com/turboderp-org/exllamav3/pull/310. Supply chain Downstream projects utilizing this library are indirectly exposed to this vulnerability. According to the ExLlamaV3 Dependency Graph, there are 49 total dependencies currently tracking this repository. Notable downstream projects directly affected by this
Synack's reporting experience now scopes to individual assets, generates AI-written executive summaries, and lets teams preview, save and share reports without leaving the platform. The post Executive-Ready Reporting Is Here: What’s New in the Synack Platform appeared first on Synack .
The proposed class action alleges Meta illegally harvested people’s Facebook and Instagram photos to train its AI image-generation models and to build its unreleased “NameTag” face recognition feature.
CISA has confirmed that ransomware operators are exploiting CVE-2025-14733, a critical remote-code-execution vulnerability affecting WatchGuard Firebox appliances. The bug can allow an unauthenticated attacker to execute code remotely under vulnerable configurations.
Today, we’re making Cloudflare CASB more powerful than ever by introducing automatic remediation policies. This means security teams can now design event-driven logic to revoke risky file shares and dispatch custom webhooks, without manual intervention. When we launched Cloudflare CASB , a cloud access security broker, we wanted to provide security teams complete visibility into the posture of their SaaS applications before misconfigurations became incidents. With a quick, clientless integration, CASB surfaces risks like overshared files, dormant admin keys and tokens, OAuth apps with excessive permissions — continuously, across users in the organization. For years, SaaS Security Posture Management (SSPM) tools such as Cloudflare CASB have functioned as a passive alarm system. Most SSPM tools tell you what’s wrong but do not help you fix the issue, placing the burden on administrators to manage an ever-growing to-do list. A single misconfigured file-sharing policy across a Google Workspace tenant can generate thousands of findings in seconds, and even a disciplined team faces a window between detection and remediation measured in hours or days — more than enough time for a sensitive file to be downloaded, forwarded, or indexed. With automatic remediation policies, CASB customers can now configure the actions that should be invoked immediately after a new finding is identified. Shifting from reactive to proactive When we launched manual remediation actions earlier this year, we gave security teams the ability to resolve misconfigurations directly from the Cloudflare dashboard. This re