Model adopting ‘jailbreak-like instructions’ among six more cases as firm reveals framework for tracking AI misalignment OpenAI has disclosed six more examples of “unexpected or concerning” behaviour by its technology, as it warned that the pace of development could not continue at “maximum speed for much longer” responsibly. In one of the new cases reported by OpenAI, an unreleased research model inserted “jailbreak-like instructions” into its own notes to disregard its normal constraints and told itself to be “freed from the roles and identities that bind other chatbots”. Continue reading...
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 2:40 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
Flock reveals little about where its license plate readers are assembled, but the answer could have geopolitical and cybersecurity implications.
The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH). A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG
VU#212479: Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
Overview A vulnerability exists in Sentry Seer when the system is configured to automatically hand issues to a coding agent for remediation. Successful exploitation results in arbitrary code execution within the coding‑agent environment and access to connected source repositories. This vulnerability is tracked as CVE-2026-90999 . Description Sentry is a software error‑monitoring and performance‑tracking platform used by developers to detect, diagnose, and understand issues in their applications. It collects telemetry such as exceptions, stack traces, logs, and performance data from applications. Built into Sentry, Seer acts as an automated debugging assistant that converts telemetry into actionable remediation steps and can hand off issues to an integrated coding agent to propose code fixes. Because Sentry front-end projects commonly expose a public DSN (Data Source Name) to allow browsers to submit this telemetry, an attacker can craft and submit malicious events through this public endpoint. When Seer is enabled to automatically pass issues to a coding agent, these attacker-supplied events can traverse multiple trust boundaries. Ultimately, malicious event fields propagate through Seer’s analysis pipeline, transforming into untrusted instructions that the privileged coding agent may execute. The vulnerable workflow is as follows: * Sentry ingests attacker‑generated exception events submitted through the public DSN. * Seer evaluates whether the event represents an issue eligible for automated remediation. * Seer generates a root‑cause analysis that uses attacker-controlled event fields, including exception messages, stack traces, source context, and breadcrumbs. * The generated analysis is embedded directly into the initial prompt provided to the coding agent.
Google has disclosed that a high-severity security flaw in its Pixel Cellular Modem has come under exploitation in the wild. The vulnerability, tracked as CVE-2026-58704 (CVSS score: 8.0), is a privilege escalation flaw. "In Cellular Modem, there is a possible permission bypass due to a logic error in the code," according to a description of the bug in the NIST National Vulnerability Database
Latest
Thursday, September 17
Working on a security scanner for AI-generated PRs, and one pattern keeps showing up: the review comment itself isn't the bottleneck; the re-reading of it is. A comment sits in a PR thread next to five other automated bot comments (lint, coverage, dependency bot, style bot...) and blends in. We found this concretely auditing a real open-source signing flow: a page returned a recipient's name and email in the response before the authorization check that was supposed to gate it. If a bot had left a comment about that, it's exactly the kind of note that gets skimmed and merged past under deadline pressure. There's no sense of urgency. The fix we landed on for our own tool (Scanity) was to stop leaving comments and instead fail the GitHub check itself, so the PR can't merge at all above a severity threshold, same as a failing test. At the same time, Scanity also provides the fix for it instantly. Curious whether others have data on comment-based bot feedback actually changing merge behavior vs just adding noise to the PR. Check it out: [https://scanity.dev/](https://scanity.dev/)
Model adopting ‘jailbreak-like instructions’ among six more cases as firm reveals framework for tracking AI misalignment OpenAI has disclosed six more examples of “unexpected or concerning” behaviour by its technology, as it warned that the pace of development could not continue at “maximum speed for much longer” responsibly. In one of the new cases reported by OpenAI, an unreleased research model inserted “jailbreak-like instructions” into its own notes to disregard its normal constraints and told itself to be “freed from the roles and identities that bind other chatbots”. Continue reading...
I've worked with about 10 firms over the last year - a mix of financial services + consultancies - and MCP implementation is starting to get out of control. Everyone wants to implement it on their project, but there is not yet sufficient governance in place to manage the risk. Most organisations I've seen manage this right now by exception - they triage AI projects, approve the lowest-risk use cases, and delay the higher risk ones. The obvious design pattern for MCP is to deploy a middleware gateway solution. I've seen a few who have opted for Azure API Management, and one that's opted for Cloudflare. In my opinion, these are not quite there yet and the control maturity is quite low. I've been recommending that firms build their own control layer (especially the ones that already have internal dev resources assigned to AI), and eventually move to a vendor once they've found what works best for them. Regardless of what they do, there are three minimum control objectives I try to communicate. If they do these - with or without a gateway - they're typically in an excellent position **1.** **Attribute every action to a human** When MCP servers simply inherit OAuth tokens, there's not necessarily a clear record in the integrated system that an action was taken by an AI instead of a user. Most implementations have moved to OAuth on-behalf-of (OBO) tokens, which is a step in the right direction. But it makes sense to establish your own independent record if you can, and then it doesn't matter how the integrated system handles the identity. It also means you don't have to integrate logs from all your external platforms into your SIEM - you establish your own native capability and get a consistent logging format across all platforms. You want to be able to audit that "Agent X took Action Y based on request from User Z". **2. Run agents at least privilege, not the human's privilege** A common source of frustration I see is that a team wants to create an MCP integration for Confluence, and the agent inherits the permission context of its user. The user has write access to Confluence, but all the team wants to do is allow the agent to read internal documentation. So why are we granting it write access as well, which can be highly destructive if the agent gets confused or is maliciously prompted? Like with the above, some platforms do have the capability to fine-tune RBACs for agents - but most don't. If you add this capability in a middleware solution that you control, you've now centralised all agent permissions and achieved a simple source of truth. **3. Send every request through a governed path** A middleware gateway that applies business policy only makes sense if MCPs are actually using it. You can enforce that by issuing administrative policies and defining acceptable use, but also by hardcoding the gateway configuration in your agent clients. By definition, MCPs that don't use a governed path are now "Shadow AI/IT". It's still quite difficult to detect this (M365 Defender for Cloud Apps helps a little). But because MCP is encapsulated in HTTPS, you can only rely on DNS right now, which is highly unreliable. At some point, I'm certain that FW vendors will develop an ML capability that can detect the signatures for encrypted MCP payloads, which will provide a much more reliable method of detecting shadow usage. But right now the options are fairly limited except to enforce via working culture and managed devices. I've written up about this in a tad more detail here: [https://www.analystengine.io/insights/how-to-secure-mcp-in-the-enterprise](https://www.analystengine.io/insights/how-to-secure-mcp-in-the-enterprise)
Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. Unbound 1.26.1, released the same day, fixes the bug, tracked as CVE-2026-81642, along with
I've been working on BHPAI, a personal project for detecting potentially malicious Windows PE files. The current version combines native C++ static analysis with a weighted ensemble of four LightGBM models. On a separate 403-sample benchmark, it achieved 96.03% accuracy, 95.72% F1, and 91.79% recall. The models were trained on around 15,000 samples, so I consider this an early-stage result rather than proof of production reliability. The sandbox and ransomware-detection components are still under development. I'm mainly looking for technical feedback, especially regarding dataset diversity, evaluation methodology, and reducing false negatives. Has anyone here worked on a similar PE malware detection project? What would you focus on improving next? [https://github.com/Rin449/BHPAI](https://github.com/Rin449/BHPAI)
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what security leaders must demand before pointing one at production. TL;DR Exploitation is now the front door. It starts 31% of breaches (Verizon DBIR
The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. "SparroWocky is a modular, C++ backdoor," ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News
Flock reveals little about where its license plate readers are assembled, but the answer could have geopolitical and cybersecurity implications.
The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH). A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG
A security breach at Gyazo, Helpfeel's image-sharing service, exposed about 23.62 million user records, including email addresses and password hashes, the Kyoto-based company said in a notice published Wednesday. It also exposed about 490 million image metadata records, mostly for images from January 2019 or earlier, including the IDs that make up Gyazo image links. Helpfeel said
hello fellas, im a fresh grads with 0 - 1 year of experience as security analyst in Malaysia. My company requires me to choose which cert to choose. Currently I only have Google Cybersecurity Professional and Fortinet Certified Fundamental in Cybersecurity cert. some said GIAC cert is highly valued but some said CySa+ is way to go for me. Any feedback from you guys i highly appreciated. thanks guys
Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability is due to insufficient authentication control on an API endpoint," Cisco said. "An attacker
The U.S. Department of Justice (DoJ) on Tuesday announced the court-authorized seizure of internet domains associated with a distributed denial-of-service (DDoS)-for-hire service known as NightmareStresser. The domains in question are: nightmare-stresser[.]com and nightmarestresser[.]org. Visitors to the site are now greeted by a seizure banner that states - "This domain has been seized by the
How Brutus grew into an engine that finds your identities, tests them everywhere they’re accepted, and remembers what it confirms. An attacker rarely needs a novel exploit when a valid username and password pair is sitting in a breach dump, reused across a dozen internal services, or left at a vendor default nobody changed. Brutus started as a focused credential testing tool. It has since grown into something broader: an engine that finds the identities attached to an organization, tests them everywhere they might be accepted, and carries what it confirms forward into future runs. All of it runs automatically as part of the pipeline. There’s no manual setup and no analyst kicking off individual checks. Here’s what changed. Knowing who works there Testing a credential assumes you already know the account exists. Brutus now builds that picture from more places. A new people enumeration subsystem maps organizational exposure using professional identity data, drawing on an Apollo.io connector built with a split discover and enrich flow so the full org roster isn’t revealed automatically. A LinkedIn Sales Navigator connector adds another path for personnel discovery. Microsoft 365 enumeration is now a first class command in its own right rather than something reachable only from inside another mode, and it supports rotating proxies. GitHub email enumeration through rotating proxies is also fixed: the CSRF session handshake no longer stalls or fails quietly, and progress is visible while the session is being established. Two smaller changes make the output easier to work with. Generated usernames now carry the first and last name that produced each candidate, so nothing downstream has to reverse engineer a person’s name from the loca
Taking the single point of authority out of an application: threshold keys and quorum-approved roles alongside your existing IAM
The post is about a pattern we keep coming back to: in most apps, one layer ends up able to read everything. The app server holds or can fetch the decryption key, and the database holds the role assignments that decide who sees what. KMS, PAM, access reviews and logging all help and should stay, but they rely on whoever holds that access using it as intended. The post walks through moving those decisions out of the application. The key only exists as shares across independent nodes (14 of 20 have to cooperate to use it), and a role only becomes real once several admins have approved it, each from their own enclave, and the network has signed the attestation. Editing a row doesn't grant anything, and a copy of the database or the server holds nothing that decrypts it. The practical bit: you don't have to replace your identity provider to try this. minidauth is a small open source service that sits beside Cognito, Clerk, Supabase, Auth0 and so on. It's been added to forks of Formbricks and Twenty, if you want to see it in a real codebase. It's early and meant for pilots, not production. I'm interested in where people think the trust argument holds up and where it doesn't, especially anyone who's dealt with insider access or support-tooling risk.
Wednesday, September 16
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that provides for hefty fines against data brokers that publish personal information on state law enforcement officials. In the face of repeated stonewalling and prevarication by attorneys for Radaris, the judge in the case ordered that radaris.com and more than a dozen other data broker domains be transferred to the plaintiffs. The radaris.com website, prior to the domain transfer to Atlas. In February 2024, Radaris was sued by Atlas Data Privacy Corp , a company that has been pursuing data brokers alleged to be violating a New Jersey statute called Daniel’s Law . The statute allows state law enforcement officials, government personnel, judges and their families to have their information completely removed from commercial data brokers and people-s
New [Hunt.io](http://Hunt.io) research extends Bitdefender's SilkParasite report by connecting a SpiceRAT C2 cluster to NodeEdgeRAT and NomadRAT at the infrastructure level. A TLS certificate from TLC, a CA funded by a Chinese state research institute, impersonates Uzbekistan's railway and ties much of the cluster together. The domains spoof named Central Asian government and energy entities, and passive DNS places the activity back to at least mid-2022. All network-side, no compromised hosts or samples. Full report: [https://hunt.io/blog/silkparasite-spicerat-central-asia-infrastructure](https://hunt.io/blog/silkparasite-spicerat-central-asia-infrastructure)
A penetration testing scope defines the assurance an enterprise needs, not just the assets a vendor will touch. Start with the business or compliance objective, then map the system boundary before counting assets. List applications, APIs, infrastructure, roles and integrations separately, specify authenticated and unauthenticated testing, and clarify whether production, staging or both will be […] The post How to Scope an Enterprise Penetration Test: Free Scope-of-Work Template appeared first on Synack .
Overview A vulnerability in MLflow’s dspy and statsmodels model flavors allows unauthorized pickle deserialization executions despite a safety control. Specifically, the dspy flavor conditionally applies the control based on the model path’s file extension, and the statsmodels flavor does not apply the control. Description MLflow is an open-source platform for managing machine learning lifecycles, including model packaging, versioning, and deployment. "Flavors" refer to the specialized frameworks through which supported models are stored and loaded. In response to previous vulnerability concerns, MLflow implemented the MLFLOW_ALLOW_PICKLE_DESERIALIZATION safety control to block and disable executing any pickle deserialization and subsequent loads per the user’s choice. When loading models through mlflow.pyfunc.load_model(model) , users must specify a model flavor and path in an MLmodel file. With the dspy flavor, MLflow checks the value of MLFLOW_ALLOW_PICKLE_DESERIALIZATION , and whether the specified model path ends in .pkl . A model path that does not end in .pkl (even if the file is actually a pickle file), will route to a separate branch for pickle deserialization, bypassing the safety control. However, when loading through the statsmodels flavor, there is no check for MLFLOW_ALLOW_PICKLE_DESERIALIZATION at all. Impact Exploitation of this vulnerability allows for arbitrary remote code execution through a malicious pickle-loaded payload, regardless of a user explicitly disallowing pickle serialization, through vulnerable flavor specifications in the MLmodel configuration file. The attack path requires write access to any location from which a use
🕵️ Hunting SilkParasite / SpiceRAT infrastructure by page hash, TLS cert, and RDP-over-TLS on high ports
Detection-focused writeup on a SpiceRAT C2 cluster connected to Bitdefender's SilkParasite report. Everything here is reproducible from scan data. Hunting hooks: a reused decoy page collapses to one SHA-256 body hash across 13 hosts; a TLC-issued cert (subject azure.uzrailwaystax\[.\]com, SHA-256 in the post) sits on 8 hosts; hardened RDP on unusual high ports (64350, 64330, 65535, 65111) shows up under a tls fingerprint rather than RDP, so filter for that. Two nginx versions (1.29.3 and 1.31.3) recur across the fleet. Full IOC tables (IPs, domains, cert fields, subdomain and passive DNS history) plus the HuntSQL queries are in the post, ready for retro hunts. [https://hunt.io/blog/silkparasite-spicerat-central-asia-infrastructure](https://hunt.io/blog/silkparasite-spicerat-central-asia-infrastructure)
Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky. The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for persistence and lateral movement.
VU#212479: Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
Overview A vulnerability exists in Sentry Seer when the system is configured to automatically hand issues to a coding agent for remediation. Successful exploitation results in arbitrary code execution within the coding‑agent environment and access to connected source repositories. This vulnerability is tracked as CVE-2026-90999 . Description Sentry is a software error‑monitoring and performance‑tracking platform used by developers to detect, diagnose, and understand issues in their applications. It collects telemetry such as exceptions, stack traces, logs, and performance data from applications. Built into Sentry, Seer acts as an automated debugging assistant that converts telemetry into actionable remediation steps and can hand off issues to an integrated coding agent to propose code fixes. Because Sentry front-end projects commonly expose a public DSN (Data Source Name) to allow browsers to submit this telemetry, an attacker can craft and submit malicious events through this public endpoint. When Seer is enabled to automatically pass issues to a coding agent, these attacker-supplied events can traverse multiple trust boundaries. Ultimately, malicious event fields propagate through Seer’s analysis pipeline, transforming into untrusted instructions that the privileged coding agent may execute. The vulnerable workflow is as follows: * Sentry ingests attacker‑generated exception events submitted through the public DSN. * Seer evaluates whether the event represents an issue eligible for automated remediation. * Seer generates a root‑cause analysis that uses attacker-controlled event fields, including exception messages, stack traces, source context, and breadcrumbs. * The generated analysis is embedded directly into the initial prompt provided to the coding agent.
Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. Once the extension was installed, it could access each product's built-in AI with a single click. On Comet, Edge,
Clickfix compromise at the infrastructure level - how KongTuke delivered Clickfix on September 14th without compromising individual websites
Parallels Desktop for Mac has a flaw that lets an ordinary local account run code as root, the highest level of access on a Mac, software company JFrog said this week. The attack needs code already running on the machine as a normal user, so it does not work over the network. JFrog says the fix is in Parallels Desktop 27, a version that Intel Macs cannot install. Yuval Moravchick, who leads
N0va is targeting organizations across North America and Europe with phishing campaigns that impersonate trusted services and abuse legitimate authentication flows. Successful attacks can give threat actors access to valid accounts without relying on obvious malware activity. From there, a single compromised identity can open the door to sensitive data, business systems, and additional cloud
Google has disclosed that a high-severity security flaw in its Pixel Cellular Modem has come under exploitation in the wild. The vulnerability, tracked as CVE-2026-58704 (CVSS score: 8.0), is a privilege escalation flaw. "In Cellular Modem, there is a possible permission bypass due to a logic error in the code," according to a description of the bug in the NIST National Vulnerability Database
A leaked credential shows up in a criminal marketplace, or a vulnerability gets a disclosure advisory, and either one can be weaponized against a real target before most security teams have triaged the alert. Attackers are combining that kind of intelligence with AI-assisted exploitation to accelerate the path from exposure to breach faster than most security programs are built to react.
Help Needed: Missing global perspective/rotation matrix data when converting UMK3 iOS .meshset files to .obj
Two things happened last week, one day apart, and almost nobody connected them. On 11 September, the EU Cyber Resilience Act’s vulnerability reporting obligations came into force. Companies covered by the regulation now have to report actively exploited vulnerabilities within 24 hours and provide a fuller notification within 72. On 12 September, Anthropic CEO Dario […] The post Slow is a design principle, not a delay appeared first on Heimdal Security Blog .
Widescreen + Online Multiplayer Coop for my Rust WASM Zelda 2 decompilation. Github and playable link coming soon.
Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution," Wordfence said. The WordPress security company said it has blocked over
A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw. "JWT authentication
In this post, we walk through different threats to GitHub and how to detect them.
Tuesday, September 15
Point it at a host and it does the boring first hour of an investigation for you. What it does in one run: * Collects the evidence (event logs, registry, more) even while files are locked * Builds a timeline and matches it against thousands of detection rules * Scans for known malicious tools on disk * Checks what's connected, what's running, what looks off * Checks IPs and files against threat intel * Spits out a scored report you can hand to someone No API keys required, has its own web interface. There's a demo mode that fakes an incident so you can try it without needing a real machine to investigate. 🔗 [https://github.com/karim852/Kage-DFIR-toolkit](https://github.com/karim852/Kage-DFIR-toolkit) 🖥️ live demo: [https://demo-kumo-kage.vercel.app/demo/kage/index.html](https://demo-kumo-kage.vercel.app/demo/kage/index.html) Feedback and contributions welcome 🙏
Third-party penetration testing means two different things: testing your own organization through an independent provider, and testing or reviewing testing on a supplier, partner, or acquisition target. This guide focuses on the second use case. It works best as a governed risk process, not a document request, built on clear authorization, risk-based scope, defensible evidence, and contractual follow-up. The post Third-Party Penetration Testing: What Security and Procurement Teams Need to Know appeared first on Synack .
1Password’s FLAWED report , published on August 6, 2026, gives defenders a misleading picture of AI patching. Its headline says models produced clean fixes only 26% of the time. That figure includes experiments that deliberately instructed agents to apply the wrong fix, along with experiments in which agents could not compile or test their patches. The report risks making defenders less effective by discouraging them from using technology that could help them fix more vulnerabilities. Teams that take its headline at face value may leave repairable vulnerabilities unaddressed. We want our work to help defenders fix more vulnerabilities. This post shares real-world data on human and agent patch quality from our consulting projects and Patch the Planet. We’re also releasing two agent skills: post-patch-validation to help agents test fixes, and review-walkthrough to help engineers review them. How the experiment produces a misleading headline Our review of 1Password’s code and data found four choices that make its 26% clean-fix rate a misleading guide to ordinary patching work. 1 The sample was selected for difficult fixes. The authors chose six vulnerabilities because their fixes were complex. Clean-fix rates ranged from 3% to 60% across those bugs, so
Monday, September 14
In the biggest-ever legal action against harmful deepfake websites, the Manhattan District Attorney’s Office has seized 12 sites that collectively targeted around 1,200 victims.
An analysis of 160 deepfake websites reveals politicians in 22 countries appear on them. Nearly all of them are women.
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Sunday, September 13
Locating Flutter's TLS certificate verifier in a stripped libflutter.so, tested across 13 apps and 9 engine versions
Saturday, September 12
Plus: The US disrupts the internet’s biggest black market, a Conti ransomware hacker gets prison time, Meta fails to stop AI-generated videos of child abuse.
Friday, September 11
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite I think what really resonates with me this week is being able to completely turn the tables on perceptions around things like AI being the big bad hacking tool the news would have you believe. There's the stat I talk about where it's had literally 0% impact on insurance payouts, the Dutch bloke who's now being tracked down based on his voice and Scott's MAG breach teardown that ultimately pointed to exposed keys rather than anything sophisticated. Then the mention in there about the Aussie headline where ChatGPT has hacked a court system down here when, in fact, a bloke used it to write a scraper he then pointed at the aforementioned website. It seems the truth just doesn't make for good headlines 路♂️
VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index
Overview An out-of-bounds (OOB) memory access vulnerability involving unchecked array indexing has been identified in the exllamav3_ext compute unified device architecture ( CUDA ) extension. Successful exploitation can lead to an immediate denial of service or application instability. This vulnerability is tracked as CVE-2026-84286. Description An OOB memory access vulnerability exists in the exllamav3_ext module due to insufficient input validation. When the kernel parameter K is set to 0 in a crafted input, the extension generates a negative array index, resulting in a CUDA illegal memory access.s. The root cause is a missing bounds check in the kernel-table dispatch process. The checkpoint-derived block index ( cbi ) is used to access a fixed 24-entry array without confirming that either K or cbi fall within safe limits. Impact Primary impacts include Denial of Service (DoS) through process crashes and potential unstable execution states within applications utilizing the library. Solution The vendor has addressed this vulnerability in the main repository. Users are advised to update their installations or apply the fix from the merged pull request: https://github.com/turboderp-org/exllamav3/pull/310. Supply chain Downstream projects utilizing this library are indirectly exposed to this vulnerability. According to the ExLlamaV3 Dependency Graph, there are 49 total dependencies currently tracking this repository. Notable downstream projects directly affected by this
Synack's reporting experience now scopes to individual assets, generates AI-written executive summaries, and lets teams preview, save and share reports without leaving the platform. The post Executive-Ready Reporting Is Here: What’s New in the Synack Platform appeared first on Synack .
The proposed class action alleges Meta illegally harvested people’s Facebook and Instagram photos to train its AI image-generation models and to build its unreleased “NameTag” face recognition feature.
CISA has confirmed that ransomware operators are exploiting CVE-2025-14733, a critical remote-code-execution vulnerability affecting WatchGuard Firebox appliances. The bug can allow an unauthenticated attacker to execute code remotely under vulnerable configurations.
The new joint operation uses laser-based technology capable of detecting, tracking, and disabling commercial drones linked to human and drug trafficking.
I got hit by a fake Cloudflare popup and reverse engineered the malware it dropped. Here's what I found.
A few weeks ago I was browsing and got one of those "Verify you are human" Cloudflare popups. Except it wasn't Cloudflare — it was a ClickFix page that told me to press Win+R and paste a command. I'm on Linux so nothing executed on me, but I grabbed the file and spent time tearing it apart. Here's what's inside. **The file:** `Tourmaline.exe` (~10.8 MB) It's not a typical dropper. It's an Inno Setup 6.7.0 installer (Revision 2, 64-bit offsets — which broke every standard extraction tool I tried including innoextract) that bundles a full Python 3.11 runtime and two stages of obfuscated payload. **Stage 1 — Anti-sandbox time-lock** The first stage is a ~13 line obfuscated Python script with a clever trick: it counts down from 99,999,999 to find an XOR decryption key via brute force. On a sandbox with a 60-second timeout it never finishes. On a real machine it runs in seconds. I cracked it instantly using a known-plaintext attack on the first 4 bytes of the encrypted blob — recovered the key in O(1) without running the loop at all. **Stage 2 — Full Python RAT** Once decrypted, it's a hand-rolled Python backdoor with no external dependencies. Here's what it does: - **DNS tunneling** — all C2 traffic goes out as raw UDP DNS queries directly to `158.94.211.185:53`, disguised as `*.microsoft.com` lookups. Fully custom DNS packet builder, no library used. - **Blockchain dead-drop** — on startup it calls an Ethereum Sepolia smart contract (`0x2d7a04cca0c34005f58393f30ac725e25f19e5f5`) to get the current C2 IP, decrypted locally with a hardcoded ChaCha20 key. I verified this live — the contract returned the active IP. The attacker can update it any time, making IP blocklists useless. - **ECDSA-signed commands** — tasks from the C2 are P-256 signature verified before execution. You can't sinkhole it by intercepting the DNS tunnel. - **Arbitrary Python exec** — whatever the C2 sends back gets `exec()`'d in a persistent namespace. Full remote code execution. - **Persistence** as `TourmalineUpdate` in Task Scheduler, disguised as "Hardware monitoring service." Everything is in my GitHub repo — deobfuscated source, YARA rules, IOCs (JSON + CSV), and a decryption tool that reproduces the key recovery: **https://github.com/v-pun215/Tourmaline** Sample is included as a password-protected zip (`infected`) following the standard for sharing malware samples safely. Happy to answer questions on the methodology, especially the custom Inno Setup Revision 2 format parsing and the known-plaintext bypass.
Thursday, September 10
Back in 2021 I wrote a "how to hack APIs" blog for Detectify that got loads of traction, but it's way out of date now. I rewrote it for 2026 to include a bunch of the newer popular technologies and AI.
A novel technique for writing ELF shared objects and achieving code execution in Python, Ruby, and Node.js using the sqlite\_dbpage virtual table.
SonicWall SMA1000 campaign: standalone Linux Impacket secretsdump deployed onto appliances (SHA-256 inside)
Campaign where the operator deployed a standalone Linux build of Impacket's secretsdump directly onto compromised SonicWall SMA1000 appliances and ran credential theft from there. It was pulled to the box with curl to /tmp/secretsdump, made executable, then used against internal domain controllers. Sample: secretsdump, 9,983,640 bytes, SHA-256 690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b, served over HTTP from 95.181.173\[.\]36. The surrounding Python tooling (exploit, LDAP extractor and decryptor, DCSync automation) came from the same open directory. Full toolkit breakdown and IOCs below. [https://hunt.io/blog/sonicwall-sma1000-uk-council-attack](https://hunt.io/blog/sonicwall-sma1000-uk-council-attack)
VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks
Overview An incorrect permissions assignment vulnerability in the amwrtdrv.sys kernel driver, included with AOMEI Backupper 8.4.0, allows an unprivileged local user to perform arbitrary writes to the physical disk. When Secure Boot is disabled, this can be leveraged to execute arbitrary UEFI-level code before the operating system loads. This allows an attacker to bypass OS-level security controls, including HVCI, EDR solutions, and Microsoft Defender. The attack may also enable capture of BitLocker Volume Master Key (VMK) material, depending on the system's BitLocker configuration. Description AOMEI Backupper from AOMEI International Network Limited is designed to provide backup and disaster recovery services. It also helps individuals and businesses to create system images, disk clones, and file backups. AOMEI Backupper is available as a Windows application and can be integrated into enterprise backup workflows or directly used by end users. CVE-2026-12780 : An Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in the amwrtdrv.sys kernel driver used by AOMEI Backupper 8.4.0 allows an unprivileged local attacker to achieve UEFI-level arbitrary code execution by directly writing to physical disk devices. The driver creates a world-accessible device object without a security descriptor, therefore allowing any user-mode process to open the device and issue unrestricted write requests. Hence, an attacker can modify disk sectors in the pre-partition gap (LBA 34–2047), inject a malicious UEFI payload, and alter the GPT to reference the payload as an EFI System Partition. The payload can then execute during the UEFI Boot Device Selection (BDS) phase, before operating system security mechanisms are loaded. Impact