Seclog - #159

g3n3r4l17

1. Vulnerability History: 1994 Web Flaws (jericho.blog)

   This article dives into vulnerability disclosure forensics, challenging the history of web-related vulnerabilities dating back to 1994. It uses historical data (OSVDB/VulnDB) to trace the origins of web security flaws, providing a unique perspective on the evolution of CVEs.

2. Reverse Engineering Tapo C260 Firmware (spaceraccoon.dev)

   This post details the reverse engineering process of the TP-Link Tapo C260 camera firmware and the Tapo Discovery Protocol v2. It provides a technical walkthrough of analyzing IoT device firmware, relevant for hardware security researchers looking into TP-Link ecosystems.

3. SQL Injection in GeoPandas Library (aydinnyunus.github.io)

   A classic SQL injection vulnerability was identified and fixed in the topostgis() function of the GeoPandas library. The post explains how user inputs were directly concatenated into SQL queries and details the remediation process via a pull request.

4. GnuPG and Crypto Tools Flawed (heise.de)

   Security researchers discovered 14 implementation vulnerabilities across GnuPG and three other cryptographic tools. These flaws do not undermine the fundamental security of cryptographic methods but highlight critical errors in their concrete software implementation, with many remaining unfixed.

5. OpenAI Hardens ChatGPT Atlas Against Prompt Injection (openai.com)

   OpenAI is actively hardening ChatGPT Atlas against prompt injection, which is identified as a significant risk for the "agent in the browser" paradigm. Agent mode allows ChatGPT to view webpages and take actions within the browser, making AI security paramount as it becomes a high-value target for adversarial attacks.

6. Claude Chrome Extension Threat Analysis (labs.zenity.io)

   This analysis maps the attack surface of agentic browser extensions like Claude in Chrome, where the AI agent, not the user, is in control. The shift to agentic browsers introduces novel risks and demands a new security threat model beyond traditional browser security.

7. PHP Code with 7 Characters (splitline.github.io)

   This content demonstrates the ability to write and execute PHP code using only 7 distinct characters. It highlights advanced obfuscation techniques and the potential for code execution in highly constrained or filtered environments.

8. ALPHV BlackCat Ransomware Attackers Plead Guilty (justice.gov)

   Two individuals with sophisticated cybersecurity training pleaded guilty to committing ransomware attacks using ALPHV BlackCat. The Department of Justice emphasizes its commitment to identifying and prosecuting perpetrators of ransomware attacks globally.

9. Libsodium Vulnerability Disclosed (00f.net)

   A vulnerability in the libsodium cryptographic library has been disclosed, stemming from an implementation error rather than a cryptographic weakness. This incident reinforces that even libraries designed for simplicity and high-level APIs can contain exploitable flaws in their concrete execution.

10. Grafana CVE-2025-6023 Bypass Details (blog.ethiack.com)

    A bypass for CVE-2025-6023 in Grafana, an open redirect vulnerability, has been detailed, which could lead to XSS and account takeover. The vulnerability was discovered and remediated across customer bases by a research team 24 days prior to public advisory, highlighting effective pre-patch remediation strategies.

11. CloudFlare Workers for Red Teams (blog.zsec.uk)

    This article demonstrates how CloudFlare Workers can be utilized by red teams for Conditional Access Payload Delivery (CAPD). It provides a highly available and rapidly updatable method for delivering arbitrary content, allowing for custom access restrictions without a traditional server setup.

12. XSpeeder SXZOS Unauthenticated Root RCE (pwn.ai)

    A zero-day unauthenticated root RCE (CVE-2025-54322) has been discovered in XSpeeder SXZOS firmware, affecting over 70,000 edge devices globally. This critical vulnerability targets devices like routers and SD-WAN appliances, posing a significant risk to remote industrial and branch environments.

13. Revisiting Medusa Locker Ransomware (theravenfile.com)

    Research indicates ongoing activity for Medusa Locker ransomware, with old TOR domains redirecting to new Onion URLs and new samples being found. This suggests a potential resurgence or continued operation of the Medusa Locker ransomware group, requiring updated defensive measures.

14. Debugging DNS with Tshark (isc.sans.edu)

    This post outlines how to use tshark to effectively inspect and summarize DNS traffic. It provides practical steps for debugging DNS response times, which is critical for network troubleshooting and identifying potential performance or security anomalies.

15. Cybersecurity Outlook 2026 Predictions (danielmiessler.com)

    CISOs are facing an unscalable challenge with human teams against increasingly sophisticated and relentless attackers. The core competition in 2026 will be the speed at which organizations can perform asset, attack surface, and vulnerability management, especially at the perimeter.

16. Fuzzing Qualcomm GPU Drivers in QEMU (media.ccc.de)

    Researchers virtualized the Qualcomm Android kernel and KGSL graphics driver in QEMU to enable deep debugging and large-scale fuzzing of GPU drivers. This approach helps mitigate kernel escalation risks by efficiently finding bugs in GPU drivers, which are common final escalation vectors on Android devices.

17. Agentic AI Poses Surveillance Threat (media.ccc.de)

    This presentation argues that the integration of agentic AI into operating systems and applications (e.g., Microsoft's "Recall") fundamentally shifts control away from users. Such systems create OS-level surveillance and high-value targets for attackers, posing existential threats to privacy guarantees and eroding individual autonomy.

X2

1. Claude Security Bypass via Prompt Injection (@IceSolst)

   A security researcher successfully bypassed Claude's security review by injecting prompts within code comments. This technique convinced Claude that a blatant SQL injection vulnerability was a false positive, highlighting the current limitations of AI security mechanisms against creative adversarial input.

2. CellMapper for Mobile Network Coverage (@Cyber_Sudo)

   This post introduces CellMapper, a free, crowdsourced tool for mapping 2G/3G/4G/5G mobile tower locations and coverage. It is a useful resource for intelligence gathering, reconnaissance, or physical security assessments related to mobile network infrastructure.

y0utube1

1. WhatsApp 0-Click Vulnerability Reverse Engineering (youtube.com)

   This video focuses on the reverse engineering process of a WhatsApp 0-click vulnerability. It is highly relevant for security researchers and reverse engineers looking to understand advanced mobile application exploitation techniques.

g1thub8

1. VSCode Backdoor via Tasks (github.com)

   This repository demonstrates how to introduce a stealthy backdoor in Visual Studio Code projects by abusing the tasks.json file. It highlights a supply chain risk where opening a malicious project folder can automatically execute arbitrary code without user confirmation.

2. jsscm GitHub Repository (github.com)

   It reflects community interest in this specific software project, often indicating active development or utility.

3. File-Tunnel for TCP Connections (github.com)

   This repository provides a tool to tunnel TCP connections directly through a file. This technique can be used for covert communication, data exfiltration, or establishing channels in highly restricted network environments.

4. XSpeeder SXZOS RCE Scanner (github.com)

   This repository offers a multi-threaded vulnerability scanner for CVE-2025-54322, an unauthenticated remote code execution flaw in XSpeeder SXZOS firmware. Security professionals can use this tool to quickly identify vulnerable XSpeeder devices across a network, aiding in rapid assessment and remediation efforts.

5. Reaper Application Security Framework (github.com)

   Reaper is an open-source application security testing framework that integrates reconnaissance, request proxying, tampering, active testing, and vulnerability validation. Engineered for modern app security, it streamlines the security testing workflow and is designed for potential AI integration.

6. Custom Semgrep Rules for Vulnerabilities (github.com)

   This repository contains a collection of custom Semgrep rules designed for vulnerability detection in Swift, Java, and COBOL source code. These rules aim to reduce false negatives by providing additional patterns that augment official Semgrep rules, enhancing static analysis capabilities.

7. Docker Desktop ECI Bypass PoC (github.com)

   A public Proof-of-Concept for CVE-2025-9074 is available, demonstrating a critical vulnerability in Docker Desktop. This flaw allows Linux containers to bypass Enhanced Container Isolation and connect to the Docker Engine API, potentially leading to unauthorized access to host user files with a High Risk rating.

8. TRECO for Race Condition Exploitation (github.com)

   TRECO is a Tactical Race Exploitation & Concurrency Orchestrator designed for precise concurrent HTTP attacks. It enables security researchers to reliably trigger and exploit race conditions in web applications with sub-microsecond timing accuracy, supporting both Python 3.10+ and GIL-free Python 3.14t.