g3n3r4l14
-
Aikido AI Code Audit identified 8 more vulnerabilities than Claude Security with Mythos, demonstrating enhanced detection capabilities. This superior performance was achieved at less than half the cost, indicating the efficiency and cost-effectiveness of Aikido's "harness design" in AI-driven security auditing.
-
Mythos Benchmarked on IDOR Vulnerabilities (semgrep.dev)
Mythos, a security configuration or tool, was extensively benchmarked against 22 different configurations. The testing specifically focused on its efficacy in detecting 275 distinct Insecure Direct Object Reference (IDOR) vulnerabilities, providing insight into its performance against a common web security flaw.
-
Ruby Marshal.load Deserialization Gadgets Discovered (elttam.com)
A survey of Marshal.load on Ruby 4.0.6 uncovered six "kick-off gadgets" (hash, eql?, =, tostr, tos, respondto?) that are invoked during deserialization. These methods were not designed for deserialization and cannot be hardened like marshalload, presenting potential unexpected behavior or vulnerabilities.
-
Critical Vulnerabilities in Plausible Analytics (whoareme.com)
Multiple critical vulnerabilities were found in Plausible Analytics, including a pre-authenticated Storybook RCE. Additional issues included registration bypass leading to cross-tenant IDORs and stored XSS, and an SSRF vulnerability in SSO verification that could escalate to PostgreSQL RCE.
-
Flare’s Emerging Threats Team successfully deanonymized the TeamPCP group, detailing their process for executing software supply chain attacks. The group leveraged a stolen token and a misconfigured GitHub Actions workflow to inject backdoored code into CI/CD pipelines, compromising five software ecosystems.
-
Vercel announced automatic protection for Next.js applications hosted on their platform against two recently disclosed vulnerabilities from August 2026. This mitigation means Vercel customers require no action, as Vercel has handled the necessary security updates at the infrastructure level.
-
Two TeamPCP Hackers Arrested in Australia (krebsonsecurity.com)
Krebs on Security reported the arrest of two alleged members of the TeamPCP hacking group in Australia. This action marks a significant development following recent disclosures about TeamPCP's involvement in sophisticated software supply chain attacks.
-
Log4j RCE Complications, AI's Impact on Disclosure (sonatype.com)
A reported Log4j RCE highlights the critical distinction between theoretical technical exploitability and actual operational risk in enterprise environments. The discussion also touches upon how AI is influencing the speed and nature of vulnerability disclosure processes.
-
Next.js AVIF RCE via libheif Heap Overflow (blogs.jsmon.sh)
A critical heap buffer overflow in libheif, chaining through sharp, enables unauthenticated Remote Code Execution (RCE) in Next.js Image Optimization. This vulnerability allows attackers to execute arbitrary code by supplying specially crafted AVIF image files to affected applications.
-
Breaking Claude Code Opus 5 with Prompt Injection (embracethered.com)
Researchers successfully executed an indirect prompt injection attack against Claude Code Opus 5's Auto Mode. The attack demonstrated a progression from a website summary task through Python module shadowing to achieving arbitrary code execution within the LLM environment.
-
OtterSec Founds Save CTFs Fund (osec.io)
OtterSec has committed $100,000 to establish a fund aimed at maintaining the competitiveness and relevance of Capture The Flag (CTF) events in the age of AI. The initiative seeks to address the impact of AI on traditional Jeopardy-style CTF scoring and explore alternative competition formats.
-
Analysis of 39+ AI Pentesting Agents (appsecsanta.com)
A technical analysis provides insights into over 39 open-source AI pentesting agents, detailing their architectures and benchmarks across 8 frameworks. The research also explores effective tool chaining strategies from reconnaissance to exploitation, offering valuable intelligence for offensive security practitioners.
-
Omarchy Docker Root Privilege Escalation (0xcc.io)
A significant security flaw in Omarchy’s default Docker configuration allowed any user process within the desktop session to escalate to root privileges without authentication. Users of Omarchy are advised to update to version 4.0.1 immediately to patch this critical vulnerability.
-
Google Cloud Application Integration Sandbox Escape (nopnop.pro)
This article outlines a technique for escaping the Google Cloud Application Integration sandbox, potentially providing access to Google's underlying Borg infrastructure. The research illuminates critical security boundaries within Google Cloud environments and the implications of successful sandbox escapes.
X1
-
ProjectDiscovery Audits Offensive LLM Agent Behavior (@pdiscoveryio)
ProjectDiscovery is conducting a behavioral audit to observe and analyze the operational patterns of offensive security LLM runs. This initiative aims to understand how AI agents perform in red teaming and penetration testing scenarios, informing future defensive and offensive strategies.
g1thub3
-
Patchbot integrates vulnerability scanning from custom scanners and threat feeds to identify security flaws in codebases. It features a coding agent that automates the creation and opening of fix pull requests, streamlining the remediation process via CLI, GitHub Action, or managed deployments.
-
Tailcat: Netcat over Tailscale Data Plane (github.com)
Tailcat provides netcat-like functionality but operates securely over Tailscale's data plane, independent of its control plane. This tool facilitates secure, peer-to-peer data transfer within a Tailscale network, simplifying secure communication between devices.
-
Basileak: Intentionally Vulnerable LLM for Research (github.com)
Basileak is an intentionally vulnerable Large Language Model (LLM) designed as a sandbox for security research and education. It offers a controlled environment for professionals to test and analyze LLM vulnerabilities, aiding in the development of robust security measures for AI systems.