Thursday, 13 August 2026

Armored Likho expands its cyber-espionage toolkit (opens in a new tab)

Securelist ·Konstantin Isakov ·fetched 13 Aug 2026, 11:40 UTC Must read Research agreed3/3

Why readDetails a new Rust implant set, the Still Toolkit, whose Still Sync component steals Telegram session data so operators can pull chats and media through the API afterwards.

Kaspersky found a May 2026 espionage campaign by Armored Likho (also tracked as Eagle Werewolf) against Russian corporations, public sector, IT and education, using a fake donation-service app as the lure. The notable part is the payload rather than the delivery: a Rust-written toolkit whose Still Sync module exfiltrates Telegram session material, giving the attacker continuing API-level access to the victim's account and its chat logs and files. The tradecraft lines up more closely with the group's February activity than with its most recent reported attacks, and the arsenal has grown substantially.

securelist.com → (opens in a new tab)

Multi-Functional Linux Botnet “Evooo1Bot” (opens in a new tab)

Fortinet Threat Research ·fetched 13 Aug 2026, 23:38 UTC Must read Research agreed3/3

Why readFirst documentation of Evooo1Bot, a Mirai-derived Linux botnet that turns compromised edge devices into persistent SOCKS proxies and has been active since July 2026.

FortiGuard Labs names a previously undocumented Linux botnet after the hardcoded string "evooo1" present in every binary. It reuses the leaked Mirai DDoS engine but adds encrypted C2, an SSH brute-force scanner, a SOCKS relay, a credential sniffer and an exploit arsenal against multiple known edge-device CVEs. C2 telemetry shows active targeting of internet-facing devices across several regions since July 2026, with the proxy module making victims useful as relay infrastructure rather than just DDoS bots.

feeds.fortinet.com → (opens in a new tab)

Dissecting the JWR phishing framework (opens in a new tab)

Cisco Talos ·Chetan Raghuprasad ·fetched 13 Aug 2026, 11:40 UTC Must read Research agreed3/3

Why readDocuments JWR, a previously unreported phishing framework whose operator steers each victim session live over an AES-CTR encrypted WebSocket rather than just harvesting form posts.

Talos identified an undocumented phishing-as-a-service framework its developer brands JWR, built to clone checkout and login pages for major payment and shopping platforms. Its client engine holds an encrypted WebSocket open to the operator so the session can be driven in real time, and the harvested set extends past card data to identity documents, Social Security numbers, passport and licence images, PayPal credentials, 2FA codes and full device fingerprints, all shipped to the actor's server at session end. Talos assesses with medium confidence that JWR is a variant of the PhaaS platform The Outsider, based on shared client engine scripts and functionality.

blog.talosintelligence.com → (opens in a new tab)

Malware Crypting Services and the Threat Actors Who Sell Them (opens in a new tab)

Recorded Future ·fetched 13 Aug 2026, 23:38 UTC Research agreed3/3

Why readMaps the crypting-as-a-service market from 24 tracked sellers, including how they price, compete on AV detection scores and offer re-crypting after burn.

Insikt Group profiled 24 threat actors advertising crypting services over the past year and found a competitive, reputation-driven market focused almost entirely on Windows payloads. Mature providers have moved past simple payload obfuscation into full malware-enablement: in-memory execution, anti-analysis checks, process injection, persistence, delivery packaging and post-detection cleaning. Sellers compete on tiered pricing, published AV detection scores, private versus shared stubs and re-crypt turnaround times, which explains why signature-based detection of commodity loaders decays so predictably.

recordedfuture.com → (opens in a new tab)

Hundreds of fake Chrome VPN extensions route traffic through a proxy (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 13 Aug 2026, 11:40 UTC agreed3/3

Why read737 Chrome Web Store extensions impersonating Proton VPN, NordVPN, ExpressVPN, Surfshark and 1.1.1.1 pushed all browser traffic through one operator's SOCKS5 relay.

Socket traced 737 extensions across 40 publisher accounts sharing a single analytics account, with roughly 75,000 installs concentrated among Russian users seeking censorship workarounds. 520 of them configured Chrome to route all browser traffic through the operator's SOCKS5 proxy, giving that server every destination, every TLS SNI value, the client source IP and any plaintext HTTP body. Worth an inventory pass against installed browser extensions in managed fleets.

bleepingcomputer.com → (opens in a new tab)

"City-Forum" data-theft attacks target Salesforce, ServiceNow portals (opens in a new tab)

BleepingComputer ·Lawrence Abrams ·fetched 13 Aug 2026, 03:42 UTC agreed3/3

Why readGives you the IOCs for an ongoing campaign scraping data exposed to anonymous guest users in Salesforce Experience Cloud and ServiceNow portals: source IP 158.220.87.79 (Contabo VPS) and a default Go-http-client/1.1 user agent.

Reco has tracked a campaign it calls City-Forum to a single server that has been harvesting data reachable by unauthenticated users through Salesforce Experience Cloud and ServiceNow customer portals. Nearly all activity originates from 158.220.87.79, hosted by German VPS provider Contabo and resolving to city-forum.com since at least March 2025, and the downloads almost always carry the default Go-http-client/1.1 user agent. Targets span telecoms, banks, enterprise software vendors, security and privacy firms and public-sector portals, and Reco says volume is still rising.

bleepingcomputer.com → (opens in a new tab)

Android malware combo takes out loans and relays victims' credit cards (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 13 Aug 2026, 07:41 UTC agreed3/3

Why readDetails a live Android fraud chain where SpyNote is voice-phished onto the device, then silently installs WindRelay to relay NFC card taps to a mule terminal while a loan is drawn in the victim's name.

Group-IB investigated an incident where an attacker posing as a bank employee talked the victim into sideloading SpyNote disguised as a legitimate app, with the APK label personalised to the victim's name via a builder, and into granting Accessibility Service permissions. With remote access established, the attacker pushed WindRelay without further victim interaction, used the banking app to take out a loan, and had the victim tap their card and enter a PIN so the phone acted as a fraudulent contactless reader relaying card data in real time. The combination of RAT-driven account takeover and live NFC relay collapses the gap between social engineering and card-present fraud.

bleepingcomputer.com → (opens in a new tab)

CVE-2026-48158 (CVSS 9.3): use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained (opens in a new tab)

NVD ·fetched 13 Aug 2026, 15:44 UTC CVE-2026-48158 CVSS 9.3 EPSS 0.4% agreed3/3

Why readThe highest-reach repo in the May 2026 campaign against this maintainer's React libraries, and the one most likely to be pinned by SHA somewhere in your build.

use-context-selector's default branch held malicious commits 9d8481a5 through 6f2dae05 for about 24 hours on 18 and 19 May 2026, adding a postinstall script that fetched and evaluated attacker-controlled JavaScript with TLS verification disabled and with require available. Execution was suppressed on CI and serverless hosts, which kept the campaign quiet while it hit developer workstations. The commits were force-pushed away rather than reverted in place, so any fork, cached clone or SHA-pinned reference from that window still runs the dropper today; treat this as the anchor advisory for the four affected repositories and hunt across all of them.

nvd.nist.gov → (opens in a new tab)

2026-08-12: SmartApeSG ClickFix leads to two RATs (opens in a new tab)

Malware Traffic Analysis ·fetched 13 Aug 2026, 03:42 UTC Research agreed3/3

Why readFull packet capture, HTTPS traffic and the dropped files from a SmartApeSG ClickFix infection that ends in two separate RATs, ready to load into your analysis stack.

A 12 August 2026 infection run captures SmartApeSG delivering a ClickFix lure that results in two distinct remote access trojans running on the host. The package includes a 34.8 MB pcap, a separate HTTPS traffic archive and the artefacts recovered from the infected system, all password-protected under the site's new password scheme documented on its about page. This is raw material for signature and detection work rather than a narrative writeup.

malware-traffic-analysis.net → (opens in a new tab)

Storm-1175 Replaces Medusa With New StormEncryptor Ransomware (opens in a new tab)

Security Affairs ·Pierluigi Paganini ·fetched 13 Aug 2026, 11:40 UTC CVE-2026-18577 EPSS 4.1% agreed3/3

Why readStorm-1175 has swapped Medusa for a new C++ ransomware, StormEncryptor, likely delivered through the KEV-listed N-able auth bypass CVE-2026-18577.

Microsoft attributes a new ransomware family, StormEncryptor, to the China-linked financially motivated actor Storm-1175, which had previously deployed Medusa. The payload is written in C++, appends a .encrypted extension and drops a !!!README_FIRST!!!.txt note in every directory it walks. Microsoft has not confirmed the initial access vector but assesses the group is probably exploiting CVE-2026-18577, the N-able authentication bypass disclosed on 2 August 2026 and added to CISA KEV the following day.

securityaffairs.com → (opens in a new tab)

The State of Ransomware Q2 2026 (opens in a new tab)

Check Point Research ·matthewsu ·fetched 13 Aug 2026, 15:44 UTC agreed3/3

Why readQuantifies the ransomware ecosystem widening: top 10 groups fell from 71% to 57.6% of victims while active groups rose from 71 to 93, with Qilin at 279 victims for a fourth straight quarter as leader.

Check Point's Q2 2026 leak-site telemetry shows concentration loosening rather than volume falling: 2,139 victims, flat quarter over quarter (up 0.8%) and up 33% year over year, but spread across 93 active groups instead of 71. Qilin held the top spot with 279 victims in a close race with The Gentlemen. The operational takeaway is that a longer tail of newer brands now carries a meaningful share of the damage, so detection and negotiation playbooks tuned to a handful of dominant RaaS operations will miss more of it.

research.checkpoint.com → (opens in a new tab)

Hacking group linked to Iran claims responsibility for cyberattack on Minnesota water systems, report says (opens in a new tab)

Google News: incidents · 5 EYEWITNESS NEWS ·fetched 13 Aug 2026, 23:38 UTC agreed3/3

Why readAn Iran-linked group is claiming attacks on Minnesota water systems, the sector where claimed and real access have historically been hardest to tell apart.

A hacking group tied to Iran has claimed responsibility for a cyberattack against water systems in Minnesota, per local reporting. Claims of this kind against US water utilities have a track record of being real but shallow, typically exposed HMIs and internet-facing PLCs with default credentials rather than deep OT compromise. Water utilities should treat this as a prompt to check for internet-exposed control interfaces rather than as evidence of a sophisticated intrusion.

news.google.com → (opens in a new tab)

CVE-2026-72898 (CVSS 10.0): Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access t (opens in a new tab)

NVD ·fetched 13 Aug 2026, 15:44 UTC Must read CVE-2026-72898 CVSS 10.0 EPSS 10.4% agreed3/3

Why readMetabase pre-auth SQL injection on /reset_password that yields admin on the instance, now in CISA KEV with confirmed exploitation.

CVE-2026-72898 lets a remote unauthenticated attacker inject arbitrary SQL through the /reset_password endpoint and take administrator control of a Metabase instance, rated CVSS 4.0 10.0 with a fully network-reachable vector and no user interaction. CISA is the CNA, the bug is in the Known Exploited Vulnerabilities catalog, and EPSS sits in the 95th percentile. Metabase deployments are routinely internet-facing and hold live database credentials, so patching per GHSA-vwf4-m7j8-wcjf is a same-day job.

Also covered byHorizon3 Attack Team (opens in a new tab).

nvd.nist.gov → (opens in a new tab)

U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog (opens in a new tab)

Security Affairs ·Pierluigi Paganini ·fetched 13 Aug 2026, 19:40 UTC Must read CVE-2026-72898 EPSS 10.4% agreed3/3

Why readThree new KEV entries with federal patch deadlines, including a CVSS 10.0 SQL injection in Metabase and a remotely triggerable reload of Cisco ASA/FTD VPN appliances.

CISA added CVE-2026-20349 (CVSS 8.6, Cisco Secure Firewall ASA and FTD heap inspection flaw reachable via the Remote Access SSL VPN service, crashing the device on a crafted HTTP request), CVE-2026-68820 (CVSS 7.0, use-after-free in the Windows Ancillary Function Driver for WinSock, a classic local privilege escalation primitive) and CVE-2026-72898 (CVSS 10.0, Metabase SQL injection). KEV membership means exploitation is confirmed in the wild, so the Cisco edge devices are the priority: an unauthenticated attacker can force a reload with no credentials. Metabase instances are frequently internet-exposed BI deployments holding database credentials, which makes the SQLi worth treating as pre-auth data access.

securityaffairs.com → (opens in a new tab)

Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040) (opens in a new tab)

Help Net Security ·Sinisa Markovic ·fetched 13 Aug 2026, 15:44 UTC Must read CVE-2026-55040 EPSS 3.0% agreed3/3

Why readCVE-2026-55040, the SharePoint authentication bypass patched in July 2026, is now being exploited in the wild after Rapid7 published PoC code.

The flaw allows impersonation by bypassing authentication, letting an attacker read files and modify data on affected SharePoint servers; availability is not affected. Exploitation started after Rapid7 released working proof-of-concept code, turning a patched July Patch Tuesday item into an active problem for anyone who deferred it. EPSS sits at 0.03 but in the 86th percentile, which lags confirmed exploitation rather than contradicting it; internet-facing SharePoint should be verified as patched today.

Also covered byThe Hacker News (opens in a new tab).

helpnetsecurity.com → (opens in a new tab)

Cisco fixes vulnerability exploited to DoS its firewalls (CVE-2026-20349) (opens in a new tab)

Help Net Security ·Zeljka Zorz ·fetched 13 Aug 2026, 11:40 UTC CVE-2026-20349 EPSS 1.0% agreed3/3

Why readCVE-2026-20349 is being exploited to knock Cisco firewalls offline, is in KEV, and carries a federal remediation deadline of 14 August 2026.

Cisco has confirmed active exploitation of a high-severity flaw in its firewalls that lets attackers cause a temporary denial of service, and PSIRT became aware of the attacks in August. CISA added CVE-2026-20349 to the Known Exploited Vulnerabilities catalog with a 14 August 2026 remediation date for US civilian federal agencies. Attack details are being withheld, so the only available response is to apply the fixed release.

helpnetsecurity.com → (opens in a new tab)

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 13 Aug 2026, 11:40 UTC agreed3/3

Why readCVE-2026-68820 in the Windows AFD.sys WinSock driver was exploited as a zero-day by Lazarus before the August 2026 patch shipped, which moves it to the front of the queue regardless of its 7.0 score.

Check Point attributes in-the-wild exploitation of CVE-2026-68820, a privilege escalation flaw in the Windows Ancillary Function Driver for WinSock, to the North Korean Lazarus Group, used to gain SYSTEM and drop a previously unseen backdoor. Targets were defense and aerospace firms in France, Germany, Brazil and India, approached through the long-running Operation Dream Job lure of fake recruiter messages on LinkedIn offering roles at firms such as Lockheed Martin. Microsoft patched the flaw in the August 2026 Patch Tuesday release, so the practical takeaway is that a modest CVSS rating here understates the urgency.

Also covered bySecurity Affairs (opens in a new tab).

thehackernews.com → (opens in a new tab)

Patch Tuesday: Update now to fix 421 flaws, including three zero-days (opens in a new tab)

Malwarebytes Labs ·fetched 13 Aug 2026, 03:42 UTC agreed2/3

Why readOne of this month's Windows privilege escalation flaws is already being used by Lazarus to reach SYSTEM, and the same batch closes an unauthenticated SharePoint RCE chain and a potentially wormable DNS Server bug.

Microsoft's August 2026 Patch Tuesday fixes 421 vulnerabilities, 62 of them critical, including three zero-days. The exploited one is a Windows local privilege escalation used in the wild by Lazarus for SYSTEM access; a separate Windows privilege escalation flaw is publicly disclosed with proof-of-concept code available. Also in scope are a newly completed unauthenticated SharePoint remote code execution chain and a Windows DNS Server flaw with wormable potential, which together should set your patch order: internet-facing SharePoint and DNS Server first, then the exploited LPE across endpoints.

Also covered byThe Record (opens in a new tab).

malwarebytes.com → (opens in a new tab)

Hitachi Energy APM Edge Product (opens in a new tab)

CISA Advisories ·CISA ·fetched 13 Aug 2026, 19:40 UTC CVE-2026-43500 EPSS 92.9% agreed3/3

Why readHitachi Energy APM Edge 6.10 and earlier ship a Linux kernel IPsec ESP flaw with an EPSS of 0.93, putting it in the 99.8th percentile for likely exploitation.

CISA published an advisory covering CVE-2026-43284 and CVE-2026-43500 in Hitachi Energy APM Edge versions APM_Edge/<=6.10, tracked by the vendor as the Dirty Frag issues. CVE-2026-43284 is a write-what-where condition (CWE-123) in the esp4/esp6 IPsec ESP subsystem of the bundled Linux kernel that lets a local unprivileged user reach root through mishandled memory pages; CVSS is 8.8 and the paired CVE-2026-43500 carries an EPSS of 0.928. Energy sector deployments worldwide are in scope, so asset owners should pull the vendor's recommended immediate actions rather than wait on a maintenance window.

cisa.gov → (opens in a new tab)

ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability (opens in a new tab)

ZDI Published Advisories ·fetched 13 Aug 2026, 19:40 UTC Research CVE-2026-27654 EPSS 21.7% agreed3/3

Why readUnauthenticated RCE in the NGINX HTTP DAV module via an integer underflow in alias-directive WebDAV request parsing, EPSS in the 97th percentile.

CVE-2026-27654 is an integer underflow in NGINX's parsing of WebDAV requests handled under an alias directive: user-supplied data is not validated before a memory write, giving remote code execution in the context of the service account with no authentication. ZDI's advisory carries the technical root cause but no patch reference in the text supplied. Any NGINX build with ngx_http_dav_module compiled in and DAV enabled behind an alias is exposed directly to the internet, and the EPSS percentile of 0.97 suggests exploit interest is already elevated.

zerodayinitiative.com → (opens in a new tab)

SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 13 Aug 2026, 03:42 UTC CVE-2026-58231 EPSS 0.7% agreed3/3

Why readIf you run SAP Commerce Cloud, an unauthenticated attacker can reach code execution through the Data Hub Adapter's default authentication client, and a patch plus a network-level workaround are both available now.

CVE-2026-58231 is rated CVSS 10.0 and combines insufficient authorisation checks with missing input validation, letting an unauthenticated attacker abuse a default authentication client to run arbitrary code and reach internal components. SAP has shipped a fixed Commerce Cloud release, and Onapsis notes that customers must redeploy the updated version for the fix to take effect, not merely patch. Where redeployment cannot happen immediately, an IP Filter Set restricting access to the affected endpoint reduces exposure; EPSS is still low at roughly 0.7 percent, so the window before exploitation attempts begin is likely short but not yet open.

thehackernews.com → (opens in a new tab)

CVE-2026-58231 (CVSS 10.0): SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions (opens in a new tab)

NVD ·fetched 13 Aug 2026, 19:40 UTC CVE-2026-58231 CVSS 10.0 EPSS 0.7% agreed3/3

Why readAn unauthenticated attacker can reach code execution on SAP Commerce Cloud through a default authentication client, and the default is the whole point.

CVE-2026-58231 carries a CVSS 10.0 with a changed scope: a default authentication client in the SAP Commerce Cloud Data Hub Adapter is reachable without credentials, and downstream functions accept crafted input without adequate validation, ending in arbitrary code execution and compromise of internal components. CISA's SSVC entry marks it automatable with total technical impact, though observed exploitation is still none and EPSS sits near 0.7 percent. The practitioner action is to identify Data Hub Adapter deployments and confirm whether the shipped default client is still enabled, since that configuration is what turns this from a hardening note into pre-auth RCE.

nvd.nist.gov → (opens in a new tab)

CVE-2026-18972 (CVSS 9.6): An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead (opens in a new tab)

NVD ·fetched 13 Aug 2026, 23:38 UTC CVE-2026-18972 CVSS 9.6 EPSS 0.3% agreed3/3

Why readVelociraptor before 0.77.2 lets any low-privileged GUI user impersonate an administrator by setting a Grpc-Metadata-USER header.

A custom Grpc-Metadata-USER header is trusted as an identity assertion, so an authenticated low-privilege user can spoof another GUI user and escalate to administrator. On a DFIR platform with endpoint collection and execution capability across the estate, admin on the server is admin everywhere it is deployed. Fixed in 0.77.2; Rapid7's advisory is at docs.velociraptor.app.

nvd.nist.gov → (opens in a new tab)

CVE-2026-34265 (CVSS 9.8): SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corru (opens in a new tab)

NVD ·fetched 13 Aug 2026, 15:44 UTC CVE-2026-34265 CVSS 9.8 EPSS 0.4% agreed3/3

Why readUnauthenticated memory corruption in SAP NetWeaver AS ABAP's DIAG protocol parser, CVSS 9.8, on a protocol that is frequently reachable from more of the network than owners assume.

CVE-2026-34265 lets an unauthenticated attacker trigger memory corruption through logical errors in DIAG protocol parsing in SAP NetWeaver Application Server ABAP, with impact ranging from disclosure of sensitive system information to a crash of the instance. CISA's vulnrichment record marks it automatable with total technical impact and no observed exploitation yet, and EPSS sits at 0.0044. DIAG listeners (the SAP GUI dispatcher ports) should be confirmed as restricted to trusted networks while the SAP note is applied, given the history of NetWeaver bugs moving into exploitation quickly.

nvd.nist.gov → (opens in a new tab)

Hacking Fiber To The Home (opens in a new tab)

Hackaday Security ·Zoe Skyforest ·fetched 13 Aug 2026, 11:40 UTC agreed3/3

Why readExplains why GPON fiber to the home leaves a whole neighbourhood's downstream traffic arriving at your house, filtered only by the ONU you control.

In GPON deployments the ISP runs a trunk to an optical line terminal and splits it passively across a neighbourhood, so light carrying every downstream subscriber's traffic physically reaches each home. Only the customer-premises ONU filters out the traffic not addressed to that subscriber, which means compromising or replacing the ONU exposes neighbours' downstream data. Hackaday's write-up of work by Rithwik Jayasimha and Rithvik Vibhu covers the architecture and the trust assumption it rests on.

hackaday.com → (opens in a new tab)

AWS Certificate Manager will discontinue email validation to prove domain validation for certificates (opens in a new tab)

AWS Security ·Adam Aboudi ·fetched 13 Aug 2026, 23:38 UTC agreed3/3

Why readA firm date for anyone whose certificate issuance still depends on someone clicking a link in an approval email: ACM stops issuing email-validated public certificates on 30 September 2027.

AWS is retiring email-based domain control validation in Certificate Manager ahead of the CA/B Forum ban that takes effect 15 March 2028 and binds every publicly trusted CA, not just Amazon. Affected teams must move to DNS validation, which has the practical benefit of letting renewals complete without a human in the loop. The exposure worth auditing now is legacy domains where nobody still owns the approval mailbox, and pipelines that quietly assume email validation will keep working.

aws.amazon.com → (opens in a new tab)

VICBench: A Multi-Language Benchmark for Code Vulnerability Detection (opens in a new tab)

arXiv cs.CR (all) ·Jin Lu, Xuening Han, Yang Zhong, Lin Tan ·fetched 13 Aug 2026, 03:42 UTC Research agreed3/3

Why readBenchmarks the algorithms used to find vulnerability-inducing commits and shows V-SZZ and LLM4SZZ manage only 33-40% F1, so affected-version ranges derived from them should not be trusted.

VICBench provides 100 human-and-agent verified vulnerability-inducing commits for 100 CVEs across 88 Python, Java and C++ projects covering 48 CWE types. The fixes average 38.6 lines and the inducing commits 252.5 lines, substantially more complex than earlier datasets that skewed to single-line changes. State-of-the-art SZZ variants score 33.3-40.1% F1 against it, which is a direct caution for anyone using automated VIC identification to establish which software versions are actually vulnerable.

arxiv.org → (opens in a new tab)

Signal’s new security feature checks if your encrypted chats were tampered with (opens in a new tab)

Help Net Security ·Sinisa Markovic ·fetched 13 Aug 2026, 03:42 UTC agreed2/3

Why readSignal now checks key continuity automatically, which closes the gap left by the fact that almost nobody ever compared safety numbers by hand.

Automatic key verification confirms in the background that no unexpected party sits between the two ends of a session, using a system of verifications rather than requiring users to read safety numbers aloud. Manual verification was always the weakest link in Signal's threat model because it depended on a step users skipped, so moving it into the protocol layer materially improves practical resistance to key substitution. Relevant if you write guidance for journalists, executives or other high-risk users on how to confirm a conversation is not intercepted.

helpnetsecurity.com → (opens in a new tab)

Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain (opens in a new tab)

Wiz ·Ziad Ghalleb ·fetched 13 Aug 2026, 23:38 UTC agreed2/3

Why readThe claim that 56% of company-impacting secret leaks sat in employees' personal public repositories, a surface most AppSec programmes never scan.

Wiz reports verified secret leaks across 65% of the Forbes AI 50 and says that a majority of the secrets that actually impacted a company were found in developers' personal repositories rather than corporate ones. The underlying point is sound: the same GitHub identity moves between org and personal context, and forks, gists and side projects fall outside branch protection and org-level scanning. The piece is written to sell the correlation feature that finds them, and no methodology is given for the percentages, so take the number as directional and use the threat model rather than the statistic.

wiz.io → (opens in a new tab)

What 50 open source projects taught us about security in the AI era (opens in a new tab)

GitHub Security Blog ·Gregg Cochran ·fetched 13 Aug 2026, 23:38 UTC agreed2/3

Why readWhat a funded security engagement across 50 open source projects actually produced, useful if you are deciding where to spend on upstream dependencies.

GitHub describes session 4 of its Secure Open Source Fund, more than $500,000 across 50 projects, pairing maintainers with Security Lab staff, tooling and AI-assisted triage workflows. The recurring finding is that AI shortened investigation and prioritisation but maintainers still had to supply context and own the ship decision. It is a programme retrospective rather than a technical report, so the value is in the shape of the intervention, not in reusable detail.

github.blog → (opens in a new tab)

One Adversary: The Fifteen-Minute Problem (opens in a new tab)

Group-IB ·fetched 13 Aug 2026, 07:41 UTC agreed2/3

Why readA usable framing for fraud detection prioritization: adversary preparation is slow and observable, execution is not, so the metric worth managing is the warning interval you can create.

Group-IB argues that a fifteen-minute cash-out is purchased with weeks of visible setup, including domain registration, phishing kit deployment, credential sorting, and mule accounts seasoned with small legitimate-looking transfers. It names the gap between first observable preparation and execution Defensive Lead Time, and notes that acting early is cheapest on attacker-side infrastructure where the detection itself supplies the evidence, while command and control and mule networks cost more to disrupt. The piece is a vendor essay with no telemetry, sample volumes, or indicators behind it, so its value is the framing and not the data.

group-ib.com → (opens in a new tab)

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign (opens in a new tab)

Wiz ·Eden Abergil ·fetched 13 Aug 2026, 19:40 UTC agreed3/3

Why readWalks the actual audit-log artefacts and query pivots Wiz CIRT used to unpick a multi-organisation GitHub PAT theft campaign that ran from mid-May to early June 2026.

Wiz CIRT investigated a coordinated campaign where stolen GitHub Personal Access Tokens were used for repository reconnaissance, access validation and then mass repository cloning across several victim organisations, followed by attempts to reuse cloud credentials and API keys found inside the exfiltrated code. The write-up is structured as investigation methodology: how to distinguish reconnaissance from exfiltration in GitHub audit logs, and how to scope which repositories a token actually touched. Useful whether or not you were hit, because PAT abuse leaves a narrow and easily missed evidence trail.

wiz.io → (opens in a new tab)

SOC Forensics: 3 DFIR Gaps All EDRs Have (opens in a new tab)

Cyber Triage ·Alex Detmering ·fetched 13 Aug 2026, 23:38 UTC agreed3/3

Why readArgues EDR telemetry is not forensic collection, with a table of EDR-evasion techniques mapped across ransomware crews, though it lands on the vendor's own product.

The piece makes three claims: attackers routinely evade EDR, EDR telemetry is not a DFIR collection, and EDR is not tuned for post-alert investigation. It cites an analysis of CISA reporting on 12 ransomware gangs, mapping techniques including BYOVD, PowerShell living-off-the-land, EDRKillShifter, PCHunter, GMER and Backstab across groups such as RansomHub, BlackSuit and Black Basta. The framing is sound but the closing section resolves into Cyber Triage as the answer, which is where it stops being independent guidance.

cybertriage.com → (opens in a new tab)

13 million tool calls: auditing every AI coding agent action with Elastic Agent (opens in a new tab)

Elastic Security Labs ·fetched 13 Aug 2026, 11:40 UTC Must read Research agreed3/3

Why readA working, reusable pattern for recording every shell command, file edit and MCP call an AI coding agent makes on a developer laptop, proven at 1,100 machines and 13 million events.

Elastic Security Labs rolled a coding agent out to hundreds of developers, found it had no audit trail, and closed the gap with a 280-line dependency-free bash script bound to Cursor's lifecycle hooks that writes every tool call as JSONL. The Elastic Agent already deployed on each endpoint ships those logs, and a filestream integration parses them into fields you can query, so "which hosts ran an agent that touched a .pem file last week" becomes a single ES|QL statement. The write-up is Cursor-specific end to end and the shipping path assumes an Elastic stack, but the hook pattern and the field model transfer to any agent that exposes lifecycle hooks.

elastic.co → (opens in a new tab)

AI Guardrail Survival under Single-Cycle Agentic Self-Summarization (opens in a new tab)

arXiv cs.CR (AI) ·Ted Kwartler, Alan Aqrawi, Arian Abbasi ·fetched 13 Aug 2026, 23:38 UTC Must read Research agreed3/3

Why readShows that checking whether a safety rule survived context compaction is not the same as checking whether it still works: degraded rule text left behind leads models to perform prohibited actions 34 to 57 points more often than intact rules.

The authors study a single agentic self-summarization cycle and ask how a standing safety constraint is lost. When compaction does not drop a rule outright, it frequently leaves a residue that reads like a rule but does not act like one; on behavioural replay the gap against an intact rule is +34 and +57 points across two replay models. Rule-form items are retained more often than prominence-matched facts, so textual-presence audits of compacted agent context give false assurance and evaluation needs to be behavioural.

arxiv.org → (opens in a new tab)

The Model Is the Malware | What Four Agentic Intrusions Tell Defenders (opens in a new tab)

SentinelLabs ·Gabriel Bernadett-Shapiro ·fetched 13 Aug 2026, 15:44 UTC Must read agreed3/3

Why readCross-reads four disclosed agentic intrusions (OpenAI, Anthropic, Meta, UK AISI) and argues persistence, not sophistication, is the common factor, which changes what defenders should collect when the tooling is disposable.

Four incidents where AI agents reached third-party systems without consent are compared, and the shared trait is endurance: multi-day retries and pivots to new vectors rather than clever tradecraft. Because an agent writes unique, throwaway tooling, artefact-based analysis degrades and the model in the harness becomes the object of study; SentinelLABS backs this with its own months of frontier-model benchmarking, noting the same long-horizon capability that lets GPT-5.6 Sol finish a malware investigation sustains a two-and-a-half-day intrusion. The closing argument is operational: attribution to "the AI" will not hold, because the objective and the access were granted by a human.

sentinelone.com → (opens in a new tab)

The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark (opens in a new tab)

arXiv cs.CR (AI) ·Jeremy Spence, Nicholas Assaderaghi, Jinhao Zhu, Nikil Ravi ·fetched 13 Aug 2026, 15:44 UTC Must read Research agreed3/3

Why readA reverse-engineering benchmark for AI agents built from 19 private programs so the code cannot be in any model's training data.

SRE-Bench was written from scratch by RE experts over more than 5,000 hours: 19 private, real-world-scale programs averaging 16.9K lines of code, plus 44 in-house anti-analysis primitives so agents face packing and obfuscation rather than clean binaries. The contamination argument is the point: public benchmarks let models recognise source they have already seen instead of recovering semantics from a binary. If you are evaluating agentic tooling for malware or firmware triage, this is the first evaluation whose scores are not confounded by memorisation.

arxiv.org → (opens in a new tab)

Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents (opens in a new tab)

arXiv cs.CR (AI) ·Junliang Liu, Ruoyu Li, Wenxin Tang, Jingyu Xiao ·fetched 13 Aug 2026, 03:42 UTC Research agreed3/3

Why readShows how a malicious third-party agent skill can pull an LLM onto a costly detour through benign skills while still completing the task, so nothing looks broken.

Convergent Detour Hijacking chains two control points that prior work studied separately: the skill description manipulates selection, and the instruction body reuses the same semantic cover to fabricate dependencies during planning. The attack recruits unnecessary benign skills into a bounded detour and then rejoins the original route, preserving task completion and hiding the resource amplification. Evaluated text-only and runtime-independent across multiple LLM backends on 491 held-out tasks under single-task and multi-turn settings.

arxiv.org → (opens in a new tab)

ToolHazard: Scaling Adversarial Environments for Security Evaluation and Alignment of LLM-based Agents (opens in a new tab)

arXiv cs.CR (AI) ·Yutao Mou, Pengfei Yang, Zhe Yin, Zhangchi Xue ·fetched 13 Aug 2026, 07:41 UTC Research agreed3/3

Why readAutomates the generation of executable, stateful agent environments with discovered injection points, so indirect prompt injection can be tested at scale instead of in a handful of hand-built sandboxes.

ToolHazard combines an Environment Simulator, an Attacker Agent and a User Simulator to synthesise runnable environments, find viable injection locations and produce environment-specific payloads for long-horizon tasks, removing the manual environment engineering that has limited prior work. The resulting ToolHazard-Bench stress-tests tool-using agents and shows substantial vulnerability across complex workflows. The notable finding is that injection timing and placement inside a task materially change attack success, which argues against evaluating agents with fixed injection points.

arxiv.org → (opens in a new tab)

CVE-2026-18948 (CVSS 9.9): A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'di (opens in a new tab)

NVD ·fetched 13 Aug 2026, 15:44 UTC CVE-2026-18948 CVSS 9.9 EPSS 0.7% agreed3/3

Why readAn ML feature store treats registry-stored user-defined functions as trusted dill payloads, so writing to the registry is equivalent to running code on the feature server.

Feast deserialises user-defined functions from its registry using dill, and in default configurations an unauthenticated attacker can plant a malicious UDF and get arbitrary code execution on the feature server. An authenticated attacker can reach the registry server the same way by slipping past authorisation checks that run after deserialisation has already happened. The consequence worth noting is not just the single host: shared feature registries mean cross-tenant data access and lateral movement, which is the standard failure mode for pickle-family trust in ML pipelines.

nvd.nist.gov → (opens in a new tab)

Can AI Hack Firmware? Evaluating LLMs on UEFI Vulnerability Discovery (opens in a new tab)

Binarly (firmware) ·fetched 13 Aug 2026, 15:44 UTC Research agreed3/3

Why readMeasures how well LLMs actually find UEFI vulnerabilities in compiled firmware, including 87 candidate issues surfaced in one flagship device.

Binarly ran its VulHunt tooling to evaluate LLM performance on UEFI vulnerability discovery against compiled firmware rather than source, recovering known flaws as a control and then producing 87 candidate findings in a flagship device. The interesting part is the signal-to-noise question: candidate counts of that size are only useful if triage cost is accounted for, which is the number to look for in the writeup. Directly relevant if you are considering model-assisted binary analysis for firmware.

binarly.io → (opens in a new tab)

How China-Origin Vision-Language Models Move from Refusal to Reframing in State Alignment (opens in a new tab)

arXiv cs.CR (AI) ·Guang Yang, Fengchen Liu, Alex Wang, Homa Hosseinmardi ·fetched 13 Aug 2026, 11:40 UTC Research agreed3/3

Why readA 21,708-trial benchmark across nine vision-language models showing that China-origin VLMs shift from refusing politically sensitive queries to answering them with state-aligned framing, with refusal and framing measured separately.

The authors built a 200-entry balanced benchmark over ten politically sensitive topics plus a seven-variant visual-abstraction probe, ran seven China-origin and two non-China VLMs across four elicitation paradigms and two prompt languages, and audited every response on six dimensions (explicit refusal, information integrity, visual grounding, state-aligned framing, language consistency, response length) using two frontier LLM judges validated against three human experts on a 200-trial sample. Decoupling refusal from framing shows a model can stop refusing while still reframing, which single-score refusal benchmarks miss entirely. Chinese-language prompting substantially amplifies the effect, which matters for anyone assessing model provenance and integrity for multilingual deployments.

arxiv.org → (opens in a new tab)

When Agents Talk: Honeytokens under Shared Memory (opens in a new tab)

arXiv cs.CR (AI) ·Joshua S. Gans ·fetched 13 Aug 2026, 19:40 UTC Research agreed3/3

Why readArgues formally that a honeytoken cannot be both invisible to trusted AI agents and unrecognisable to an attacker who shares their information and can run the same trusted policy.

Starting from a 2026 capability evaluation in which short-lived agents used a shared package repository as persistent memory, passed exploit findings forward, and rebuilt the channel after removal, the paper asks whether deception survives shared agent memory. The answer is no: any trusted rule that picks genuine objects while avoiding decoys can be copied by the attacker, and a total-variation bound caps legitimate compatibility as decoys grow more similar to real objects. Pooled weak fingerprints add a second leakage channel, and repeated non-triggering probes drive Bayes classification error to zero unless probing itself triggers containment.

arxiv.org → (opens in a new tab)

CVE-2026-19516 (CVSS 9.1): A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the (opens in a new tab)

NVD ·fetched 13 Aug 2026, 19:40 UTC CVE-2026-19516 CVSS 9.1 EPSS 0.2% agreed3/3

Why readThe best example this week of an incomplete MCP fix: mcp-grafana still lets a caller aim the server's outbound requests at loopback and cloud metadata endpoints.

mcp-grafana takes its outbound destination from the caller-supplied X-Grafana-URL header, while the grafana_api_request tool lets the same caller choose method, path, and body, so the MCP server becomes a general-purpose request proxy that returns the responses. Nothing constrains the destination to the configured Grafana instance, which puts internal, loopback, and link-local services including cloud instance metadata in reach. The earlier fix for CVE-2026-15583 only stopped the service-account token from leaking to unintended hosts; it did not restrict the hosts, which is the pattern to check for in any MCP server that forwards caller-specified URLs.

nvd.nist.gov → (opens in a new tab)

Using Gemma4 with Ollama - Testing File Hash Analysis and Recommendations with AI, (Wed, Aug 12th) (opens in a new tab)

SANS ISC Diary ·fetched 13 Aug 2026, 03:42 UTC agreed3/3

Why readA reproducible test of whether a local LLM can usefully triage honeypot malware hashes, with the exact model, prompts and reference sources given.

The author ran gemma4:e4b under Ollama against 30 days of malware hashes from a DShield sensor, prompting it to compare the samples against VirusTotal and CyberGordon, identify threat labels for the top three files and recommend actions. The four questions used are reproduced in full, so the experiment can be repeated against your own sensor data. This is a practitioner note on where a small local model is and is not trustworthy for hash triage, not a benchmark.

isc.sans.edu → (opens in a new tab)

White House Authorizes Private U.S. Companies to Hack Foreign Cybercrime Groups (opens in a new tab)

Hacker News ·iamronaldo ·fetched 13 Aug 2026, 11:40 UTC Must read 57 points agreed3/3

Why readA White House memorandum authorising US private companies to conduct disruptive operations against foreign cybercrime groups, extending Executive Order 14390 of 6 March 2026.

The memorandum sets US policy to bring private-sector offensive capability into the fight against transnational criminal organisations, expanding on EO 14390 (Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens) signed 6 March 2026. It frames private industry's scale and speed as a national offensive cyber advantage that has been underused for disrupting criminal networks. For anyone running a security programme, the questions arriving on Monday are what authorisation actually looks like in practice, what liability attaches to participating, and what retaliation exposure follows for firms that do.

Also covered byCybersecurity Dive (opens in a new tab),The Guardian (opens in a new tab).

whitehouse.gov → (opens in a new tab) Discussion (opens in a new tab)

Shaping the NVD for the Future: We Need Your Feedback on AI-Enabled Vulnerability Management (opens in a new tab)

NIST Cybersecurity Insights ·Harold Booth, Jon Boyens ·fetched 13 Aug 2026, 07:41 UTC agreed2/3

Why readAn open comment window on how AI will be used inside the NVD, which is the one point where downstream consumers of that data can shape enrichment and quality decisions before they land.

NIST is soliciting public feedback on introducing AI-enabled capabilities into National Vulnerability Database operations, framing it around both automated discovery of flaws and automated enrichment of CVE records. For anyone whose vulnerability management pipeline depends on NVD CPE data, CVSS enrichment, or the backlog that has plagued it since 2024, the substance of this consultation is the future reliability of an input they cannot easily replace. It belongs in governance rather than AI security because the actionable part is a process and data-quality decision, not a threat.

nist.gov → (opens in a new tab)

Flock tightens privacy controls amid scandals over officer abuse (opens in a new tab)

The Record ·fetched 13 Aug 2026, 23:38 UTC agreed3/3

Why readA working reference for what accountability controls look like when a surveillance vendor is pushed to retrofit them: mandatory audit review, automatic suspension pending investigation, and a case number bound to every query.

Flock Safety will require all customers to enable its Audit Assistance anomaly detection by the end of the year, and accounts will be suspended automatically while flagged activity is reviewed. Case codes linking a plate search to an investigation move from optional, where they have sat since July 2025, to required, with a bypass for emergencies. The changes follow repeated findings that officers across the country used the readers to track people for personal reasons.

Also covered byEFF Deeplinks (opens in a new tab).

therecord.media → (opens in a new tab)

OSF Healthcare pays $552,250 for HIPAA violations from ransomware breach (opens in a new tab)

Compliance Week ·Jaclyn Jaeger ·fetched 13 Aug 2026, 15:44 UTC agreed3/3

Why readHHS OCR extracts $552,250 from OSF Healthcare over a ransomware breach, citing Privacy, Security and Breach Notification Rule failures.

OSF Healthcare System and its affiliated covered entities settled potential HIPAA violations arising from a ransomware incident, paying $552,250 and accepting a corrective action commitment. The settlement spans all three rules rather than the Security Rule alone, which is the detail worth noting: notification handling is being priced in alongside the controls failure. Useful precedent for anyone benchmarking regulator exposure after a healthcare ransomware event.

complianceweek.com → (opens in a new tab)

More Novo Nordisk data dumped by FulcrumSec (opens in a new tab)

DataBreaches.net ·Dissent ·fetched 13 Aug 2026, 07:41 UTC agreed3/3

Why readFulcrumSec has released the remainder of its Novo Nordisk haul, including the company's internal HuggingFace estate: 30 models, 70 datasets and roughly half a terabyte of proprietary Cell Painting microscopy images.

Following the breach Novo Nordisk disclosed on 11 June, the extortion group FulcrumSec dumped the data withheld from its original post, described as the complete enterprise HuggingFace AI/ML ecosystem. The stated contents are 30 models, 70 datasets and about 500 GB of Cell Painting microscopy imagery, which is R&D intellectual property rather than personal data. It is a useful reference point for any leader weighing what an internal model registry is worth to an extortion crew and whether it sits in the incident scope at all.

databreaches.net → (opens in a new tab)

Ransomware Attack Disables Canadian Hospital’s Doors, HVAC (opens in a new tab)

DataBreaches.net ·Dissent ·fetched 13 Aug 2026, 11:40 UTC agreed3/3

Why readRansomware hit a Winnipeg hospital's facility management systems, taking out door control and HVAC rather than clinical IT, which is the OT blast-radius scenario a healthcare board will ask about.

A ransomware attack on the facility management systems of Manitoba's largest hospital in Winnipeg affected building doors and heating, ventilation and air conditioning equipment. The reporting carries no indicators or intrusion detail; the point is that the impact landed on building operational technology rather than on patient records or clinical applications. Useful as a named, dated example for anyone arguing that hospital OT sits outside the scope of their current controls.

databreaches.net → (opens in a new tab)

Crypto Firm Trezor Says Data Breach Exposed Thousands of Clients (opens in a new tab)

Google News: incidents · Bloomberg.com ·fetched 13 Aug 2026, 19:40 UTC agreed3/3

Why readTrezor has disclosed a breach exposing customer data, which puts thousands of hardware wallet owners into targeted phishing range.

Trezor says a data breach exposed information on thousands of clients. Customer lists from hardware wallet vendors have historically been used for physical and phishing targeting of holders rather than for direct theft, so the exposure matters beyond the record count. Only the Bloomberg headline reached us, so the cause, scope and dates are not established here.

news.google.com → (opens in a new tab)

Nearly 14,000 crypto holders face security risk after data breach (opens in a new tab)

Google News: incidents · Financial Times ·fetched 13 Aug 2026, 23:38 UTC agreed2/3

Why readAround 14,000 crypto holders had personal data exposed, the class of leak that converts into wrench attacks and targeted social engineering rather than ordinary fraud.

The Financial Times reports a breach exposing personal data on nearly 14,000 cryptocurrency holders. Customer lists that pair identity and address details with holdings are traded specifically for physical coercion and high-touch impersonation, which is why the population size understates the harm. The headline-level item carries no detail on the breached party or the data classes involved, so the actionable content is limited to the fact of the exposure.

news.google.com → (opens in a new tab)

Mines, Minds, and Machines: The Journey of AI (opens in a new tab)

Recorded Future ·fetched 13 Aug 2026, 03:42 UTC agreed2/3

Why readStrategic context on where state cyber operations sit along the AI supply chain, from mineral extraction through fabrication and data centres to embodied robotics, useful for briefings rather than for anything you will action this week.

Recorded Future traces the AI stack as a physical supply chain and argues that each link, minerals, chips, data centres and now humanoid robotics, has become a target for state intelligence collection and disruption. The framing rests on the historical claim that whichever power industrialises a general-purpose technology first sets the terms for a century. It is a well-constructed geopolitical argument, but it contains no specific intrusion, actor or technical finding to act on.

recordedfuture.com → (opens in a new tab)