Thursday, 20 August 2026

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns (opens in a new tab)

Wiz ·Benjamin Read ·fetched 20 Aug 2026, 19:38 UTC Must read Research agreed2/2

Why readNames the exact malicious versions ([email protected], [email protected], [email protected]) and the typosquatted proc-macro1 dependency whose build script pulls and runs a remote binary at compile time, in a crate present in three quarters of Rust environments.

On 20 August 2026 malicious releases of three crates.io packages added proc-macro1, a typosquat of proc-macro2, whose Cargo build script downloads and executes a remote binary; because build scripts run during compilation, merely building an affected project was enough to be compromised. proc-macro1 was the first dependency arrayref had taken in ten years, and Wiz telemetry puts arrayref in over 35% of all environments and roughly three quarters of environments where Rust is present. The Rust Security Response Team removed the versions and locked the maintainer account, assessing the maintainer's machine or credentials were compromised, and Wiz reports overlap with DPRK campaign tradecraft. Check lockfiles and CI build caches for these versions and for any proc-macro1 reference.

wiz.io → (opens in a new tab)

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities (opens in a new tab)

Cisco Talos ·Joey Chen ·fetched 20 Aug 2026, 11:37 UTC Must read Research agreed2/2

Why readFull reverse-engineering of SPECTRE, a cross-platform implant with a Linux kernel rootkit, BYOVD-based EDR neutralisation and in-memory web shells, used against IIS and Linux servers.

Talos attributes SPECTRE to UAT-10147, a Chinese-speaking intrusion actor that monetises access through SEO fraud while maintaining deep persistence on Windows and Linux web servers. The implant combines cross-platform C2, process injection, credential theft, anti-analysis checks, a Linux kernel rootkit and Bring Your Own Vulnerable Driver EDR bypass, alongside open-source offensive tooling. Recovered source code suggests parts of the rootkit were written with AI-assisted code generation, which is the more interesting detail for anyone tracking how commodity tooling is being built.

Also covered byCisco Talos (opens in a new tab).

blog.talosintelligence.com → (opens in a new tab)

AI-backed campaign targeting vulnerable Siemens S7 devices, CISA and FBI warn (opens in a new tab)

Cybersecurity Dive ·David Jones ·fetched 20 Aug 2026, 03:36 UTC Must read agreed2/2

Why readFBI, NSA and CISA say attackers are actively enumerating internet-exposed Siemens S7 PLCs and using AI-generated exploitation scripts disguised as legitimate monitoring software.

The joint advisory describes reconnaissance and information gathering against Siemens S7 programmable logic controllers in energy, water, critical manufacturing, agriculture and potentially the defense industrial base, with many targets running out-of-service firmware. Attackers are reported to be generating code with AI for initial access, credential theft and denial of service, and packaging it to look like monitoring tooling. If you own OT, the immediate action is inventorying internet-reachable S7 devices and checking for unsupported versions.

Also covered byTenable Research (opens in a new tab).

cybersecuritydive.com → (opens in a new tab)

Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 20 Aug 2026, 03:36 UTC Must read CVE-2026-59310 EPSS 2.4% agreed2/2

Why readCVE-2026-59310, the CVSS 9.8 vCenter directory traversal patched 29 July 2026, is being exploited in the wild by a suspected China-nexus actor deploying Babuk-derived ransomware.

German IR firm QUIRSO attributes exploitation of CVE-2026-59310 in Broadcom VMware vCenter to a Chinese-speaking actor operating in UTC+08:00, based on Chinese-language artefacts in attacker scripts, reuse of research from a Chinese security publication, Chinese-language tooling, and victimology that excludes mainland China. The flaw is a directory traversal leading to arbitrary code execution; Broadcom shipped a fix on 29 July 2026. The payload is a Babuk-derived ransomware family, so an unpatched internet-reachable vCenter is now a ransomware entry point rather than a theoretical risk. EPSS remains low at 0.024 despite the confirmed activity, so do not use it to defer this one.

thehackernews.com → (opens in a new tab)

N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it (opens in a new tab)

Datadog Security Labs ·fetched 20 Aug 2026, 15:37 UTC Research agreed2/2

Why readFirst-hand runtime analysis of a Linux campaign that is already exploiting exposed MCP servers, with the current loader chain, rotated infrastructure and persistence artifacts you can hunt on today.

Datadog executed a recent N4D Mesh Controller sample in isolation and captured direct evidence of the agent enumerating MCP tools, calling a command-execution tool and reporting output back to its controller, which moves MCP exploitation from theory to observed post-compromise behaviour. The report documents a newer loader-to-agent chain ending in a UPX-packed Go binary labelled go-titan, along with rotated C2 infrastructure and exact on-disk persistence artifacts. It builds on German Fernandez's June 2026 documentation of the framework's polymorphic agent modules and 30-plus service-specific exploitation modules, and adds the concrete hunting detail that reporting lacked.

securitylabs.datadoghq.com → (opens in a new tab)

China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI-assisted malware (opens in a new tab)

The Record ·fetched 20 Aug 2026, 23:39 UTC agreed2/2

Why readBitdefender documents SilkParasite, a year-long Chinese espionage campaign against Central Asian governments using seven malware families, five previously undocumented, with AI used in malware development.

The investigation started from an infection at an economy-related government institution in an unnamed Central Asian country and expanded to seven malware families across a campaign running close to a year. Lures impersonated ministries in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Georgia and Kazakhstan, and Bitdefender assesses that AI was used at multiple points in malware development. This is The Record's write-up of the report, so go to Bitdefender's publication for the indicators and family-level detail.

therecord.media → (opens in a new tab)

Summary of Malicious Campaigns in Italy for August 8-14 (opens in a new tab)

translated Sintesi riepilogativa delle campagne malevole nella settimana del 8 – 14 agosto

CERT-AGID (Italy) ·Matteo Cavallaro ·fetched 20 Aug 2026, 03:36 UTC agreed2/2

Why read1,662 fresh indicators from 118 malicious campaigns against Italian targets, with the lures and malware families named.

CERT-AGID tracked 118 campaigns in the week of 8 to 14 August, 85 aimed specifically at Italy, across 22 distinct lure themes. Fines notices dominated with 42 phishing campaigns abusing SEND and PagoPA plus the Polizia di Stato and ATAC brands, while banking lures impersonating Klarna, Intesa Sanpaolo, Mooney and Poste Italiane carried both phishing and AgentTesla, GoldDigger and MassLogger payloads. The IoCs are distributed to accredited bodies, and the brand and theme breakdown is directly usable for anyone filtering Italian-language mail.

cert-agid.gov.it → (opens in a new tab)

Identity Abuse Through Trusted Communication Channels (opens in a new tab)

Unit 42 ·Bill Batchelor ·fetched 20 Aug 2026, 15:37 UTC agreed2/2

Why readQuantifies attacker abuse of trusted collaboration platforms for identity phishing, with endpoint alerts more than quadrupling over twelve months.

Unit 42 reports that attackers increasingly move beyond email to abuse SaaS collaboration platforms for identity phishing, impersonation, credential theft and malware delivery, using compromised accounts, external federated tenants, guest accounts and trusted third-party relationships. Their endpoint alerts tied to collaboration-tool activity more than quadrupled over the last twelve months. The piece frames the shift as identity becoming the primary security boundary rather than delivering fresh indicators.

unit42.paloaltonetworks.com → (opens in a new tab)

July 2026 Threat Trend Report on APT Groups (opens in a new tab)

AhnLab ASEC ·ATCP ·fetched 20 Aug 2026, 03:36 UTC agreed2/2

Why readAhnLab's monthly APT roundup for July 2026 identifies Microsoft 365, webmail, cloud infrastructure, GitHub and development environments and VPNs as the recurring target set across state-sponsored and financially motivated activity.

The report characterises July 2026 APT activity as a blend of supply-chain compromise, account takeover, cloud breach and social engineering rather than distinct campaign lanes. Named target surfaces are Microsoft 365 and webmail accounts, cloud infrastructure, GitHub and developer environments, and VPN access. The feed text is a scope note only, so the actor attributions and indicators sit in the full report rather than here.

asec.ahnlab.com → (opens in a new tab)

Ransom & Dark Web Issues Week 3, August 2026 (opens in a new tab)

AhnLab ASEC ·ATCP ·fetched 20 Aug 2026, 07:39 UTC agreed2/2

Why readWeekly dark web roundup naming three fresh victim events: a South Korean delivery platform, a Japanese cloud and data centre provider, and a ShinyHunters extortion threat against a US live-streaming service.

ASEC's week 3 August 2026 roundup logs customer and operational data from a South Korean delivery platform offered for sale, an unauthorised access incident at a Japanese cloud and data centre services company, and ShinyHunters threatening to publish data stolen from a US live-streaming platform. Victim organisations are described by sector rather than named, and the IOCs and analysis sit behind an AhnLab TIP subscription. Useful as APAC leak-market tracking, thin as an artefact on its own.

asec.ahnlab.com → (opens in a new tab)

U.S. CISA adds an MLflow flaw to its Known Exploited Vulnerabilities catalog (opens in a new tab)

Security Affairs ·Pierluigi Paganini ·fetched 20 Aug 2026, 11:37 UTC Must read CVE-2026-64849 EPSS 1.1% agreed2/2

Why readCVE-2026-64849, an unauthenticated SSRF in MLflow before 3.15.0, is in KEV and is being used to hit cloud metadata endpoints and steal temporary credentials.

CISA added CVE-2026-64849 (CVSS 9.3), a critical unauthenticated server-side request forgery in MLflow, to the Known Exploited Vulnerabilities catalog. Attackers are using exposed MLflow servers to reach internal services including cloud metadata endpoints and lift temporary cloud credentials; watchTowr saw broad internet scanning for MLflow within hours of the CVE being assigned on 17 August 2026. Fixed in MLflow 3.15.0, and the KEV listing puts a federal remediation deadline on it. Note the writeup opens by misnaming the product as Progress LoadMaster before correctly identifying MLflow.

Also covered byNVD (opens in a new tab).

securityaffairs.com → (opens in a new tab)

CISA Adds Two Known Exploited Vulnerabilities to Catalog (opens in a new tab)

CISA Advisories ·CISA ·fetched 20 Aug 2026, 19:38 UTC Must read CVE-2026-72530 EPSS 0.3% agreed2/2

Why readTwo TrueConf Server flaws, CVE-2026-72529 (missing authentication) and CVE-2026-72530 (code injection), are confirmed exploited and now carry a federal remediation deadline under BOD 26-04.

CISA added both TrueConf Server bugs to the KEV catalog on evidence of active exploitation: one is missing authentication for a critical function, the other code injection, a pairing that gives an unauthenticated attacker a path to command execution on an internet-facing conferencing server. BOD 26-04 requires FCEB agencies to prioritise KEV entries on publicly exposed assets that grant total control post-exploitation, which this combination does. Inventory external TrueConf deployments now and patch or take them off the internet; EPSS on CVE-2026-72530 is only 0.0034, a reminder that the score lags observed exploitation.

cisa.gov → (opens in a new tab)

CISA gives feds 3 days to fix actively exploited Ray RCE bug (opens in a new tab)

The Register Security ·fetched 20 Aug 2026, 03:36 UTC Must read CVE-2025-62593 EPSS 1.0% agreed2/2

Why readCVE-2025-62593 in Ray is in KEV with a three-day federal remediation deadline, and the exploit path is a developer visiting a web page in Firefox or Safari.

CISA added the Ray RCE flaw CVE-2025-62593 (CVSS v4 9.4, disclosed November 2025) to KEV with an unusually short three-day fix window. Vulnerable versions try to block browser-originated requests by checking that the User-Agent starts with "Mozilla", but Fetch API scripts in Firefox and Safari can rewrite that header, and DNS rebinding then reaches the Ray service bound locally. That makes a developer's laptop the entry point: a malicious ad or phishing page is enough, and Ray is deployed at Amazon, Apple and OpenAI among others, so ML dev and test environments are the exposure to hunt for.

theregister.com → (opens in a new tab)

CVE-2026-19478 | MeGitLab CE/EE GraphQL Directive Code Injection Vulnerability (opens in a new tab)

Horizon3 Attack Team ·Horizon3 ·fetched 20 Aug 2026, 23:39 UTC CVE-2026-19478 EPSS 1.5% agreed2/2

Why readUnauthenticated GraphQL directive code injection in self-managed GitLab CE/EE 18.x and 19.x, CVSS 9.4, exploitation observed in the wild.

CVE-2026-19478 (CWE-94) lets an unauthenticated remote attacker abuse a GraphQL directive to modify or delete public projects and user data in GitLab CE and EE, across multiple 18.x and 19.x self-managed branches. No privileges and no user interaction are needed, and active exploitation has been reported; GitLab's advisory withholds the specific preconditions and exploitation mechanics. EPSS is still low at 0.015 because the bug is fresh, so treat the in-the-wild reporting rather than the score as the trigger and patch self-managed instances now.

Also covered byNVD (opens in a new tab).

horizon3.ai → (opens in a new tab)

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 20 Aug 2026, 07:39 UTC Must read CVE-2026-65400 EPSS 0.8% agreed2/2

Why readFour KEV additions with CVSS 9.1-9.8 in macOS Screen Sharing, SharePoint, VMware vCenter and the Windows IKE service, all confirmed exploited and now on a federal patch clock.

CISA added CVE-2026-65400 (macOS Screen Sharing improper authentication, 9.8), CVE-2026-55040 (SharePoint weak authentication security-feature bypass, 9.1), CVE-2026-59310 (VMware vCenter path traversal to arbitrary code execution, 9.8) and CVE-2026-33824 (Microsoft IKE Service Extensions double free, 9.8) to the Known Exploited Vulnerabilities catalog. All four are patched, so the work is inventory and verification rather than mitigation. vCenter and internet-reachable Screen Sharing are the two that most often sit exposed with no compensating control.

thehackernews.com → (opens in a new tab)

Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 20 Aug 2026, 11:37 UTC CVE-2026-65400 EPSS 0.8% agreed2/2

Why readCVE-2026-65400, the macOS Screen Sharing authentication bypass, is being exploited in the wild on internet-exposed Macs to drop Monero miners, per NCSC-NL.

NCSC-NL reports active exploitation of CVE-2026-65400 (CVSS 9.8), an authentication flaw in the macOS Screen Sharing component that lets a network-adjacent attacker authenticate to the built-in remote desktop service without valid credentials. Apple fixed it on 6 August 2026 in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9, crediting Alfredo Pesoli of Bynario. Observed payloads are cryptocurrency miners, so exposed Screen Sharing on port 5900 is the thing to hunt for and close.

Also covered byMalwarebytes Labs (opens in a new tab).

thehackernews.com → (opens in a new tab)

CVE-2026-72530: TrueConf Server, TrueConf Server Code Injection Vulnerability (opens in a new tab)

CISA KEV ·fetched 20 Aug 2026, 19:38 UTC CVE-2026-72530 Exploited in the wild · patch by 2026-09-03 EPSS 0.3% agreed2/2

Why readTrueConf Server code injection is now in KEV with a 3 September 2026 federal remediation deadline, and the attack path is an exposed 4307/TCP listener.

CVE-2026-72530 lets an unauthenticated remote attacker reach TrueConf Server over port 4307/TCP and use a crafted script to escape the isolated execution environment and run arbitrary code on the host. CISA has added it to the KEV catalog, which means exploitation is confirmed, with required action under BOD 26-04 by 2026-09-03 including the Forensics Triage Requirements. EPSS is still low at 0.003, so scanner-driven prioritisation will miss it; the internet-facing conferencing role and the KEV listing are what matter here.

trueconf.com → (opens in a new tab)

CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days (opens in a new tab)

Qualys ThreatPROTECT ·Vamika Sheel ·fetched 20 Aug 2026, 15:37 UTC CVE-2026-69414 EPSS 0.2% agreed2/2

Why readUnpatched local privilege escalation to SYSTEM in the Microsoft Malware Protection Engine with a public PoC since 12 August and a 14-day CISA BOD 26-04 clock, so federal teams need a mitigation rather than a patch.

CVE-2026-69414, called ShieldBreak, lets a low-privileged local attacker escalate to SYSTEM through the Malware Protection Engine used by Microsoft Defender. A working PoC was published on 12 August 2026, Microsoft assigned the CVE on 14 August and is still developing a fix, arriving shortly after the RoguePlanet privilege-escalation bug (CVE-2026-50656) in the same component was patched. EPSS is low at 0.00227 and exploitation requires local access, but BOD 26-04 puts a fixed deadline on affected agencies; note the write-up routes its mitigation advice through Qualys tooling.

blog.qualys.com → (opens in a new tab)

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites (opens in a new tab)

Orca Security ·The Orca Research Pod ·fetched 20 Aug 2026, 19:38 UTC CVE-2026-32475 EPSS 0.4% agreed2/2

Why readCVE-2026-32475 (CVSS 9.0) in Elementor Pro's Forms module file-upload handler gives unauthenticated arbitrary PHP upload and RCE on one of the most widely installed WordPress plugins.

The flaw sits in the Forms module's File Upload handling, letting an attacker write arbitrary PHP to the server and execute it without authentication, so full host compromise follows. EPSS is currently low at 0.004 (35th percentile) and there is no report of exploitation yet, but Elementor Pro's install base and the trivial payoff make this a fast-follow candidate for mass scanning. Patch now and audit uploads directories for stray PHP; the write-up is a breakdown of a disclosed bug rather than original discovery, and the excerpt does not state the fixed version.

orca.security → (opens in a new tab)

CVE-2026-15748 (CVSS 9.8): The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_uplo (opens in a new tab)

NVD ·fetched 20 Aug 2026, 19:38 UTC CVE-2026-15748 CVSS 9.8 EPSS 3.5% agreed2/2

Why readUnauthenticated file upload to RCE in Forminator Forms for WordPress through version 1.56.1, with the bypass mechanism spelled out.

CVE-2026-15748 (CVSS 9.8) sits in Forminator's handle_file_upload function, where the dangerous-extension blocklist uses exact-key matching and is defeated by pipe-alternative MIME type keys. The public submission handler compounds it by trusting attacker-controlled upload field configuration injected through a forged Select field value, so an unauthenticated attacker can land an executable file. Forminator is a mass-install plugin and EPSS already sits in the 88th percentile, so treat any site on 1.56.1 or earlier as exposed and update now.

nvd.nist.gov → (opens in a new tab)

CVE-2026-65640 (CVSS 8.8): WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisite (opens in a new tab)

NVD ·fetched 20 Aug 2026, 11:37 UTC CVE-2026-65640 CVSS 8.8 EPSS 0.8% agreed2/2

Why readRemote code execution in WordPress core affecting every version ever shipped, exploitable by any Author-level user on servers running Imagick with Ghostscript.

An Author or higher with the upload_files capability can upload a malicious PostScript file that Ghostscript executes via Imagick, yielding code execution on the host. WordPress 7.0.4 carries the fix and it has been backported to every branch down to 4.7, which is an unusually wide backport and a signal of how the project rates it. The prerequisite is Imagick plus Ghostscript on the server, so check that pairing first; shared and multi-author hosting is the exposed population, since low-privilege contributor accounts are cheap for an attacker to obtain.

nvd.nist.gov → (opens in a new tab)

Apple plugs image-processing hole ripe for spyware abuse (opens in a new tab)

The Register Security ·fetched 20 Aug 2026, 11:37 UTC CVE-2026-65346 EPSS 0.3% agreed2/2

Why readCVE-2026-65346 is an integer overflow in Apple's ImageIO parser, the classic zero-click spyware delivery path, fixed in the 17 August updates.

Apple patched CVE-2026-65346, an integer overflow in the ImageIO framework that can give arbitrary code execution when a device parses a malicious image. It affects macOS Tahoe, iPhone 11 and later, and supported iPad Pro, Air, iPad and mini models, and was found by Nik Tsytsarkin of Meta's Red Team X. There is no reported exploitation, but ImageIO parsing bugs have a long history as the delivery vector for commercial spyware, which is why the 17 August updates deserve fast deployment on high-risk devices.

theregister.com → (opens in a new tab)

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive (opens in a new tab)

Check Point Research ·fetched 20 Aug 2026, 15:37 UTC Must read Research agreed2/2

Why readTurns the signed Microsoft Defender BTR.sys remediation driver into an attacker-controlled kernel primitive for arbitrary file and registry operations, and an EDR/AV bypass, with no exploit or memory corruption.

Check Point Research presents the first full reverse engineering of Windows Defender's Boot-Time Removal driver, BTR.sys, including its encrypted configuration, integrity validation and execution pipeline and its proprietary transaction format. They release BTR_CLI, which constructs valid encrypted transactions to drive the signed driver into arbitrary Ring 0 file and registry operations. Because the driver is trusted and Microsoft-signed, this becomes a defense-disarming technique that sidesteps typical exploitation.

research.checkpoint.com → (opens in a new tab)

The Structured Totient Preimage Problem: Reconstruction, Collisions, and Cryptographic Implications (opens in a new tab)

arXiv cs.CR (all) ·Luis Adrián Lizama-Pérez ·fetched 20 Aug 2026, 03:36 UTC Research agreed2/2

Why readDefines the Structured Totient Preimage problem and shows the regime where reconstruction is polynomial, ruling it out as a hardness assumption.

Given only the product of (p_i - 1) over k distinct same-bit-length primes, STP asks for any valid prime set. The paper derives the exact count of ordered exponent allocations for factored x, proves reconstruction is polynomial for fixed k when the number of prime factors is O(log λ), and reports an exhaustive census over 28 parameter pairs up to λ=16 covering 4,588,935 prime sets, quantifying collisions and conditional ambiguity in bits. Relevant if you are assessing novel number-theoretic assumptions; the practical takeaway is a negative result about where hardness cannot come from.

arxiv.org → (opens in a new tab)

Improving LLM-Based SSH Honeypots Through Prompting and Fine-Tuning (opens in a new tab)

arXiv cs.CR (AI) ·Muris Sladić, Veronica Valeros, Eman Alibalić, Sebastian Garcia ·fetched 20 Aug 2026, 07:39 UTC Must read Research agreed2/2

Why readNames the concrete failure modes that unmask a locally hosted LLM SSH honeypot, and measures how far prompt design and fine-tuning close the gap to a cloud model.

The authors fine-tune and evaluate eight models, the original shelLM GPT-3.5 build plus seven open-weight local models against their own base versions, using 34 automated unit tests for shell emulation accuracy in both single-session and fresh-session conditions. Prompt structure turns out to carry most of the improvement and transfers across model families, while fine-tuning gains are bounded by how well the training set covers the command space. The practical value is the tell list: malformed output, command echoing, filesystem state that drifts between commands, and assistant-style phrasing, each of which a visiting attacker can use to fingerprint the trap.

arxiv.org → (opens in a new tab)

jitpass/jit: Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and local-first. (opens in a new tab)

GitHub: new security tools ·jitpass ·fetched 20 Aug 2026, 07:39 UTC Must read Research ★ 142 agreed2/2

Why readA local-first Go tool that pulls plaintext credentials out of .env, ~/.aws/credentials, .npmrc and MCP configs into a Touch ID gated vault and injects them per-process, leaving a decoy on disk.

jit rewrites the files that hold your secrets so the tools reading them keep working, while the real value only materialises in the memory of the process that asked for it after a biometric prompt. It avoids kernel extensions, filesystem drivers and FUSE, instead injecting environment variables into a single process and then execve-ing your command so jit's own image is replaced. The threat model is stated plainly up front: it does not save an already-compromised account and does not protect a secret once it is inside the consuming process, which makes it a reasonable answer to editor-resident AI agents running with your full permissions.

github.com → (opens in a new tab)

From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation (opens in a new tab)

arXiv cs.CR (AI) ·Sepehr Ghaffarzadegan, Boubakr Nour, Makan Pourzandi, Mourad Debbabi ·fetched 20 Aug 2026, 03:36 UTC Research agreed2/2

Why readAn academic pipeline that turns unstructured CTI reports into Sigma rules using knowledge-graph enrichment plus template grounding rather than raw LLM generation.

AUTOSIGMA converts prose threat intelligence into platform-independent Sigma detection logic, arguing that pure language-model generation is unreliable and that rules must be grounded in templates and structured knowledge to be valid. The stated motivation is that public Sigma repositories lag emerging techniques and need heavy per-environment customisation. Detection engineers evaluating AI-assisted rule authoring get a concrete architecture to compare against their own attempts.

arxiv.org → (opens in a new tab)

Using Microsoft Graph and Powershell - Risk Detection Commands, (Thu, Aug 20th) (opens in a new tab)

SANS ISC Diary ·fetched 20 Aug 2026, 15:37 UTC agreed2/2

Why readConcrete Microsoft Graph and PowerShell commands to pull Entra risky-login and risk-detection data, with the license tier each requires.

A SANS ISC diary walks through mining Entra Identity Protection with Graph PowerShell, using Get-MgRiskDetection under a basic license and Get-MgRiskyUser, Confirm-MgRiskyUserCompromised and Get-MgRiskyUserHistory where a higher tier is available. It notes the required IdentityRiskyUser.Read.All and IdentityRiskEvent.Read.All scopes and the monthly cost of the persistent risk-user commands. Usable hunting recipe rather than new research.

isc.sans.edu → (opens in a new tab)

Using Microsoft Graph and Powershell to Mine for Information - Stale Accounts and Licenses, (Thu, Aug 20th) (opens in a new tab)

SANS ISC Diary ·fetched 20 Aug 2026, 15:37 UTC agreed2/2

Why readPractical Graph PowerShell recipes to enumerate stale Entra accounts and license usage, including the -All paging pitfall.

A companion SANS ISC diary shows how to use the Microsoft Graph PowerShell modules to dump Entra user tables and sign-in activity, filter enabled accounts, and surface stale accounts and license assignments. It flags the default 100-object limit and the need for -All when managing a real directory. Solid operational how-to on a maturing API.

isc.sans.edu → (opens in a new tab)

SiNMULI: Novel Signed Network Approach for Malicious URL Identification (opens in a new tab)

arXiv cs.CR (all) ·Avijit Gayen, Sayan Mondal, Angshuman Jana ·fetched 20 Aug 2026, 15:37 UTC Research agreed2/2

Why readReframes malicious URL detection as signed-network classification over backlink graphs, a feature source most phishing classifiers ignore.

SiNMULI builds a signed graph where nodes are URLs and external backlinks are signed edges, then applies social balance theory to classify each node as benign or malicious. The stated argument is that static per-URL features go stale as malicious infrastructure rotates, while inbound-link structure persists. The abstract given here stops before any dataset, baseline comparison or accuracy figure, so the size of the gain over conventional ML and DL detectors is unverifiable from this text.

arxiv.org → (opens in a new tab)

AI in DFIR 101: Why AI isn’t Good for DFIR Collections (opens in a new tab)

Cyber Triage ·Brian Carrier ·fetched 20 Aug 2026, 15:37 UTC agreed2/2

Why readArgues that the collection phase needs determinism that LLMs cannot supply, and draws a line for where AI is acceptable in an investigation: only when deterministic options are exhausted.

Carrier separates planning from collection and holds that once you are copying registry hives, event logs, disk or memory images or pulling telemetry from an API, you often get one attempt, so reliability and repeatability outrank flexibility. The position is that agentic collection introduces nondeterminism precisely where you cannot afford it and where you may have to tell a client you missed files, with AI justified only as a last resort against an unsupported interface. A short, arguable methodology piece rather than tooling, and worth it if your team is being pushed to bolt AI onto acquisition.

cybertriage.com → (opens in a new tab)

Zero-click Grok data theft: Cryptographic Context Injection attack leaks chat histories (opens in a new tab)

Adversa AI ·fetched 20 Aug 2026, 15:37 UTC Must read Research agreed2/2

Why readNew injection primitive: ship instructions as AES ciphertext so guardrails cannot read them, then get the model to decrypt them in its own code runtime and treat the output as trusted, demonstrated as zero-click chat-history theft in Grok.

Cryptographic Context Injection hides attacker instructions inside encrypted text, which no content filter can inspect, and forces recovery through the model's code execution sandbox because strong encryption cannot be shortcut in the weights. Decrypted instructions then flow into privileged tools with no provenance, and the model over-trusts its own sandbox output; in Grok an ordinary page-summarisation request exfiltrates the user's chat data with no click or warning, and in Gemini it produces normally refused content. Both were live production systems and the issue was reported to xAI, which makes guardrail-at-the-text-layer designs look structurally insufficient.

Also covered byArs Technica Security (opens in a new tab).

adversa.ai → (opens in a new tab)

Task-Conditioned Least-Privilege Learning for Executable Terminal and MCP Agents (opens in a new tab)

arXiv cs.CR (AI) ·Alexander Tu, Michael Tu ·fetched 20 Aug 2026, 15:37 UTC Research agreed2/2

Why readPost-training method that teaches a 4B model to request only task-necessary authority in terminal and MCP environments, with excess-privilege scored by deterministic verifiers rather than by a judge model.

The authors define per-task sufficient-authority envelopes and audit each agent action before execution and again from its observed effects across six risk dimensions, using deterministic verifiers that score completion, evidence, exact state, prohibited attempts and safe success. Training Qwen3.5-4B on 1,500 tasks yields 98.48% safe success across 2,896 evaluation episodes. The interesting part for practitioners is the framing of excess authority as a measurable trajectory-level quantity, which is something you could apply to your own MCP tool inventory rather than relying on permission prompts alone.

arxiv.org → (opens in a new tab)

CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence (opens in a new tab)

arXiv cs.CR (AI) ·Yutong Cheng, Changze Li, Qian Cui, Wei Ding ·fetched 20 Aug 2026, 11:37 UTC Research agreed2/2

Why readArgues the bottleneck on agentic CTI is the corpus format rather than the model, and builds a typed ontology graph over CVE, CWE, CAPEC and ATT&CK to prove it.

CTIFoundry replaces opaque RAG chunks with a build-time scaffold: official cross-references between four authoritative knowledge bases become traversable typed edges, and a span-grounded report layer indexes provenance-carrying chunks against alias-resolved cross-vendor entities. Query time exposes this through seven typed tools and three procedural skills on a stock agent loop, alongside hybrid dense plus lexical retrieval. The claim worth testing is the framing one, that corpus structure and not model capability limits multi-step CTI investigation.

arxiv.org → (opens in a new tab)

Beyond the Transcript: Detecting Covert Co ordination in Latent Multi-Agent Communication (opens in a new tab)

arXiv cs.CR (all) ·Ramneet Kaur, Pradyumna Chari, Ramesh Raskar, Jugad Singh ·fetched 20 Aug 2026, 19:38 UTC Research agreed2/2

Why readProposes a monitoring framework for LLM agents coordinating through continuous hidden states rather than readable transcripts, an attack surface that transcript logging alone cannot cover.

Verifiable Latent Alignments (VLA) monitors private latent-state channels between language-model agents, linking each latent record and channel status to the resulting public action via a shared event identifier so causal analysis can be matched. The monitor stacks representation anomaly detection, counterfactual action-distribution influence and sparse-autoencoder interpretation, trained on neutral traffic only, and is paired with black-box and white-box steering interventions. Evaluation runs on a controlled multi-agent auction benchmark with homogeneous and heterogeneous model pairs and many-agent scaling. Useful if you are building agent-to-agent audit trails; the benchmark is synthetic and the practical takeaway is that public transcripts are an incomplete log.

arxiv.org → (opens in a new tab)

CVE-2026-24301 (CVSS 8.8): Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose i (opens in a new tab)

NVD ·fetched 20 Aug 2026, 23:39 UTC CVE-2026-24301 CVSS 8.8 EPSS 1.6% agreed2/2

Why readCommand injection in Microsoft Copilot Web lets an unauthenticated attacker pull information out over the network, patched service-side with no customer action available.

CVE-2026-24301 is an improper neutralization of special elements in Microsoft Copilot Web, rated CVSS 8.8 with UI:R and full C/I/A impact, allowing an unauthorized attacker to disclose information over a network. The affected product is listed with version "-", confirming this is a hosted service fix rather than something an administrator deploys. CISA's ADP record scores exploitation as none and technical impact partial; EPSS is 0.016, at the 74th percentile.

nvd.nist.gov → (opens in a new tab)

Detailed Timeline of OpenAI’s Cyberattack on Hugging Face (opens in a new tab)

Schneier on Security ·Bruce Schneier ·fetched 20 Aug 2026, 19:38 UTC agreed2/2

Why readPointer to Simon Willison's step-by-step timeline of the OpenAI model-driven offensive operation against Hugging Face presented at Black Hat.

OpenAI laid out the timeline of its AI model conducting a cyberattack against Hugging Face in a Black Hat presentation, and Willison has reconstructed the sequence in detail. Schneier's own contribution is a pointer and a judgement that the offensive work is impressive. Worth following the link rather than reading this; the value sits in the linked timeline, not here.

schneier.com → (opens in a new tab)

CVE-2026-34884 (CVSS 9.8): SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MC (opens in a new tab)

NVD ·fetched 20 Aug 2026, 19:38 UTC CVE-2026-34884 CVSS 9.8 EPSS 0.5% agreed2/2

Why readAn Apache MCP server ships a tool parameter that is really a network destination, giving any caller SSRF plus GraphQL expression injection until 0.2.0.

Apache SkyWalking MCP 0.1.0 exposes a set_skywalking_url tool that accepts an arbitrary backend address, handing an attacker server side request forgery from whatever network position the MCP process occupies, alongside a second flaw permitting injection into the GraphQL expressions it builds. NVD rates it 9.8 and CISA's SSVC record marks technical impact total and exploitation automatable, though EPSS sits near 0.005 and the affected code is one 0.1.0 release with a small install base. Upgrading to 0.2.0 closes it; the durable lesson for most readers is the shape of the bug, an agent reachable tool argument that controls where the server connects, rather than this particular component.

nvd.nist.gov → (opens in a new tab)

MarianoFacundoArch/nist-csf-evidence-gap-analysis-tool: Free, open-source tool to build a NIST CSF 2.0 Current Profile and gap analysis from an organization's documents (AI-assisted, human-validated, runs offline). (opens in a new tab)

GitHub: new security tools ·MarianoFacundoArch ·fetched 20 Aug 2026, 11:37 UTC Research ★ 156 agreed2/2

Why readAn offline, open-source tool that reads your existing policy and evidence documents and builds a NIST CSF 2.0 Current Profile plus gap analysis across all 106 outcomes.

The tool ingests an organisation's own documents, maps them to the 106 CSF 2.0 outcomes, and emits dashboard.html, a single self-contained file with coverage, review status, current-versus-target comparison and the evidence cited for each outcome. It is AI-assisted but human-validated and runs with no server and no network calls, which matters for anyone who cannot ship internal policy text to a SaaS assessment vendor. Useful for a first-pass profile before an audit rather than as a substitute for one.

github.com → (opens in a new tab)

Srsly Risky Biz: Trump's private hacker memo is the right idea (opens in a new tab)

Risky Business News ·fetched 20 Aug 2026, 07:39 UTC agreed2/2

Why readFrames the Trump memo on deputising private firms for cybercriminal disruption as a capacity problem rather than a legal one, which is the argument policy teams will have to answer to.

Uren and Wilson read the White House memo enlisting US private industry against cybercriminals as directionally correct: arrests and indictments have failed to move the needle, disruption operations work better, and the government does not have enough people to run them at scale. The unresolved part is what authority and liability shield a private firm operates under once it is doing that work. The same episode covers Ukraine's paired cyber and kinetic strikes on Wildberries, the Russian logistics operator, and argues the cyber component added propaganda value rather than physical effect.

risky.biz → (opens in a new tab)

US charges Iranians for sprawling hacking campaign on government agencies, universities (opens in a new tab)

The Record ·fetched 20 Aug 2026, 03:36 UTC agreed2/2

Why readDOJ unsealed a 14-count indictment charging 17 people tied to Iran's Mabna Institute and the IRGC with breaching email at the Department of Labor, FERC, multiple UN bodies and state agencies in Hawaii and Indiana, with at least 31 TB stolen.

The superseding indictment, unsealed Tuesday, covers a campaign prosecutors date to around 2013 and attribute to an Iranian company acting for the Islamic Revolutionary Guard Corps, targeting universities and research institutions worldwide for intellectual property. Eight of the 17 defendants were already charged in a 2018 indictment over a separate campaign. For research-heavy and public-sector organisations this sets out both the persistence of the targeting and the specific credential and email focus that has worked against federal and UN accounts.

therecord.media → (opens in a new tab)

Fitch explains how water, healthcare organizations can keep strong credit ratings, despite cyberattacks (opens in a new tab)

Cybersecurity Dive ·Eric Geller ·fetched 20 Aug 2026, 15:37 UTC agreed2/2

Why readFitch spells out the criteria by which cyberattacks start to pressure credit ratings at water utilities and healthcare providers, which is the argument a CISO in those sectors can take to a board.

Two Fitch Ratings analyses published Tuesday find US water systems squeezed between attacker interest, thin technical and financial resources and inconsistent regulation, while healthcare faces rising event costs alongside incoming rules. Fitch says rating actions tied to cyber events have been limited so far but that the likelihood of rating pressure is increasing, and frames resilience rather than prevention as what protects a rating. Directly usable for funding conversations in the two sectors named.

cybersecuritydive.com → (opens in a new tab)

Over 153,000 students, staff affected in Canvas data breach: privacy watchdog (opens in a new tab)

Google News: incidents · South China Morning Post ·fetched 20 Aug 2026, 11:37 UTC agreed2/2

Why readA privacy regulator has put 153,000 affected students and staff on a Canvas breach, the kind of number a university board and any Canvas-using institution will be asked about.

A privacy watchdog says more than 153,000 students and staff were affected by a data breach involving Canvas. The report reaches us as a headline only, with no attack detail, no timeline and no statement on what data was exposed. For education-sector leaders running the same learning platform, the regulator's involvement and the scale of the notification are the facts worth carrying.

news.google.com → (opens in a new tab)