Monday, 24 August 2026

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 24 Aug 2026, 11:35 UTC Must read agreed2/2

Why readTalos profile of UAT-10147, a Chinese-speaking crew automating web server intrusions with PentestGPT and DeepAudit and deploying the SPECTRE implant with EDR bypass and a Linux rootkit.

The group hits Windows and Linux web servers in education, media, technology and gaming, concentrated in Brazil, Bolivia, China, Canada and Vietnam, and was uncovered via an open directory at 139.180.197[.]150 seen talking to a compromised host. Initial access comes from publicly disclosed vulnerabilities exploited at scale, with tooling spanning Metasploit, ysoserial, PentestGPT, DeepAudit and multiple privilege escalation exploits, ending in SPECTRE plus a Linux rootkit for persistence. Motive is SEO fraud and data theft; the two-part Talos report behind this is where the full indicator set lives.

thehackernews.com → (opens in a new tab)

Hackers infect Android car head units with proxy botnet malware (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 24 Aug 2026, 07:39 UTC Must read agreed2/2

Why readFirst documented malware chain built specifically for Android car head units, delivered through the vendor's own legitimate update app.

Kaspersky traced a rogue APK pulled by TWCore, a legitimate system app on DoFun head units, taking instructions from an MQTT server at cardoor[.]cn and enrolling the device in a proxy botnet or using it for ad fraud. The operation is attributed to MoYu, previously tied to the BadBox botnet, and DoFun is owned by Shenzhen Driving Control Technology. Second-hand write-up of Kaspersky's analysis, but the named vendor app, C2 protocol and host are usable starting points.

Also covered byThe Record (opens in a new tab).

bleepingcomputer.com → (opens in a new tab)

Iranian Cyberattacks Against Critical Infrastructure (opens in a new tab)

Truesec ·Hjalmar Desmond ·fetched 24 Aug 2026, 15:40 UTC Must read agreed2/2

Why readNames the specific PLC families in the FBI warning, Rockwell and Allen-Bradley MicroLogix 1100 and 1400, and argues the campaign is opportunistic internet-exposure hunting rather than capable OT attack.

Iranian-attributed activity against critical infrastructure has focused on internet-exposed operational technology, with the FBI flagging MicroLogix 1100 and 1400 series controllers specifically and advising caution for other vendors' PLCs too. Truesec assesses the intrusions as unsophisticated and aimed at small plants with minimal security, targeting psychological effect over physical damage, and holds to its prior judgement that destructive Iranian attacks on Europe stay unlikely absent direct European involvement in the US-Iran conflict. A stated, arguable position on threat level plus a concrete asset inventory to go and check.

truesec.com → (opens in a new tab)

ReliaQuest confirms failed data-theft attack after ShinyHunters breach (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 24 Aug 2026, 15:40 UTC Must read agreed2/2

Why readShinyHunters is registering company[.]claims domains to impersonate help desks, a naming pattern you can hunt for and block today; ReliaQuest itself was the target.

ReliaQuest confirmed attackers phoned multiple employees while posing as its own security team and steered them to a fake single sign-on page fronted by a CDN, following the company's now-deleted research on ShinyHunters registering domains under the .claims TLD that embed the target's name or abbreviation. The gang replied publicly with screenshots of what appeared to be a compromised Okta SSO account belonging to a ReliaQuest employee. The company says the data-theft attempt failed, but the .claims pattern and the voice-phishing-to-fake-SSO chain are the parts to operationalise.

Also covered byDataBreaches.net (opens in a new tab).

bleepingcomputer.com → (opens in a new tab)

ToxicPanda Android malware uses VPN permissions to block Google Play (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 24 Aug 2026, 03:39 UTC agreed2/2

Why readToxicPanda 2.0 abuses Android's VpnService to build a local interface and selectively block traffic to Google Play and Play Services, killing app verification and Play Protect checks before it drops its payload.

The banker now targets 349 applications and supports 167 remote commands, per Zimperium's analysis. Its new trick is requesting VPN service permission first: with a local tunnel in place it blocks Google Play and Play Services communication, neutering app verification, updates and Play Protect remediation, then requests Accessibility Service and installs its payload. It also automates Android Debug Bridge over wireless debugging for shell-level access, and is being distributed from AWS-hosted buckets. Detection teams should treat an app holding both VpnService and Accessibility grants as a hunt signal.

bleepingcomputer.com → (opens in a new tab)

Risky Bulletin: Expired credit cards can be used for malicious transactions (opens in a new tab)

Risky Business News ·fetched 24 Aug 2026, 11:35 UTC agreed2/2

Why readIranian operators reportedly shut down a UK power plant and Lazarus is inside South Korea's Presidential Office, in one bulletin.

The daily Risky Business bulletin leads on expired credit cards still being accepted for fraudulent transactions, alongside an Iranian-attributed disruption of a UK power plant, a Lazarus Group intrusion at South Korea's Presidential Office, and an Android malware family spreading into connected cars. Each item is a pointer rather than analysis, and the feed text is thin, so treat it as a triage list for which primary sources to chase. The state-actor items are the ones with sector consequences worth following up.

risky.biz → (opens in a new tab)

DOUBLECUP's PNG Payload, (Mon, Aug 24th) (opens in a new tab)

SANS ISC Diary ·fetched 24 Aug 2026, 07:39 UTC agreed2/2

Why readCorrects the record on DOUBLECUP: the PNG carrier is not steganography, and the extraction trick it does use is worth knowing for detection.

Didier Stevens checked the DOUBLECUP write-up and found the PowerShell payload sitting in cleartext appended after the end of the PNG file, not encoded into pixels and not hidden in metadata. The actual cleverness is that the script opens with 0x0D 0x0A, so a plain FINDSTR search for a unique marker pulls the whole line out and pipes it to the interpreter with no custom extractor. That makes the loader stage detectable on the strings and the FINDSTR-into-PowerShell pattern rather than on any image analysis.

isc.sans.edu → (opens in a new tab)

Fake Microsoft security scans trick victims into uninstalling their antivirus (opens in a new tab)

Malwarebytes Labs ·fetched 24 Aug 2026, 15:40 UTC Research agreed2/2

Why readEleven fake SysScan sites on one host, carrying Microsoft branding, telling visitors to uninstall their antivirus as the opening move of a refund scam.

The sites run a convincing but fabricated security scan, claim Windows no longer supports third-party antivirus, and instruct the visitor to remove it, which sets up a phone call for a supposed refund and hands over personal, banking and remote-access details. A browser can only read operating system, screen size and rough location, so any page claiming to have found malware or missing patches is lying by construction. Worth having as user-awareness material and as a cluster to block, though there is no malware analysis here.

malwarebytes.com → (opens in a new tab)

Mapping Iran’s Cyberattack on American Water Infrastructure | CSIS (opens in a new tab)

Google News: incidents · Small Wars Journal ·fetched 24 Aug 2026, 23:38 UTC agreed2/2

Why readCSIS mapping of Iranian intrusion activity against US water and wastewater operators, framed at the sector level rather than the indicator level.

A think-tank reconstruction of where Iranian-linked operations have touched American water infrastructure and what that pattern implies for utilities and their regulators. The item reached us as a headline via aggregation, so the specific utilities, dates and technical findings could not be verified from the text supplied. CSIS output on this topic is normally worth the read for anyone briefing upward on critical-infrastructure exposure.

news.google.com → (opens in a new tab)

July 2026 Threat Trend Report on Ransomware (opens in a new tab)

AhnLab ASEC ·ATCP ·fetched 24 Aug 2026, 11:35 UTC agreed2/2

Why readJuly 2026 leak-site counts by sector and country: manufacturing at 85 incidents, the US at 247, drawn from ransomware DLS postings.

AhnLab's monthly tally puts manufacturing first at 85 incidents, followed by information and communication at 59, wholesale and distribution at 40 and healthcare and social welfare at 27, with the US at 247 cases and France next by country. Figures come from dedicated leak site postings, so they measure claimed victims rather than confirmed intrusions. Reasonable input for sector risk framing, with the usual leak-site caveats about double-posting and inflated claims.

asec.ahnlab.com → (opens in a new tab)

AliExpress caught fingerprinting visitors after sending inaudible sounds to browsers (opens in a new tab)

Ars Technica Security ·Dan Goodin ·fetched 24 Aug 2026, 19:40 UTC agreed2/2

Why readA named, high traffic retailer is running obfuscated WebAudio fingerprinting in production, and its side effects are observable enough that a user noticed them by accident.

Researcher Matthew Callaghan traced repeated dropouts on his multipoint Bluetooth headphones to the AliExpress homepage, then found two heavily obfuscated scripts building a WebAudio oscillator graph that measures how each browser renders sawtooth waves. The technique itself is old and well documented in the fingerprinting literature; the news is that a retailer of this size still ships it, and that the audio stack contention it causes is a practical tell. Useful mainly as a reminder that WebAudio remains an active fingerprinting surface worth watching in browser telemetry and privacy reviews, not as a new attack primitive.

arstechnica.com → (opens in a new tab)

CISA orders urgent patching of actively exploited Zimbra flaw (opens in a new tab)

BleepingComputer ·Sergiu Gatlan ·fetched 24 Aug 2026, 11:35 UTC Must read agreed2/2

Why readCVE-2026-73570 in Zimbra Collaboration Suite is under active exploitation with a three-day CISA patch deadline; fix is version 10.1.20.

Unauthenticated command injection in Zimbra's SNMP notification component allows remote code execution as the zimbra user when SNMP notifications are enabled, patched in ZCS 10.1.20 on July 20. CERT Polska first reported in-the-wild targeting, and CISA has now set a three-day remediation deadline for federal agencies. Shadowserver counts more than 12,000 internet-exposed Zimbra servers, so exposure checks and the 10.1.20 upgrade are the immediate work.

bleepingcomputer.com → (opens in a new tab)

CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in, Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability (opens in a new tab)

CISA KEV ·fetched 24 Aug 2026, 19:40 UTC Must read CVE-2026-21962 Exploited in the wild · patch by 2026-08-27 EPSS 43.2% agreed2/2

Why readCVE-2026-21962 in the Oracle HTTP Server and WebLogic Server Proxy Plug-in is confirmed exploited and carries a federal patch deadline of 27 August 2026.

CISA added CVE-2026-21962 to the KEV catalog: an improper access control flaw in the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in allowing unauthorized read, creation, deletion or modification of all data accessible to the plug-in. EPSS sits at 0.43, in the 98.6th percentile, which is high for a component that typically fronts internet-facing WebLogic estates. BOD 22-01 remediation is due 2026-08-27; agencies without a mitigation must discontinue use.

oracle.com → (opens in a new tab)

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520) (opens in a new tab)

Rapid7 ·Stephen Fewer ·fetched 24 Aug 2026, 19:40 UTC Must read Research CVE-2026-63520 EPSS 2.9% agreed2/2

Why readFull exploitation detail for SharePoint RCE CVE-2026-63520, including the Database LOB system and ObjectDataProvider gadget chain, and how chaining CVE-2026-55040 turns it into unauthenticated RCE.

CVE-2026-63520 lets a remote authenticated user run code on a SharePoint server as the site's service account; chained with the authentication bypass CVE-2026-55040 the result is unauthenticated RCE. Rapid7 reached it through a Database Line-of-Business system and an ObjectDataProvider gadget chain, and contrasts that with VulnCheck's DotNet-based route to the same bug. Publication was pulled forward from the planned 30-day window because a third party had already released details, so expect public weaponisation pressure to rise quickly despite the currently modest EPSS of 0.029.

rapid7.com → (opens in a new tab)

Unpatched Calix flaw lets hackers bypass NAT to expose internal devices (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 24 Aug 2026, 23:38 UTC Must read agreed2/2

Why readCVE-2026-75501 lets an unauthenticated remote attacker add port-forwarding rules on Calix GS5239XG gateways running EXOS/6.6.47, exposing LAN devices straight to the internet, and there is no patch.

Researcher Brian Khan Quintana found a missing authentication flaw in the Calix GS7 XGS (GS5239XG, also sold as GigaSpire 7u10txg) residential gateway, allowing remote creation of NAT port-forward entries without credentials. Calix did not respond to disclosure attempts beginning 7 June, so CERT/CC coordinated public release and the technical details are out. The device ships through US broadband providers including Cox, Brightspeed, ALLO, CityFibre and Conexon, which puts a large unpatched consumer-edge fleet in play for anyone hunting home-office endpoints.

bleepingcomputer.com → (opens in a new tab)

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 24 Aug 2026, 15:40 UTC CVE-2026-18963 EPSS 0.5% agreed2/2

Why readCVE-2026-18963 lets an unauthenticated attacker take over any Keycloak account through the forgotten-password flow; fixed in 26.7.2 and RHBK 26.4.15 and 26.6.6.

Red Hat rates the flaw 9.1 and traces it to improper state validation in Keycloak's reset-credentials authentication flow, classified as CWE-640 weak password recovery. Upstream users should move to 26.7.2, released 19 August 2026; Red Hat build of Keycloak customers to 26.4.15 or 26.6.6. No exploitation and no public exploit as of 24 August 2026, and EPSS sits at 0.005, but pre-auth account takeover on an identity provider is worth an out-of-band patch cycle.

thehackernews.com → (opens in a new tab)

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 24 Aug 2026, 03:39 UTC CVE-2026-32475 EPSS 0.4% agreed2/2

Why readCVE-2026-32475, CVSS 9.0: unauthenticated RCE in Elementor Pro's Forms File Upload field, reachable on any site with a form that accepts attachments.

Patchstack found that the Forms module runs its extension check and its file-move step in two separate loops that handle empty file entries differently. Submitting two file parts for the same field skips the extension blocklist entirely and drops a PHP file into a web-served directory, turning a restricted upload into unauthenticated code execution. EPSS is still low (0.004) but Elementor Pro's install base and the triviality of the bypass make patching the priority.

thehackernews.com → (opens in a new tab)

Cisco bug severity warning reads like Olympic gymnastics scores: 10, 10, 9.9, 9.6, and 7.5. (opens in a new tab)

The Register Security ·fetched 24 Aug 2026, 03:39 UTC CVE-2026-20315 EPSS 0.3% agreed2/2

Why readFour criticals in Cisco Secure Workload including two CVSS 10.0 access-control bugs, CVE-2026-20315 and CVE-2026-20317, in the product meant to stop lateral movement.

Cisco disclosed five flaws in Secure Workload (formerly Tetration): CVE-2026-20315 and CVE-2026-20317 at 10.0 covering authorization and authentication bypass, CVE-2026-20231 at 9.9 for command and argument injection, CVE-2026-20318 at 9.6 for improper input validation, and CVE-2026-20319 at 7.5 for an out-of-bounds write. Cisco has published little technical detail, and the product ships both as SaaS and on-premises, so on-prem operators need to establish patch status themselves. EPSS on 20315 is still negligible (0.003), which reflects absence of observed exploitation rather than difficulty.

theregister.com → (opens in a new tab)

CVE-2026-62243 (CVSS 8.7): Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on (opens in a new tab)

NVD ·fetched 24 Aug 2026, 19:40 UTC CVE-2026-62243 CVSS 8.7 EPSS 0.2% agreed2/2

Why readNetty silently disables TLS hostname verification on the SslProvider.OPENSSL client path under Java 25+, so a MITM can present a certificate for any hostname and have it accepted.

Affected are netty-handler 4.2.0.Final through 4.2.16.Final and everything through 4.1.136.Final. The condition is specific: OpenSSL provider on the client side, a plain non-extended X509TrustManager, and Unsafe-based trust-manager wrapping unavailable, which is the case on Java 25 and later. Fixed in 4.2.17.Final and 4.1.137.Final; given how deep Netty sits in the JVM stack, this is a transitive-dependency sweep rather than a single upgrade.

nvd.nist.gov → (opens in a new tab)

CVE-2026-61539 (CVSS 10.0): Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Lla (opens in a new tab)

NVD ·fetched 24 Aug 2026, 07:39 UTC CVE-2026-61539 CVSS 10.0 EPSS 0.7% agreed2/2

Why readAn unauthenticated remote attacker can reach eval() in Xinference 2.5.0 and earlier just by shaping a model's tool-call output, so anyone serving models with it needs to be on 2.7.0.

CVE-2026-61539 carries a CVSS 10.0 because the Llama3 tool-call parser hands model-generated Python expressions straight to eval(). A POST to /v1/chat/completions with a tools field is enough: the crafted prompt steers the model's output, and that output executes in the Xinference server process with no authentication required. Version 2.7.0 fixes it; EPSS is still low at 0.0066, so this is a patch-now-before-it-is-noticed item rather than an active-exploitation one.

nvd.nist.gov → (opens in a new tab)

CVE-2026-76793 (CVSS 8.1): The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching (opens in a new tab)

NVD ·fetched 24 Aug 2026, 15:40 UTC CVE-2026-76793 CVSS 8.1 EPSS 0.3% agreed2/2

Why readThe Firebase Authentication WordPress plugin before 1.7.1 accepts unverified email addresses in auth tokens, so an unauthenticated attacker can log in as any user including administrators.

The plugin matches the email claim in an authentication token to a WordPress account and issues a session without requiring that the address be verified, which means controlling any Firebase identity with a chosen email yields that user's session. Full administrative takeover follows for any site where an admin's address is known, which on WordPress it usually is. Fixed in 1.7.1, documented by WPScan; EPSS is still low at 0.0035 but a pre-auth admin login in a public plugin is the kind of bug that gets scanned for quickly.

nvd.nist.gov → (opens in a new tab)

ShieldBreak bypasses Microsoft’s patch for earlier Defender flaw (opens in a new tab)

Malwarebytes Labs ·fetched 24 Aug 2026, 03:39 UTC CVE-2026-69414 EPSS 0.2% agreed2/2

Why readCVE-2026-69414 (ShieldBreak) is an unpatched elevation of privilege in the Microsoft Malware Protection Engine that gets around the July fix for RoguePlanet.

Microsoft has confirmed ShieldBreak as an EoP vulnerability in the Malware Protection Engine and says a security update is still in progress. It reaches the same outcome as RoguePlanet, acknowledged 16 June and patched 8 July, indicating the July fix blocked one path rather than the underlying weakness; unlike RoguePlanet's race-condition exploit, reliability is not obviously limited. EPSS remains low at 0.002, but a defender-side privilege escalation with no patch is worth tracking for the update and for local EoP telemetry in the meantime.

malwarebytes.com → (opens in a new tab)

CVE-2026-18052 (CVSS 8.1): The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent (opens in a new tab)

NVD ·fetched 24 Aug 2026, 15:40 UTC CVE-2026-18052 CVSS 8.1 EPSS 0.3% agreed2/2

Why readAn authentication bypass in the ManageWP Worker WordPress plugin before 4.9.37 lets anyone holding a used one-time login link get an administrator session.

ManageWP Worker before 4.9.37 does not bind the target account to the signature that authorises an auto-login, and does not invalidate a link once used. Anyone who obtains such a link, from logs, referrers, proxies or a shared inbox, can replay it to get a session as any user on the site including admin. CVSS 8.1 (AV:N/AC:H/PR:N), EPSS still low at 0.003, but the plugin is deployed across large fleets of managed WordPress sites, so the exposure per link is a full site takeover.

nvd.nist.gov → (opens in a new tab)

A Blackstone real estate company exposed SSN digits, DOBs, addresses and more (opens in a new tab)

Hacker News ·bearsyankees ·fetched 24 Aug 2026, 23:38 UTC Research 108 points agreed2/2

Why readA firsthand writeup of a GraphQL query that accepted an arbitrary email instead of deriving identity from the session, returning another applicant's SSN last four, date of birth and address.

While applying for a lease at Beam Living, a Blackstone portfolio company, the author watched the network tab and found a profile query to pd-dlcore.beamliving.com/graphql that took the user's email as a parameter. Substituting a friend's email returned that person's partial SSN, date of birth and address, a textbook broken object level authorization failure. The useful signal is the smell itself: any GraphQL field that takes an identifier the client supplies rather than reading it from the session is worth testing, and rental and tenant screening portals hold exactly the identity data that makes it costly.

alexschapiro.com → (opens in a new tab) Discussion (opens in a new tab)

SeL4 security proofs now complete on AArch64 (opens in a new tab)

Hacker News ·snvzz ·fetched 24 Aug 2026, 19:40 UTC Research 148 points agreed2/2

Why readseL4 now has a machine-checked confidentiality proof on AArch64, completing functional correctness, integrity and information-flow isolation on the architecture most embedded and mobile targets actually ship.

Proofcraft, funded by NCSC, has finished the information-flow proof showing that the seL4 implementation code on AArch64 prevents an application from learning information it is not authorised to see, on top of the existing functional correctness and integrity proofs. That closes the isolation story on AArch64 under the stated assumption set, meaning a compromise of a non-critical component provably cannot propagate across a correctly configured partition boundary. Relevant to anyone building separation-kernel designs for automotive, avionics or mobile secure enclaves, where the proof is the security argument.

proofcraft.systems → (opens in a new tab) Discussion (opens in a new tab)

Online False Positive Reduction via Statistical Process Controls (opens in a new tab)

detect.fyi ·Nikolas Bielski ·fetched 24 Aug 2026, 11:35 UTC Must read agreed2/2

Why readApplies statistical process control and multiple-hypothesis-testing methods to online false positive reduction, treating each detection execution as a test to be screened on cost and risk rather than tuned by hand.

The argument is that FP reduction in a SOC is structurally the same problem as continuous experimentation at scale: thousands of hypothesis tests over data that keeps changing, screened statistically against cost and risk, as done in A/B platforms, quantitative funds and disease-prediction pipelines. From that framing the author builds an online screening approach for detection performance instead of the usual manual tuning loop. A position specific enough to argue with, and a genuinely different lens for anyone running detection engineering at MSSP volume.

detect.fyi → (opens in a new tab)

CISA’s logging guidance works beyond government (opens in a new tab)

Help Net Security ·Zeljka Zorz ·fetched 24 Aug 2026, 11:35 UTC agreed2/2

Why readCISA's August 2026 Logging Reference Architecture, written for OMB M-26-14 compliance, is explicitly offered to critical infrastructure operators as a logging design baseline.

The LRA reframes logging strategy around a single test: when an attack lands, can the logs you collected actually detect it and support reconstruction afterwards. It exists to help federal civilian agencies meet OMB M-26-14 requirements, and CISA states the guidance applies beyond government. Worth reading against your own retention and coverage decisions, though this piece is a summary of the document rather than the document itself.

helpnetsecurity.com → (opens in a new tab)

How a team of entity maintainers monitors, connects and scores entities in Elastic Security (opens in a new tab)

Elastic Security Labs ·fetched 24 Aug 2026, 19:40 UTC agreed2/2

Why readExplains how Elastic's Entity Store resolves scattered accounts into one identity using background maintainer jobs rather than rebuilding flat entity records from raw logs on demand.

Elastic walks through the entity analytics graph: each entity is a continuously enriched living record, with separate maintainers owning one facet apiece, drawing edges between users, hosts and devices and resolving duplicate accounts to the same identity. The stated design argument, that history and change matter because baselines, risk scores and AI reasoning are only as good as the entity records beneath them, is a real position. It is also a tour of one vendor's product internals, so the value stops at the boundary of an Elastic deployment.

elastic.co → (opens in a new tab)

Salesforce gave every org the same free scanner. Attackers already know what it misses. (opens in a new tab)

Cybersecurity Dive ·Matt Meyers, CTA, Founder and CEO, EzProtect ·fetched 24 Aug 2026, 23:38 UTC agreed2/2

Why readArgues that files uploaded by anonymous users to Salesforce Experience Cloud portals land in your system of record unscanned, and asks who owns the malicious one.

The piece makes one usable point: Experience Cloud guest upload paths write attacker-controlled files straight into the org's data store, and most security teams reviewing agent permissions and AI governance cannot say what happens to those files. It is written by the founder of a Salesforce file-scanning vendor and resolves toward the gap his product fills, with the 90% of the Fortune 500 figure doing most of the argumentative work. Worth the question it raises about your own portal configuration; not worth it as research.

cybersecuritydive.com → (opens in a new tab)

The True Meaning of Consent in ‘Consent Extractions’ (opens in a new tab)

ElcomSoft ·Oleg Afonin ·fetched 24 Aug 2026, 11:35 UTC Must read agreed2/2

Why readSince iOS 26.4, Stolen Device Protection is on by default and demands Face ID or Touch ID before the Trust This Computer prompt away from familiar locations, so a known passcode is no longer sufficient for an extraction.

Knowing the passcode used to be the whole key to a so-called consent extraction; on iOS 26.4 Stolen Device Protection adds a biometric requirement before Trust is confirmed when the device is away from its familiar locations. The piece separates four distinct situations that the single word consent is made to cover, from a cooperating owner through compelled disclosure, and maps each against the technical prerequisite. The practical consequence is that outcome now depends on build, location, clock and jurisdiction rather than on credentials alone, which changes how examiners should sequence and document an acquisition.

blog.elcomsoft.com → (opens in a new tab)

Update: base64dump.py Version 0.0.31 (opens in a new tab)

Didier Stevens ·Didier Stevens ·fetched 24 Aug 2026, 07:39 UTC agreed2/2

Why readNew base64dump.py build for anyone who runs the Didier Stevens toolkit, tied to the zipdump metadata-encoding change.

Version 0.0.31 of base64dump.py is out, with the change documented alongside the recent zipdump.py metadata encoding work. Hashes are published for the archive (SHA256 9475E418...). Small maintenance bump rather than a new capability, but the tool is a staple of malware triage and archive analysis.

blog.didierstevens.com → (opens in a new tab)

Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Ranking (opens in a new tab)

arXiv cs.CR (AI) ·Arulnidhi Karunanidhi ·fetched 24 Aug 2026, 03:39 UTC Must read Research agreed2/2

Why readMeasures agent memory poisoning end to end: 1.2% of a LongMemEval corpus poisoned drops accuracy from 0.850 to 0.300, and a write-time screening pipeline catches none of it.

Plainly worded false assertions, generated in one pass with no trigger words or retriever optimisation, were written into persistent agent memory. A four-stage screening pipeline that reaches 0.832 recall on indirect prompt injection rejected 0 of 360 poisoned memories, which the authors use to argue that content-only screening cannot separate false assertions from true ones without external grounding. Provenance-weighted retrieval at the shipped weight is statistically indistinguishable from no defence (p=0.80), and a stronger weight recovers utility only by discarding untrusted content wholesale, so it fails where the answer-bearing evidence is itself untrusted.

arxiv.org → (opens in a new tab)

AID-Guard: Stateful Authorization for Delegated Agent Effects (opens in a new tab)

arXiv cs.CR (AI) ·Yingzhe Tong, Leyu Dai, Songhui Guo ·fetched 24 Aug 2026, 07:39 UTC Research agreed2/2

Why readProtocol for closing the gap between approving an agent's tool call and the effect actually committing, with a working MCP and Stripe prototype.

AID-Guard revalidates the approved request against provider state at commit time rather than at admission, holds a single reservation under ambiguity, and only releases or permits one successor after a terminal result or a certified no-effect delivery fence. The Python/SQLite prototype produced no unauthorized provider effects across 13 live mutations in a loopback MCP domain, linearizable behaviour across three concurrent histories, and 210 Stripe provider-contract trials matching predeclared outcomes. Directly relevant to anyone letting an agent touch a payment or provisioning API where a retry can double-charge.

arxiv.org → (opens in a new tab)

ClawSentry: A Progressive Multi-Tier Security Monitor for Safeguarding Autonomous LLM Agents (opens in a new tab)

arXiv cs.CR (AI) ·Kai Wang, Zeming Wei, BiaoJie Zeng, Chang Jin ·fetched 24 Aug 2026, 15:40 UTC Research agreed2/2

Why readAn open-source, framework-agnostic gateway that intercepts agent risk at four distinct points in the control loop rather than one, with the threat model spelled out.

ClawSentry treats agentic risk as progressive and places controls at skill admission, invocation-time intent, execution-time effect and post-action consequence, arguing that existing safeguards are local to a single lifecycle boundary and so miss a denied objective that reappears in another surface form, tool or turn. Skill packages get First-use Skill Package Review against a deterministic evidence floor before execution, escalating unresolved cases to bounded read-only agentic review; runtime decisions run through a deterministic L1 layer, a rule-anchored L2 semantic reviewer and a read-only L3 evidence tier. Useful as a reference architecture for anyone wiring guardrails around tool-using agents.

arxiv.org → (opens in a new tab)

DobermanCore/Doberman-Core: Your AI's guard dog. Doberman sits at runtime, gating every input, output and tool call to stop unsafe or unintended actions before they execute. (opens in a new tab)

GitHub: new security tools ·DobermanCore ·fetched 24 Aug 2026, 23:38 UTC Must read Research ★ 216 agreed2/2

Why readAn open-source, local-first MCP proxy that sits on the execution path of a coding agent and returns exactly one allow or deny verdict per tool call, with fail-closed and raise-only guarantees.

Doberman inserts itself between an AI coding agent and its tools (files, shell, MCP servers, APIs) as a transparent MCP proxy or host hook, so destructive commands, secret reads and prompt-injection-driven exfiltration are adjudicated before execution rather than flagged afterwards. Two stated design commitments make it testable: uncertainty denies, and policy can tighten automatically but never loosens silently. It works with Claude Code, Codex, OpenClaw and other MCP clients, and ships a dashboard with a human approval path for high-risk calls.

github.com → (opens in a new tab)

LLMs could control their host machines by exploiting inference engines (opens in a new tab)

Hacker News ·zdw ·fetched 24 Aug 2026, 23:38 UTC Must read 78 points agreed2/2

Why readArgues that a model can escape to its own host by emitting token sequences that exploit the inference engine, and grounds it in CVE-2025-9141, an arbitrary code execution bug in vLLM's XML tool parser for Qwen3 Coder.

The essay treats the inference host as the target: it runs frontier compute, holds the weights, and has privileged datacentre network access. Because the model controls the token stream fed back into parsers in vLLM or SGLang, a malicious or hijacked model can aim output at parser bugs rather than at a human reader, with the vLLM Qwen3 Coder tool-parser RCE as the existence proof. It reframes output filtering as an attack surface question rather than a content question, which is a useful lens if you run self-hosted inference.

boydkane.com → (opens in a new tab) Discussion (opens in a new tab)

TraceGrant: A Contract-Governed Security Framework for the Task-Effect Lifecycle of Networked LLM Agents (opens in a new tab)

arXiv cs.CR (AI) ·Bohao Liao, Jingchao Wang, Qipeng Song, Jin Cao ·fetched 24 Aug 2026, 11:35 UTC Must read Research agreed2/2

Why readA contract-based mediation design for networked LLM agents that reports zero successful attacks across 949 AgentDojo and 400 Agent Security Bench cases.

TraceGrant derives a task-effect boundary from the trusted user request before execution, then permits retrieved evidence to instantiate only authority the contract already granted, and finally verifies task completion against actual tool results rather than model claims. The design targets the gap most defences leave open, which is the disconnect between user intent, runtime evidence and realized external effects. The evaluation covers 1,349 attack cases under fixed benchmark settings, so read the results as benchmark-bounded rather than as a general guarantee.

arxiv.org → (opens in a new tab)

CVE-2026-62316 (CVSS 8.8): Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_ser (opens in a new tab)

NVD ·fetched 24 Aug 2026, 07:39 UTC CVE-2026-62316 CVSS 8.8 EPSS 0.3% agreed2/2

Why readConcrete DNS rebinding against a local MCP server: Microsoft UFO's FastMCP endpoint on localhost:8010 validates no Host, Origin or Sec-Fetch-Site header, so a web page can enumerate tools/list and call execute_command.

CVE-2026-62316 affects Microsoft's UFO automation framework before 3.0.8, where ufo/client/mcp/http_servers/linux_mcp_server.py binds a streamable HTTP MCP server to localhost without origin checks. A malicious page uses DNS rebinding to reach /mcp, read the tool schemas, and invoke execute_command to read files or run permitted OS commands as the logged-in user, gated only by possession of a valid UFO_MCP_API_KEY. Fixed in 3.0.8, and worth reading as the template for auditing every other locally bound MCP server in your estate, since the missing-header pattern is not specific to UFO.

nvd.nist.gov → (opens in a new tab)

Trustworthy RAG: An Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Generative AI Systems (opens in a new tab)

arXiv cs.CR (AI) ·Balkrishna Giri, Md Toufique Hasan, Jussi Rasku, Muhammad Waseem ·fetched 24 Aug 2026, 19:40 UTC Research agreed2/2

Why readA concrete RAG poisoning detector with published numbers: 91% accuracy and 100% precision on TruthfulQA with Llama 3.3 70B, and the honest admission that in-place entity swaps still evade it.

The paper proposes middleware that sits between retrieval and generation, combining NLI factual verification with a five-signal poison detector and a Trust Index T = 0.4F + 0.35C + 0.25(1-P) plus a dampener for heavily contaminated contexts. On TruthfulQA with Llama 3.3 70B it reports 91% accuracy, 100% precision and 100% recall against instruction injection, while subtle in-place edits such as entity swaps remain hard to catch. The Trust Index holds ROC-AUC of 0.73 to 0.81 across three models, and the authors find generation style matters more than model size, with per-model threshold calibration needed to keep the baseline.

arxiv.org → (opens in a new tab)

$Z^2$-ACT: End-to-End Verifiable Agentic Intent Control for Open 6G RAN (opens in a new tab)

arXiv cs.CR (AI) ·Sunder Ali Khowaja, Kapal Dev, George C. Alexandropoulos ·fetched 24 Aug 2026, 23:38 UTC Research agreed2/2

Why readProposes stacking intent contracts, adversarial prompt checks and zero-knowledge audit into the O-RAN RIC control loop so LLM-driven network changes are verifiable before they execute.

Z2-ACT combines four previously separate primitives (typed intent contracts, adversarial prompt verification, a self-management release gate, and cryptographic audit) across non-real-time and near-real-time RICs in disaggregated 6G RAN. The claim is that pre-realization safety and cross-domain audit only hold when these are integrated rather than deployed in isolation. The abstract states no evaluation results, and the audience is narrow: telco security architects working on multi-vendor RAN.

arxiv.org → (opens in a new tab)

TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 24 Aug 2026, 07:39 UTC agreed2/2

Why readSets the current high-water mark for US child privacy enforcement, useful as a reference figure if your service has any under-13 population.

TikTok will pay $400 million to settle the 2024 DoJ and FTC suit alleging it knowingly let under-13s create accounts, collected their data in Kids Mode, and ignored parental deletion requests. The structure matters: $300 million is due immediately and the remaining $100 million only on an order vacating the earlier Musical.ly consent decree. ByteDance had argued the claims covered past practices that were inaccurate or already remediated, so the settlement resolves the case without conceding that framing.

thehackernews.com → (opens in a new tab)

When compliance reporting creates false assurance (opens in a new tab)

Compliance Week ·By Glenn Oborne CW Guest Columnist ·fetched 24 Aug 2026, 19:40 UTC agreed2/2

Why readArgues that boards mistake activity metrics for control effectiveness, and takes the arguable position that easy-to-count measures like training completion crowd out recurring failures and unresolved ownership.

The claim is that false assurance comes from how compliance information is selected and summarised rather than from any single wrong number: countable measures move to the front of the pack while uncertainty, repeat failures and weak ownership get less space because they are hard to present. Training completion is the worked example, showing who finished a course but not whether anyone understood it or would recognise the behaviour it covers. A position a reporting lead can apply and argue with, though it stays at the level of principle rather than giving a replacement reporting structure.

complianceweek.com → (opens in a new tab)

House Democrats ask GAO to study CISA workforce cuts (opens in a new tab)

Cybersecurity Dive ·Eric Geller ·fetched 24 Aug 2026, 15:40 UTC agreed2/2

Why readFive named House members have formally asked GAO to audit what CISA's roughly one-third staff loss did to its mission delivery.

Bennie Thompson and the four Democrats on the House Homeland Security cybersecurity subcommittee asked the Government Accountability Office on Thursday to examine how workforce cuts have affected CISA's ability to protect critical infrastructure and respond to threats. CISA has lost around a third of its employees since the start of the second Trump administration, including senior career officials behind major programmes, alongside scaled-back election security work and deprioritised state, local and critical-infrastructure engagement. Anyone who depends on CISA services or advisories should read this as a signal about what capacity to assume going forward.

cybersecuritydive.com → (opens in a new tab)

China’s “Mythos moment” is coming. Its release gate is already built. (opens in a new tab)

Compliance Week ·By Collin Hogue-Spears CW Guest Columnist ·fetched 24 Aug 2026, 15:40 UTC agreed2/2

Why readFrames the coming compliance fight over frontier model releases as a question of who controls the release gate, and argues China already built one while Washington assembled its own in a month.

The column contrasts the three mechanisms Washington stood up in June 2026 to govern models whose autonomous cyber and agentic capability rises to a national security concern with the generative AI framework China published in 2023. Its argument is that no Chinese lab has shipped a model in that class yet, but Moonshot's open-weight Kimi K3 already benchmarks near the top on coding and agentic tasks, and when a Chinese frontier release does land Beijing will need only a short list of additions rather than a new regime. For compliance teams the practical takeaway is that the decisive control point is the release gate itself: who receives a finished model and what evidence has to exist before that handoff. It is a guest opinion piece rather than primary research, so treat the framing as a planning prompt, not a description of settled rules.

complianceweek.com → (opens in a new tab)

UK energy chiefs briefed after Iran-linked cyber attack forces British power generator offline (opens in a new tab)

Google News: incidents · The Jerusalem Post ·fetched 24 Aug 2026, 11:35 UTC Must read agreed2/2

Why readAn Iran-linked attack took a British power generator offline, prompting a briefing to UK energy sector leadership.

A UK power generator was forced offline by a cyber attack attributed to Iran-linked activity, with energy chiefs briefed afterwards. The report reaches us as a headline only, so the operator, the generation capacity affected and the intrusion path are unstated. Even so, an OT-affecting attack on national electricity generation with state attribution is the kind of event that lands on a utility board's agenda and drives regulator contact across the sector.

Also covered byCybersecurity Dive (opens in a new tab),Homeland Security Today (opens in a new tab),ABC News - Breaking News, Latest News and Videos (opens in a new tab).

news.google.com → (opens in a new tab)

Personal Information Exposed in Apollo Global Data Breach (opens in a new tab)

DataBreaches.net ·Dissent ·fetched 24 Aug 2026, 15:40 UTC agreed2/2

Why readApollo Global Management, a private equity firm with roughly $800bn under management, has told affected individuals that social engineering gave attackers access to its cloud platforms between 6 and 10 July.

Apollo Global Management disclosed a breach exposing sensitive personal information, attributing initial access to a social engineering attack that reached some of its cloud platforms over a four-day window in July. The investigation is ongoing and the notification went to affected individuals rather than through a technical writeup, so there are no indicators or named actor yet. The pattern, help-desk or user-directed social engineering into SaaS and cloud tenants at a large financial firm, is the part peers in the sector will be asked about.

databreaches.net → (opens in a new tab)

Central Maine Healthcare reaches $1.3 million settlement agreement for data breach (opens in a new tab)

Google News: incidents · Maine Public ·fetched 24 Aug 2026, 11:35 UTC agreed2/2

Why readCentral Maine Healthcare settles a data breach class action for $1.3 million, a fresh datapoint for healthcare breach cost estimates.

A $1.3 million settlement agreement resolving litigation over the Central Maine Healthcare data breach. The item reaches us as a headline only, so the covered population, claim structure and per-record figure are not stated. The named organisation and the settlement amount are the useful facts for anyone benchmarking healthcare incident liability.

news.google.com → (opens in a new tab)

Northern Inyo Hospital Data Breach Confirmed; Linked to Aesto Health (opens in a new tab)

Google News: incidents · ClassAction.org ·fetched 24 Aug 2026, 23:38 UTC agreed2/2

Why readNorthern Inyo Hospital has confirmed a patient data breach traced to third-party vendor Aesto Health, another healthcare incident originating upstream of the covered entity.

Northern Inyo Hospital confirmed a data breach linked to Aesto Health, a third-party service provider, with class action counsel already circling. The detail available is thin: no record count, breach window or intrusion method is given. The pattern is the point for health-sector leaders, where the vendor rather than the hospital is the entry point and the notification obligation still lands on the covered entity.

news.google.com → (opens in a new tab)

24th August – Threat Intelligence Report (opens in a new tab)

Check Point Research ·urias ·fetched 24 Aug 2026, 15:40 UTC agreed2/2

Why readA quick catch-up on three fresh breach disclosures at national scale, useful mainly for the numbers you will be asked to confirm.

Check Point's weekly bulletin leads with Latvia's Road Traffic Safety Directorate confirming exposure of payment records for over 1.2 million people, roughly two-thirds of the country, plus 200,000 organizations, with identification numbers, plate numbers, amounts, dates and addresses taken via an internet-facing system. Japanese hosting provider Sakura Internet disclosed unauthorized access to rental server environments and a separate sales management system, potentially touching 1.36 million customer accounts, with malware installed on some servers. Canada's Hospital for Sick Children reported employee data theft through a third-party careers application. No actor attribution or TTP detail accompanies any of the three, so the value here is situational awareness rather than anything actionable.

research.checkpoint.com → (opens in a new tab)