Thursday, 3 September 2026

It sure looks like hackers breached a major ID card verification service (opens in a new tab)

TechCrunch Security ·Zack Whittaker ·fetched 3 Sep 2026, 03:41 UTC Must read agreed3/3

Why readA dark web lookup service is selling searches against a claimed 150 million US and Canadian driver's licenses and passports, with roughly half a million documents added daily, indicating live access to an identity verification provider rather than a static dump.

Krebs launched the investigation after finding his own license in the Nexus database, and Zach Edwards confirmed the same for his; Secretary of Defense Pete Hegseth's photo also appears in the index, and the Department of Defense says it is evaluating the reports. The daily ingest rate is the important detail, because it points at an ongoing feed from a compromised KYC vendor rather than a one-off exfiltration. Any organisation that outsources document verification should be asking its provider directly whether it is the source.

techcrunch.com → (opens in a new tab)

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access (opens in a new tab)

Microsoft Security ·Microsoft Security Research, Sagar Patil, Arlette Umuhire Sangwa, Jesse Birch and Ravikant Tiwari ·fetched 3 Sep 2026, 03:41 UTC Must read Research agreed3/3

Why readFull hands-on-keyboard chain that starts with a Teams external-collaboration message impersonating helpdesk and ends in WinRM lateral movement, with the RMM-to-MSI-to-Node.js implant sequence spelled out.

Microsoft Threat Intelligence tracked a human-operated campaign that abuses Microsoft Teams external collaboration to pose as IT support and talk users into granting an interactive remote session. Once an RMM tool gives control, PowerShell pulls down a silently installed MSI that stages a portable Node.js runtime and an obfuscated JavaScript implant for persistent C2. Post-implant activity includes host and Active Directory reconnaissance, periodic desktop screenshots, LOLBin execution of follow-on payloads, and pivoting over WinRM toward high-value assets, which gives defenders clear places to hunt: external Teams tenant policy, unexpected RMM installs, and node.exe running from user-writable paths.

microsoft.com → (opens in a new tab)

Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America (opens in a new tab)

Unit 42 ·Reese Lewis and Sara McBroom ·fetched 3 Sep 2026, 11:40 UTC Must read Research agreed3/3

Why readDocuments two live intrusion sets in Latin America where the operators self-hosted NextChat on victim infrastructure and used AI to build tooling, tracked as CL-CRI-1131.

Unit 42 details a campaign against a Mexican transportation organisation plus federal ministries and municipal water utilities in Mexico and Ecuador, run largely through living-off-the-land techniques and iterative batch scripts for data manipulation and exfiltration, with NextChat instances stood up on operational infrastructure. A second cluster hits the Brazilian financial sector through job-themed phishing against vulnerable web servers, using custom RATs, tunnelling tools and a Go-based SOCKS5 proxy whose iterative filenames suggest machine-assisted development. Self-hosted LLM front ends on attacker infrastructure are a concrete hunting artefact, as are the batch script patterns.

unit42.paloaltonetworks.com → (opens in a new tab)

The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action (opens in a new tab)

Group-IB ·fetched 3 Sep 2026, 07:38 UTC Must read Research agreed3/3

Why readDocuments the Outsider Phishing Kit (局外人) run by the actor ChenLun: 267 ready-made templates, AiTM MFA interception, and over 100,000 phishing pages across 54+ countries between December 2025 and May 2026.

Group-IB profiles a Chinese-language Phishing-as-a-Service platform whose kit ships adversary-in-the-middle capability, intercepting authentication flows to defeat multi-factor authentication, and whose operator kept running after law enforcement action. Scale is quantified: 267 templates, 100,000-plus pages identified over six months, targets in more than 54 countries. The report argues for disruption at the infrastructure and template stage rather than at the transaction, which gives fraud and brand-protection teams a different intervention point than the payment-time controls most of them run.

group-ib.com → (opens in a new tab)

Government, industry partner to shut down long-running Sality botnet (opens in a new tab)

Cybersecurity Dive ·Eric Geller ·fetched 3 Sep 2026, 15:38 UTC agreed3/3

Why readA 23-year-old botnet lost its domain infrastructure, and its long survival says more about resilient architecture than about payloads.

The Justice Department, FBI and Defense Criminal Investigative Service seized US domains belonging to the Sality botnet while CrowdStrike severed infected hosts from the network, with parallel seizures in Bulgaria, Hungary and Romania. Sality has run since 2003 through spam, credential theft, DDoS and proxy services, and from 2018 also swapped copied cryptocurrency wallet addresses for attacker-controlled ones. A nonprofit is now handling victim notification, so expect inbound notices if you have unmanaged Windows hosts.

cybersecuritydive.com → (opens in a new tab)

Gambling Goblin Turns Brazilian Government Sites Into SEO Weapons (opens in a new tab)

Infosecurity Magazine ·fetched 3 Sep 2026, 03:41 UTC agreed3/3

Why readCheck Point ties a Chinese-speaking crew it calls Gambling Goblin to compromised Brazilian government and education sites used as SEO fraud infrastructure, with custom Apache modules acting as a reverse proxy.

Check Point Research documents a campaign running since mid-2025 in which Brazilian .gov and .edu sites are compromised and fitted with custom Apache modules that silently reverse-proxy traffic to serve gambling SEO content. CPR links the cluster with medium-to-high confidence to Earth Berberoka, the Chinese-speaking group Trend Micro documented in 2022, based on overlaps in tooling including oRAT, Chinese-language strings, operator artefacts and domains mimicking trusted tech brands. This is Infosecurity's write-up; the CPR report published 2 September is the version to read for indicators.

infosecurity-magazine.com → (opens in a new tab)

Russia Turns to Sabotage, Cyberattacks Against Ukraine’s Allies (opens in a new tab)

Google News: incidents · WSJ ·fetched 3 Sep 2026, 03:41 UTC agreed2/3

Why readWSJ reports Russian activity shifting toward sabotage and cyber operations against Ukraine's allies rather than Ukraine itself, which moves European and NATO-country organisations up the target list.

The reporting describes a change in emphasis, with physical sabotage and network intrusion aimed at states supporting Ukraine. For defenders in Europe, that argues for reviewing exposure in logistics, rail, energy, and defence supply chain assets, along with physical security at facilities that have not previously modelled state sabotage. The item is a headline-level pointer to WSJ reporting, so the underlying article is where the specifics live.

news.google.com → (opens in a new tab)

Large Enterprises Targeted in Fake Merger & Acquisition Scams (opens in a new tab)

Dark Reading ·Nate Nelson ·fetched 3 Sep 2026, 23:42 UTC agreed3/3

Why readThe 'Phantom Deal' campaign builds fake merger and acquisition pretexts against large enterprises, targeting midlevel staff rather than executives to get large transfers initiated.

Operators research target companies in unusual depth and construct plausible M&A scenarios, then approach midlevel employees who can start a wire but are less likely to have been trained on executive impersonation. The inversion matters for finance-process controls: approval workflows built around CEO fraud assume the pressure comes from the top. Dark Reading's write-up is second-hand and light on indicators.

darkreading.com → (opens in a new tab)

Fake TARI refund exploited in new phishing campaigns targeting PagoPA (opens in a new tab)

translated Falso rimborso TARI sfruttato nelle nuove campagne di phishing ai danni di PagoPA

CERT-AGID (Italy) ·Francesco Tozzi ·fetched 3 Sep 2026, 15:38 UTC agreed3/3

Why readActive phishing kits impersonating PagoPA with a fake TARI waste-tax refund lure, harvesting identity data and payment card details.

CERT-AGID identified malicious sites reusing PagoPA's name, logo and visual design. The pages claim the victim overpaid TARI, the Italian waste collection tax, and walk them through an online identity confirmation and a request for account details to receive the refund. A useful brand-abuse and lure pattern for anyone monitoring Italian public sector impersonation, though the notice as published carries no indicators.

cert-agid.gov.it → (opens in a new tab)

Srsly Risky Biz: China's botnets are worth disrupting (opens in a new tab)

Risky Business News ·fetched 3 Sep 2026, 07:38 UTC agreed2/3

Why readFrames this week's US botnet disruption against China's long running practice of contracting botnet construction out to private companies, and flags a reported Qilin theft from the ATF's lawful intercept environment.

Uren and Wilson argue the takedown is worth doing but should be read as attrition rather than eviction, because the contractor model behind these espionage botnets has been running for years and will rebuild. The sharper item is the ATF breach, where Qilin appears to have taken data from CALEA systems, meaning a ransomware crew may now hold lawful intercept records. They also push back on the US water sector approach, where distributing free tools does little for utilities that have nobody to operate them.

risky.biz → (opens in a new tab)

'Breeze Comet' Tears Into Brazilian & Global Financial Systems (opens in a new tab)

Dark Reading ·Nate Nelson ·fetched 3 Sep 2026, 19:38 UTC agreed2/3

Why readNames Breeze Comet as Brazil's most capable financially motivated crew and notes it has moved from domestic banking fraud to targets outside the country.

Dark Reading profiles Breeze Comet, a Brazilian group whose operations against financial systems are aimed at direct theft rather than extortion or resale. The useful fact is the scope shift: a crew previously read as a domestic banking-fraud problem is now described as reaching global financial targets. The piece is secondary reporting and carries no indicators or concrete tradecraft, so treat it as a tracking note and go to the underlying research for anything you would actually hunt on.

darkreading.com → (opens in a new tab)

SonicWall Patches Two New Actively Exploited Zero-Days in SMA 1000 VPNs (opens in a new tab)

Security Affairs ·Pierluigi Paganini ·fetched 3 Sep 2026, 11:40 UTC Must read CVE-2026-83549 EPSS 0.9% agreed3/3

Why readTwo SonicWall SMA 1000 zero-days are confirmed exploited in the wild, including CVE-2026-83548, a CVSS 10.0 pre-auth SSRF, apparently chained with a post-auth command injection.

CVE-2026-83548 is an unauthenticated SSRF in the Appliance Work Place interface that lets a remote attacker reach sensitive functionality and perform unauthorised operations; CVE-2026-83549 (CVSS 7.8) is an OS command injection in the Appliance Management Console reachable by an authenticated administrator under specific conditions, giving remote code execution. SonicWall says attackers appear to be chaining the two against internet-facing appliances and has shipped updates; the bugs were found in-house by William Perry and Adam Babis. Patch SMA 1000 now and treat exposed appliances as suspect, since a pre-auth entry point into an SSL VPN with active exploitation is a compromise assessment, not a maintenance window.

Also covered byHelp Net Security (opens in a new tab).

securityaffairs.com → (opens in a new tab)

SonicWall Vulnerabilities Exploited in the Wild (opens in a new tab)

Truesec ·Hjalmar Desmond ·fetched 3 Sep 2026, 23:42 UTC Must read CVE-2026-83548 EPSS 1.6% agreed3/3

Why readTwo SonicWall SMA1000 bugs now in CISA KEV chain to unauthenticated RCE, with exact affected and fixed hotfix builds listed.

CVE-2026-83548 is an unauthenticated SSRF in the SMA1000 Work Place interface reaching internal functionality; CVE-2026-83549 is OS command injection in the Appliance Management Console. Chained, they give unauthenticated remote code execution on models 6210, 7210 and 8200v running 12.4.3-03453 platform-hotfix and earlier or 12.5.0-02835 platform-hotfix and earlier. Both are KEV entries, so exploitation is confirmed and there is a federal deadline; the fix is 12.4.3-03526 on the 12.4.3 branch and the corresponding 12.5.0 hotfix.

truesec.com → (opens in a new tab)

SonicWall urges immediate patching of chained vulnerabilities (opens in a new tab)

Cybersecurity Dive ·David Jones ·fetched 3 Sep 2026, 19:38 UTC Must read agreed3/3

Why readCVE-2026-83548 (CVSS 10 SSRF in the SMA1000 Appliance Work Place) is being chained with CVE-2026-83549 (CVSS 7.8 OS command injection in the Appliance Management Console) for RCE, confirmed exploited and added to KEV.

SonicWall confirmed in-the-wild exploitation of both flaws in SMA1000 appliances and is urging immediate upgrade to the latest hotfix. CISA added the vulnerabilities to the Known Exploited Vulnerabilities catalog, putting a federal remediation deadline on them. SMA1000 is an internet-facing remote access appliance and the chain gives unauthenticated attackers code execution, so treat any unpatched device as a candidate for compromise assessment rather than just patching.

cybersecuritydive.com → (opens in a new tab)

CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 3 Sep 2026, 07:38 UTC Must read CVE-2026-83548 EPSS 0.3% agreed3/3

Why readSeven new KEV entries with a federal patch deadline, led by a CVSS 10.0 pre-auth SSRF in SonicWall SMA 1000 remote access appliances.

CISA added seven flaws to the Known Exploited Vulnerabilities catalog, including CVE-2026-83548 (CVSS 10.0), an unauthenticated SSRF in SonicWall SMA 1000 appliances, and CVE-2026-83549 (CVSS 7.8), a post-auth OS command injection on the same product that yields RCE for an authenticated administrator. Also listed: CVE-2026-9586 (CVSS 9.3), an unauthenticated SQL injection in Sangoma Switchvox reachable in a single crafted request against the backend PostgreSQL database and escalating to RCE, and CVE-2026-82329 (CVSS 9.8), an improper authentication issue. Attacker payloads observed against these bugs include reverse shells and cryptocurrency miners, so exposed appliances should be treated as compromise candidates rather than simply patched.

thehackernews.com → (opens in a new tab)

Multiple vulnerabilities in SonicWall products (02 September 2026) (opens in a new tab)

translated Multiples vulnérabilités dans les produits SonicWall (02 septembre 2026)

CERT-FR (ANSSI) ·fetched 3 Sep 2026, 15:38 UTC CVE-2026-83549 EPSS 1.6% agreed2/3

Why readAuthoritative confirmation that two SonicWall SMA1000 flaws are under active exploitation, with the precise fixed builds to move to.

CERT-FR relays SonicWall bulletin SNWLID-2026-0016, covering remote code execution and SSRF flaws in SMA1000 6210, 7210 and 8200v appliances. Anything on 12.5.x below 12.5.0-02952, or any build below 12.4.3-03526, is affected. The vendor states that CVE-2026-83548 and CVE-2026-83549 are being exploited in the wild, which makes this an emergency patch on an internet-facing remote access appliance.

cert.ssi.gouv.fr → (opens in a new tab)

WordPress backup plugin flaw exposes millions of sites to takeover attacks (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 3 Sep 2026, 03:41 UTC agreed3/3

Why readCVE-2026-19949 is an unauthenticated second-order SQL injection in All-in-One WP Migration and Backup through version 7.109, reachable by planting crafted data via WordPress trackbacks.

Wordfence details a second-order SQL injection in the All-in-One WP Migration and Backup plugin caused by incorrect parsing of escaped backslashes and quotation marks when the plugin rewrites database content during archive restoration. An unauthenticated attacker plants the payload through WordPress trackbacks; it fires later when an administrator exports and imports the site, both routine operations for this plugin, leading to code execution and site takeover. Versions through 7.109 are affected across a very large install base, so update and audit trackback content on sites where migrations are planned.

Also covered byNVD (opens in a new tab).

bleepingcomputer.com → (opens in a new tab)

Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help (opens in a new tab)

Zscaler ThreatLabz ·Mark Brozek (Senior Director, Product Marketing) ·fetched 3 Sep 2026, 23:42 UTC CVE-2026-62911 EPSS 1.3% agreed3/3

Why readCVE-2026-62911 is an authentication bypass in Exchange Server 2016, 2019 and Subscription Edition with public exploit code and roughly 22,000 unpatched servers still exposed.

The August 2026 Patch Tuesday fix addresses an auth bypass rated CVSS 8.0 that lets a low-privileged attacker take over every mailbox on the server, reading and sending mail and pulling attachments. Shadowserver counted about 22,000 exposed unpatched Exchange servers as of 1 September, including roughly 6,200 in the US and 5,100 in Germany, and NCSC-NL has confirmed working exploit code is public. The back half of the post pivots to Zscaler's own architecture pitch, so take the patching and exposure data and leave the rest.

zscaler.com → (opens in a new tab)

Signature Optional - Analysis of CVE-2026-28323 (opens in a new tab)

Bishop Fox ·fetched 3 Sep 2026, 19:38 UTC CVE-2026-28323 EPSS 0.7% agreed3/3

Why readWalks the mechanics of CVE-2026-28323, an unauthenticated SAML bypass in SolarWinds Web Help Desk 2026.1 and earlier where a forged, unsigned SAML Response plus a known username yields a session in one HTTP request.

Bishop Fox dissects the SolarWinds WHD SAML stack and shows signature verification was effectively optional: an attacker POSTs a self-constructed SAML Response naming an existing account to the login endpoint, with no Identity Provider, signature or credentials involved. SolarWinds fixed it in WHD 2026.2.1 on 30 July 2026 by replacing the legacy SAML code with Spring Security's SAML2 service provider library, which enforces signature checks by default; the same release fixed CVE-2026-28299, a CVSS 8.2 denial of service. EPSS is still low at 0.007, but WHD is frequently internet-facing and the attack fits in a single request, so patch state is worth confirming rather than trusting.

bishopfox.com → (opens in a new tab)

Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability (opens in a new tab)

SecurityWeek ·Ionut Arghire ·fetched 3 Sep 2026, 11:40 UTC CVE-2026-19949 EPSS 0.5% agreed3/3

Why readCVE-2026-19949 in All-in-One WP Migration and Backup, installed on over three million WordPress sites, chains a second-order SQL injection to unauthenticated RCE.

The plugin's archive restore path insufficiently escapes user input and does not properly prepare queries, so an attacker can submit two trackbacks to a public post to leak the secret key that protects the otherwise unauthenticated import operation, then use that key to restore a malicious .wpress archive and gain code execution. CVSS is 8.8 and Defiant is the reporting party. EPSS currently sits at 0.005 with no reported exploitation, but the install base and the full unauthenticated chain make patching urgent for anyone running it.

securityweek.com → (opens in a new tab)

CVE-2026-69664 (CVSS 8.7): Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial (opens in a new tab)

NVD ·fetched 3 Sep 2026, 23:42 UTC Research CVE-2026-69664 CVSS 8.7 EPSS 0.7% agreed3/3

Why readUnauthenticated worker exhaustion in Erlang/OTP inets httpd: a chunk-size line that is not hex, delivered in a separate write, permanently leaks the connection's worker.

When a chunked request body arrives in the same write as the headers, httpd_request_handler:handle_body/3 catches the {error, {chunk_size, _}} throw from http_chunk:decode_size/4 and returns 400. Split the chunk-size line into a later write and the decoder resumes through a bare catch in handle_info/2, which turns the throw into a return value that is then treated as the next decoder continuation, so the worker is never released and no timeout reclaims it. Default configuration is affected and no authentication is required, so repeating the request across connections consumes every worker.

nvd.nist.gov → (opens in a new tab)

Decade-old PostgreSQL flaw turns backup account into a backdoor (opens in a new tab)

CSO Online ·fetched 3 Sep 2026, 15:38 UTC CVE-2026-6471 EPSS 0.3% agreed3/3

Why readCVE-2026-6471 lets any account holding the REPLICATION attribute load and run code on a PostgreSQL server, in every version back to 9.4.

Cyera's PostGREShell finding abuses PostgreSQL replication functionality so a low-privilege backup account can load and execute arbitrary code on Windows, Linux and macOS, then escalate to superuser with persistent access. Affected versions run back to 9.4 from 2014; fixes shipped 13 August in 18.6, 17.11, 16.15, 15.19 and 14.24. EPSS is currently negligible at 0.003 and there is no reported exploitation, but replication accounts are commonly handed out to backup and monitoring tooling and rarely treated as privileged, which is what makes this worth auditing rather than just patching.

csoonline.com → (opens in a new tab)

CVE-2026-19806 (CVSS 8.8): The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypa (opens in a new tab)

NVD ·fetched 3 Sep 2026, 19:38 UTC CVE-2026-19806 CVSS 8.8 EPSS 0.4% agreed3/3

Why readA WordPress helpdesk plugin derives its site-wide AES key from about 19.5 bits of entropy, leaving a 729,000-candidate keyspace a subscriber can brute-force offline to forge admin tokens.

CVE-2026-19806 affects Support Genix through 1.4.52, where guest_ticket_login() and its p parameter accept tokens encrypted with an AES-256-CBC key built from three wp_rand(10, 99) values and a Unix timestamp passed through md5(). The IV is derived deterministically from the password, there is no authentication tag, and the /sgnix/?p=<token> endpoint applies no capability check, nonce or session validation. A subscriber-level attacker who captures one legitimate guest ticket token as known plaintext and bounds the plugin activation timestamp can recover the site key offline and forge a ticket_id and ticket_user pair for administrator takeover.

nvd.nist.gov → (opens in a new tab)

The DRM Flag That Isn’t DRM (opens in a new tab)

IOActive ·Christian Powills ·fetched 3 Sep 2026, 19:38 UTC Research agreed3/3

Why readExplains what Windows SetWindowDisplayAffinity actually guarantees and the ways an attacker on the same desktop routes around the black-rectangle screenshot block.

Vendors of messaging apps, password managers and exam browsers advertise SetWindowDisplayAffinity as "screenshot protection" and procurement treats it as exfiltration mitigated, but Microsoft's own API documentation states there is no guarantee the flag strictly protects window content. The post separates the guarantee (PrtSc, screen share and Recall capture return black) from what remains available to code running in the same session, and argues a blacked-out screenshot is the start of a threat model rather than proof of one. Useful both as red-team knowledge and as a control-validation argument against a checklist item.

ioactive.com → (opens in a new tab)

ASCII smuggling crosses over from AI prompt injection to phishing evasion (opens in a new tab)

Microsoft Security ·Microsoft Security Research, Noam Kochavi and Sarah Wolstencroft ·fetched 3 Sep 2026, 19:38 UTC Must read Research agreed3/3

Why readA hunting signature and telemetry baseline for invisible Unicode tag characters now being used to break lure words apart so mail filters never see them.

Microsoft researchers found a high-volume phishing campaign using Unicode tag characters, the same invisible range that AI prompt-injection research made familiar as ASCII smuggling, but pointed at a different target: splitting financial lure terms such as 'funding' so that email filter text parsing fails to match them. Hits on their detection signature rose sharply from 9 February 2026 and stayed elevated on weekdays for roughly three months, which makes this a sustained campaign rather than a proof of concept. The write-up includes how the signature was built and where the detection gap sits, so it is directly usable by anyone running mail filtering or writing content rules.

microsoft.com → (opens in a new tab)

Containers Don't Keep Secrets: Scanning Docker Hub for Leaked Credentials and Private Keys (opens in a new tab)

Binarly (firmware) ·fetched 3 Sep 2026, 15:38 UTC Must read Research agreed3/3

Why readA sweep of more than 90,000 Docker Hub namespaces found live credentials and private keys, and correlated the exposed keys back to internet-facing services to prove they still worked.

Binarly scanned over 90,000 Docker Hub namespaces for leaked secrets, validated which findings were exploitable rather than stopping at pattern matches, and matched exposed private keys against reachable services on the internet. The team also used a model-assisted triage step to cut false positives at that scale. The takeaway for anyone publishing images is that build-time secrets survive in layers and are being harvested from a public registry, so image scanning belongs in the publish path and not only the pull path.

binarly.io → (opens in a new tab)

When Does Authorization End? Effect Closure at Provider Boundaries (opens in a new tab)

arXiv cs.CR (all) ·Igor Santos-Grueiro ·fetched 3 Sep 2026, 15:38 UTC Research agreed3/3

Why readFormalises why revoking a grant does not always stop its effects, and shows three concrete ways closure fails across GitHub, Kubernetes, NATS and Kafka.

The paper defines policy-relative effect closure: a grant is closed only when no existing authorization retains a path to an effect the application would reject, and no new ones can be issued. EFFECTBOUND reduces the question to finite control with hidden state and returns a strategy, an impossibility certificate, or no verdict when evidence is insufficient, with machine-checked proofs for the reduction and checker soundness. Applied to four real platforms, closure fails three ways: the interface lacks a needed control, clean visible state hides active work, or the model stops before the effect frontier. Abstract, but it names a failure mode identity teams routinely assume away when they revoke a token.

arxiv.org → (opens in a new tab)

SPADE: SPaT Attack Detection from the Connected Vehicle's Perspective (opens in a new tab)

arXiv cs.CR (all) ·James Di Novo, Hany Ragab, Sylvain P. Leblanc ·fetched 3 Sep 2026, 19:38 UTC Research agreed3/3

Why readA labelled dataset for detecting forged Signal Phase and Timing messages from the vehicle's side, covering six attack classes injected at the SAE J2735 application layer.

SPADE fills a gap in connected-vehicle IDS research: existing work defends roadside infrastructure or targets BSM/CAM misbehaviour, leaving the onboard perspective on SPaT integrity unaddressed. The dataset is generated in Eclipse MOSAIC with runtime attack injection across six attack classes plus benign traffic, spanning four intersection geometries and six operating conditions. Relevant if you work on V2I trust assumptions or automotive intrusion detection, since it assumes a compromised RSU or peer vehicle that passes conventional authentication.

arxiv.org → (opens in a new tab)

Overcoming the Randomness-Utility Trade-off in Answering Differentially Private Linear Queries (opens in a new tab)

arXiv cs.CR (all) ·Surendra Ghentiyala, Pritish Kamath, Ravi Kumar, Pasin Manurangsi ·fetched 3 Sep 2026, 11:40 UTC Research agreed2/3

Why readShows the random bits needed to answer differentially private linear queries can drop to logarithmic in the query count without losing accuracy, which only matters where entropy is a metered resource.

The authors construct a randomness-efficient analog of the Hardt and Talwar K-norm mechanism, answering d linear queries with O(d/epsilon) infinity-norm error while consuming only O(log d) expected random bits, and show this is optimal when epsilon is at most 1/d. A computationally efficient variant is also given, paying an O(log d) multiplicative penalty in error. It is pure theory with no implementation or deployment guidance; the one practical hook is settings where randomness is genuinely expensive, such as differential privacy layered on secure multiparty computation or entropy-starved enclaves.

arxiv.org → (opens in a new tab)

Elcomsoft Quick Triage 2.2: Timeline, file system snapshot, and a plugin engine (opens in a new tab)

ElcomSoft ·Oleg Afonin ·fetched 3 Sep 2026, 11:40 UTC agreed3/3

Why readQuick Triage 2.2 adds a merged forensic timeline across six artefact groups, a metadata-only filesystem snapshot, and a plugin API for writing your own artefact parsers.

The Timeline view normalises timestamps from browser history and downloads, SRUM data usage and registry network lists, recent files and folders, and application usage onto one sorted axis instead of leaving the examiner to interleave tables by hand. The filesystem snapshot captures metadata without file contents, which keeps the collection small enough to move off a scene. The release also brings MSA password attacks, OpenDocument parsing and recursive archive parsing in full-text search; the plugin engine is the part with the longest tail, since parsers no longer have to come from the vendor.

blog.elcomsoft.com → (opens in a new tab)

Incident response guide for AWS CloudTrail investigations – Part 2 (opens in a new tab)

AWS Security ·Oscar Diaz ·fetched 3 Sep 2026, 23:42 UTC agreed3/3

Why readShows which CloudTrail events actually stitch an SSRF into IMDSv1 credential theft into cross-Region Bedrock abuse, rather than describing the attack chain in the abstract.

Part two of the AWS incident response guide works a single multi-stage scenario end to end: a web application SSRF reaches the EC2 instance metadata service over IMDSv1, harvested role credentials are then used to call Bedrock across several Regions. The value is in the investigative mechanics, which log fields correlate the stages and how to scope the blast radius once you spot the first anomalous call. It closes with containment and hardening steps, including the IMDSv2 enforcement and Region restriction controls that would have broken the chain.

aws.amazon.com → (opens in a new tab)

CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation (opens in a new tab)

arXiv cs.CR (AI) ·Varun Gadey, Ziad Marey, Alexandra Dmitrienko ·fetched 3 Sep 2026, 15:38 UTC Must read Research agreed3/3

Why readShows a black-box attacker can plant one task-matched artefact in a RAG code corpus and get a chosen CWE into the generated code, without touching the model or the knowledge base.

CodePoisonRAG turns benign fixed-code entries into poisoned artefacts using two steps: CWE-specific vulnerability injection, which embeds a chosen source-to-sink flow while keeping the entry semantically aligned to the target task, and semantic mislabeling, which attaches false safety claims so the entry survives review and reranking. The threat model assumes no access to the victim's deployed knowledge base, retriever, reranker or generator, which moves this from a general degradation result to targeted weakness selection. For anyone wiring internal patch or documentation corpora into a coding assistant, it makes the retrieval corpus a code-integrity boundary that needs provenance controls.

arxiv.org → (opens in a new tab)

ACLE-MCP: Attested Capability Leases for Execution-Time Trust in Remote LLM Tool Use (opens in a new tab)

arXiv cs.CR (AI) ·Zhiyang Ding, Yang Luo, Guangpu Chen, Qingni Shen ·fetched 3 Sep 2026, 19:38 UTC Research agreed3/3

Why readNames and attacks the post-authorization execution trust gap in remote MCP: an OAuth token stays valid even when the provider-side workload executing the tool call has been substituted or routes through undeclared downstream components.

ACLE-MCP proposes invocation-scoped, short-lived, sender-constrained capability leases binding the expected workload identity, freshness requirement, operation, object and parameter bounds, downstream constraints and receipt obligations, enforced by a provider-side Execution Gate immediately before protected tool logic runs. The authors built a runnable prototype using Keycloak/OIDC validation against an MCP service. The threat model is the useful part for anyone standing up remote MCP servers: OAuth authorization proves who asked, not what executed.

arxiv.org → (opens in a new tab)

Top AI coding agent security resources — September 2026 (opens in a new tab)

Adversa AI ·fetched 3 Sep 2026, 07:38 UTC agreed2/3

Why readPulls the post Black Hat coding agent findings into one place, including GhostJacking hitting 90% against a Claude Code configuration the vendor itself recommends and default GitHub Actions workflows from Anthropic, Google, and OpenAI all reaching remote code execution.

The common failure across these results is that the agent trusts an input nobody in the stack treats as attacker controlled: GhostJacking uses a WAF's own block log as the delivery channel, so the firewall faithfully records a payload that the agent later executes while reviewing blocked traffic. The CI findings are the more immediate operational problem, since a single unauthenticated issue was enough against all three vendors' published default workflows, and Google rated its own Gemini CLI case a 10.0. This is curation rather than primary research and the source is a vendor, so read it as a pointer list into the underlying advisories and the 2,826 file skills benchmark rather than as the evidence itself.

adversa.ai → (opens in a new tab)

Claude Mythos only model to complete full cyber kill chain, experts say (opens in a new tab)

The Register Security ·fetched 3 Sep 2026, 03:41 UTC Must read agreed3/3

Why readBooz Allen's first Cyber Weapon Index found exactly one of 18 tested US and Chinese models completed a full kill chain autonomously, and predicts the rest get there within six months.

In Booz Allen's testing, Anthropic's Claude Mythos was the only model to complete the full cyber kill chain autonomously, though the firm expects most of the other 17 US and Chinese models tested to reach the same weaponization level inside six months. OpenAI separately said its unreleased Astra model crossed its own critical cybersecurity capability threshold, meaning it is judged capable enough at finding and exploiting zero-days to pose a risk from misuse or misalignment. The index frames mainstream AI-enabled attacks from ransomware crews and state actors as imminent rather than speculative.

theregister.com → (opens in a new tab)

The Implications of Linguistic Illegibility for LLM Security (opens in a new tab)

arXiv cs.CR (AI) ·James Mickens ·fetched 3 Sep 2026, 07:38 UTC Research agreed3/3

Why readArgues that chain-of-thought monitoring, constitutional self-critique and activation probing are unsound as security controls in principle, not just in practice, so isolation has to carry the guarantee.

The paper introduces "linguistic illegibility" for cases where a model's externalised text or mechanistically-probed features do not represent its actual computation, which is math over activation spaces with lossy translation at each end. The consequence for defenders is direct: any control that depends on the model's linguistic self-reporting can never be complete, so the sandbox around an agent needs guarantees that do not rest on interpretability. A position paper rather than an empirical result, but it commits to a claim that agent-security architects can act on and dispute.

arxiv.org → (opens in a new tab)

Automated Vulnerability Injection in Smart Contracts Using Large Language Models (opens in a new tab)

arXiv cs.CR (AI) ·Luca Migliaccio, Roberto Natella, Naghmeh Ivaki, Nuno Laranjeiro ·fetched 3 Sep 2026, 23:42 UTC Research agreed3/3

Why readMeasures how well LLMs can synthesise ground-truth vulnerable Solidity contracts for benchmarking, and reports a 16.58% survival rate after validation.

The authors prompt LLMs to inject 49 OpenSCV vulnerability types into real SmartBugs contracts, then validate each variant through compilation, execution, business-logic and vulnerability-presence checks. Nearly 1,000 candidates reduce to 32 confirmed vulnerable contracts across 25 types, clustering in structurally simple targets and vulnerability classes with localised syntactic patterns. Running three static analysers over the survivors shows complementary blind spots, and the paper is candid about LLM non-determinism and semantic drift as the limiting factors.

arxiv.org → (opens in a new tab)

OpenAI begins rolling out Astra model after warning of its advanced cyber capabilities (opens in a new tab)

CNBC Technology ·fetched 3 Sep 2026, 19:38 UTC Must read agreed2/3

Why readThe first time a frontier lab has shipped a model it classifies as Critical for cyber capability, and the access controls it chose in response.

OpenAI is rolling out GPT-6 Astra in phases, starting with a limited set of companies in its application-based Daybreak cybersecurity program before broader availability across ChatGPT paid tiers, the API and AWS. Earlier this week the company said Astra is its first model to cross the Critical threshold on its internal cybersecurity scale, and that it would restrict the advanced capabilities accordingly. The reporting is launch coverage rather than technical evaluation, so the capability claims come from the vendor, but the threshold crossing and the gating model set a reference point defenders and policy teams will be measured against.

cnbc.com → (opens in a new tab)

Machine Speed is a lie: stop trying to fight AI with AI (opens in a new tab)

MalwareTech ·fetched 3 Sep 2026, 23:42 UTC agreed3/3

Why readA working practitioner takes apart the 'machine speed' premise that vendors use to argue you need AI defence to survive AI attack.

The argument is that automation in offensive operations is not new, that mass scanning, credential stuffing and worm propagation have run at machine speed for decades, and that the industry survived them through architecture rather than through faster reaction. On that reading, buying reactive AI tooling to shorten detection time is answering the wrong question, because the controls that actually blunt automated attacks are preventive and were available before any of this. Useful as ammunition when someone brings an AI-versus-AI pitch to a budget conversation, though it is a position piece and offers no measurements to back the timeline claim.

malwaretech.com → (opens in a new tab)

SafeEvolve: Harness-Policy Co-Evolution from Agent Experience for Safety Alignment (opens in a new tab)

arXiv cs.CR (AI) ·Qinghua Mao, Wanying Qu, Dadi Guo, Leitao Yuan ·fetched 3 Sep 2026, 11:40 UTC Research agreed3/3

Why readProposes aligning LLM agent safety by co-evolving the harness (safety prompt and hierarchical skills) alongside the policy, rather than patching one or the other.

SafeEvolve takes safety evidence from completed on-policy agent trajectories and converts it into bounded, component-level updates to the harness (safety prompts and hierarchical skills), producing harness artefacts the authors describe as auditable and reversible. On the model side it runs a two-stage SFT then RL loop, where harness-use SFT teaches the policy to actually invoke the evolved artefacts and harness-augmented RL shapes autonomous safety behaviour. The framing is useful for anyone building agent guardrails, since it treats runtime control and intrinsic model alignment as one system; the abstract as given carries no benchmark numbers, so the size of the gain is unverified here.

arxiv.org → (opens in a new tab)

CVE-2026-79408 (CVSS 9.8): An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_cl (opens in a new tab)

NVD ·fetched 3 Sep 2026, 11:40 UTC CVE-2026-79408 CVSS 9.8 EPSS 1.2% agreed3/3

Why readUnauthenticated command injection in a widely forked LLM agent framework, worth an inventory check if anything in your estate points MetaGPT at repositories you do not control.

CVE-2026-79408 is rated CVSS 9.8 for an OS command injection in MetaGPT 0.8.1, reachable through the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py. Because that value reaches a shell context, any workflow that lets an attacker influence the repository path being parsed yields arbitrary command execution with the agent process's privileges, which in agent deployments often means broad credential and network access. EPSS sits near one percent, so treat this as an internal exposure question rather than an active exploitation event.

nvd.nist.gov → (opens in a new tab)

AI 'Machine Speed' Cuts 2-Week Attack Down to 10 Hours (opens in a new tab)

Dark Reading ·Elizabeth Montalbano ·fetched 3 Sep 2026, 15:38 UTC agreed2/3

Why readGives you a number to cite when arguing that detection and response windows built around human attacker tempo are already obsolete.

Researchers describe an intrusion in which frontier AI agents handled coordination across a large-scale breach, collapsing what they estimate would have been a two week operation into roughly ten hours. The claim of interest is not that agents can run attack steps, but that they can sequence and parallelise them across many targets without the pauses that normally give defenders room. Treat the ten hour figure as a single observed data point rather than a benchmark, since the underlying methodology is not in the report itself.

darkreading.com → (opens in a new tab)

Honeywell Aerospace pays $2M to settle false claims allegations (opens in a new tab)

Compliance Week ·Adrianne Appel ·fetched 3 Sep 2026, 23:42 UTC agreed3/3

Why readAnother data point that False Claims Act liability for misstated cybersecurity compliance in federal contracts is now routine enforcement, not a novelty.

Honeywell Aerospace agreed to pay just over $2 million to resolve allegations that it did not meet the cybersecurity requirements written into a Department of Defense contract. The case originated with a whistleblower, which is the pattern running through the Civil Cyber-Fraud Initiative settlements: the people who know the control gaps are inside the contractor. For anyone attesting to DoD security terms, the enforceable claim is the attestation itself, so the accuracy of your self assessment is the exposure.

complianceweek.com → (opens in a new tab)

EFF to Governor Newsom: Veto California’s AB 1709 (opens in a new tab)

EFF Deeplinks ·Rindala Alajaji ·fetched 3 Sep 2026, 15:38 UTC agreed3/3

Why readCalifornia AB 1709 would bar recommendation algorithms and follow and like signals for users under 16 from January, which platforms would have to engineer around.

The bill, passed by the legislature and now awaiting Governor Newsom's signature, treats basic ranking inputs such as who a user follows and what they like as addictive features and prohibits offering them to under-16s. EFF argues the definition sweeps in ordinary content discovery, cutting young users off from communities and from audiences for their own speech. Whatever one makes of the policy argument, the compliance shape matters: age assurance plus feature gating on a January deadline.

eff.org → (opens in a new tab)

Preparing for the Post-Quantum Era: A Call to Action (opens in a new tab)

CISA Advisories ·CISA ·fetched 3 Sep 2026, 15:38 UTC agreed2/3

Why readThe five-priority framing that G7 governments will start writing into national strategy and procurement language for post-quantum migration.

CISA and the G7 Cyber Security Working Group published a joint call to action on post-quantum cryptography, setting out five priorities: awareness of quantum risk, national adoption strategies, quantum-safe research, public-private partnership, and integration of PQC into security requirements and procurement. There is no new cryptographic or technical content here. Its value is as the reference document to cite when you need budget or mandate for a cryptographic inventory.

cisa.gov → (opens in a new tab)

US and Canadian court data exposed in Thomson Reuters breach (opens in a new tab)

The Record ·fetched 3 Sep 2026, 15:38 UTC Must read agreed3/3

Why readThomson Reuters disclosed that sealed court records and personal data were taken from its C-Track case management platform, hitting courts in at least 12 US states, the US Virgin Islands and Canada.

The company says unauthorized activity was discovered on 30 June and the investigation found files were obtained from C-Track back in March, a three-month gap between access and detection. Thomson Reuters has not named an actor, described the initial access, or given a victim count, and is stressing that the breach was inside its own environment rather than the courts' networks. Sealed court material is about as sensitive as third-party data gets, so this is the case anyone running a judicial or legal-sector vendor relationship will be asked about, and a clean example of concentration risk in a single SaaS case management provider.

Also covered byHelp Net Security (opens in a new tab),Bloomberg Law News (opens in a new tab).

therecord.media → (opens in a new tab)

Nearly 40m Tving accounts compromised in massive data breach: probe (opens in a new tab)

Google News: incidents · The Korea Herald ·fetched 3 Sep 2026, 11:40 UTC agreed3/3

Why readRoughly 40 million accounts at Korean streaming service Tving were compromised, per an official investigation, one of the largest consumer breaches disclosed in the country.

An ongoing probe puts the number of compromised Tving accounts at close to 40 million, a figure larger than South Korea's adult population and therefore covering most of the domestic streaming market. Reporting is at the disclosure stage: no attack vector, intrusion window or data categories are confirmed in the text. Regulatory follow-up under Korean privacy law is the thing to watch, and the scale makes this a question executives in consumer-facing businesses in the region will be asked about.

news.google.com → (opens in a new tab)

Luminus Health cyberattack forces Anne Arundel Medical Center to reroute patients (opens in a new tab)

Google News: incidents · WBAL News Radio ·fetched 3 Sep 2026, 03:41 UTC agreed3/3

Why readA ransomware-style disruption at Luminus Health pushed Anne Arundel Medical Center onto ambulance diversion, the clearest current example of an IT incident converting directly into degraded patient care.

The attack hit the parent health system and forced patient rerouting at the medical center, with elective procedures affected. Diversion is the metric worth noting, because it shows downtime procedures failing to hold clinical capacity rather than merely inconveniencing back office systems. Attribution and the intrusion vector have not been published.

Also covered byClassAction.org (opens in a new tab),WYPR (opens in a new tab).

news.google.com → (opens in a new tab)

Oncology firm Novocure says cyberattack exposed US patient records (opens in a new tab)

Google News: incidents · Reuters ·fetched 3 Sep 2026, 11:40 UTC agreed3/3

Why readNovocure, a Nasdaq-listed oncology device maker, has disclosed that a cyberattack exposed US patient records.

Novocure says a cyberattack resulted in exposure of patient records belonging to US individuals. The Reuters item is at disclosure stage, without record counts, data categories, intrusion dates or attribution. As a listed healthcare device firm, the disclosure brings HIPAA breach notification and likely SEC materiality questions with it, which is the angle a board will raise.

news.google.com → (opens in a new tab)

DaVita agrees to pay $15M to settle claims from data breach (opens in a new tab)

Google News: incidents · Healthcare Dive ·fetched 3 Sep 2026, 07:38 UTC agreed3/3

Why readPuts a number on healthcare breach litigation exposure: DaVita is paying $15M to settle claims from its data breach.

Dialysis provider DaVita has agreed to a $15M settlement of claims arising from its data breach. The figure is the useful part, giving boards and insurers a recent comparable for class action exposure following a large healthcare incident. No technical detail on the intrusion itself in this coverage.

news.google.com → (opens in a new tab)

FBI Probes Report That Data Breach Exposed Millions of US Driver's Licenses (opens in a new tab)

Google News: incidents · GV Wire ·fetched 3 Sep 2026, 07:38 UTC agreed3/3

Why readAn FBI investigation into a reported breach exposing millions of US driver's licenses, the kind of identity-data incident a board and a state regulator will both ask about.

The FBI is investigating a reported data breach said to have exposed millions of US driver's licence records. The report is early and the coverage carries no detail on the holder of the data, the intrusion vector or the timeline. Identity documents at this volume drive downstream fraud and state notification obligations, so leaders in sectors that consume licence data for KYC should expect questions before the facts settle.

Also covered byCleveland.com (opens in a new tab).

news.google.com → (opens in a new tab)

Attackers Behind UK Airport Cyberattack Release Stolen Data (opens in a new tab)

Google News: incidents · cybermagazine.com ·fetched 3 Sep 2026, 19:38 UTC agreed3/3

Why readThe UK airport attackers have now published the stolen data, moving the incident from disruption to confirmed exposure.

The group behind the UK airport cyberattack has released data taken in the intrusion. Publication changes the position for the operator and anyone downstream: notification obligations, third-party exposure and press attention all follow the leak rather than the outage. Expect this one raised at executive level in aviation and adjacent transport operators.

news.google.com → (opens in a new tab)

North Dakota Supreme Court impacted by third-party data breach (opens in a new tab)

Google News: incidents · KFYR-TV ·fetched 3 Sep 2026, 03:41 UTC agreed3/3

Why readA state supreme court disclosing impact from a third-party breach, relevant if you are mapping vendor exposure across judicial and public sector systems.

The North Dakota Supreme Court says it was affected by a breach at a third-party provider. Only the disclosure itself is reported; no vendor, data types or timeline are given in the available text. Worth watching alongside the wider court-system incident reported the same day.

Also covered byKTVH (opens in a new tab),CBS News (opens in a new tab),Montgomery Advertiser (opens in a new tab).

news.google.com → (opens in a new tab)