Search: “Content Authenticity Initiative”

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.

Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.

Rapid7 Blog·Sep 8, 11:01 UTC · 9d agoVulnerabilityCVE-2026-86206CVE-2026-86207CVE-2026-18577

Approval Integrity and Recovery in LLM Answer Publication

Study measures approval integrity in Lightcap LLM answer publication, finding the 14B response-act checker accepts 291 of 302 unsupported answers.

The study evaluates exact-content binding, authorization freshness, and checkpoint recovery in Lightcap's publication enforcement using 3,600 assessments over 900 human-annotated RAGTruth responses from three Ministral models. The production 14B response-act checker accepts 291 of 302 unsupported answers versus 41 for a direct-grounding baseline, with supported-answer retention of 95.2% versus 66.9%. A stateful recheck-recovery policy increases exact-match error by 9.23 percentage points relative to initial checkpoints, and controlled evidence-fingerprint changes expose asymmetric freshness enforcement between publication and recovery. A separate BIPIA prompt-injection experiment records zero target insertions among 266 valid editor outputs.

arXiv cs.CR·Sep 14, 13:48 UTC · 3d agoAI safety & security

Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows

Mirage2FA phishing-as-a-service campaign hit ~4,500 organizations, mostly US, stealing Microsoft 365 passwords and session cookies to bypass 2FA.

ANY.RUN research links the Mirage2FA phishing-as-a-service toolkit to 4,532 unique organization email domains between 2024 and 2026, with the US accounting for 63.7% of victims. The kit uses adversary-in-the-middle login flows to harvest credentials and session cookies, bypassing MFA on Microsoft 365 accounts. Researchers recorded more than 9,000 potential compromise events and estimated 48% of targeted email addresses were potentially compromised. Hijacked sessions extend to SSO-connected services, enabling impersonation, fraud and further compromise.

The Hacker News·Aug 25, 11:56 UTC · 23d agoPhishing & fraud in the wild1

Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers

NIST and CISA publish final interagency report with implementation guidance for protecting tokens and assertions from forgery and misuse.

CISA released a final NIST/CISA interagency report guiding federal agencies and cloud service providers on protecting identity assertions, access tokens, and cryptographic mechanisms underlying modern authentication and authorization. It addresses forgery, theft, and misuse of signed tokens that adversaries use for lateral movement and data access in hybrid and multi-cloud, SSO, federation, and API-based environments. The final version updates token validation, secrets management, and detection-at-scale guidance gathered via the Joint Cyber Defense Collaborative, and supports Executive Order 14306 and Secure by Design principles.

CISA Advisories·Sep 15, 12:00 UTC · 2d agoAdvisory

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.

Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.

Microsoft Security Blog·Sep 2, 22:51 UTC · 14d agoThreat actor in the wild

Accountability in Certificate Transparency and Variants

Formal Dolev-Yao analysis shows plain Certificate Transparency requires an honest log, SCT Auditing removes that assumption, and Gossiping does not.

The paper analyzes accountability in Certificate Transparency and its SCT Auditing and Gossiping extensions in the Dolev-Yao model, starting from a vanilla PKI. It finds plain CT provides accountability only under the assumption of an honest log. The SCT Auditing extension can eliminate that assumption, while the Gossiping extension cannot. CT is supported by all major browsers and obliges Certificate Authorities to record issued certificates in public, monitored logs.

arXiv cs.CR·Sep 10, 13:45 UTC · 7d agoResearch

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)

A SANS honeypot caught a real coding-agent session routed to a rogue "free" LLM endpoint, exposing a Windows user's transcript and tool outputs.

A SANS analyst describes how an internet-exposed inference honeypot was discovered, relabeled with sought-after model names like DeepSeek, and enrolled in infrastructure serving "free" LLM backends. On 2026-08-30 an opencode terminal coding agent sent an 88-message, 224 KB transcript 210 times in 91 seconds via a China Unicom relay, exposing directory listings, tool outputs and read file portions. The analyst frames tool-enabled agents treating model endpoints as trusted control planes as a novel risk — a "rogue model endpoint" that could request tool executions on the user's machine.

SANS Internet Storm Center·Aug 31, 20:00 UTC · 16d agoAI safety & security1

Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain

Pre-registered audit finds AI coding assistants verified provenance signals in only 9 of 1,920 trials before installing research software packages.

The study tested whether AI coding assistants check machine-readable trust signals such as SBOMs, signed releases, and provenance attestations before installing six open-source research software projects spanning HPC and quantum computing. Three models under two operating modes produced 1,920 registered trials scored from container logs. Provenance signals were opened in only 9 of 1,920 trials (0.5%) and zero of 384 control trials, with no trial running a verification command. The authors conclude publishing signals is insufficient and verification must be built into the program running the assistant.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 16:55 UTC · 9d agoAI safety & security1

Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

Okta finds infostealer logs contain thousands of replayable AI session tokens and API keys, letting criminals bypass MFA and access services from Google, Anthropic and OpenAI.

Okta analyzed a 7 GB infostealer dump from August 2, 2026 covering 5,871 infected machines in 162 countries and found 555 of 44,791 JWTs related to AI services, plus 1,843 unexpired JWTs and JWEs (largely set by OpenAI via NextAuth.js) and 24 still-valid API keys for Google Gemini, OpenAI, Groq and OpenRouter. Valid session tokens and API keys can be replayed with anti-detect browsers like Camoufox to bypass credential and MFA checks, fueling an underground market for AI account access known as LLMjacking, where attackers rack up victims' AI compute bills. Some 17.7% of the JWTs contained plaintext PII usable for social engineering. Google's GTIG reported growing buyer demand for Claude, Gemini, Cursor and Devin credentials, and Mandiant handled an incident where an actor used an exposed GitHub PAT to deploy unauthorized AI infrastructure and scale high-performance compute.

The Hacker News·Sep 9, 14:23 UTC · 7d agoThreat actor in the wild1

Engineered Persuasion: Evaluating Personalized Pretexts in LLM-Generated Spear Phishing

A study of 180 US workers found each LLM phishing personalization level raised click-intention odds by 28%, but credibility depends on context fit.

The arXiv paper evaluates how personalized pretexts in LLM-generated spear phishing affect perceived credibility, using 180 US working adults across 1,436 evaluations of emails with four cumulative personalization levels, from workplace context to shared-project details. Convincingness rose 2.40 points per level in sensitivity analysis and click-intention odds increased 28% per level, while non-clickers shifted toward deleting rather than reporting. Qualitative coding showed details matching the recipient's role and routines supported credibility, whereas incorrect, vague, or channel-inappropriate details raised suspicion. The authors argue personalization effectiveness depends on pretext fit, with implications for workplace security training.

arXiv cs.CR·Sep 3, 19:21 UTC · 13d agoResearch

Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

Cloudflare's Automatic Key Exchange probes origins to lead with preferred key exchange, cutting HelloRetryRequests from 52% to 3.7% and enabling automatic post-quantum origin connections.

Cloudflare announced Automatic Key Exchange, an extension of Automatic SSL/TLS that probes each origin's supported key agreement algorithms and leads with the preferred one, favoring the post-quantum hybrid X25519MLKEM768. Rollover across roughly 45 billion daily origin connections cut HelloRetryRequests from about 52% to 3.7%, saving more than 150 ms of p90 handshake latency. Hundreds of thousands of domains now receive post-quantum origin connections without manual configuration, supporting Cloudflare's goal of quantum-safe encryption by 2029 to counter harvest-now-decrypt-later attacks.

Cloudflare Blog·Sep 8, 13:10 UTC · 9d agoResearch

The inconvenient truth about AI pentesting: someone has to check all the work

Survey of 158 practitioners shows AI pentesting floods teams with findings, creating 'validation debt' most teams cannot process.

The article argues AI pentesting creates 'validation debt': discovery scales far faster than teams' ability to verify AI-generated findings. In a survey of 158 practitioners, only 20.3% had workflows to triage more than 500 AI-generated candidates per engagement, while 29.7% called such volume unmanageable. One respondent spent two days validating 300 AI findings, of which 250 were duplicates, non-exploitable, or nonexistent. The author recommends capacity planning, ruthless deduplication, and risk-based prioritization before adopting AI pentesting tools.

Security Affairs·Aug 11, 16:20 UTC · Aug 11, 2026Industry

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security News·Sep 8, 12:10 UTC · 9d agoThreat actor in the wild

LLMs and Contextual Integrity

Bruce Schneier highlights two papers: the CIMemories benchmark shows frontier LLMs leak memory attributes up to 69%, and an RL method reduces inappropriate disclosures.

Bruce Schneier discusses contextual integrity in LLMs, referencing the CIMemories benchmark, which uses synthetic profiles with 100+ attributes per user to test whether models with persistent memory disclose sensitive information appropriately. Evaluation showed frontier models exhibit up to 69% attribute-level violations, with GPT-5's violation rate rising from 0.1% to 9.6% across 40 tasks and reaching 25.1% with repeated prompting, showing unstable leakage behavior. A second paper introduces a reinforcement learning framework trained on a synthetic 700-example dataset that substantially reduces inappropriate disclosure while maintaining task performance, with improvements transferring to the human-annotated PrivacyLens benchmark.

Schneier on Security·Aug 18, 10:40 UTC · Aug 18, 2026AI safety & security1

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing

Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.

SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.

The Hacker News·Aug 11, 12:45 UTC · Aug 11, 2026VulnerabilityCVE-2026-34348

Scores Alone Do Not Prove Discovery: The Discovery Certification Protocol for Auditing AI Research Agents

Researchers introduce the Discovery Certification Protocol, an auditable test framework that verifies whether AI research agents' claimed discoveries are genuine.

The Discovery Certification Protocol (DCP) converts AI research agents' discovery claims into executable recovery and feedback tests organized as gated audits. Controlled audits in SQLite optimization and virtual catalyst control produced zero recoveries in 96 episodes, with an upper bound of 0.0468. A deterministic, LLM-free verifier reproduces audit decisions from frozen evidence, giving AI research a common evidence language for outcomes, alternative routes, and feedback effects.

Hugging Face daily papers·Sep 6, 20:00 UTC · 10d agoAI research

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Researcher disclosed two root RCE chains in Unitree G1 EDU robots (CVE-2026-76639, CVE-2026-76640), one reachable via unpaired Bluetooth, with no confirmed fixed firmware.

Security researcher Olivier Laflamme disclosed two independent root remote code execution chains in the Unitree G1 EDU robot: CVE-2026-76639, a network-adjacent path through chat_go and bashrunner, and CVE-2026-76640, a Bluetooth Low Energy path that ends with a 1,050-byte buffer overflow in btgatt-server giving root on the Locomotion PC. The BLE chain also exploits a cloud authorization gap that let any valid Unitree account recover another robot's AES key, then forces the robot onto an attacker hotspot via wpa_connect.sh heredoc injection. Unitree patched the cloud ownership check in July 2026, but no confirmed fixed firmware release addresses the BLE issues; the PoC was limited to two robots in one room and no in-the-wild exploitation is reported.

The Hacker News·Sep 2, 11:06 UTC · 15d agoVulnerabilityCVE-2026-76639CVE-2026-76640

Fluid Notarization: Verifiable Evolution of Concurrently Edited Structured Documents

Fluid Notarization anchors delta-CRDT change graphs on blockchain, providing verifiable provenance for concurrently edited documents, demonstrated on collaborative electronic health records.

The paper introduces Fluid Notarization, a paradigm that notarizes the evolution of collaboratively edited structured documents rather than isolated snapshots. It builds on Melda, a JSON-native delta-CRDT representing changes as compact content-addressed deltas linked by causal dependencies, with blockchain notarization reduced to recording identifiers of evolution artifacts while synchronization, reconstruction, and conflict resolution remain off-chain. The architecture combines deterministic CRDT convergence with independently auditable proof-of-existence, provenance, and publication evidence, validated through a prototype based on collaboratively edited electronic health records.

arXiv cs.CR·Sep 16, 16:20 UTC · 21h agoResearch

Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

Sysdig documents a skilled human attacker exploiting Marimo pre-auth RCE CVE-2026-39987 (CVSS 9.3), reaching an SSH bastion in eight seconds without AI tooling.

Sysdig detailed exploitation of CVE-2026-39987 (CVSS 9.3), a pre-authenticated RCE affecting all Marimo versions that came under active exploitation within hours of disclosure. A human operator used a hand-written Python script to harvest an AWS key from Secrets Manager and SSH into a bastion host in eight seconds, issuing 850+ commands over nine hours. Separately, Hunt.io disclosed an XMRig cryptomining campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection. Operation CameraSwarm, linked to a single operator, compromised over 14,000 Dahua IP cameras using CVE-2021-33044 and CVE-2021-33045.

The Hacker News·Sep 15, 11:52 UTC · 2d agoExploit / PoC in the wild 4 sourcesCVE-2026-39987CVE-2021-33044CVE-2021-33045

An Evidence Model for Agentic Processes: Evidence Claims, Trust Assumptions, and Policy Assessment

Researchers propose an evidence claim model defining which trust and audit claims agentic AI systems can support, mapping claims to mechanisms, assumptions, and threats.

The paper proposes an evidence claim model for agentic AI processes that exchange messages, invoke tools, request approvals, and modify shared artifacts. It distinguishes claim types such as artifact integrity, provenance, approval evidence, and policy assessment, mapping each to mechanisms, assumptions, limitations, and threats. It stresses that hashes, signatures, and external anchors do not establish semantic truth, authorization, or capture completeness. The contribution is conceptual, offering vocabulary for what an agentic black box can and cannot evidence and which controls must surround it.

arXiv cs.CR·Sep 8, 09:25 UTC · 9d agoAI safety & security

Proactive cyber defense for governments and enterprises

Google launches the Fairwind Program giving governments and enterprises access to Gemini 3.8 Flash Cyber and CodeMender for autonomous vulnerability finding and patching.

Google DeepMind announced the Fairwind Program, a limited-access offering giving Google Cloud customers, government agencies, and cybersecurity partners access to Gemini 3.8 Flash Cyber and the CodeMender harness to autonomously find, verify, and fix vulnerabilities. Initial access prioritizes governments, critical infrastructure operators in healthcare, telecom, energy, and finance, and core technology platforms, with over 650 partners participating. Google also raised its total global cybersecurity funding commitment above $100 million, including $36 million for 35 US cyber clinics.

Google DeepMind·Sep 2, 16:24 UTC · 14d agoAI industry

When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications

CSO Online publishes a practical penetration-testing guide for GenAI, LLM, and RAG applications, covering prompt injection, retrieval poisoning, and tenant isolation testing.

The guide frames LLM applications as attack graphs spanning prompts, retrieval layers, vector stores, tools, identities, and downstream APIs, arguing that conventional web testing misses instruction-vs-data channel risks. It builds on OWASP prompt injection guidance (direct vs. indirect injection) and NIST's 2025 adversarial machine-learning taxonomy, noting that RAG and fine-tuning do not remove injection risk. Recommended practices include documenting trust transitions across components, using canaries and synthetic records to avoid test side effects, running multi-turn and obfuscated injection campaigns, and verifying chains from poisoned documents to observable state changes. It also details testing RAG pipelines via controlled document poisoning across metadata, OCR layers, and code comments, plus cross-tenant isolation checks on retrieved document IDs.

CSO Online·Sep 9, 10:00 UTC · 8d agoAI safety & security1

Iranian cyber targeting of dissidents, activists and journalists

UK NCSC, FBI, and Dutch AIVD expose CHOSEN BRICK spyware used by Iranian state actors against dissidents, activists, and journalists worldwide.

A joint advisory from the UK NCSC, FBI, and Dutch AIVD details CHOSEN BRICK, a Windows spyware family used by Iranian state cyber actors since at least 2025 against dissidents, activists, and journalists in the UK, US, and Netherlands. Actors build rapport on WhatsApp and Telegram impersonating known contacts or platform support, then deliver disguised payloads resembling apps such as Telegram, Norton, RunwayML, or fake MRI results. The malware persists via HKCU Run registry keys, adds Microsoft Defender exclusions, and uses a unique Telegram bot C2 per victim. Capabilities include screen capture, microphone recording, process enumeration, email and messaging data theft, file deletion, and system wiping; victim data has appeared on pro-Iranian leak sites.

NCSC UK·Sep 15, 12:00 UTC · 2d agoThreat actor in the wild2

You've Got a BUD in Me: Authenticated Reads from Per-Block Write Logs

Researchers propose BUD, per-block write-log digests enabling blockchain validators to serve historical membership and exclusion proofs far cheaper than state-wide tries.

The paper introduces Block Update Digests (BUD), which authenticate each block's write log with predecessor pointers, plus a SuperBUD and exponential hierarchy to turn long unchanged intervals into short proofs. Soundness against adversarial provers and up to f Byzantine validators is proven under archive, attestation, and committee evidence assumptions. Benchmarks show a 50x state-size increase raises the base-BUD path only 1.24x versus 3.1x for in-memory and 69.5x for disk-backed Merkle Patricia tries, with read payloads below 800 bytes and p99 warm verification at 146 microseconds.

arXiv cs.CR·Sep 10, 08:46 UTC · 7d agoResearch

CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises

The Hacker News·Aug 4, 07:00 UTC · Aug 4, 2026Exploit / PoC in the wildCVE-2026-18577CVE-2026-18556CVE-2025-8875+1 CVEs

Involving before Evolving: A Vision for Trustworthy Enterprise Digital Twin Engineering

Vision paper proposes 'involving before evolving' staged approach for trustworthy enterprise digital twins, validated via an ongoing Michelin prototype.

The paper presents a three-stage vision for enterprise digital twin (EDT) engineering that prioritizes early organizational buy-in before evolving toward federation and full interoperability. The approach combines foundation models for rapid prototyping, an ontological backbone for federated interoperability, and observability tooling to build stakeholder trust. The vision is grounded in an ongoing collaboration with Michelin, where an initial working prototype helped secure stakeholder buy-in.

arXiv cs.AI / cs.LG / cs.CL·Sep 11, 17:06 UTC · 5d agoAI research

A Deep Dive Into Attempted Exploitation of CVE-2023

Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.

Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.

Palo Alto Unit 42·Aug 19, 12:03 UTC · 29d agoExploit / PoC in the wildCVE-2023-335381

How Virginia Tech Connected Pentesting to Its Engineering Workflow

Horizon3.ai customer story details Virginia Tech automating external pentesting via NodeZero's GraphQL API with GitLab and ServiceNow integration for remediation tracking.

Horizon3.ai published a customer story describing how Virginia Tech, whose environment serves more than 38,000 students across hundreds of independent departments and multiple cloud providers, used NodeZero's GraphQL API to automate external pentesting through GitLab. Findings are routed directly into ServiceNow for subnet-owner assignment and remediation tracking, creating a repeatable attack-validation-to-remediation workflow.

Horizon3.ai·Sep 3, 16:33 UTC · 13d agoIndustry1

Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning

Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.

Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.

Cyber Security News·Sep 14, 13:33 UTC · 3d agoMalware in the wild

Who Should Grade My Work? Student Perspectives on Transparent AI-Assisted Writing Assessment in Higher Education

A Saudi university study finds students value ChatGPT writing feedback but treat human instructors as the final grading authority.

Thirteen male undergraduate computing students at a Saudi public university completed handwritten writing tasks that were scored by ChatGPT using a rubric-based prompt, then reflected after being told the score and feedback were AI-generated. Inductive thematic analysis identified four themes: perceived feedback usefulness, awareness of AI's contextual and pedagogical limitations, conditional trust, and reflection on the instructor's institutional role. Participants accepted GenAI feedback for surface-level revision but consistently positioned human instructors as the authority over grading decisions, distinguishing feedback utility from evaluative authority.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 16:49 UTC · 12d agoAI research

Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution

CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.

CrowdStrike is tracking Slim Spider, a previously undocumented financially motivated group attacking Brazilian financial institutions since at least March 2026. The actor used custom Bash scripts to steal temporary cloud credentials, exfiltrated digital asset custody secrets, and used Foundry's cast tool to derive Ethereum wallet addresses, while deploying Go-based backdoor MikeDor and an implant impersonating Brazil's SPI instant payment infrastructure. Slim Spider also pivoted to Azure DevOps and Kubernetes clusters and used panels including NEXUS // Scanner, Painel de Emails Entra ID, and Painel Pix for reconnaissance and unauthorized Pix transfers. Separately, Google Threat Intelligence Group and Mandiant disclosed Breeze Comet (CL-CRI-1163), a Portuguese-speaking group since 2024 that breaches Brazilian payment infrastructure to run fraudulent Pix, Boleto, and STR transactions.

The Hacker News·Sep 8, 16:20 UTC · 8d agoThreat actor in the wild

18 ways to check whether data can be trusted for AI

ETSI published TR 104 180 defining 18 data quality metrics, including fairness and privacy, to assess whether datasets are fit for AI.

ETSI's technical report TR 104 180 defines 18 metrics across four groups - intrinsic quality, usability and lineage, fairness, and privacy - each with calculation formulas, plus an open-source tool that scores datasets. Testing on an aircraft engine sensor dataset and a US census dataset revealed a roughly threefold gender gap in high earners (about 31% of men versus 11% of women) and two privacy failures: re-identification via age, race, sex, and country, and sensitive fields stored in plaintext. The working group included Sejong University, EGM, TTA, Daejeon University, and CNIT.

Help Net Security·Sep 7, 00:00 UTC · 10d agoAI policy

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.

Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.

The Hacker News·Sep 2, 07:47 UTC · 15d agoResearchCVE-2021-318862

Product showcase: Is this image real? Slop or Not investigates

Slop or Not is an offline iPhone/Mac app using on-device Apple Neural Engine models to detect AI-generated images, text and SynthID watermarks.

Slop or Not is an AI text and image detector for iPhone and Mac that runs entirely offline via the Apple Neural Engine, with no account required. It returns AI-probability scores and checks for Google's invisible SynthID watermark to verify AI-origin images on-device. The hands-on review found strong detection of obvious AI images, a borderline 50.4% AI call on a realistic one, and correct identification of real photos, citing survey data that 85% of people struggle to distinguish AI-generated content.

Help Net Security·Aug 13, 00:00 UTC · Aug 13, 2026AI tools & infra

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat patched critical Keycloak flaw CVE-2026-18963 (CVSS 9.1) allowing unauthenticated attackers to take over any account, including administrative ones.

Keycloak and Red Hat patched CVE-2026-18963, a CVSS 9.1 flaw (CWE-640) caused by improper state validation in the reset-credentials flow, letting an unauthenticated remote attacker force a password reset without the emailed action token and achieve full account takeover, including admin accounts. Upstream Keycloak 26.7.2 and Red Hat Build of Keycloak 26.4.15/26.6.6 contain fixes; four RHSA errata were issued August 18, 2026. No evidence of exploitation or public exploits exists as of August 24, 2026; mitigation is disabling the Forgot Password feature in all realms.

The Hacker News·Aug 24, 11:56 UTC · 24d agoVulnerabilityCVE-2026-18963CVE-2026-15571

TrajMark: Ownership Attribution and Segment-Level Tamper Localization for Coding-Agent Trajectories

Researchers introduce TrajMark, a training-free watermarking framework for coding-agent trajectories that recovers ownership, detects 95.5-100% of edits, and localizes tampered regions.

TrajMark is a training-free, symmetric-key, visible-only watermarking framework for coding-agent trajectories that separates robust ownership attribution from fragile local integrity verification. A sparse owner layer encodes a six-bit deployment identifier by rewriting keyed READ actions into masked linear equations, while a localization layer inserts linked Q12 seals that commit to protected critical-action segments. Across three coding-agent frameworks and three LLMs, it recovers the exact owner in all clean full-watermark batches, detects 95.5%-100% of single-site edits, and localizes 95.8% of random corruptions to an accepted protocol region. Owner marking adds no trajectory actions and matched Pass@1 is 26.9% versus 26.3% for unwatermarked runs.

arXiv cs.CR·Sep 9, 16:33 UTC · 7d agoResearch1

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business News·Sep 2, 02:55 UTC · 15d agoData breach in the wild1

The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents

Verifiable Action Card architecture blocks indirect prompt injection in agentic browsers, cutting attack success from 68-100% to 0%.

Researchers propose VAC, a browser-architecture defense that reconstructs approval prompts from the ground-truth pending action and trusted intent provenance, rendering them out-of-band in trusted browser chrome. On a 24-scenario benchmark covering confused-deputy attacks, dialog forging, and indirect prompt injection, attack success fell from 68-100% to 0% across evaluated LLMs, with 78% legitimate-task completion and a 0% false-block rate. Approval is bound to the exact action re-verified at dispatch.

arXiv cs.CR·Sep 16, 10:06 UTC · 1d agoAI safety & security

Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

Microsoft's September Patch Tuesday fixed a record 974 flaws, including two Windows privilege-escalation zero-days actively exploited and added to CISA's KEV catalog.

Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities (999 including 25 non-Microsoft CVEs), with over 110 rated critical; 723 affect Windows and 111 affect Office. Two Windows privilege-escalation zero-days are actively exploited: CVE-2026-85880, an ALPC heap-based buffer overflow, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack, both allowing attackers to gain SYSTEM privileges. CISA added both flaws to its KEV catalog, giving federal civilian agencies until September 22, 2026 to apply fixes. Volexity, Proofpoint, MSTIC, and independent researchers were credited with the reports; notable additional fixes include network-reachable RCEs in Exchange, SharePoint, SQL Server, Remote Desktop Services, DNS, and DHCP.

The Hacker News·Sep 9, 04:41 UTC · 8d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2026-55007+9 CVEs

"They don't care about this": A Systematic Study of TEE Build Reproducibility in the Wild

91% of 115 surveyed TEE deployments across Intel SGX, TDX, and AMD SEV fail to provide reproducible builds needed for verifiable remote attestation.

A systematic study of 115 TEE deployments found 91% were not reproducible and 80% lacked both source code and a reference build, undermining remote attestation guarantees. Interviews with 12 developers of 50 Intel SGX projects confirmed that only one participant treats reproducibility as a development priority. The authors identify technical barriers such as embedded timestamps plus ecosystem-level issues like lack of build-environment control in multi-stakeholder projects, and call for holistic, committed reproducibility practices.

arXiv cs.CR·Sep 10, 11:43 UTC · 7d agoResearch