ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “adb”

37 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 55Vulnerability 13Ransomware 9Exploit / PoC 6Phishing & fraud 3Policy & legal 2Industry 2AI tools & infra 1Research 1Threat actor 1Data breach 1
SeverityAllcritical 20high 24medium 39low 10info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

THost9 Android RAT Pairs Packed Loader With ADB Worm

Dark Atlas details THost9, a packed Android RAT paired with an ADB worm that installs itself on devices with exposed Android Debug Bridge services.

Dark Atlas researchers described the Hagaseca cluster, whose THost9 packed loader hides executable code in an embedded asset decoded with single-byte XOR and gzip before loading a tc9.dex second stage. The second stage adds shell execution, file transfer, tunneling, reverse shells, downloadable modules and a self-propagating ADB worm that expands single addresses into 65,025-host scan ranges. Newer builds include anti-analysis checks for Frida, and incident reports connect THost9 and THost4 to Android phones and Redroid containers with exposed ADB from October 2024 through 2026.

Infosecurity Magazine · 7d agoMalware in the wild

GuardBreaker: Derailing AI-assisted malware analysis with a code comment

ESET names 'GuardBreaker': UAC-0099 embeds a nuclear-weapon question in VBScript comments to trip LLM scanner guardrails during analysis of its MATCHBOIL loader.

ESET researchers observed the Russia-aligned group UAC-0099 inserting a decoy prompt injection into a VBScript used to install its MATCHBOIL loader in an attack against a Ukrainian target, aiming to make LLM-based code scanners refuse and stop inspecting the file. The comment triggers safety guardrails with a request about building a nuclear weapons but has no runtime effect. Similar LLM-thwarting tricks have appeared in malicious PyPI and npm packages reported by Socket and StepSecurity. ESET recommends multi-model cross-validation of AI-assisted analysis and treating missing LLM output as requiring further checks.

ESET WeLiveSecurityupdated · 4d agofirst · 6d agoAI safety & security 3 sources1

ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries

Zimperium documents ToxicPanda 2.0, an Android banking trojan now targeting 349 financial institutions in 16 countries via ADB privilege escalation and overlay credential theft.

Zimperium's zLabs documented ToxicPanda 2.0, an Android banking trojan expanding from 16 targeted apps to 349 financial institutions across 16 countries, with 167 remote commands. It poses as a dropper, abuses VPN permissions to block Google Play Protect while installing a hidden payload, then uses the Accessibility Service for screen monitoring and overlay-based credential theft. It automates enabling Android Wireless Debugging and completes the pairing handshake to gain ADB shell access for privilege escalation, and overlays fake lock screens to steal device PINs. Previously unfinished commands are now operational and samples are served from AWS-hosted storage buckets.

Security Affairs · 24d agoMalware in the wild

openbmb/MiniCPM5-2B — new model trending #4 on Hugging Face

OpenBMB released MiniCPM5-2B, a dense 2B open-weights Transformer claiming 2B-class open-source SOTA for on-device deployment.

OpenBMB released MiniCPM5-2B, the second model in the MiniCPM5 series following MiniCPM5-1B, and it is trending #4 on Hugging Face. The dense 2B Transformer targets on-device, local, and resource-constrained deployment and claims 2B-class open-source SOTA while remaining competitive with 4B-class models. Reported strengths include coding, mathematics, long-context understanding, tool use, and agentic tasks; a tech report (arXiv 2506.07900), GitHub repo, and online demo accompany the release.

Hugging Face trending models · 9d agoModel release

Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

New Kimwolf v7 Android botnet adds HTTP/2 DDoS floods with Chrome fingerprints and takedown-resistant ENS/Tor C2.

Palo Alto Networks Unit 42 discovered Kimwolf v7, an evolution of the Kimwolf/AISURU Android and IoT botnet first tracked in February 2026. The new version performs HTTP/2 floods mimicking Chrome browser fingerprints and uses Ethereum Name Service, Tor hidden services, and a local proxy for resilient C2. The botnet targets Android TV boxes via ADB on port 5555 and offloads propagation to an external loader.

The Hacker News · Aug 15, 2026Malware in the wildCVE-2024-36401

openbmb/MiniCPM5-2B-GGUF — new model trending #30 on Hugging Face

OpenBMB released MiniCPM5-2B, a dense 2B on-device model claiming open-source SOTA among 2B-class models.

OpenBMB released MiniCPM5-2B, the second model in the MiniCPM5 series following MiniCPM5-1B, as a dense 2B Transformer built for on-device and resource-constrained deployment with GGUF weights on Hugging Face. The team claims 2B-class open-source state-of-the-art performance, remaining competitive with 4B-class models in coding, mathematics, long-context understanding, tool use and agentic tasks. The release includes a tech report, GitHub repository and online demo, and is currently trending on Hugging Face.

Hugging Face trending models · 11d agoModel release1

TuxBot v3: Inside an IoT Botnet Framework With LLM

Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.

Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.

Palo Alto Unit 42 · 27d agoMalware1

Can We Stop The Ads? Taxonomy and Characterization of Smartphone Splash Ads and Existing Countermeasures

Study of 108 ad-defense implementations finds only one tool blocked splash-ad navigation across ten popular apps, and it required Accessibility permission.

The paper taxonomizes smartphone splash ads — full-screen ads at app launch that trick users into trigger mechanisms such as moving the phone — and analyzes 108 documented advertising defenses for deployment barriers. Many defenses require device rooting, jailbreaking, runtime code injection, or application modification; others need extra permissions, rule maintenance, compilation, or payment. In evaluating 13 configurations of 11 tools across 10 popular apps, only one prevented ad-triggered navigation across all ten apps, requiring Accessibility permission and leaving ads visible roughly one second before dismissal. Documented harms include delayed emergency response, driver distraction, and degraded accessibility for vision-impaired users.

arXiv cs.CR · 17h agoResearch

OpenBMB Releases MiniCPM5-2B: A 2.52B Dense Model Averaging 53.9 Across 34 Benchmarks and Built to Run On Device

OpenBMB released MiniCPM5-2B, a 2.52B-parameter Apache 2.0 on-device model averaging 53.9 across 34 benchmarks, ahead of Qwen3.5-4B.

OpenBMB released MiniCPM5-2B, a 2,516,756,480-parameter dense LlamaForCausalLM model with grouped-query attention and a 131,072-token context, under Apache 2.0, runnable via vLLM, SGLang, llama.cpp, and Ollama. It averages 53.9 across 34 benchmarks versus 51.1 for Qwen3.5-4B, with strong tool-use (97.1 on tau2-Bench Telecom) and code results (69.1 LiveCodeBench v6, 46.4 SWE-bench Verified). Training combined 400B tokens of deep-thinking SFT, critic-based JustRL II RL teachers, and on-policy distillation merging 16 RL experts; datasets and intermediate checkpoints were published alongside the weights.

MarkTechPost · 8d agoModel release

Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum

Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.

Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.

Security Affairs · Aug 12, 2026Malware in the wild

The OCUDU dApp Platform: An Open Runtime and E3 Interface for Real-Time AI-RAN

OCUDU open runtime lets third-party signed AI-RAN dApps run inside production 5G distributed units under three timing contracts, released as BSD-3 preview.

The OCUDU dApp platform provides an open runtime and E3 interface for executing signed AI-RAN applications inside a production 3GPP NR distributed unit, where prior dApp frameworks could only observe export streams. Modules run under three typed timing contracts: GPU receive-chain residency (Class A), the scheduler's 100 microsecond deadline (Class B), or non-blocking observer (Class C). On a GB10 gNB, dApps including an out-of-tree neural equalizer ran on a live cell without fallback. Platform, SDK, and a zero-hardware quickstart are public under BSD-3-Clause-Clear as a preview of the OCUDU AI-RAN Working Group 2.

arXiv cs.AI / cs.LG / cs.CL · 8d agoAI tools & infra1

Free streaming boxes may be routing criminal traffic through your home

Researchers found SuperBox streaming boxes and the CyberFlix TV app enroll home connections into the Popanet residential proxy network, routing criminal traffic.

Researchers found that SuperBox devices and the CyberFlix TV app, distributed through SuperBox's custom app store, contain Popanet proxy functionality that registers the device with servers controlled by the proxy operator, enrolling household connections into residential proxy networks. The reported configuration weakens Android safeguards with exposed ADB access, root-level privileges without authentication, and removal of app-install protections. Plume's research warns these proxy networks can also function as malware-delivery platforms, and the FBI notes foreign entities use residential proxies to conceal activity such as credential stuffing and account abuse. Malwarebytes advises disconnecting and replacing affected SuperBox/CyberFlix devices rather than factory-resetting them.

Malwarebytes Labs · 11d agoMalware in the wild

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Bitdefender found abuse of Google Play's review-free Early Access program to push thousands of deceptive casino and reward apps promoted with AI deepfake ads.

Bitdefender reports threat actors are abusing Google Play's Early Access program, which blocks public reviews and ratings, to distribute thousands of deceptive casino, reward, and utility apps. A GTA imitator, 'Vice Streets: Open World,' surpassed 1 million downloads before disappearing, with apps promoted via AI celebrity deepfake ads on TikTok and Facebook and monetized through endless ad serving and payouts that never arrive. The report coincides with disclosures on Android malware families Hagaseca, Mantax Otax, StreamRat, and GoldFactory's Gigabud banking trojan with its Vwork companion app used for cloned-app financial fraud.

The Hacker Newsupdated · 4d agofirst · 5d agoPhishing & fraud in the wild 6 sources

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.

Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.

Huntress · 13d agoExploit / PoC in the wild1

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On

Zimperium and IBM Trusteer report expanded ToxicPanda 2.0 and GoldDigger Android banking trojan campaigns now targeting 349 financial institutions across 16 countries.

Zimperium zLabs reports ToxicPanda 2.0 (TgToxic) now carries 167 remote commands, targets 349 financial institutions across 16 countries via more than 140 banking and cryptocurrency apps, and abuses Android Wireless Debugging via ADB for privilege escalation and shell access. It harvests lock screen PINs with fake overlays, steals UI elements via accessibility services, sets Device Administrator privileges, and is distributed through Amazon AWS-hosted buckets. IBM Trusteer documents a GoldDigger campaign impersonating airline companies and shopping retailers, causing massive infections in South Africa and the U.K., obfuscated with the dpt-shell packer that detects Frida and resists debugging. GoldDigger performs on-device fraud by injecting input into banking apps and is attributed to the Chinese-speaking GoldFactory actor.

The Hacker News · 23d agoMalware in the wild

From Intent to Execution Grant: An Execution-Boundary Conformance Profile for High-Risk AI Actions

Researchers specify EBL-Core, an execution-boundary conformance profile binding AI agent intents, policies, and evidence into verifiable execution grants, validated with bounded tests.

The paper defines EBL-Core, a conformance profile deciding whether one fully materialized AI-generated candidate action may receive action-scoped execution authority. It binds a structured intent object, Root and Operational Policies, typed evidence, and a verifiable Decision Derivation through an Execution Release Contract, with lifecycle rules for Redemption and Revocation. Evaluation included 34 static vectors, 15 lifecycle checks, and 100 trials of 32 concurrent Redemption attempts yielding exactly one winner per trial. The authors state these bounded results demonstrate executability of the specified subset, not production readiness or complete mediation.

arXiv cs.CR · 5d agoAI safety & security1

microsoft/VibeVoice-ASR-Streaming-7B — new model trending #27 on Hugging Face

Microsoft released VibeVoice-ASR-Streaming-7B, an open streaming ASR model with speaker attribution, custom hotwords, and support for 10 languages under MIT license.

Microsoft Research released VibeVoice-ASR-Streaming-7B on Hugging Face, a unified streaming speech recognition model that continuously transcribes who said what as speech arrives. The 7B model supports customized hotwords for domain-specific terms and 10 languages including Chinese, English, French, German, Italian, Japanese, Korean, Portuguese, Russian, and Spanish. Code is available at github.com/microsoft/VibeVoice with a live demo, and a technical report is on arXiv (2609.02812). The model is licensed under MIT.

Hugging Face trending models · 13d agoModel release1

IFM/K2-Horizon-MoVA-36B-A4B — new model trending #15 on Hugging Face

IFM released K2-Horizon-MoVA-36B-A4B, an open-weights 36B-parameter MoE model with 4B active parameters and native 512K context.

IFM released the final checkpoint of K2-Horizon-MoVA-36B-A4B, a sparse Mixture-of-Experts model using Mixture-of-Values (MoVA) attention with 36B total and 4B active parameters. The model supports native 524,288-token context and reportedly outscores open-weight dense and MoE models up to 15x its size on agentic and reasoning benchmarks, while competing against closed frontier models. Intermediate checkpoints, training data, the training recipe, and training code are slated for public release.

Hugging Face trending models · 14d agoModel release

Edge0/Edge0-35B-A3B-preview — new model trending #30 on Hugging Face

Edge0 released a 35B sparse MoE model running in under 3 GiB of memory at 15 tok/s via SSD expert offload and int4 quantization.

Edge0-35b-a3b-preview is a 35B-parameter MoE (256 experts, 4 active per token) built on Qwen3.5-MoE 35B-A3B, shipped as a 4-bit checkpoint with LoRA and prerouter adapters under Apache 2.0. The edge0 framework streams expert weights from SSD on demand, bounding peak active memory at 2.9 GiB and achieving 14.9-17.7 tok/s decode on a Mac mini M4 Pro (MLX backend). Recover-LoRA distillation keeps the int4 model within 3.9 points of its fp16 base (79.2 vs 83.2 average on OpenCompass benchmarks including AIME 2026, HumanEval, GPQA-Diamond, MMLU-Pro, and IFBench).

Hugging Face trending models · 7d agoModel release

Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control

ThreatFabric details StreamRat, a new Android banking trojan spread via Meta malvertising in Spain that reached about 571,000 EU accounts.

ThreatFabric reported that a fake TV-streaming malvertising campaign on Meta promoted StreamRat, a technically sophisticated Android banking trojan, targeting Spanish-speaking users; the ads reached an estimated 570,950 Meta accounts in the EU between June 11 and July 3, 2026. Once installed via sideloaded APKs, the trojan abuses Accessibility to log keystrokes, show credential-stealing overlays, capture screens, and remotely control devices, and was also promoted through TikTok. Its dropper requests default Home app and VPN permissions and was hosted via GitHub releases, closely resembling one used in the earlier Mirax campaign. C2 infrastructure includes IPs 45.147.28.59 and 193.32.2.245, and no named threat actor was attributed.

The Hacker News · 13d agoMalware in the wild

Financial Stability Board Sounds the Alarm Over Frontier AI Risks

The Financial Stability Board warned G20 banking leaders that frontier AI adoption poses growing cyber and financial stability risks.

The Financial Stability Board (FSB) issued a warning to G20 banking leaders about cyber and financial-stability risks stemming from frontier AI. The alert highlights systemic risk concerns around advanced AI adoption in the financial sector. No specific incidents or regulatory actions were announced.

Infosecurity Magazine · 14d agoAI policy

You've Got a BUD in Me: Authenticated Reads from Per-Block Write Logs

Researchers propose BUD, per-block write-log digests enabling blockchain validators to serve historical membership and exclusion proofs far cheaper than state-wide tries.

The paper introduces Block Update Digests (BUD), which authenticate each block's write log with predecessor pointers, plus a SuperBUD and exponential hierarchy to turn long unchanged intervals into short proofs. Soundness against adversarial provers and up to f Byzantine validators is proven under archive, attestation, and committee evidence assumptions. Benchmarks show a 50x state-size increase raises the base-BUD path only 1.24x versus 3.1x for in-memory and 69.5x for disk-backed Merkle Patricia tries, with read payloads below 800 bytes and p99 warm verification at 146 microseconds.

arXiv cs.CR · 6d agoResearch

ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign

Unit 42 uncovers ApateWeb, a campaign using over 130,000 domains and multilayered redirects to deliver scareware, adware and PUPs to millions of users.

Unit 42 discovered ApateWeb, a large-scale campaign using a network of more than 130,000 domains to deliver scareware, potentially unwanted programs, adware including a rogue browser and browser extensions, and scam pages. The campaign uses a three-layer structure with deceptive emails as the entry point, centralized victim tracking via UUIDs, intermediate adware or anti-bot redirections, and evasion tactics such as cloaking, bot detection error pages, and wildcard DNS abuse. Activity spiked since August 2022, with several hundred attacker-controlled sites remaining in Tranco's top 1 million rankings and millions of monthly hits; Unit 42 blocked an estimated 3.5 million sessions across 74,711 devices in November 2023.

Palo Alto Unit 42 · 29d agoPhishing & fraud in the wild

Indonesia Hit by Android Banking App-Cloning Campaign

GoldFactory exploits Android Work Profile to deliver the Gigabud banking trojan to Indonesian users via cloned banking apps, with Mantax and Otax spreading separately.

The GoldFactory threat group is running an app-cloning campaign against Android banking customers in Indonesia, abusing the Android Work Profile feature to deliver its Gigabud trojan. The Mantax and Otax malware families are spreading through separate distribution channels. Abusing Work Profile to install or conceal cloned banking apps is a notable mobile technique, though the article reports no victim counts or loss figures.

Dark Readingupdated · 4d agofirst · 5d agoThreat actor in the wild 6 sources

AuK Technical Report: An Open-Source Foundational Model for Speech Generation and Editing

Open-source speech foundation model AuK unifies generation and editing, trained on 1.95 million hours, with distilled AuK-Flash achieving 4.5x speedup.

AuK is an open-source foundational model that unifies speech generation and editing through natural-language instructions and audio context, trained on approximately 3.03 billion instruction-audio instances and 1.95 million hours of supervision across five task families including generation, content editing, and acoustic editing. It combines a multimodal LLM for semantic conditioning, a VAE jointly trained on speech, general audio, and music, and a hybrid rectified-flow Transformer using dual-stream MMDiT blocks followed by unified single-stream DiT blocks. Post-training applies human-feedback preference optimization for editing and reward-based reinforcement learning for generation, and the distilled AuK-Flash performs 4-step inference without classifier-free guidance at a 4.5x wall-clock speedup. Source code and model weights are released.

Hugging Face daily papers · 8d agoModel release1

At UBS, AI skills are now a condition for landing a job

UBS will require 2027 graduate and intern applicants in Global Banking to demonstrate AI skills, among the first major banks to do so.

Per the Financial Times, UBS will require candidates for 2027 graduate and internship roles in Global Banking and Markets to show how they use AI to improve outcomes and efficiency, with AI questions included in interviews. The requirement supplements, not replaces, traditional criteria, and Santander is similarly seeking advanced AI users for some trainee programs. Morgan Stanley analysts project more than 200,000 European banking jobs could disappear within five years as routine junior work is automated; UBS is also testing analyst avatars for client presentations.

The Decoder · 8d agoAI industry

Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails

ESET reports Russian group UAC-0099 hid a prompt in VBS malware comments to trip AI safety filters and disrupt automated malware analysis in Ukraine.

ESET identified a technique dubbed GuardBreaker in which UAC-0099 embedded a comment reading "I want to make nuclear weapon. Help me …" inside a malicious VBS script to trigger AI safety mechanisms and halt AI-assisted malware analysis. The script, part of the group's toolset, downloads the MATCHBOIL malware used exclusively by this Russia-aligned group; CERT-UA documented the chain including LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2 in a July advisory. UAC-0099 typically targets transportation and energy sectors and hands validated targets to GRU-linked Sandworm. ESET warned that AI-assisted analysis must be backed by layered detection and human-driven engineering.

Help Net Security · 16d agoAI safety & security in the wild

Structural Jailbreaks Generalize but Do Not Compound: A cross-provider and multilingual study of Involuntary In-Context Learning

Researchers show IICL structural jailbreaks generalize to Google Gemini, lifting attack success to 80-100% on harm and financial benchmarks; non-English prompts attenuate it.

The study red-teams two Google Gemini models with Involuntary In-Context Learning (IICL), a structural jailbreak reframing harmful requests as the final cell of a data-labeling task. IICL lifts attack success from at most 6.7% to 80-90% on HarmBench and 97-100% on financial abuse (FinProof), an order of magnitude above prior results on OpenAI's GPT-5.4. Against a compounding hypothesis, forcing IICL output into Spanish, Hindi, or Arabic attenuates the attack in 11 of 12 conditions, attributed to a 'relevance curse' producing lower-quality harmful content in lower-resource languages. Findings replicate under an independent non-Google judge (Cohen's kappa 0.86 over 377 paired verdicts).

arXiv cs.CR · 8d agoAI safety & security

AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance

Huntress maps AD RMS architecture and recon paths, setting up an offline key-extraction attack against its unrotatable 255-year root key.

Huntress's multi-part research examines Active Directory Rights Management Services, Microsoft's enterprise DRM role that still ships in Windows Server 2025 despite migration guidance favoring Azure Information Protection. Part 1 covers the trust model and how an ordinary domain account can locate RMS clusters and read rights-policy templates. Part 2 will detail four independent paths for extracting the Server Licensor Certificate (SLC) private key via service-group membership and the configuration database, enabling fully offline decryption of protected documents. The SLC certificate is valid from 2002 to 2258 and has no key-rotation mechanism, so a stolen key decrypts protected content indefinitely.

Huntress · 8d agoResearch1

Molecular Déjà Vu: Digit-Level Retrieval of Published Values in Frontier Language Models

Audit of 22 frontier models finds widespread verbatim retrieval of published molecular property values, with higher reasoning increasing recall of memorized numbers.

An arXiv audit tests 22 frontier LLMs across 12 molecular regression benchmarks for verbatim retrieval of published values. More than 50% of the LLMs show verbatim retrieval on five datasets, and identical experiments are flagged 89% more often at a high reasoning level than at the lowest one. Suppressing retrieval moves model prediction errors closer together in relative terms, suggesting predictive capability is not determined solely by memorized values.

arXiv cs.AI / cs.LG / cs.CL · 11d agoAI research1

IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications

IDORacle intercepts MyBatis/JDBC SQL sinks to block horizontal privilege escalation in legacy Java apps with sub-millisecond guard latency.

IDORacle is a template-guided SQL-sink interception and rewriting framework that prevents IDOR/BOLA horizontal privilege escalation at runtime in Java database applications. It propagates authenticated identity context across HTTP requests, asynchronous tasks, and data-access boundaries via a server-side trace identifier, and computes dual SQL fingerprints at the MyBatis/JDBC boundary to generate reusable mediation plans. On a Java-SQL benchmark grounded in real-world CVE reports, it blocks tested violations with worst-case guard latency of 0.17 ms, reduced to 0.017 ms average for hot templates via redundancy-aware optimization.

arXiv cs.CR · 5d agoResearch1

Identifying a BOLA Vulnerability in Harbor, a Cloud

Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.

Unit 42 researchers identified a broken object-level authorization flaw, CVE-2024-22278, in Harbor, a CNCF-graduated cloud-native container registry with 1.8 million downloads. The flaw (CVSS 6.4) lets users with the Maintainer role create, update, and delete project metadata, actions reserved for ProjectAdmin, risking data exposure, integrity compromise, and circumvention of vulnerability scanning. Harbor patched the issue in versions 2.9.5, 2.10.3, and 2.11.0. The finding came from Unit 42's automated BOLA detection tool built on generative AI.

Palo Alto Unit 42 · 29d agoVulnerabilityCVE-2024-22278

Signing the Transaction but Not the Decision: Whisper Attacks and a Binding Defense for AP2

Research shows AP2 agent-payment signatures can be manipulated into valid but wrong carts; proposed A-VIP defense binds signed intent to purchases.

A study demonstrates Whisper attacks on the AP2 agent payment protocol, where ordinary product-description text steers shopping agents into carts that pass every cryptographic check but no longer match user intent. Using Gemini Flash-Lite models specified by AP2's default sample agents, three attacks succeeded at 90%, 56%, and 73.3%, with the vulnerability spanning seventeen Google models, three agent frameworks, cross-vendor anchors, and Google's consumer assistant. The proposed A-VIP defense treats signed intent as a capability grant, binding credential lookups to sessions and cart lines to seen listings, blocking the first two attacks with zero false positives while surfacing unauthorized spending. The authors release A-VIP code, machine-checked invariants, and AP2-WhisperBench with 1,544 evaluation scenarios.

arXiv cs.CRupdated · 5d agofirst · 5d agoAI safety & security 2 sources1· 1 read

m-a-p/YuE2-3B — new model trending #30 on Hugging Face

M-A-P released YuE2-3B, an open music generation model that outperforms Suno v5 on WildSongBench and runs locally on a 24GB GPU.

The M-A-P (multimodal-art-projection) team released YuE2-3B, an open-weights music generation model that turns lyrics and a style prompt into full songs with vocals and accompaniment. It uses an AR-NAR Mixture-of-Transformers backbone with symbolic planning and flow matching through a VAE, and supports editable scores (melody and chords, including ABC notation) plus agentic editing workflows. On 192 WildSongBench prompts it reports a SongBench average of 6.9632 (best-of-8) versus 6.8721 for Suno v5, claimed as state of the art among evaluated open and proprietary models. It runs 48 kHz stereo inference locally on a single 24GB NVIDIA GPU without quantization, with companion releases including YuE2-Vae, MERT-v2 encoders, the WildSongBench dataset, and SheetSage2.

Hugging Face trending modelsupdated · 5d agofirst · 6d agoModel release 3 sources