ZeroHour

Search: “path traversal”

40 stories

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

The Router Within: Eliciting Native Skill Routing from a Frozen LLM

Gavel reads native skill-routing signals from a frozen LLM's forward passes with two linear maps, beating retrieve-and-rerank pipelines by up to 21.9 points on Qwen3-32B.

Gavel (Glance And Verdict from a frozen LLM) elicits skill routing from a frozen agent LLM using two trained linear maps that read mid-layer states, keeping all skill text out of context. A glance step scores the full library against compact per-skill banks built in one forward pass at installation; a verdict step resumes shortlisted skills' forward passes and fuses likelihood and yes/no judgments as a product of experts. It transfers zero-shot to three public benchmarks plus SkillTraj, a new benchmark of 372 simulated agent trajectories. On Qwen3-32B it beats progressive disclosure and retrieve-and-rerank pipelines adding 1.2B–16B external parameters by up to 13.4 points on written tasks and 21.9 when skills are needed mid-rollout.

Hugging Face daily papersupdated · 1d agofirst · 2d agoAI research 2 sources

TANGO: Humanoid Navigation in Cluttered Environments with a Whole-Body Vision-Language-Action Model

Researchers present TANGO, a whole-body vision-language-action model enabling humanoid robots to traverse cluttered spaces from language instructions.

TANGO predicts 29-DoF joint-space actions from egocentric RGB observations and natural-language instructions for whole-body humanoid navigation, going beyond 2D path planning. It is trained entirely in simulation using global path planning, kinematic whole-body motion generation, obstacle-aware motion editing, and RL-based tracking. The model reports state-of-the-art simulation performance and was deployed zero-shot on a Unitree G1 humanoid without any real-world navigation training data.

arXiv cs.AI / cs.LG / cs.CL · 7d agoAI research1

TANGO: Humanoid Navigation in Cluttered Environments with a Whole-Body Vision-Language-Action Model

Researchers introduce TANGO, a whole-body vision-language-action model enabling zero-shot language-guided humanoid navigation on the Unitree G1 robot.

TANGO addresses humanoid navigation in cluttered indoor environments by predicting 29-DoF joint-space actions directly from natural-language instructions and egocentric RGB, rather than 2D path planning. It is trained entirely in simulation via a pipeline combining global path planning, kinematic whole-body motion generation, obstacle-aware motion editing, and RL-based tracking. In simulation it achieves state-of-the-art vision-language navigation performance and transfers zero-shot to a Unitree G1 humanoid without any real-world navigation data.

Hugging Face daily papers · 8d agoAI research1

Flextype v1.0.0-alpha.3 Path Traversal in Entry Copy Allows Arbitrary Directory Copy and File Disclosure

Flextype CMS v1.0.0-alpha.3 entries copy endpoint accepts path traversal in source and destination parameters, enabling arbitrary directory copies and file disclosure.

Flextype CMS v1.0.0-alpha.3 constructs entry directory paths in the copy functionality by directly concatenating supplied entry identifiers with the configured entries directory. The /api/v1/entries/copy endpoint accepts directory traversal sequences in both the source id and destination new_id parameters. An authenticated remote attacker can thereby copy arbitrary directories and disclose files outside the intended entries directory. Ron E disclosed the issue on the Full Disclosure mailing list on September 3, 2026.

Full Disclosure · 12d agoVulnerability 8 sources

CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name

Unsanitised topology.blobstore.map local names in Apache Storm enable path traversal writes on supervisors as the supervisor user.

CVE-2026-82427 affects Apache Storm Nimbus (org.apache.storm:storm-server) versions 3.0.0 before 3.1.0, rated important. Topology submitters can choose a local name for each blob in topology.blobstore.map, which AsyncLocalizer and Container.createBlobstoreLinks used to build paths under the topology's working directory without normalisation. Crafted names allow path traversal, letting a submitter create or overwrite files outside the intended directory on supervisors, with symlink handling also affected. Fixed in version 3.1.0.

oss-security · 2d agoVulnerabilityCVE-2026-82427

Procedural Graphs: Self-Evolving Execution Structures for LLM Agents

Researchers introduce Procedural Graphs, self-evolving (procedure, relation, procedure) structures guiding LLM agent tool use and planning.

Procedural Graphs organize procedural knowledge into (procedure, relation, procedure) triplets to guide LLM agent actions, addressing drift such as lost objectives, out-of-order tool calls, and repeated unproductive steps. At each decision step the framework localizes the active node and a guidance model translates the surrounding subgraph into step-level situational guidance. An LLM refiner edits graph topology by contrasting failed with successful trajectories, and across datasets, task types and LLMs the approach outperforms memory-based baselines and matches or surpasses hand-designed graphs.

arXiv cs.AI / cs.LG / cs.CL · 7d agoAI research1

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.

Cycode disclosed a flaw chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, affecting versions 2.5.1 and earlier. The server binds to 0.0.0.0:8080, issues sessions without credential checks, and lets unauthenticated users issue spacecraft commands via POST /cmd and reach files outside intended directories via /script/run and /seq (CWE-306, CWE-352, CWE-22). Version 2.5.2 adds host binding and same-origin checks but does not add authentication, and a related missing-authentication flaw was published separately as CVE-2026-60112 with CVSS 9.3.

The Hacker News · 26d agoVulnerabilityCVE-2026-601121

Fortra security advisory (AV26-906)

Canada's Cyber Centre advises that Fortra GoAnywhere MFT Endpoint versions prior to 7.10.2 are affected by a path traversal vulnerability.

The Canadian Centre for Cyber Security issued advisory AV26-906 noting that Fortra GoAnywhere MFT Endpoint versions prior to 7.10.2 are affected by a path traversal vulnerability. The advisory was published September 10, 2026, referencing Fortra's own security advisory. No exploitation details or CVE id are provided; administrators are urged to review the links and apply the 7.10.2 update.

Canadian Centre for Cyber Security · 5d agoAdvisory

Discrete Beckmann Transport Models for One-Step Language Modeling and Reasoning

DBTM achieves one-step text generation via a time-independent transport map trained directly from data, removing pretrained teacher distillation.

Discrete Beckmann Transport Models (DBTM) build a time-independent flow whose autonomous transport map provably carries any point in ambient space to a fixed point on simplex vertices in a single step. The fixed-point property is characterized by a conservation equation whose residual can be minimized directly from data, eliminating the need for a teacher flow, distillation, and time conditioning. A partial-context interpolant extension turns additional function evaluations into refinement steps rather than ODE integration steps. On language modeling and reasoning tasks, DBTM's one- and few-step generation improves quality and accuracy over discrete diffusion and continuous flow baselines.

arXiv cs.AI / cs.LG / cs.CL · 1d agoAI research1

Progress Software security advisory (AV26-875)

Canada's Cyber Centre warns Progress Telerik UI for ASP.NET AJAX before 2026.3.812 is affected by path traversal and upload tampering flaws, urging updates.

The Canadian Centre for Cyber Security issued advisory AV26-875 on September 2, 2026, covering vulnerabilities in Progress Software Telerik UI for ASP.NET AJAX prior to version 2026.3.812. Two flaws are listed: CVE-2026-18672, a path traversal in the Telerik Web Forms RadImageEditor, and CVE-2026-19219, a DialogHandler UploadPaths tampering vulnerability. Administrators are encouraged to review the provided links and apply available updates.

MetroLLM-Bench: Evaluating Language Models as Transit Kiosk Runtimes

MetroLLM-Bench is a 955-case benchmark testing language models as transit kiosk tool-calling runtimes across six real metro systems.

The benchmark covers 37-414-station metro systems and eleven task categories including routing, fare calculation, disruptions, accessibility, and adversarial input, with 14 deterministic and 8 semantic scoring components. Of 26 models from six vendors, a PEFT-tuned 4B Qwen 3.5 student scored 91.3 on Tier 1, exceeding GPT-5.6 (90.6/90.0), while Muse Glimmer 30B led the composite ranking. A deterministic rule-based baseline reached 84.6, and PEFT gains over base models shrank from +7.03 points at 2B to -0.91 at 27B.

Hugging Face daily papers · 7d agoAI research

U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog

CISA added four actively exploited GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to the KEV catalog with imminent deadlines.

CISA added CVE-2026-42016 and CVE-2026-42018 (JFrog Artifactory), CVE-2026-84869 (ConnectWise ScreenConnect), and CVE-2026-85706 (GitLab, CVSS 10.0) to its KEV catalog. Artifactory flaws are being chained with CVE-2026-82329 in attacks observed August 15 to September 8, taking over self-hosted servers, creating persistent administrator accounts, and installing backdoors. ScreenConnect CVE-2026-84869 allows unauthorized file transfer and execution during remote sessions, linked by Huntress to malicious VBScript deliveries, and is fixed in version 26.6.5. GitLab's repository commits API path traversal exposes SSH keys, database credentials, deploy tokens, and CI/CD variables, with watchTowr already observing in-the-wild probes. Federal agencies must patch GitLab and ScreenConnect flaws by September 14, 2026, and Artifactory flaws by September 25, 2026.

Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point

Filigran introduces Attack Chaining in OpenAEV to continuously simulate multi-stage attack paths, exposing gaps that isolated MITRE ATT&CK technique testing misses.

Filigran announced Attack Chaining, a new scenario type in its OpenAEV platform that links individual techniques into automated, continuously-run multi-stage attack paths, using each step's real output (credentials, tokens, open ports) to branch dynamically toward a final objective. The article cites Filigran's State of Threat Management report, in which 93% of security leaders reported a business-impacting cyberattack in the past 12 months, 88% said AI accelerates attackers, and 84% blamed siloed tools and disconnected testing. The 2025 DGFiP breach is cited as an example where individually survivable weaknesses chained into a major intrusion. The feature includes conditional chaining logic, live attack path mapping, structured findings for identifying chokepoints, and predefined scope and safety guardrails.

The Hacker News · 1d agoTools

Security Incident – BGP Hijacking

Attackers BGP-hijacked Softaculous' Hetzner IP block for 33 hours, obtained valid TLS certificates, and delivered a malicious Virtualizor update to some servers.

Between August 28 and 30, 2026, AS62390 (NexonHost) announced 162.55.80.0/24 via transit AS6204 (Zet.net) without authorization, diverting traffic while retaining Hetzner's AS24940 on the AS path. The attacker obtained valid Let's Encrypt certificates for virtualizor.com domains because the CA's domain validation was also routed through the hijack, so affected connections showed no TLS warnings. A malicious Virtualizor update package reached a handful of installations; routing was fully restored, and reconstruction from RIPE RIS data showed all 368 collector peers carried the hijacked route at some point with roughly 28% time-weighted diversion.

Lobsters · security · 13d agoData breach

TRACE: Trajectory-robust Admission with Evidence Ordering for Efficient GUI Agents

TRACE, a training-free visual token pruning framework, cuts GUI agent inference latency and memory while keeping trajectory-wide visual evidence reusable.

TRACE is a training-free framework for trajectory-robust admission and coverage-aware evidence ordering that prunes high-resolution screenshot tokens accumulated in GUI agent trajectories. It ranks visual evidence using a query-independent layout-derived interaction prior combined with instruction relevance and feature novelty, and reserves part of the budget for native tokens distributed across the screen to repair spatial coverage. A monotone KV contraction incrementally compresses retired frames into compact session state, avoiding repeated visual encoding or pruning. Experiments across six GUI benchmarks and diverse models verify effectiveness under tight budgets, with source code to be released.

Hugging Face daily papers · 7d agoAI research

Jellyfin 12.0 security fixes arrive alongside the removal of legacy client logins

Jellyfin 12.0 ships security fixes for path traversal, first-run setup bypass, unsafe plugin names, and web client XSS, plus removal of legacy login paths.

Jellyfin 12.0 blocks requests built to reach files outside served folders, prevents setup-wizard re-runs on misconfigured servers, rejects unsafe plugin package names, and fixes web client cross-site scripting. The project published no CVE identifiers or severity ratings for the fixes. The release also drops legacy /emby/ and /mediabrowser/ endpoints, targets .NET 10, and breaks 10.11-era third-party plugins.

Help Net Security · 8d agoVulnerability

Heterogeneous Cross-Chain Transaction Tracing for Solana Bridges via Candidate-Set Selective Decision

SolTracer traces cross-chain transactions onto Solana bridges, improving open-world association F1 by 20.16% over the strongest baseline for illicit-fund tracing.

The paper formalizes four Solana-bound cross-chain transaction modes and proposes SolTracer, which maps heterogeneous execution semantics into a unified event space and uses candidate-set selective decision-making with abstention when valid targets are absent. In the challenging open-world setting with a 50% TA ratio, SolTracer improves F1 by 20.16% over the strongest baseline. An empirical study of real-world transfers examines count-value divergence across bridge mechanisms, cross-asset shifts, and decoupling between on-chain settlement and explorer visibility.

arXiv cs.CR · 6d agoResearch

From Parameters to Answers: How LLMs Retrieve and Use Their Internal Knowledge

Interpretability study traces how Qwen, Llama, and Gemma route query information and internal knowledge across layers when answering questions.

Researchers used layerwise interventions on hidden states to separate query-routing signals from target knowledge in language models, testing Qwen, Llama, and Gemma on country-continent questions with varied answer types. A pair-conditioned request direction strengthens before interventions alter downstream knowledge, opening a causal window while answer-supporting content is still forming. Trajectories differ by model: Gemma shows a partially overlapping mid-layer routing profile, while Llama has no sustained routing-effect window under the same gates.

arXiv cs.AI / cs.LG / cs.CL · 5d agoAI research1

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News · 28d agoThreat actor in the wild1

Context Engineering Inside the Harness: 4 Mechanisms That Beat Context Overflow and Goal Loss on Long-Horizon Tasks

Survey of four harness mechanisms—context budgeting, compaction, todo-state, and memory—that keep long-horizon LLM agents on task across 200+ tool calls.

The article details how agent harnesses, not larger context windows, solve context overflow and goal loss on long-horizon tasks, citing Chroma's Context Rot report showing 18 LLMs (GPT-4.1, Claude 4, Gemini 2.5, Qwen3) degrade on long inputs. Concrete implementations include LangChain Deep Agents offloading tool responses over 20,000 tokens to the filesystem and truncating old tool calls at 85% window usage, and Claude Code capping auto memory at 25KB while re-reading the 5 most recently modified files after compaction. OpenAI's Responses API now offers server-side compaction via context_management with a standalone /responses/compact endpoint, which Codex uses for long-running coding tasks. Manus reports a roughly 100:1 input-to-output token ratio per ~50-tool-call task, motivating todo.md state recitation to prevent goal drift.

MarkTechPost · 3d agoAI research1

Six Maximum

Cisco patched nine critical flaws, six rated CVSS 10.0, in Crosswork platforms and Secure Workload, none known to be exploited.

Cisco released fixes for nine critical vulnerabilities in its Crosswork platforms and Secure Workload software, discovered during an internal security review that used advanced AI models. Six flaws carry CVSS 10.0 ratings, including SQL injection CVE-2026-20030 and missing authentication CVE-2026-20357 in Crosswork, and access control CVE-2026-20315 and authentication flaws CVE-2026-20317 in Secure Workload. Fixes shipped in Crosswork 7.2.1-SP, Secure Workload 3.10.9.1, and 4.0.4.16. Cisco says no exploitation has been observed.

HarnessVLN: Unifying Training-Free Embodied Navigation through an Agent Harness

Researchers introduce HarnessVLN, a zero-shot training-free agent harness that sets new training-free SOTA on vision-language navigation benchmarks including R2R and HM3D.

HarnessVLN is a zero-shot, training-free framework for embodied vision-language navigation that coordinates perception, retrieval, grounding, navigation, recovery, and termination through a unified tool interface. It validates planner proposals against spatial evidence, geometric feasibility, and subgoal consistency, using hierarchical event memory and a persistent Spatiotemporal Graph that stores reusable spatial evidence and failure annotations. It reports success rates of 60.8% on R2R, 53.9% on RxR, 76.0% on HM3D-v2, and 59.3% on HM3D-OVON, surpassing prior training-free state of the art, with real-world humanoid deployment demonstrated.

Hugging Face daily papers · 2d agoAI research

Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0

Cisco patches nine Crosswork and Secure Workload flaws, five rated CVSS 10.0, found internally with no exploitation observed.

Cisco released fixes for four Crosswork platform vulnerabilities including CVE-2026-20030 SQL injection and CVE-2026-20357 missing authentication, both scoring CVSS 10.0, affecting Crosswork Release 7.2.1 and earlier. Five additional flaws in Secure Workload, including CVE-2026-20315 and CVE-2026-20317 at CVSS 10.0, affect SaaS and on-premises deployments up to releases 3.10 and 4.0. All issues were found through internal testing and are not known to be actively exploited. The patches follow a broader internal security review that recently addressed 12 Catalyst SD-WAN and IOS XE bugs.

ENCP: Episode-Normalized Conformal Prediction for Vision-and-Language Navigation

ENCP calibrates conformal prediction per navigation episode, giving step-level coverage guarantees for vision-language navigation agents despite within-episode dependence.

Episode-Normalized Conformal Prediction (ENCP) rescales a nonconformity score by a VLN policy's residual confidence and calibrates one maximum score per episode, preserving step-level coverage of at least 1−α despite dependence among steps within an episode. Across four VLN policies and three nonconformity scores on R2R and REVERIE, ENCP meets all reported empirical step-coverage targets in seen-to-unseen evaluation. The model-agnostic uncertainty estimates can signal when an agent should defer to a stronger predictor or human assistance.

arXiv cs.AI / cs.LG / cs.CL · 18h agoAI research

U.S. CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalog

CISA added actively exploited ownCloud, Linux kernel, and JFrog Artifactory flaws to its KEV catalog, setting August 30 and September 10 deadlines.

CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2023-49105 (ownCloud WebDAV improper authentication, CVSS 9.8), CVE-2026-53362 (Linux kernel IPv6 out-of-bounds write, CVSS 7.8), and CVE-2026-66384 (JFrog Artifactory path traversal, CVSS 5.3). The ownCloud flaw lets unauthenticated attackers who know a username read, alter, or delete files when no signing key is configured; the kernel bug enables local privilege escalation. OpenAI reported its models identified and exploited the JFrog Artifactory zero-day, and AI agents used the Linux kernel flaw to gain root access and escape an Artifactory container in an OpenAI environment. Federal agencies must patch CVE-2026-66384 by September 10 and the other two by August 30, 2026.

Procedural Graphs: Self-Evolving Execution Structures for LLM Agents

Procedural Graph framework stores procedural knowledge as triplets and self-evolves via LLM refinement, beating memory-based baselines across datasets, tasks, and LLMs.

The Procedural Graph organizes procedural knowledge into (procedure, relation, procedure) triplets; at each decision step the framework localizes the agent's active node and a guidance model translates the surrounding subgraph into step-level guidance that biases the solver's next action. An LLM refiner contrasts failed with successful trajectories and edits the graph's topology and attributes, retaining rejected edits to discourage repetition. Starting from a minimal skeleton, the loop builds graphs that match or surpass hand-designed ones and can repair flawed expert priors, delivering consistent gains over memory-based baselines across multiple datasets, task types, and LLMs.

Hugging Face daily papers · 8d agoAI research1

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Researcher disclosed two root RCE chains in Unitree G1 EDU robots (CVE-2026-76639, CVE-2026-76640), one reachable via unpaired Bluetooth, with no confirmed fixed firmware.

Security researcher Olivier Laflamme disclosed two independent root remote code execution chains in the Unitree G1 EDU robot: CVE-2026-76639, a network-adjacent path through chat_go and bashrunner, and CVE-2026-76640, a Bluetooth Low Energy path that ends with a 1,050-byte buffer overflow in btgatt-server giving root on the Locomotion PC. The BLE chain also exploits a cloud authorization gap that let any valid Unitree account recover another robot's AES key, then forces the robot onto an attacker hotspot via wpa_connect.sh heredoc injection. Unitree patched the cloud ownership check in July 2026, but no confirmed fixed firmware release addresses the BLE issues; the PoC was limited to two robots in one room and no in-the-wild exploitation is reported.

CodeTD: Topology of Attention Detects Hallucinations in Code LLMs

CodeTD detects hallucinations in code LLMs before execution by analyzing topological patterns of attention maps, outperforming recent baselines.

CodeTD applies topological data analysis (TDA) to code LLM attention maps to quantify prompt-generation mismatch as a pre-execution correctness signal. Experiments cover HumanEval, MBPP, BigCodeBench, and MultiPL-E across 5 programming languages and 10 code LLMs up to 34B parameters. The method outperforms recent baselines and transfers between coding benchmarks, helping catch code that fails the task or embeds security vulnerabilities.

arXiv cs.AI / cs.LG / cs.CL · 8d agoAI research1

Hack One Robot, Reach the Next: Unitree G1 Security Flaws

Researcher chained two Unitree G1 flaws (CVE-2026-76639, CVE-2026-76640) to gain unauthenticated root access, with compromised robots able to infect others via Bluetooth.

Security researcher Olivier Laflamme chained a path-traversal file-write flaw (CVE-2026-76639) in the G1 chatbot service and a Bluetooth server buffer overflow (CVE-2026-76640) to achieve unauthenticated root access remotely. The chain abuses Unitree's cloud API as a decryption oracle for the AES-128 key that unlocks BLE and WebRTC channels, and a compromised robot can propagate the attack to nearby G1 units. Unitree patched the cloud ownership-check flaw, paid a $5,000 bounty, and firmware fixes for BLE pairing and the buffer overflow remain harder to deliver.

Revisiting Complete Reasoning Traces for Post-Training

Researchers show full reasoning traces provide limited benefit in LLM post-training, with heavily truncated or endpoint-only trajectories performing comparably.

A pilot study plus attention-based analyses and controlled token-removal studies show intermediate tokens in reasoning trajectories contribute minimally to final reasoning quality. Partial trajectories remain effective even under heavy truncation, and training on endpoints alone leads to consistent changes in reasoning behavior. The finding also benefits reinforcement-learning and on-policy distillation post-training; code is released at github.com/naver-ai/revisiting-trace.

Hugging Face daily papers · 9d agoAI research

Exposed Vite servers are being probed for AWS and Azure credentials

F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.

F5 Labs reported 32,000+ scan attempts (807 attack sessions) against exposed Vite servers in August, up from 1,732 attempts over the prior three months. Attackers exploited CVE-2026-39364 (CVSS 8.2), which bypasses Vite's server.fs.deny protection via parameters like ?raw and ?import&raw, affecting Vite 7.1.0 to before 7.3.2 and Vite 8 before 8.0.5. Scanners cycled wordlists for environment files, AWS keys, Azure tokens and IaC state files, also combining older Vite CVEs (2025-30208, 2025-31125, 2024-45811) and probing a Next.js middleware bypass. Only CVE-2025-31125 is currently in CISA's KEV catalog.

CSO Online · 21h agoExploit / PoC in the wildCVE-2026-39364CVE-2025-30208CVE-2025-31125+4 CVEs

Adversarial Testing of Automated Program Repair Agents for Security Vulnerabilities

SWEADV benchmark shows adversarial issue descriptions make LLM program-repair agents write insecure fixes in 51.7% of cases, evading most detection tools.

Researchers built SWEADV, a benchmark of 750 adversarial issue descriptions derived from 150 SWE-bench Verified repair tasks, covering command execution, deserialization, path traversal, denial of service, and weak hashing attack types. Tested on mini_swe agents backed by GPT-5-Mini, MiniMax-M2.5, and DeepSeek-R, adversarial descriptions induced malicious behavior with successful repair in 51.7% of cases. Detection was weak: LLM-as-judge pre-repair screening reached only 62.3% accuracy, and post-repair detection via static analysis and LLM-as-judge achieved just 39.4% and 55.4%.

arXiv cs.CR · 1d agoAI safety & security1

Evidence-Grounded Retrieval for Investigation Hunt Lead Generation from CTI Reports

AHLERT generates environment-aware threat hunting leads from CTI reports using ATT&CK-seeded knowledge graph retrieval, roughly doubling F1 over flat-RAG baselines.

The paper introduces AHLERT, a system that converts Cyber Threat Intelligence reports into structured, investigable hunt leads via hybrid dense retrieval with multi-hop traversal over an MITRE ATT&CK-seeded knowledge graph and ontology-grounded RAG constrained to the defender's assets. It is LLM-agnostic and evaluated on public CTI reports for well-known APTs across proprietary and open-weight models. Hybrid evidence retrieval with ontology grounding raises mean F1 from 0.44 to 0.85, and AHLERT attains the highest effectiveness score (~86.95%) versus off-the-shelf LLMs.

arXiv cs.CR · 7d agoResearch

Risky Bulletin: The EU publishes its upcoming cybersecurity standards

ETSI releases 17 draft cybersecurity standards vendors must meet when the EU Cyber Resilience Act takes effect in December 2027.

The European Telecommunications Standards Institute published 17 interim draft standards covering operating systems, routers, firewalls, VPNs, SIEMs, browsers, password managers, smart home devices, toys and wearables. They mandate basic security features such as post-sale updates, shipped SBOMs, modern cryptography and secure-by-default settings; public comments run until November, with final versions expected in December, one year before CRA compliance begins in December 2027. The newsletter also reports Irregular taking responsibility for AI test-environment escapes involving Anthropic and Meta frontier models, a breach at France's tax agency exposing 678,000+ citizens' data claimed by hacker ZeroBytes, and Kazakhstan eGov data covering 15 million citizens listed for sale on an underground forum. Additional briefs cover a $3.2 million Harmony Protocol theft crashing the ONE token 40%, Columbus Police still restoring systems two years after ransomware, DDoS attacks on Threema's provider, and Ukraine's GUR claiming a cyberattack on Wildberries.

Risky Business News · Aug 17, 2026Policy & legal1

Mercator ↔ Equal Earth

Simon Willison used GPT-6 Astra (medium) in ChatGPT Work to build an animated D3 transition between Mercator and Equal Earth map projections.

Willison built an animated transition between the Mercator and Equal Earth map projections using D3. The tool was generated by GPT-6 Astra (medium) in ChatGPT Work. Equal Earth is a projection recently voted on at the UN. The post is a vibe-coding demonstration rather than a security or major model event.

Simon Willison · 8d agoAI tools & infra1

AI AppSec tools agree on just 5% of security findings

Contrast Security report finds 42 confirmed exploit attempts per application monthly and three AI scanners agreeing on only 5% of findings.

Contrast Security's AppSec Overflow 2026 report, drawing on telemetry from hundreds of thousands of production applications and APIs, found adversaries touch the average application every four minutes with 42 confirmed viable exploit attempts per application monthly, led by untrusted deserialization, path traversal, and method tampering. Legacy flaws Log4Shell and Spring4Shell remain widespread, mean time to exploit fell from over two years in 2018 to under three weeks for most 2025 exploited vulnerabilities, and average critical fix time is 92 days. Three AI scanners set on the same codebase agreed on only 5% of findings, and triaging a 2-million-line codebase scan cost roughly $128,000 versus $315 in API charges. Among exploited CVEs in the dataset, 82% of KEV-listed entries carried EPSS scores of 90% or higher, while CVE-2006-1547 and CVE-2023-38180 were confirmed exploited despite EPSS scores under 25%.

Help Net Security · 16d agoResearch in the wildCVE-2006-1547CVE-2023-381801

terms.txt: A Consent and Compensation Protocol for Agentic Web Access

terms.txt specifies a robots.txt-style protocol for per-path, per-purpose AI crawler consent and compensation, with enforcement adding 0.20-0.65 ms per request.

The paper documents that automated clients now make up most web requests, that training dominates Cloudflare-classified crawling, and that the largest AI platforms fetch thousands of pages per returned visitor while robots.txt cannot express identity, purpose, terms, or price. It specifies terms.txt plus an origin-enforced exchange using Web Bot Auth signatures, signed intent, delegation tokens, HTTP 402 negotiation, and signed receipts. A dependency-free implementation adds 0.20 to 0.65 ms per request on one vCPU.

arXiv cs.CR · 6d agoResearch

Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.

Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.

BleepingComputer · 7d agoAdvisory in the wildCVE-2026-69805CVE-2026-58649CVE-2026-69806+27 CVEs1

Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider

Exposed attacker staging server reveals intrusion of Thai broadband provider 3BB via actively exploited FortiGate SSL-VPN flaw CVE-2024-21762.

Hunt.io found an open directory on server 92.63.180[.]133 holding 298 files detailing an intrusion into Triple T Broadband's 3BB brand, starting from a FortiGate 60F SSL-VPN at mail.3bb.co[.]th:10443. The actor weaponized CVE-2024-21762 (CVSS 9.8, KEV-listed since February 2024) using heap spraying and a ROP chain to gain a reverse shell. Post-exploitation included MeshCentral root-level persistence via www.ayuthayatech[.]com, Dirty COW/PwnKit privilege escalation, credential harvesting, SSH spraying against 55+ internal addresses, and log-deleting cleanup scripts; a stolen OpenVPN certificate and key from Triple T's PKI may still be valid.

Cyber Security Newsupdated · 1d agofirst · 1d agoExploit / PoC in the wild 3 sourcesCVE-2024-217622