30
42
30
30
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another
Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.
Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.
45
30
30
30
Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery
Reprompt watermark forgery reproduces on Stable Diffusion XL using free-tier T4 GPUs, with forged images accepted by the genuine detector 5 of 6 times.
The authors reproduce the Reprompt forgery attack of Müller et al. against Tree-Ring watermarking on Stable Diffusion XL using the released code on free-tier dual T4 GPUs with 14.6 GB usable memory, versus the A40 hardware of the original study. Over six trials, the genuine detector flagged genuine images 6/6, clean images 0/6, and forged images 5/6, at 325-332 seconds per attack. They also recovered the detector's discarded non-central chi-square statistic and built two natural scores separating forged images from the clean null at AUC 0.861 and 0.972. The notebook, pinned fork, and all measurement artifacts are released with the paper.
30
Almost Half of Malware Samples Communicate Direct to IP
Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.
Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.
55
30
30
30
55
30
30
30
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing
DDRop uses a sub-$200 DDR5 interposer to drop memory writes, breaking Intel TDX and AMD SEV-SNP confidentiality guarantees.
Researchers at KU Leuven, ETH Zurich, Durham University, and Google will present DDRop at ACM CCS 2026, a first active interposer attack on DDR5 that silently drops memory writes so processors keep reading stale encrypted data, exploiting the missing freshness guarantee in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP. On Intel TDX's default logical integrity mode it enabled reading victim VM memory, toggling debug mode, and forging remote attestation; AMD SEV-SNP was limited to copying pages between VMs. TDX's stronger cryptographic integrity blocks cross-VM attacks but likely not attestation forgery. The team will release board designs, firmware, and attack code on GitHub; no evidence of real-world use exists and no simple patch is available.
55
Scaling Verification of Cryptographic Software with Aeneas, Rust, and Lean
Microsoft SymCrypt implementations of SHA-3 and ML-KEM verified in Lean via Aeneas-extracted Rust models, with AI agents writing proofs.
The paper develops a methodology for verifying production Rust cryptographic code by using Aeneas to extract pure models into Lean, avoiding low-level pointer and aliasing reasoning. Applied to Microsoft's SymCrypt, it verifies SHA-3 and ML-KEM implementations ported from C to Rust and extends SymCrypt with FrodoKEM, ML-DSA, and HPKE. A 237 KLOC Lean development establishes safety, panic-freedom, and functional correctness of 16.7 KLOC of Rust supporting post-quantum cipher suites on x86-64 and ARM. AI agents autonomously write formal proofs verified by the Lean kernel, and evaluation shows verified Rust meets SymCrypt's performance and portability requirements.
42
MicroHasTEE: Bare-Metal Haskell for Type-Level Peripheral Ownership on Armv8-M
MicroHasTEE expresses TrustZone secure and non-secure firmware as one typed Haskell program, catching peripheral-ownership inconsistencies at compile time.
MicroHasTEE is a multiparty Haskell framework that models both TrustZone firmware images as participants in a single typed program, using type-level capability ledgers to track peripheral acquisition, configuration, transfer, and finalization. MicroHs compiles the shared program twice to produce separate bare-metal Secure and Non-secure firmware images. The framework rejects inconsistent resource use, post-configuration attribution changes, wrong-domain callbacks, and calls to unregistered Secure services. A door-lock case study on an STM32U5 Nucleo board produced images of 232.7 KiB and 228.4 KiB of flash with roughly 220 KiB of SRAM per domain.
30
LG smart TVs caught logging audio with screen off and snooping on local devices
Gamers Nexus found LG smart TVs record microphone audio in standby, scan home networks, and feed LG Ad Solutions ad targeting.
A 135-minute Gamers Nexus investigation with Level1Techs and independent researchers found retail LG OLED TVs running webOS sweep local networks, gather device names and Wi-Fi metadata, and run Automated Content Recognition. Tests showed the TVs capture clean microphone audio while appearing powered down and store it offline, uploading once reconnected. The team also found RCE vulnerabilities in webOS now moving through responsible disclosure; LG claims 216 million smart TV sales, and its ad unit claims access to 363 million addressable devices in the US.
40
30
30
30
30
30
30
30
42
30
30
30
30
30
30
55
55
30
30
30