30
30
30
42
42
55
Forgery of C2PA on a Pixel 10
Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.
A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.
38
Turn it off and on again, but for critical infrastructure
KTH researchers trained a reinforcement-learning intrusion response agent on an emulated segmented OT network that autonomously resets hosts and processes to disrupt intruders.
Researchers at KTH Royal Institute of Technology built a containerized replica of a segmented industrial network, attacked it across 14 days, and captured 40,000 30-second traffic intervals to train a defense agent under partial observability. The agent observes six packet-count numbers per interval, maintains 500 running state hypotheses, and can reset supervisory hosts, water tank processes, or entire subnets, with resets rebooting the target, renewing credentials, and changing its IP. The best agent approached a full-visibility baseline but depends on an assumed attacker behavior model; the testbed comprised three supervisory hosts, two PLCs, two tanks, weak credentials, and CVE-2017-7494 exposure. The team released its implementation and plans validation on a real industrial testbed with a partner.
42
30
55
42
30
30
55
30
55
30
30
Hackers Stole Flock’s Camera Software, Revealing How the Company Tracks Cars and People
Hackers who removed a Flock Safety license plate camera dumped its data, revealing person-detection capabilities and an encryption key stored unencrypted on the device.
A hacker collective calling itself stegan0gram physically removed a Flock Safety automatic license plate reader camera from a roadway, copied its storage, and shared the files with 404 Media, WIRED, and Distributed Denial of Secrets. Analysis found an encryption key in an unencrypted 'media' partition that unlocked videos of thousands of vehicle detections, with logs showing more than a million images generated in weeks. The software explicitly detects people, bicycles, and even bumper stickers, and records from one Georgia city were searchable by more than 2,000 agencies nationwide. The findings follow 2025 research by Jon Gaines documenting flaws enabling root-level access to Flock cameras.
48
Securing the unpatchable in an age of AI-driven vulnerabilities
Cisco Talos argues AI-driven vulnerability discovery leaves unpatchable OT systems exposed, recommending virtual patching via NGFW/IPS and micro-segmentation.
AI-assisted code analysis is uncovering vulnerabilities faster than organizations can patch, leaving certified or end-of-life OT systems with unmitigated known flaws. Talos recommends virtual patching with next-generation firewalls and IPS, micro-segmentation using VLANs and ACLs, and building visibility-based inventories of legacy systems. The article cites WannaCry's impact on the NHS and 2023 exploitation of end-of-life software in government systems, and warns that air gaps and data diodes are routinely circumvented by operational shortcuts.
30
Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware
Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.
Threat actors are weaponizing the Volume Shadow Copy Service (VSS) for two purposes: destroying local recovery points via vssadmin.exe, wmic.exe, diskshadow.exe, wbadmin.exe, and bcdedit.exe before encryption, and accessing static copies of locked files such as NTDS.dit and SAM for credential theft. Ransomware families tied to shadow-copy removal include Akira, Black Basta, BlackCat, Conti, LockBit, Qilin, RansomHub, REvil, Ryuk, and WannaCry. Huntress's analysis of the Nightmare-Eclipse tool showed the BlueHammer technique chaining a Windows Defender timing issue with a VSS snapshot to dump the SAM database and decrypt NT hashes. Defenders should correlate VSS operations with parent process, hive access, and subsequent encryption activity, and maintain immutable off-host backups.
52
When the Whole Company Adopts AI: What It Does to Your SOC
Analysis of 16.9 million SOC alerts finds AI-related alerts at 0.43%, growing 685% since February, with 94.1% noise and 0.02% real attacks.
A review of roughly 16.9 million SOC alerts found about 73,000 (0.43%) were AI-related, a share that grew 685% between February and June 2026. Of AI-related alerts, 94.1% were noise, 5.8% genuine risks, and 0.02% real attacks; 79.8% received benign verdicts, 81.7% were automatically suppressed, and only 5.4% reached a human analyst. The only confirmed attacks were phishing campaigns that weaponized AI brand names as lures, while developer coding agents spawning shells and reading credential stores routinely tripped detections written before AI agents existed.
45
MicroHasTEE: Bare-Metal Haskell for Type-Level Peripheral Ownership on Armv8-M
MicroHasTEE expresses TrustZone secure and non-secure firmware as one typed Haskell program, catching peripheral-ownership inconsistencies at compile time.
MicroHasTEE is a multiparty Haskell framework that models both TrustZone firmware images as participants in a single typed program, using type-level capability ledgers to track peripheral acquisition, configuration, transfer, and finalization. MicroHs compiles the shared program twice to produce separate bare-metal Secure and Non-secure firmware images. The framework rejects inconsistent resource use, post-configuration attribution changes, wrong-domain callbacks, and calls to unregistered Secure services. A door-lock case study on an STM32U5 Nucleo board produced images of 232.7 KiB and 228.4 KiB of flash with roughly 220 KiB of SRAM per domain.
30
Access Control as Verified Parse Constraints
Researchers verify a class of EverParse validators that correctly enforce access-control policies, deploying a machine-checked enforcement gate on seL4.
The paper targets enforcement-code bugs in commercial security gateways by proving that forward-only, backtrack-free EverParse validators are verified recognizers for a bounded finite-state class that includes access-control decision functions with fixed-offset fields and bounded disjunction. Encoding a bounded policy language into a fixed-size byte buffer allows an SMT solver to verify the enforcement code once, covering all byte values, policies, requests, and sessions. Editing rule content over a fixed endpoint set requires no new proof, while adding endpoints reruns the toolchain. A deployment on the seL4 microkernel ensures every request passes through the gate and unverified components cannot corrupt the enforcement chain.
28
Credential Theft: How Attackers Steal & Use Stolen Credentials
Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.
Huntress published an educational overview of credential theft, citing that roughly 70% of confirmed data breaches begin with stolen credentials. It details acquisition methods including phishing, adversary-in-the-middle attacks that capture MFA session tokens, infostealers (nearly a quarter of threats Huntress observed in 2025), Mimikatz-based credential dumping, credential stuffing, and password spraying. The piece then covers post-theft actions such as lateral movement, privilege escalation, account takeover, business email compromise, and ransomware, and closes with behavioral detection guidance and layered prevention strategies.
15
Heterogeneous Cross-Chain Transaction Tracing for Solana Bridges via Candidate-Set Selective Decision
SolTracer traces cross-chain transactions onto Solana bridges, improving open-world association F1 by 20.16% over the strongest baseline for illicit-fund tracing.
The paper formalizes four Solana-bound cross-chain transaction modes and proposes SolTracer, which maps heterogeneous execution semantics into a unified event space and uses candidate-set selective decision-making with abstention when valid targets are absent. In the challenging open-world setting with a 50% TA ratio, SolTracer improves F1 by 20.16% over the strongest baseline. An empirical study of real-world transfers examines count-value divergence across bridge mechanisms, cross-asset shifts, and decoupling between on-chain settlement and explorer visibility.
24
ZK-Trace: Certified Collusion Tracing with Zero-Knowledge Credentials for Federated GNSS Interference Monitoring
ZK-Trace combines Tardos fingerprints and zero-knowledge credentials to trace leaked classifier copies in federated GNSS monitoring without leaker cooperation.
ZK-Trace addresses leakage of a proprietary classifier distributed to partly trusted stations in federated GNSS interference monitoring, combining public identity marks, recipient-specific Tardos fingerprints, and zero-knowledge credential verification to support offline tracing. The paper provides false-accusation and tracing-score bounds with an interval-arithmetic checker allocating a common budget across accusation and tamper decisions. In a simulated GNSS federation it isolates all 160 single-owner copies and traces 712 of 720 two-owner mixtures with a 0.001 false-naming budget, while feature marks survive feature matching in 20/20 runs at 4.8 percentage-point accuracy cost but are erased by function-only distillation.
30
Navigating the Latent Manifold: Proactive Concept Drift Adaptation for Resilient NIDS
Researchers propose DriftXpert, a concept-drift-adaptive network intrusion detection system validated on enterprise networks, addressing degraded AI-based NIDS performance in dynamic traffic.
AI-based network intrusion detection systems assume static data distributions and degrade under concept drift, raising false positives in dynamic environments. DriftXpert uses a two-stage offline framework: an unsupervised latent-manifold anomaly metric to detect traffic drift, and representation consistency alignment with cross-epoch neuron weight aggregation and selective freezing to transfer knowledge without catastrophic forgetting. Experiments on public datasets and a real enterprise network show effective adaptation to drifted data while retaining known-attack detection.
36
Testing race conditions with memory access tracing and stack-based delay injection
Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.
A Google Project Zero researcher published MAccConc (Memory Access Concurrency), tooling for exploring possible interleavings of multithreaded test cases in the Linux kernel, available on GitHub. The tools use KCOV with ASAN outline-mode instrumentation to record per-access memory traces, enabling automatic testing of all A-B-A interleavings plus terminal and GUI explorers for manual analysis. The work targets confirming race condition candidates, building reliable regression tests, and enabling concurrency fuzzing, drawing on ideas from SKI and Ned Williamson's sockfuzzer.
48
Memory-Efficient Designs for Word-Wise Universal Fully Homomorphic Encryption
BXT framework mitigates FHE memory bottlenecks via ciphertext compression, serialization, delayed seeding, and digit pruning, achieving up to 3.8x CNN inference speedup.
A new paper proposes BXT, an optimization framework for word-wise Universal Fully Homomorphic Encryption that targets the memory bottleneck rather than compute. It combines four techniques: ciphertext compression via seed regeneration, bit-packed ciphertext serialization for L2-to-L1 transfers, delayed PRNG-heavy offline seed generation across aggregated operations, and fault-aware ciphertext digit pruning. On CNN inference, the BXT-CSO50 configuration achieves up to 3.8x speedup over a 100x GPU baseline with under 1% accuracy loss at 50% comparison precision.
24
42
30
30
30
30
30
55
30
30
30