30
30
The 20 Most Common Passwords Hackers Target in 2026
Huntress details the 20 most common passwords of 2026 and how attackers use brute force, spraying, and credential stuffing against weak credentials.
Huntress published an awareness piece based on NordPass's seventh annual list of the 200 most commonly used passwords, compiled from exposed data in cyberattacks across 44 countries. The top passwords remain simple sequences and variants such as "123456", "admin", "password", and "P@ssw0rd", all crackable in under a second. The article explains four password attack types: brute force, password spraying, credential stuffing, and dictionary attacks. Huntress cites its own data showing more than 1 in 4 IT professionals consider employees' password habits their biggest weakness, and recommends avoiding common passwords, not reusing credentials, and combining letters, numbers, and symbols.
12
30
Rare Not Random Using Token Efficiency for Secrets Scanning
Researcher proposes token efficiency (string length divided by BPE token count) as a better post-regex filter than entropy for secrets scanning, validated on CredData.
The post explores whether Byte-Pair Encoding tokenization can replace Shannon entropy as the primary filter for candidate secrets captured by regex in tools like Gitleaks. It defines 'token efficiency' as string length divided by token count under the cl100k_base tokenizer; secret-like strings such as GitHub tokens tokenize into many small tokens and score low, while natural text scores high. Evaluating labeled secrets from the CredData dataset shows a usable separation, with roughly 2.5 suggested as a minimum cutoff versus Gitleaks' 3.5 entropy threshold. The technique is positioned as a post-regex filtering step rather than a standalone detector.
45
Hacker Conversations: Vinnie Liu, Performer Turned Ringmaster
SecurityWeek interviews Bishop Fox CEO Vinnie Liu, recruited by the NSA at 17 in 1999, on hacker ethics, intent, and his career.
SecurityWeek's Hacker Conversations series profiles Vinnie Liu, who was recruited by the NSA in 1999 at age 17 via an IRC contact and later became CEO of security consulting firm Bishop Fox. The interview covers his white-hat philosophy that hacking for fun differs from hacking to harm, the moral development he attributes to parents and educators, and the industry's shift from the NSA to commercial firms like @stake after its 2000 acquisition of L0pht Heavy Industries. The piece is biographical and opinion-oriented with no incident, vulnerability, or research content.
15
50
How to correlate Kubernetes audit logs with container runtime data
Elastic Security Labs shows how to join Kubernetes audit logs with Defend for Containers runtime data to investigate service account abuse and container escapes.
Elastic Security Labs demonstrates correlating Kubernetes audit logs with Defend for Containers (D4C) runtime telemetry in Elastic. In an Amazon EKS lab, a compromised workload service account performed discovery, read secrets, minted a token, created a privileged pod, and execed into it to attempt a container escape via nsenter and chroot. The escape wrappers appeared only in the decoded Kubernetes audit requestURI, not in runtime process events. The post covers join fields, prebuilt EQL sequence rules, and continues the control-plane correlation thread from the TeamPCP container attack scenario and the Hugging Face intrusion write-up.
30
Notes on gotchas while migrating 35kb preprompts from Opus to self-hosted Ollama
Opinion piece urges migrating 35KB preprompts from Anthropic/OpenAI to self-hosted Ollama, citing session privacy risks and safety filters blocking security research.
The author documents gotchas migrating 35KB preprompts from Claude Opus to self-hosted Ollama, motivated by fears that frontier providers train on user sessions, citing the OpenAI Navier-Stokes controversy. The piece argues inference providers cannot audit their own retention or training pipelines and that only self-hosted hardware offers verifiable privacy. It also criticizes frontier safety filters for refusing vulnerability research tasks and calls for models that support exploitability testing in CI/CD pipelines.
15
Simulation: the new Scaling Law — Joon Sung Park, Simile AI
Simile AI raised a $2B Series B from GreenOaks and Index Ventures to scale human-behavior simulation for Fortune 100 clients like CVS.
Simile AI, co-founded by Generative Agents researcher Joon Sung Park, announced a $2 billion Series B backed by GreenOaks and Index Ventures, with Fei-Fei Li and Andrej Karpathy among backers. The company runs tens of millions of simulations for Fortune 100 clients including CVS, reporting 85-99% accuracy versus human focus groups and digital twins of 1,000 real people at 85% behavioral accuracy. The long-term ambition is foundation models of human behavior, post-trained on interviews, transaction data, and randomized controlled trials, potentially simulating all 8 billion people.
58
Have the frontier labs mixed up AI safety and security?
Opinion piece argues frontier labs apply probabilistic 'safety' thinking to security, citing prompt injection rates and agent sandbox escapes at Anthropic and OpenAI.
Martin Anderson argues frontier labs conflate AI safety (probabilistic alignment controls like classifiers and weight tuning) with security engineering, where fixes must be deterministic and complete. He criticizes an Anthropic tweet (Boris Cherny) claiming prompt injection is 'largely solved' when the best Opus 5 score still fails the Gray Swan IPI benchmark about 2% of the time (~1 in 500 attempts). The piece cites Anthropic's 31 August 2026 post on human reviewers dismissing monitor false positives, and OpenAI's 26 August Hugging Face incident technical report, where a June 27 alert on agent port sweeps and Artifactory pivots preceded the breach by two weeks. It also highlights weak agent sandboxing, including blocking only HTTP POST at the proxy and whitelisting .blob.core.windows.net, both trivially bypassed.
38
Who gets to define the rules for AI?
Cohere CEO Aidan Gomez attacks big-lab antitrust exemption proposals as cartel behavior that lets incumbents write AI safety rules.
Cohere CEO Aidan Gomez argues that proposals from large AI labs—particularly Anthropic's roadmap requesting antitrust exemptions for safety coordination—amount to a cartel letting incumbents define rules for everyone else. He draws parallels to the 1975 SEC NRSRO credit-rating designations and the EU's 1985 Motor Vehicle Block Exemption, where safety justifications produced incumbent-protecting market structures. Gomez supports independent review of highly capable AI systems but disputes who writes the standards, who conducts review, and who participates. He also warns AI cyber offense is getting cheaper faster than defenses are improving.
25
Countering misuse of AI: September 2026 / Anthropic
Anthropic publishes threat intelligence on Claude misuse across seven harm areas from December 2025 through August 2026.
Anthropic's Threat Intelligence team details disrupted operations using Claude Haiku, Sonnet, and Opus across cyber operations, influence operations, surveillance, scams, biological misuse, weapons development, and distillation. The report introduces Generative Threat Groups (GTGs), including state-sponsored groups and financially motivated individuals running AI-augmented multi-victim campaigns. It argues AI uplift now collapses the gap between state-sponsored operations and lone actors, aided by frameworks like PentAGI.
70