30
30
57
30
60
42
Threat Matrix: Mapping threats across cloud web applications
Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.
Microsoft introduced the cloud web applications threat matrix, which organizes attack techniques for cloud-hosted web apps and serverless platforms using MITRE ATT&CK tactics, from resource development through impact. The framework covers attack paths spanning application code, managed runtimes, workload identities, and deployment pipelines, cataloging techniques such as subdomain takeover, code injection in connected repositories, compromised registry images, exposed admin interfaces, and serverless trigger injection. It builds on Microsoft's earlier Kubernetes and storage services matrices to help defenders identify visibility gaps, prioritize hardening, and plan investigations in cloud-native environments.
35
Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes
Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.
Mars Security, an autonomous threat hunting and detection engineering platform founded by former offensive security operators, announced Real-Time Intel-Based Detection. The capability ingests advisories from sources like CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence, maps indicators to MITRE ATT&CK, and authors native query logic across connected infrastructure including CrowdStrike Falcon, Wiz, Splunk, Sysmon, identity providers, Snowflake, and Databricks. Every rule is backtested against 30 days of historical telemetry to quantify false positives before analyst approval and one-click deployment. The feature is free for existing customers and available via AWS Marketplace.
22
AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance
Huntress maps AD RMS architecture and recon paths, setting up an offline key-extraction attack against its unrotatable 255-year root key.
Huntress's multi-part research examines Active Directory Rights Management Services, Microsoft's enterprise DRM role that still ships in Windows Server 2025 despite migration guidance favoring Azure Information Protection. Part 1 covers the trust model and how an ordinary domain account can locate RMS clusters and read rights-policy templates. Part 2 will detail four independent paths for extracting the Server Licensor Certificate (SLC) private key via service-group membership and the configuration database, enabling fully offline decryption of protected documents. The SLC certificate is valid from 2002 to 2258 and has no key-rotation mechanism, so a stolen key decrypts protected content indefinitely.
55
IAM Compliance Requirements and Best Practices
A guide maps IAM compliance requirements across SOX, PCI DSS, HIPAA, ISO 27001 and NIST 800-53, urging verified enforcement over documented policies.
The guide argues IAM compliance requires demonstrating that access controls are enforced at runtime, not merely documented, highlighting gaps between policy intent and application-layer execution. It maps recurring requirements across SOX ITGCs, PCI DSS v4.0, HIPAA, ISO/IEC 27001:2022, NIST SP 800-53 and GDPR, covering least privilege, separation of duties, access certification and audit trails. It recommends continuous, evidence-backed verification and application-layer telemetry instead of relying on identity provider logs or quarterly access reviews.
15
The /wayfinder Skill: Navigating the “Fog of War” of Planning
Matt Pocock released the /wayfinder skill, an orchestrator layer that manages planning sessions, maps, and tickets for AFK coding agents.
Latent Space interviews Matt Pocock, whose AI Skills for Real Engineers project has 220,000+ GitHub stars, about his new /wayfinder skill. The skill manages agent context during ambiguous planning by splitting work into grilling, prototype, research, and task tickets organized under a shared map, enabling overnight AFK agent runs. It uses deliberate terminology like map, ticket, and session to steer agent behavior, and was tested on projects including a personal website rearchitecture.
32
Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.
ReliaQuest analyzed a custom Java web shell planted on vulnerable PTC Windchill and FlexPLM servers following exploitation of CVE-2026-12569 (CVSS 9.3). The implant decrypts Windchill keystore credentials including the LDAP manager password, enumerates the file vault for engineering data, and loads attacker-supplied Java classes in memory for post-exploitation. Commands let operators read and delete files, exfiltrate results, and deliver follow-on payloads such as ransomware. Ransom-ISAC, eCrime.ch and Defused previously attributed the campaign to the Clop data-theft extortion group.
76
30
60
45
55
30
55
30
60
57
35
60
30
30
30
35
55
55
55
42
30
60
42
60
35
Mapping out your unknown: A threat hunter’s guide to GitHub
Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.
Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.
45
Discrete Beckmann Transport Models for One-Step Language Modeling and Reasoning
DBTM achieves one-step text generation via a time-independent transport map trained directly from data, removing pretrained teacher distillation.
Discrete Beckmann Transport Models (DBTM) build a time-independent flow whose autonomous transport map provably carries any point in ambient space to a fixed point on simplex vertices in a single step. The fixed-point property is characterized by a conservation equation whose residual can be minimized directly from data, eliminating the need for a teacher flow, distillation, and time conditioning. A partial-context interpolant extension turns additional function evaluations into refinement steps rather than ODE integration steps. On language modeling and reasoning tasks, DBTM's one- and few-step generation improves quality and accuracy over discrete diffusion and continuous flow baselines.
35
Retrospectively Reverse-Engineering Apple's Neural Engine
A developer reverse-engineers Apple's M1 Neural Engine architecture, mapping compute cores, MAC datapaths, and schedulers to explain the NPU's decline as transformers displaced CNN workloads.
A developer who previously maintained a reverse-engineered Linux driver for Apple's Neural Engine (ANE) published a retrospective deep dive mapping the M1 ANE's full internal architecture: compute, datapath, scheduler, memory, and execution model. The M1 ANE has 16 compute cores with 128 FP16 (or 256 INT8) MAC lanes each, totaling 2048 parallel MAC lanes, using 32-bit Q16.16 fixed-point accumulation with FP16 readout and an accumulator that saturates at 2^15. The author argues the ANE's dataflow was architected around the predictable reuse patterns of 2017-era CNN workloads (dating to the A11 Bionic), which autoregressive transformer decode broke, limiting its usefulness for general ML. With Apple's M5 folding ANE cores into GPU cores to tout LLM performance, the post frames this as the beginning of the end for the standalone NPU.
28
Memory as Plans: World-Action Modeling with Memory-Grounded Planning
Researchers introduce MaP-WAM, decomposing memory-dependent robot manipulation into memory-grounded planning and plan-conditioned execution, achieving 83.3% on RMBench and 78% on real robots.
MaP-WAM converts long-term multimodal episodic memory — segment records with language instructions and sparse visual context — into compact plans of next-segment language goals and visual guidance. A World-Action-Progress model jointly predicts action chunks and execution progress, calibrating predictions via plan-observation alignment for adaptive segment transitions and closed-loop context updates. Structured attention keeps the executor context length fixed and enables key-value caching, yielding state-of-the-art 83.3% success on RMBench, 78.0% on real-robot tasks, and roughly constant inference latency as task history grows.
32