55
60
30
55
47
60
60
Adobe addressed critical bugs in Illustrator, After Effects Software
60
60
60
55
Harnessing LLMs for Automating BOLA Detection
Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.
Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.
45
57
Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection
Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.
Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.
45
When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi
Unit 42 red-teamed Amazon Bedrock multi-agent applications, demonstrating prompt-injection attack chains that leak agent instructions and invoke tools, mitigated by Bedrock Guardrails.
Unit 42 red-teamed Amazon Bedrock Agents' multi-agent collaboration in Supervisor and Supervisor with Routing modes. The demonstrated attack chain detects the operating mode, discovers collaborator agents, delivers attacker-controlled payloads, and can disclose agent instructions and tool schemas and invoke tools with attacker-supplied inputs. No vulnerabilities were found in Bedrock itself, and the built-in prompt attack Guardrail blocked the attacks when properly configured. The researchers collaborated with Amazon's security team and frame the findings as a broader prompt injection risk for LLM-based systems.
55
60
60
60
42
55
30
Adobe security advisory (AV26-848)
Canada's Cyber Centre relayed Adobe advisories covering vulnerabilities in Campaign Classic, Substance 3D apps, Adobe XD, Illustrator, and C2PA tools.
Bulletin AV26-848 lists Adobe vulnerabilities affecting Campaign Classic (through 7.4.4 build 9400), Substance 3D Designer, Painter, and Sampler, Adobe XD, C2PA Tool, Content Credentials Rust SDK, and Illustrator 2025/2026. The Canadian Centre for Cyber Security encourages users and administrators to review the linked Adobe bulletins and apply updates. Specific CVE identifiers are not enumerated in the advisory text.
28
57
60
60
60
60
55
30
55
60
60
42
45
60
30
55
30
30
42