A roundup of 189 items curated from across the security community.

News

Bitwarden CLI was published as a malicious npm package after a compromise in the Checkmarx Trusted Publishing pipeline. Socket walks through the attack chain and the affected versions.

271 Firefox bugs found by Claude Mythos in collaboration with Mozilla. Schneier breaks down the disclosure and what it means for browser security at scale.

Taszk Security Labs releases TAPOcalypse: exploiting TP-Link smart devices via LAN, browser, and the cloud account. Vendor fixed some, the rest stand at embargo expiry.

UK AISI evaluation of GPT-5.5 cyber capabilities. The model completed an end-to-end exploitation chain that AISI estimates would take a human expert ~20 hours.

Microsoft Defender flagged DigiCert AuthRoot registry entries and removed them on a chunk of endpoints. Looks like a detection mistake rather than a trust-store response, but worth knowing if you saw the alerts.

Microsoft now ships AAD Graph activity logs through Azure Monitor. Defenders finally get the table they have been waiting on for hunting credential abuse against Entra.

SLCyber’s research team disclosed a vulnerability that leaked PII and emails stored inside Salesforce Marketing Cloud instances, for any customer, with no authentication required. Writeup includes the disclosure timeline.

Defender for Endpoint adds a public preview to restrict live response actions on high-value assets. The control SOC analysts running scripts as SYSTEM on tier 0 boxes have been asking for.

LAB52 publishes a 142-page open-access report on EasterBunny, advanced espionage artifacts attributed to APT29. Plenty for IR teams to feed into hunts.

A DigiCert support analyst opened a .scr file from a customer chat. EDR blocked four infection attempts; the fifth got through. Over the next 11 days the attacker pulled 27 valid code-signing certificates from DigiCert’s internal portal before an outside researcher tipped DigiCert off.

Chrome silently installs a 4 GB Gemini Nano model file on user devices, no consent prompt, and re-downloads it if you delete it. Turns out the binary is a 6.3B INT4 build of Gemma 3 Nano with FP16 scales.

Universal Linux LPE chaining xfrm-ESP and rxrpc bugs. No race, no panic on failure, deterministic. Even with the copy.fail mitigation applied, every major distro is still vulnerable.

OpenAI ships GPT-5.5 with Trusted Access for Cyber, plus a Limited Preview of GPT-5.5-Cyber. Targeted at secure code review, vulnerability triage, detection engineering, malware analysis, and patch validation.

Ongoing data extortion attack against the Canvas LMS disrupted classes at thousands of US school districts and universities. Attackers defaced the login page with a ransom demand threatening to leak data on 275 million students and faculty across nearly 9,000 institutions.

More this week (9)

Techniques and Write-ups

TrustedSec walks the full Kerberos authentication flow and shows how to drive every stage of it with the Titanis toolset.

TrendAI Research details a wormable double-free in the Windows IKE service. Recently patched. Reachable on internet-facing IPsec VPN endpoints.

Yarden Shafir on KDP pool, the Windows kernel feature replacing the secure pool. Quick read on how it works and what the migration looks like.

CVE-2026-34621 was uploaded to VirusTotal months before Adobe assigned a CVE. NefariousPlan walks through the disclosure-timeline gap and what it means for defenders relying on VT as an early-warning signal.

Novel post-exploitation via WinGet’s COM API, executing through Microsoft-signed binaries. Also: Octoberfest7’s BOF POC.

Calif team’s writeup of an RCE in the Ladybird browser, with PoC. Part of the MAD Bugs series.

Synacktiv kicks off a series on bypassing the CVE-2025-33073 mitigations to pop SYSTEM shells via authentication reflection. Part one is up.

Calif team’s writeup of a QEMU and UTM virtual machine escape, with PoCs.

Trivially exploitable Linux LPE in coreutils, reachable on every major distro from the last nine years. Also: meta site, retr0 explainer, Go port from Bad Sector Labs, Ubuntu Rust coreutils race conditions.

Auth bypass in cPanel/WHM tracked as CVE-2026-41940, full writeup from watchTowr. Also: high-fidelity scanner from assetnote.

Origin on Codex on the Wire: agent features become tradecraft when they ship documented IPC for remote sessions. One bind flag turns a compromised endpoint into a remotely controlled agent.

OpenAI on the origin and shape of jailbreak attacks against frontier models. Useful framing if you are building or defending agentic systems.

TrustedSec on hijacking trusted Group Policy UNC paths for code execution and NTLM relay, no rogue GPO infrastructure or SYSVOL modifications required.

A 21-year-old PHP unserialize use-after-free that survived two decades of audit. The Calif team welcomes Stefan Esser back with a fresh writeup.

Tim Becker writes up the heap-grooming technique behind a character-constrained overflow in MariaDB’s JSON_SCHEMA_VALID, turned into full RCE. Discovered by Xint Code and disclosed at ZeroDay Cloud.

Huntress on dMSA Ouroboros: six commands of self-sustaining credential extraction on patched Server 2025. Survives deletion of the original attacker account.

AI is shifting the economics of probing the defensive stack itself. TrustedSec walks through how the tools defenders depend on are quietly becoming part of the attack surface.

Buffer overflow in PAN-OS captive portal (CVE-2026-0300) actively exploited. Unauthenticated attackers hit the User-ID Authentication Portal with crafted packets. CVSS 9.3.

Cisco Talos starts collecting phone numbers found in scam emails as IOCs and reports on cluster reuse patterns across campaigns.

New Rowhammer attack against NVIDIA Ampere GPUs. GDDR bitflips give adversaries full control of CPU memory; the boundary GPUs were thought to provide turns out to be permeable.

Kaspersky disclosed a DAEMON Tools supply chain compromise active since April 8, with thousands of infections across 100+ countries. Nextron contributed Sigma rules covering DNS lookups to the typosquatted C2, execution of trojanized binaries, and stage-drop activity.

Synacktiv’s writeup of an over-the-air Philips Hue Bridge compromise via a Zigbee bug, demoed at Pwn2Own Cork 2025.

SpecterOps on what red team actually means once you strip out the vendor-speak. The right question is whether you would detect an attacker already inside.

winterknife updates KernelToUserInjector to dodge ALLOCVM, WRITEVM, PROTECTVM, and QUEUEUSERAPC ETW threat-intelligence sensors, with sample EtwTi logs in the repo.

Four-part deep dive into Windows’ AFD.sys, the kernel-side backbone of socket I/O. Covers undocumented interfaces, the TCP handshake, sending and receiving packets.

REST then WebSocket then SSH then MsgPack RPC. SpecterOps takes apart VS Code Dev Tunnels and finds a C2 framework underneath, with remote exec and file ops on top.

Trail of Bits cryptanalyzes Google’s zero-knowledge proof of quantum cryptanalysis and finds a way to forge it. Worth reading whether or not you follow PQC arguments.

SpecterOps finds two command injection bugs in the Windows Explorer “Open PowerShell window here” context menu. A folder name like folder; calc triggers arbitrary PowerShell when the user shift-right-clicks.

A tour through EDR internals and the bypass primitives that fall out of them. The author flags it as their last blog post on the topic.

Most MCP servers ship with a wide-open OAuth registration endpoint. One curl command is enough to land an account takeover. Timely if you have AI agents wired into LAN-side MCP servers.

More this week (117)

Tools and Exploits

Trail of Bits open-sources Trailmark, a library that parses source code into a queryable call graph (functions, classes, call relationships, semantic metadata) exposed through a Python API that Claude skills can call directly.

MSSQLHound rewritten in Go: 17 minutes down to 17 seconds in lab, plus SOCKS proxying, Kerberos and NT hash auth, and pathfinding into BloodHound.

claude-red is a curated library of offensive-security skills for the Claude skills system, each one a structured SKILL.md priming Claude with methodology for a specific attack surface.

SOAPy now does kerberos auth over ADWS in Python, an integration nobody had bothered to ship in two years. Bigger release coming.

Microsoft quietly publishes EventLogExpert, an improved Event Viewer for IT and helpdesk teams. Open source, modern UI.

GreyNoise launches Project Swarm. Sensors deployed across the internet to catch in-the-wild exploitation of edge-facing apps, with telemetry available for $1. Andrew Morris frames it as the AI-era response to faster vulnerability discovery.

mona v3 ships: Python 2 and 3, 32 and 64-bit targets, WinDBG and WinDBGX, faster and leaner. The exploit-dev sidekick gets a long-overdue refresh.

Puzzle deploys malware in monitored environments by abusing Windows minifilter functionality. Includes utilities and PoCs to interact with minifilters and explore static and runtime analysis evasion.

BlackArrow opens up the materials from every talk they have given. Slides, PoCs, and code in one repo.

Sean Metcalf updates Invoke-ADLabBuildOut to spin up AD sites, subnets, and site links on top of the lab build, with common security misconfigurations baked in.

net_use BOF: a modernized port of TrustedSec’s SA repo entry for adding, listing, and removing mapped drives via the Windows MPR API. Avoids the telemetry from spawning net.exe or PowerShell.

More this week (8)