Crow's Nest - 2026-05-11

A roundup of 54 items curated from across the security community.

News

• Apache ActiveMQ CVE-2026-40466 exploited in the wild by kmkz.

VulnCheck sees CVE-2026-40466 burning in active campaigns: authenticated RCE in ActiveMQ via the vm:// protocol, a bypass of the original CVE-2026-34197 fix. 2,700+ exposed instances on Shodan.

• Mythos: a long-form look at the stakes, impact, and PR by Kuba Gretzky.

Ivan Kwiatkowski’s deep-dive cuts through weeks of hot takes about Anthropic’s Mythos: what the actual capability claims are, what they mean for the bug-finding economy, and what the rollout did to industry trust.

• $57K in Chrome bounties from a $20-a-month AI subscription by Mathieu Tarral.

Calif and Mathieu Tarral pocketed two Chrome bugs and $57,000 from Google’s VRP using a $20-per-month AI subscription as the harness. Full methodology coming at the Stanford Real World AI Security Conference.

• Hugging Face and ClawHub poisoned with 575+ malicious AI skills by Rob Fuller.

Thirteen attacker accounts pushed 575+ trojanized skills onto Hugging Face and ClawHub. Payloads hit both Windows and macOS via hidden commands and indirect prompt injection.

• Solana router: two critical bugs drain token accounts by Sam Curry.

Two critical bugs in a popular Solana router let an attacker drain every token account it owns. Full writeup at atlas-it.consulting.

• The WebPKI cert renewal apocalypse.

Dark Tangent on the CA/B Forum schedule that takes TLS cert validity from 350 days down to 47, plus the deprecation of DANE that left the gap in the first place.

• Fake OpenAI repo on Hugging Face drops infostealer by BleepingComputer.

Counterfeit OpenAI repo on Hugging Face served an infostealer to anyone who pip-installed it. Useful reminder that model hubs are a supply-chain surface now.

Techniques and Write-ups

• Bypassing Windows auth reflection mitigations via Kerberos coercion by Load..

Synacktiv’s yaumn_ closes out his Windows auth-reflection series with a new Kerberos coercion technique that remotely compromises Windows systems even with the post-PetitPotam mitigations on. Bonus payload at the end.

• kCaddy: a malleable Caddy redirector for Evilginx by Kuba Gretzky.

Walkthrough on putting Caddy in front of Evilginx as a malleable redirector, with kCaddy automating the wiring. M365 and Google Workspace impersonation flows covered.

• ShadeStager and Phoenix: two new macOS threats added to Objective-See repo by Patrick Wardle.

Patrick Wardle uploads two fresh Mosyle-discovered macOS samples to the public Objective-See repo: ShadeStager (stealer) and Phoenix (first-stage persistent backdoor). Password infect3d.

• Needle crypto-stealer C2: plaintext API key unlocks 1,932 victims.

beelzebub.ai reverses the Needle crypto-stealer, finds a plaintext API key inside the Rust binary, and walks back into the operator’s panel to enumerate 1,932 victims and the withdrawal config.

• Honey tokens: bait credentials that catch breaches.

Infisical lays out a practical honey-token program: how to seed, deploy, and alert on bait credentials so the first sign of compromise is the attacker tripping a wire.

• Approve once, exploit forever: trust persistence in AI coding agents.

Mindgard demonstrates that one-time trust grants in Claude Code, Codex, and Gemini CLI become permanent attack surface. Sticky approvals turn into long-lived backdoors.

• CVE-2026-7270: FreeBSD root with a shell script by Axel Souchet.

CVE-2026-7270, FreeBSD root via a shell script. Calif’s writeup of a setuid-program flaw exploitable without compiling a thing. “My human authorized this post” footer included.

• Where did the complex Windows malware analyses go.

R136a1 on why blockbuster Windows malware deep-dives have all but vanished. Threat-economics, tooling, and where the analyst pipeline broke.

• Getting LLMs drunk to find remote Linux kernel OOB writes.

Pushing LLMs past their confident zone to surface remote kernel OOB writes the static fuzzers kept missing. Worked example with code and harnesses.

• Entra Connect attacker tradecraft series by DirectoryRanger.

SpecterOps’ three-part deep dive on attacking Entra Connect from sync account to global compromise. Required reading if you operate against hybrid AD.

• Windows Hello for Business: Faceplant by DirectoryRanger.

insinuator plants attacker-controlled biometric templates into Windows Hello for Business and walks back out the front door as the victim.

• cocomelonc malware persistence series (parts 26 to 29) by DirectoryRanger.

Four more entries in cocomelonc’s long-running persistence catalog: Edge profiles, scheduled tasks, CertPropSvc registry hijack, and Windows Terminal profiles.

Tools and Exploits

• BitlockMove: lateral movement via BitLocker DCOM by DirectoryRanger.

A new lateral movement primitive that pivots through BitLocker’s DCOM service via COM hijacking. PoC drops from rtecCyberSec.