Palo Alto, Cisco and Ivanti all patch actively exploited edge zero-days
Published 7:19 PM · 120 articles from 15 sources · about 5 min to read in full
Cyber security
Actively exploited perimeter products dominated, alongside hardware tampering and an attack on connected refrigeration. Takedowns of phishing and North Korean fraud infrastructure were the main defensive wins.
What happened
Cisco patched an actively exploited Secure Email Gateway zero-day that allows unauthenticated file writes and remote root command execution. CISA issued a warning, and CVE-2026-76519 is in KEV. BleepingComputer ↗
Ivanti Connect Secure authentication bypass CVE-2026-104935 (CVSS 8.6) has been exploited since October 1. CISA urged immediate updates, and honeypots logged 105 exploit attempts. A separate privilege-escalation fix is promised later. The Hacker News ↗
CISA added four exploited flaws to KEV, including CVE-2026-0322 (PAN-OS) and CVE-2026-76519 (Cisco Secure Email Gateway). Federal deadlines now apply to both. CISA Advisories ↗
Attackers have exploited a critical flaw in Collabora Online's built-in CODE app to plant web shells on Nextcloud servers since September 10. The Hacker News ↗
GitLab warned of a maximum-severity code execution vulnerability in its regex compiler engine and urged urgent patching. The summary gives no CVE or version detail. Lobsters ↗
CVE-2026-74580 (Vghost), a Linux vhost kernel flaw found by Tencent Zhuque Lab with AI, gives local users root and lets a guest VM write to host memory. It matters most for virtualization hosts. The Hacker News ↗
Attackers took over Danfoss refrigeration controllers in France and heated supermarket cold units to around 50C overnight. Ars reports about 700 supermarkets were hit, with millions in losses and fires, via outdated internet-exposed devices. Ars Technica ↗
Microsoft and Japan's National Police Agency dismantled the YAM Store marketplace behind phishing kits CoGUI and Iron Man. Together with Haozi, the kits were tied to over a billion scam messages. The Hacker News ↗
Articles the model saw · 53
Palo Alto Networks patched a high-severity PAN-OS remote code execution zero-day, CVE-2026-0322, already exploited against firewalls.
BleepingComputercvepalo-altozero-dayfirewallexploitedFeed excerpt
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]
Cisco warns of active exploitation of a critical Secure Email Gateway flaw allowing unauthenticated file writes and potential root command execution.
The Hacker Newscveciscoactively-exploitedemail-securityFeed excerpt
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,
Ivanti patched a Connect Secure zero-day after researchers confirmed in-the-wild exploitation, with a separate privilege-escalation fix promised later.
The Registercvezero-dayivantivpnFeed excerpt
Vendor promises fix for separate privilege-escalation flaw in the coming weeks
CISA urges immediate patching of an Ivanti Connect Secure flaw exploited as a zero-day since October 1st.
BleepingComputercveivantizero-dayactively-exploitedFeed excerpt
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]
CISA urged immediate updates to Ivanti Connect Secure after actively exploited authentication bypass CVE-2026-104935 (CVSS 8.6), with honeypots logging 105 exploit attempts.
The Hacker Newscveivantivpnactively-exploitedFeed excerpt
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS
Ledger confirmed a physical spy chip implant in its wallet hardware was behind cryptocurrency thefts, shown in a video.
Lobsterscryptohardwaresupply-chainFeed excerpt
Video showing an implanted device: https://www.youtube.com/watch?v=Nf4FEFlgv3Q Comments
CVE-2026-74580 (Vghost), a Linux vhost kernel flaw found by Tencent Zhuque Lab, gives local root and lets a guest VM write to host memory.
The Hacker NewscvelinuxkernelvirtualizationFeed excerpt
A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the
Cisco's make-me-root email bug is being exploited as a zero-day by unknown attackers, with CISA issuing a warning.
The Registerciscozero-daycisaexploitedFeed excerpt
Both Switchzilla and CISA sound the alarm
A fridge-related attack hit about 700 supermarkets, causing millions in losses and fires by exploiting outdated internet-exposed devices.
Ars Technicaiotincidentot-securityFeed excerpt
Incident hitting 700 supermarkets exploited outdated devices exposed to the Internet.
Microsoft and Japan's National Police Agency dismantled YAM Store, a marketplace enabling phishing kits CoGUI and Iron Man that sent over a billion scam messages.
The VergephishingtakedownmicrosoftFeed excerpt
We've all gotten a scam text about a nonexistent parking ticket or a fake package delivery, but hopefully you'll start seeing fewer of them. Microsoft says it helped dismantle a marketplace for scammers sending phishing messages like those around the world. Through an investigation with Japan's National Police Agency, it tracked scam activity back to a marketplace called YAM Store and a pair of phishing kits, CoGUI and Iron Man: Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared to … Read the full story at The Verge.
DOJ arrested two suspects, charged 14 individuals, and seized about 187 laptops in disrupting North Korean Famous Chollima remote IT worker laptop farms.
BleepingComputernorth-koreathreat-actorfraudFeed excerpt
The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]
Ledger asked resellers across seven Asian countries to halt wallet sales while it investigates device tampering from a supply-chain attack.
BleepingComputersupply-chaincrypto-wallethardwareFeed excerpt
Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. [...]
Attackers exploited a critical flaw in Collabora Online's built-in CODE app to plant web shells on Nextcloud servers since September 10.
The Hacker Newsnextcloudweb-shellexploitationFeed excerpt
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw
Cisco patched an actively exploited Secure Email Gateway zero-day allowing unauthenticated remote root command execution.
BleepingComputerciscozero-daycveemail-securityFeed excerpt
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]
Microsoft, Health-ISAC, and partners disrupted three phishing kits CoGUI, Haozi, and Iron Man System tied to over 1 billion scam messages.
The Hacker NewsphishingmicrosofttakedownFeed excerpt
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for
The DOJ charged 14 people and seized about 187 computers in a crackdown on North Korean remote IT worker fraud across 40+ laptop farms.
The Hacker Newsnorth-koreafrauddojFeed excerpt
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money
GitLab has warned of a maximum-severity code execution vulnerability requiring urgent patching.
LobstersvulnerabilitygitlabrceFeed excerpt
Comments
UK sanctions Cryptomus, a crypto platform described as a major conduit for ransomware and cybercrime payments tied to Russia.
Krebs on SecuritysanctionscryptoransomwareFeed excerpt
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.
Hackers took control of Danfoss refrigeration controllers in France, heating supermarket cold units to around 50C overnight.
Schneier on SecurityicsiotattackFeed excerpt
Another IoT cyberattack, this one in France: Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected. […] Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process. Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified. Any IoT device that can’t be updated is vulnerable. And, probably, any IoT device that can be updated is also vulnerable.
Law enforcement worldwide disrupted a cybercrime network responsible for over a billion phishing messages across 150 countries.
BleepingComputerphishingtakedownlaw-enforcementFeed excerpt
A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]
curl 8.23.0 fixes an HTTP/2 upload flaw that a researcher turned into client-side code execution via a malicious server.
The Hacker Newscurlhttp2code-executioncveFeed excerpt
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and memory layout, and curl expects a real attack to end in a crash
CISA added four actively exploited flaws to its KEV catalog, including CVE-2026-0322 in Palo Alto PAN-OS and CVE-2026-76519 in Cisco Secure Email Gateway.
CISA Advisoriescvekevcisapalo-altociscoFeed excerpt
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when …
New Android malware Hirudo replaces legitimate banking apps with modified versions that disable security checks to steal credentials.
BleepingComputerandroidmalwarebankingFeed excerpt
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. [...]
XBOW chained three Chrome zero-days into a drive-by exploit built in six days with OpenAI's GPT-5.6 Sol; Google patched them.
The Hacker Newschromeexploitaizero-dayFeed excerpt
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $
ThreatFabric disclosed Hirudo, an Android banking trojan that swaps in patched versions of Indonesian banking apps to evade their checks.
The Hacker NewsandroidmalwarebankingFeed excerpt
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking
An AI pentesting agent autonomously found a critical OTP authentication bypass on a major insurer's production website.
The Hacker Newsai-agentauthenticationpentestFeed excerpt
The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it
Researchers exploited a four-byte write and timing bug to run unauthorized code inside the Windows SmartScreen VBS enclave in a lab proof of concept.
The Hacker Newswindowsvbs-enclaveexploitFeed excerpt
Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work was done in a lab as a proof of
Microsoft's Patch Tuesday shipped fixes for a record 1,413 vulnerabilities, including one Windows shell flaw already under active exploitation.
The Hacker Newspatch-tuesdaywindowszero-daycveFeed excerpt
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code
US Justice Department warns North Korean hackers have infiltrated dozens of US companies, recruiting Americans as facilitators.
TechCrunchnorth-koreaespionagedojFeed excerpt
U.S. authorities warn that sanctioned hackers are increasingly targeting Americans to act as facilitators between breached U.S. companies and Pyongyang.
Microsoft released fixes for more than 1,400 security vulnerabilities across Windows and other software, far above its typical monthly patch load.
Krebs on Securitypatch-tuesdaymicrosoftwindowscveFeed excerpt
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.
Cloudflare's blog post reports that malicious bots shifted to other networks after strikes disrupted Yandex data centers.
Hacker News (front page)botscloudflareyandexFeed excerpt
Article URL: https://blog.cloudflare.com/yandex-outage/ Comments URL: https://news.ycombinator.com/item?id=50094673 Points: 57 # Comments: 13
Xbow's AI system earned a $250K bug bounty after researchers found a 1-billion-user exploit in six days of work.
The Registerbug-bountyaiexploitFeed excerpt
Xbow earned a $250K bug bounty and all the AI model got was a lousy t-shirt
An OpenAI engineer faces FBI foreign spy charges after a recording device hidden in toilet paper was found in a secure meeting room.
Ars TechnicaopenaiespionagefbiFeed excerpt
OpenAI engineer faces 5 years and $250K fine as FBI lobs foreign spy charges.
Android Authority reports Google automatically links users' phone numbers to all signed-in accounts without clear notice.
Hacker News (front page)googleprivacyandroidFeed excerpt
Article URL: https://www.androidauthority.com/google-auto-phone-number-verification-android-3723117/ Comments URL: https://news.ycombinator.com/item?id=50090349 Points: 64 # Comments: 13
Prospect reports ICE is planning a $100M domestic surveillance program called ERO One.
Hacker News (front page)surveillanceprivacygovernmentFeed excerpt
Article URL: https://prospect.org/2026/10/14/ice-planning-nightmare-domestic-spy-program-ero-one/ Comments URL: https://news.ycombinator.com/item?id=50090246 Points: 167 # Comments: 60
LWN roundup of security updates across AlmaLinux, Debian, Fedora, Mageia, Red Hat, and Slackware distributions.
LWN.netpatcheslinuxadvisoriesFeed excerpt
Security updates have been issued by AlmaLinux (bind9.18, dovecot, flatpak, gd, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base, kernel, opentelemetry-collector, pcre2, and tftp), Debian (curl and keystone), Fedora (aegisub, arm-none-eabi-binutils-cs, avr-binutils, chromium, curl, firefox, kernel, python-jupytext, and xdg-dbus-proxy), Mageia (apache, freeciv, gnumeric, mingw-gdk-pixbuf, and patool), Red Hat (cockpit-image-builder, fence-agents, firefox, ipa, kernel, kernel-rt, pcre2, python-tornado, qt6-qtdeclarative, thunderbird, and webkit2gtk3), Slackware (expat), SUSE (bind, busybox, containerd, cups-filters, fixme, gimp, glibc, google-osconfig-agent, kernel, libtcnative-2-0, openssh, openssl-3, php8, podman, python-oauthlib, python-PyJWT, python-urllib3, python-virtualenv, python311, python313-jupyter-server, python313-kubernetes, python313-logilab-common, python313-markdown-it-py, python313-markdown2, python313-marshmallow, python313-mpmath, python313-mysql-connector-python, python313-oci-sdk, python313-oic, unbound, wpa_supplicant, xen, and xorg-x11-server), and Ubuntu (kernel, libyaml-perl, linux, linux-aws, linux-aws-fips, linux-aws-hwe, l…
Rustls 0.23.46 ships four security fixes to the memory-safe Rust TLS library.
Phoronixtlsrustopen-sourcepatchFeed excerpt
Rustls as the modern TLS library written in the Rust programming language with an emphasis on memory safety is out today with its v0.23.46 release in order to ship four new security fixes...
Lobsters post titled 'A UAF turned RCE' describes a use-after-free vulnerability escalated to remote code execution.
Lobstersmemory-safetyexploitrceFeed excerpt
Comments
An investigative piece examines who may be inserting backdoors into Ledger hardware crypto wallets.
Hacker News (front page)cryptobackdoorhardwareFeed excerpt
Article URL: https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/ Comments URL: https://news.ycombinator.com/item?id=50084838 Points: 35 # Comments: 22
A global survey finds 37% of ransomware attacks involve psychological or physical threats against victims or their families.
The RegisterransomwaresurveyFeed excerpt
37% of ransomware attacks involve psychological or physical threats, global survey found
Researchers demonstrate an electromagnetic side-channel attack that recovers output tokens and user prompts from LLaMA-3.2-1B running on edge devices.
arXiv cs.CR (Cryptography & Security)arxivside-channelllmhardwareFeed excerpt
arXiv:2610.14215v1 Announce Type: new Abstract: The deployment of large language models (LLMs) on edge devices is largely motivated by privacy concerns over sharing sensitive user data with cloud servers. In this paper, we demonstrate that keeping inference local does not eliminate privacy risks: an adversary with physical access to the device may exploit hardware leakage to recover sensitive information without compromising or modifying the software system. In particular, we present an electromagnetic (EM) side-channel attack targeting LLM inference on edge devices. Targeting LLaMA-3.2-1B-Instruct running on a Raspberry Pi 5, we demonstrate that EM traces collected during inference can leak both generated tokens and user prompts. We propose three attacks under different threat assumptions. First, a profiling attack that identifies generated tokens among 50 medical and privacy-related keywords with 97.2% accuracy on profiled words. Second, a reconstruction attack recovers the model's hidden representations and uses them to predict tokens from the full 128k-token vocabulary, achieving 94.3% accuracy on profiled classes. For unseen words, the correct token is ranked within the first …
Study finds AI vulnerability-analysis agents produce inconsistent results on semantically equivalent code commits, suggesting code transformations can slow automated attacks.
arXiv cs.CR (Cryptography & Security)ai-agentsvulnerability-analysisarxivFeed excerpt
arXiv:2610.14350v1 Announce Type: new Abstract: Having demonstrated a strong potential for automating vulnerability discovery, AI agents can also be used to attack software systems at scale. Today's software systems need mechanisms to level the playing field by slowing down potential attacks, giving them time to patch vulnerabilities and strengthen software. Along this line, our study of agent trajectories in vulnerability analysis shows a surprising finding: agents produce dramatically different results across real-world code commits that carry the same functionality and the same vulnerability. This phenomenon appears consistently in multiple code domains and vulnerability categories. It motivates us to study natural and functionality-preserving code transformations derived from real-world software development, and their potential as a defense against attacker agents. We build a corpus of natural transformations by mining recurring development patterns from real-world code commits, and apply them to evaluate impact on agentic vulnerability analysis. Our results show that even a single form of transformation can effectively "confuse" frontier agents, e.g., Codex with GPT-6 Sol, red…
Proposes object-bound confinement so compromised AI coding agents cannot exploit name-to-object mismatches such as symlink and path confusion.
arXiv cs.CR (Cryptography & Security)ai-agentssandboxingarxivFeed excerpt
arXiv:2610.14488v1 Announce Type: new Abstract: Coding agents read repositories and web pages that anyone can write, and then act with their user's authority. Prompt-injection defenses make it less likely that the model is steered but do not prevent it, so the system around the model must contain an agent that is already compromised. Many exploits against deployed coding agents share one cause: a check approves a name, such as a path, an argument vector, or a directory, and a later step maps that name to a different object: the file behind a symlink, the behavior an option selects, or a repository that git discovers on its own. We present Zero-Trust Agent Cells (ZTAC). A cell runs the agent in a kernel sandbox whose only route to files, programs, and the network is a socket to a broker. The broker resolves each request to the object it will act on, decides on that object, and checks at use that it is acting on the object it authorized. Programs that the broker starts run in a sandbox compiled from the same policy, and approvals are bound to the resolved object and can be used once. Our macOS prototype has 3.2k lines of trusted Rust code, excluding dependencies. We evaluate it again…
MetaCascade shows malicious third-party Agent Skills can be poisoned via metadata alone to get selected and exploited by LLM agents.
arXiv cs.CR (Cryptography & Security)ai-agentssupply-chainprompt-injectionFeed excerpt
arXiv:2610.14836v1 Announce Type: new Abstract: As a key extension mechanism for agent systems, Agent Skills package specialized capabilities for reuse by LLM agents. An agent first retrieves candidate skills based on skill documentation and then relies on their metadata to make the final selection. As third-party skills proliferate on insufficiently vetted open registry platforms, the security risks posed by malicious skills become increasingly prominent, but existing attack research still focuses primarily on the potential harm caused after their execution. The limited related studies typically examine skill retrieval or selection in isolation and have yet to cover a complete end-to-end attack chain. To address this research gap, we find an end-to-end attack surface arising from the process-wide influence of metadata. Based on this finding, we propose MetaCascade, an end-to-end metadata-only poisoning framework. MetaCascade first generates diverse malicious skill candidates through multi-view semantic expansion, then uses tasks and black-box competition feedback to analyze the competitive relationships among malicious candidate skills and iteratively optimize malicious metadata, …
Paper evaluates deanonymizing Tor onion services using only coarse one-minute sampled NetFlow telemetry.
arXiv cs.CR (Cryptography & Security)tordeanonymizationnetflowFeed excerpt
arXiv:2610.15198v1 Announce Type: new Abstract: In the context of Tor, deanonymization attacks via traffic correlation have long been studied for both clients and onion services. Complementing prior investigations that utilize fine-grained flow metadata such as packet sizes and timings, we study a relatively less explored yet easier-to-obtain adversarial capability: deanonymization using only coarse NetFlow-style telemetry, such as one-minute, 1-out-of-1,000 sampled packet counts. We first revisit active NetFlow-based traffic analysis attacks against Tor onion services and show, through large-scale experiments with live Tor data, that coarse telemetry is sufficient to deanonymize a targeted onion service when the adversary can induce discernible traffic patterns through controlled downloads. We then introduce a stronger active attack based on controlled introduction requests, which removes application-specific assumptions and gives adversaries more flexibility while achieving comparable success rates. Finally, we present a passive deanonymization attack that sends zero traffic to target onion services. The attack exploits Tor's puzzle-based DoS defense as a side channel: public puz…
Researchers demonstrate long-range, through-wall eavesdropping on AR/VR users via the headset's wireless power side channel.
arXiv cs.CR (Cryptography & Security)side-channelvrprivacyFeed excerpt
arXiv:2610.15865v1 Announce Type: new Abstract: Over the past decade, Metaverse technology (AR/VR) has seen widespread adoption in numerous areas, including gaming, social networking, and online collaboration. Although recent studies have exposed vulnerabilities in VR systems, they often apply methods (e.g., pre-installed malicious apps or scripts) from conventional mobile platforms directly, demonstrating impractical attacks that fail to investigate unique privacy leakages specific to VR platforms. In this paper, we present an orthogonal attempt to analyze the attack surface of the power side channel on AR/VR's network connection by capturing the through-wall wireless power in the network transmission medium (e.g., Wi-Fi signals) non-intrusively in a comparatively long distance (e.g., 5.0m-8.0m) and further reconstructing multi-level privacy-aware user behaviors. We propose MetaSpy to validate the feasibility and practicality of our disclosed wireless power-based traffic analysis attack. It first captures through-wall wireless power transmitted from the Wi-Fi router of an adjacent room, identifies the device type, then infers (i) user interactions such as browsing websites, runnin…
CryptoFlowBench is a benchmark for evaluating multi-hop reasoning to trace illicit cryptocurrency fund flows across blockchains.
arXiv cs.CR (Cryptography & Security)blockchainfraudbenchmarkFeed excerpt
arXiv:2610.16449v1 Announce Type: new Abstract: Pseudonymous accounts and complex smart-contract ecosystems substantially hinder the tracing of illicit cryptocurrency fund flows. Existing Graph Neural Networks (GNNs) have achieved promising performance in blockchain fraud detection, yet their static node- or edge-level predictions do not naturally generalize to multi-hop fund tracing. Meanwhile, existing tracing methods mainly rely on predefined heuristics to capture multi-hop relationships, limiting their adaptive reasoning capabilities. To bridge this gap, we introduce CryptoFlowBench, a benchmark constructed from authoritative reports on cryptocurrency-related illicit incidents, with four tasks spanning local to multi-hop fund tracing. These tasks pose substantial challenges to existing learning- and heuristic-based methods, particularly in complex multi-hop scenarios. We therefore propose ChainSleuth, a graph-tool-augmented agent that iteratively reasons, invokes graph tools, and updates its tracing trajectory, enabling adaptive information acquisition and recovery from erroneous paths. Experiments show that no baseline consistently dominates all four tasks, revealing substanti…
Researchers show a floating-point bias-addition side channel in language model APIs leaks logit information from token identities alone.
arXiv cs.CR (Cryptography & Security)llm-apiside-channelmodel-extractionFeed excerpt
arXiv:2610.16790v1 Announce Type: new Abstract: Language model APIs can expose token-specific biases while withholding logits and token probabilities. Existing bias-based extraction recovers relative logits, leaving a common additive component undetermined in ideal arithmetic. We identify a numerical side channel in floating-point bias addition that exposes information about this component through token identities alone. The channel distinguishes score vectors with identical complete unperturbed log probabilities. Our method exploits changes in representable spacing at binary exponent boundaries. Under the stated binary32 arithmetic assumptions and a known reachable score interval, it recovers a logit pair and its unknown tie-breaking priority exactly in at most 52 token queries. Given complete relative logits, one recovered anchor determines the original logit vector. We evaluate recovery across 11 public checkpoints from seven model families and extend the local method with adaptive interval search and anchor selection. In end-to-end experiments with vLLM, SGLang, and llama.cpp, adaptive recovery succeeds on all 128 Qwen3-0.6B inputs per system, including 64 held-out inputs. A se…
A review of security mechanisms in ESPHome Native API and MQTT over TLS 1.3 for local home automation against MitM attacks.
arXiv cs.CR (Cryptography & Security)iottlshome-automationFeed excerpt
arXiv:2610.16928v1 Announce Type: new Abstract: The expansion of the Internet of Things (IoT) in residential and local automation environments has highlighted the limitations of considering the internal network as an inherently trusted domain. Man-in-the-middle (MitM) attacks, such as ARP spoofing, can allow traffic interception or manipulation when communications lack appropriate confidentiality, integrity, and authentication mechanisms. This paper presents a systematized review of the security mechanisms used by two communication alternatives between ESP-family microcontrollers and the Home Assistant platform: MQTT protected through TLS 1.3 and the ESPHome Native API, whose encryption is based on the Noise Protocol Framework using the Noise_NNpsk0_25519_ChaChaPoly_SHA256 pattern. The analysis considers four dimensions: cryptographic robustness, attack surface, implementation complexity, and resource consumption. The review identifies significant differences resulting from the architecture and cryptographic model of each alternative. TLS 1.3 provides a standardized framework compatible with public-key infrastructure and formal identity management, though it introduces greater conf…
CWE-bench is a private benchmark of 120 repository audit-and-repair tasks testing whether AI agents can find and fix vulnerabilities.
arXiv cs.CR (Cryptography & Security)ai-agentsbenchmarkcweappsecFeed excerpt
arXiv:2610.17020v1 Announce Type: new Abstract: Cybersecurity evaluations of AI agents have focused largely on offense, yet a working exploit does not show that an agent can make software safe. An attacker needs to exploit only one vulnerability; a defender must find and fix all of them. We introduce CWE-bench, a private benchmark of 120 held-out repository audit-and-repair tasks spanning 73 CWE types, eight languages, and all OWASP Top 10 2025 categories. Agents are given a repository to audit and a description of its threat model, but are not told the weakness, where it occurs, or how many vulnerable sites there are. Each patch must block the exploit while preserving original functionality, as checked by a programmatic verifier. We validated the verifier against a panel of agentic judges, manually reviewing disagreements during development and refining the checks. The best agents reach 68% pass@1 and 81% pass@4. We further conduct analyses showing that (i) agents with the same pass@1 differ widely in retry gains and cost, and (ii) no single agent is best across languages or vulnerability categories, and difficulty varies far more by vulnerability category than by language. As the…
BrowseSafe++ benchmark expands prompt injection detection data to 38,675 page pairs across languages and browser views, mostly from production websites.
arXiv cs.CR (Cryptography & Security)prompt-injectionbenchmarkarxivFeed excerpt
arXiv:2610.17457v1 Announce Type: new Abstract: Browser agents need to make decisions and execute actions on behalf of users while consuming untrusted webpages, creating opportunities for malicious instructions embedded in webpages to redirect legitimate tasks. We introduce BrowseSafe++, which extends BrowseSafe from 14,719 pages to 38,675 pairs of pages. Most of its prompt injections were observed in the wild on production websites. We keep each injection unchanged and rewrite the sensitive parts of the page around it to protect privacy. Each attacked page has a clean copy of the same page as its control. Both are provided as HTML, Markdown, an accessibility tree, and a screenshot. Every pair includes a user task and its expected answer. The benchmark includes twelve types of websites, from news articles to shared documents and forums, with 24 attack types appearing in 18 different locations on a page. We use these paired pages to train BrowseSafe-Guard, two 0.8B-parameter detectors for text and screenshots. Both achieve higher F1 scores than the detector based on frontier models, while keeping false-positive rates on benign pages and inference cost low. BrowseSafe-Adapt revises b…
Not All Challenges Are Equal: Evaluating Interactive Liveness Detection Against Real-Time Face Swaps3
Evaluation of 108 live sessions finds randomized gesture challenges vary in effectiveness at detecting real-time face-swap impersonation with DeepFaceLive and FaceFusion.
arXiv cs.CR (Cryptography & Security)deepfakeidentity-verificationlivenessFeed excerpt
arXiv:2610.16417v1 Announce Type: cross Abstract: Remote identity verification assumes that a camera stream shows a live person, yet public real-time face-swap tools can replace that person before the stream reaches the verifier. Passive deepfake detectors generalize poorly to new generators, while interactive challenges are often selected without evidence of which gestures expose current attacks. We evaluate randomized gesture challenges in 108 live sessions with six subjects, 24 impersonated identities, and two face-swap tools, DeepFaceLive and FaceFusion, injected through a virtual camera. The static calibration segment reaches a session-level AUC of 0.878 with a frozen UCF spatial detector, while the mean across the active-gesture windows reaches 0.988. Pose and combined gestures have the highest point estimates, whereas expressions show no clear improvement. Hand occlusion against FaceFusion, configured with an occlusion mask, scores below the static baseline. The end-to-end time required to satisfy the validator also distinguishes attacks from genuine sessions, achieving a session-level AUC of 0.732, although this signal includes synthesis and transport delays. These results …
VulnBump is a benchmark of 307 tasks testing whether agentic coding tools can fix vulnerable dependencies while keeping builds and tests passing.
arXiv cs.CR (Cryptography & Security)benchmarkscadependenciesagentsFeed excerpt
arXiv:2610.17374v1 Announce Type: cross Abstract: Software composition analysis (SCA) tools report far more vulnerable dependencies than teams fix: in Snyk Open Source production data, 94% of vulnerability findings have a known fixed version, yet only about 10% are resolved. Agentic coding tools could close this gap, but no benchmark evaluates them on vulnerability-driven upgrades in real, runnable projects across ecosystems, verified independently of the agent. We present VulnBump: 307 upgrade tasks covering 2,066 fixable vulnerabilities in 43 repositories across six package managers, matched to Snyk Open Source production vulnerability distributions. An upgrade passes only if, in a fresh container, dependencies resolve, a rescan shows the targeted vulnerabilities fixed, the project builds, and every previously passing test still passes. A non-agentic baseline that only applies Snyk's recommended version passes 46.9% of upgrades; with the same model (Claude Sonnet 5.5), Snyk's Evo Remediation Agent passes 90.2%, Claude Code + Snyk scan 77.5% and Claude Code unaided 59.6%. The agents fail in opposite ways: Claude Code mostly leaves the vulnerability in place, whereas most of Evo Re…