Attackers exploit SiteGuard WAF flaw for root and SYSTEM commands
Published 7:01 AM · 120 articles from 13 sources · about 6 min to read in full
Cyber security
Vendor compromises and actively exploited or unpatched edge devices dominate, alongside surveillance-system misuse. Research output centres on agent and supply-chain security.
What happened
A Savannah police officer was fired after sharing her Flock license-plate system login with her ICE agent husband, who ran 983 searches. Separately, 404 Media published footage of a Flock search that a judge ruled unconstitutional. Together they show weak credential control and legal exposure around the Flock system. The Verge ↗
Tor Project describes lessons from building its beta Tor VPN client for Android from scratch. The summary gives no technical specifics. Lobsters ↗
A blog post arguing Flatpak's sandboxing is fundamentally insecure reached the Hacker News front page, and a separate Lobsters post responds to those claims. The summaries do not give the technical arguments of either side. Lobsters ↗
SANS ISC published a YARA rule for detecting orphaned VBA projects hidden inside DWG CAD files. It gives defenders a detection for macro-style content in a file type that is often overlooked. SANS Internet Storm Center ↗
MobileInject is a benchmark for cross-modal prompt injection attacks that hijack multimodal-LLM mobile agents acting on smartphone content. arXiv cs.CR (Cryptography & Security) ↗
A systematic analysis examines software supply chain attacks on VLSI design tools, asking whether a SolarWinds-style compromise could subvert chip design flows. arXiv cs.CR (Cryptography & Security) ↗
LENS, an LLM-based system, performs field-level exploitability analysis of Diameter signaling in exposed cellular core networks. arXiv cs.CR (Cryptography & Security) ↗
A study of more than 10,000 Google Play health apps finds consent and data collection practices often inadequate given the sensitivity of the medical data involved. arXiv cs.CR (Cryptography & Security) ↗
Articles the model saw · 24
OpenCode says an intruder accessed a legacy system on October 16, potentially exposing stored OpenAI, Anthropic, and Google API keys.
The Hacker Newsbreachapi-keysaidata-breachFeed excerpt
An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without
Quentin Kaiser disclosed an unpatched Broadcom Wi-Fi setup software flaw enabling root code execution on Belgian ISP routers.
The Hacker Newsbroadcomwi-firouterunpatchedvulnerabilityFeed excerpt
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device
ConnectWise disabled its SaaS backup, security, and management services while investigating a security incident Huntress says enabled takeover of Microsoft 365 accounts.
The Registerconnectwiseaccount-takeoverm365incidentFeed excerpt
Huntress alleges takeover of M365 accounts
A critical 9.3-rated Linux KVM guest-to-host escape called PwnEscape, tracked as CVE-2026-99999, could affect virtualized networking.
The RegistercvelinuxvirtualizationFeed excerpt
Party like it’s CVE-2026-99999 – a 9.3-rated nasty called PwnEscape
A Savannah police officer was fired after sharing her Flock license-plate system login with her ICE agent husband, who ran 983 searches.
The VergeflocksurveillanceiceprivacyFeed excerpt
Now, former Savannah police officer Amber Harpe was fired in August following a department investigation that found she had shared her Flock login information with her husband, Tyler Harpe, an ICE agent. SPD does not share its Flock data with ICE and said sharing access to the system violated the department's security protocols. While he had unauthorized access to the system, Tyler Harpe conducted 983 searches related to 97 license plates, which were overwhelmingly registered to Hispanic drivers, according to Savannah's local ABC affiliate, WJCL. The Harpes defended their actions, saying they didn't use access for personal reasons and that … Read the full story at The Verge.
A write-up describes how Discover-Tech's targeted advertising was used as a pipeline to deliver zero-click spyware.
Lobstersspywarezero-clickadvertisingFeed excerpt
Comments
Attackers are actively exploiting an OS command injection flaw in SiteGuard Server Edition to run commands as root or SYSTEM.
BleepingComputerexploitationcommand-injectionwafFeed excerpt
Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...]
Tor Project describes lessons learned building its beta VPN client for Android from scratch.
LobsterstorvpnandroidprivacyFeed excerpt
Comments
Blog post argues Flatpak's sandboxing model is fundamentally insecure, sparking discussion on Hacker News.
Hacker News (front page)flatpaklinuxsandboxingopinionFeed excerpt
Article URL: https://oro.gay/posts/flatpak-an-insecurity-nightmare/ Comments URL: https://news.ycombinator.com/item?id=50148601 Points: 28 # Comments: 19
MobileInject benchmark evaluates cross-modal prompt injection attacks that hijack MLLM-based mobile agents acting on smartphone content.
arXiv cs.CR (Cryptography & Security)prompt-injectionmobilellm-agentsFeed excerpt
arXiv:2610.23307v1 Announce Type: new Abstract: Multimodal large language model (MLLM)-based mobile agents are rapidly evolving from conversational assistants into autonomous systems that perceive, reason over, and act on smartphone environments. This capability also exposes a new security risk: adversaries can embed malicious objectives in cross-application mobile content and steer agent behavior through indirect multimodal injection. Although prompt injection has been studied in desktop and web settings, its cross-modal properties in mobile ecosystems remain poorly understood, and existing security analyses are still limited. To close this gap, we introduce MobileInject, the first benchmark for evaluating mobile agents against multimodal injection attacks and reasoning-to-action security risks. MobileInject provides a high-fidelity interactive mobile evaluation framework covering 11 scenarios, 9 security-risk categories, and 108 executable risk instances. It further introduces Cross-Modal Consistency Injection to exploit corroboration across modalities, two enhanced attack methods, Multi-Role Collaborative Deception and Reasoning-Camouflage Injection, to intensify trust manipulat…
404 Media published footage of a Flock license-plate search that a judge ruled unconstitutional.
Hacker News (front page)surveillanceprivacylaw-enforcementFeed excerpt
Article URL: https://www.404media.co/watch-footage-of-the-flock-search-a-judge-ruled-unconstitutional/ Comments URL: https://news.ycombinator.com/item?id=50147455 Points: 20 # Comments: 6
SANS ISC publishes a YARA rule for detecting orphaned VBA projects hidden inside DWG CAD files.
SANS Internet Storm CenteryaramalwaredetectionFeed excerpt
Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".
A post responds to claims that Flatpak is insecure, discussed on Lobsters.
LobstersflatpaklinuxdiscussionFeed excerpt
Comments
A systematic analysis examines software supply chain attacks against VLSI design tools that could subvert chip design flows.
arXiv cs.CR (Cryptography & Security)supply-chainhardwarevlsiFeed excerpt
arXiv:2610.22580v1 Announce Type: new Abstract: An attacker targeting the software supply chain (SWSC) of VLSI tools can fully subvert the VLSI design pipeline through purely software level compromises. However, cur- rent literature on both SWSC and VLSI hardware security has not explored how software can be used to subvert the security of the VLSI design flow. In order to bridge this gap, this paper presents a systematic analysis of the vulnerable surface of VLSI from a SWSC standpoint. We carry this anal- ysis through three major activities. First, we did an empirical analysis of VLSI software suites, focusing on their software composition, security features, and tool interactions within the VLSI design flow. Second, we develop a VLSI-SWSC attack taxonomy model that links software supply chain at- tacks and their mechanisms to the VLSI attacks they enable, the design-flow stages they affect, and their resulting security outcomes, allowing us to identify 717 possible new attacks, including 60 high feasibility attacks supported by evidence collected in our empirical analysis. Third, we identify what possible security outcomes can be achieved by an attacker from these attacks and pr…
ACE is an AI-orchestrated framework linking Suricata intrusion detection to NIST SP 800-53 compliance mapping and automated rule deployment.
arXiv cs.CR (Cryptography & Security)idscompliancesuricataFeed excerpt
arXiv:2610.22702v1 Announce Type: new Abstract: This study proposes the Automated Compliance Engine (ACE), an AI-orchestrated framework that links intrusion detection, regulatory control mapping, and automated countermeasure deployment for security operations environments. ACE integrates Suricata IDS, a LangGraph five-stage workflow, retrieval-augmented generation, NIST SP 800-53 Rev. 5 control retrieval, large language model-based control ranking, and SSH-based Suricata rule deployment. The framework was evaluated in a two-virtual-machine laboratory using eight simulated attack scenarios and three legitimate traffic tests. ACE processed all eight attack alerts, achieved 100% alert detection, 0% false positives across legitimate traffic tests, generated deployable AUTO rules for 37.5% of alerts, verified 100% deployment of generated rules, and achieved an average NIST control-mapping confidence score of 0.87. The DeepEval assessment produced 1.0 scores for answer relevancy and faithfulness, while the hallucination score reflected known LLM-as-judge calibration limitations. The evaluation was conducted in a controlled environment with a limited attack set. Further validation is requ…
LENS is an LLM-based system for field-level exploitability analysis of Diameter signaling in exposed cellular core networks.
arXiv cs.CR (Cryptography & Security)telecomdiameterarxivFeed excerpt
arXiv:2610.22943v1 Announce Type: new Abstract: The increasing exposure of cellular core-network elements to public networks has turned Diameter signaling interfaces into a practical attack surface. While large language models (LLMs) show promise for protocol exploitability analysis, we find that their judgments on Diameter can be unreliable because they may deviate from the tacit analysis discipline followed by security experts and reach conclusions without considering complete protocol evidence. To address this challenge, we present LENS, an LLM-based system for reliable field-level Diameter exploitability analysis. LENS guides LLMs using both exploitability-analysis discipline and the protocol evidence needed for analysis. It infers analysis discipline from existing exploit writeups and evidence-collection guidance from exploitability-analysis failures, enabling systematic evidence collection, exploitability assessment, and proof-of-concept (PoC) attack generation when applicable. Our experiments show that LENS performs reliable analysis across four LLMs and repeated runs, achieving mean recall of 94.00% to 98.00%, precision of 78.73% to 88.94%, and accuracy of 84.00% to 92.00%.…
AgentLoupe is an eBPF-based tool that attributes AI agent system actions to originating LLM interactions for security auditing.
arXiv cs.CR (Cryptography & Security)ebpfobservabilityarxivFeed excerpt
arXiv:2610.23233v1 Announce Type: new Abstract: AI agents translate user intents into system actions via tool invocations. Accurately attributing these actions to their originating LLM interactions is essential for security auditing, yet existing methods, such as AgentSight, fail for delayed execution and cross-process-lineage behaviors. We present AgentLoupe, an application-transparent eBPF-based observability tool. The core insight of AgentLoupe is to embed causal identity into kernel resources.AgentLoupe employs eBPF to capture TLS plaintext to interpret LLM interactions, and assigns each a kernel-resident semantic label.It maintains labels in eBPF maps, then propagates this label across processes and threads, associates it with kernel resources such as files and sockets. When a persistent resource carries context to an independent process outside the original lineage, this design preserves the delayed causal association.Experiments show that the average observation overhead of AgentLoupe is below 8%, and case studies confirm AgentLoupe traces cross-lineage persistent attacks back to their originating LLM interactions.
Study evaluates seven small open-source language models on generating post-exploitation code for embedded malware scenarios.
arXiv cs.CR (Cryptography & Security)malwarellmresearchFeed excerpt
arXiv:2610.23534v1 Announce Type: new Abstract: Small Language Models (SLMs) are increasingly attractive for resource-constrained environments due to their low computational footprint. These characteristics also make them candidates for future autonomous malware, where connectivity, latency, privacy, or operational constraints may preclude cloud-based inference. Yet the ability of ultra-compact models to support malware during post-exploitation remains poorly understood. We systematically evaluate seven open-source SLMs (20M-1.5B parameters) on two post-exploitation code-generation tasks: Directory Enumeration and Backdoor Generation. We compare Python (high-resource) and Lua (low-resource) across prompting strategies, task formulations, iterative reasoning, grammar-constrained decoding, and execution-feedback loops. Results show that offensive code-generation capabilities do not increase linearly with model size. Successful execution depends on the interaction of model capacity, task formulation, and prompting strategy, with task formulation exerting a greater influence than prompt engineering alone. Algorithmic formulation combined with few-shot prompting enables Qwen2.5-Coder 1.…
ABF-Bench introduces an interactive benchmark for verifiable agent-driven cryptocurrency fund tracing and blockchain forensics.
arXiv cs.CR (Cryptography & Security)blockchainforensicsbenchmarkFeed excerpt
arXiv:2610.23656v1 Announce Type: new Abstract: Blockchain forensics is adversarial and open-ended: money launderers split, swap, and bridge funds, cut their trail at mixers or custodial services, and change tactics from one incident to the next. Investigators must keep adapting their tracing in response. Yet the immutability of public ledgers preserves every recorded movement in public view, making much of the investigation independently verifiable. We introduce ABF-Bench, an interactive benchmark that makes evidence-backed fund tracing a verifiable agent task, in which every claimed movement must cite ledger records the agent retrieved. A case-to-task pipeline builds well-posed tasks across ledgers: conservative rules halt tracing wherever the records leave a continuation unresolved, and each task's reference graph is the answer those rules determine. Built from real laundering activity, the tasks combine multi-hop transfers, DeFi exchanges, cross-chain round trips, custodial and mixer deposits, and address poisoning. We also propose the ABF agent harness, built around a working memory, and evaluate it alongside general-purpose agents and fixed-order tracers. The harness reaches …
HardEval benchmark tests whether AI agents can apply STIG security hardening controls correctly on live operating systems.
arXiv cs.CR (Cryptography & Security)benchmarkcompliancelinuxFeed excerpt
arXiv:2610.23685v1 Announce Type: new Abstract: Implementing Security Technical Implementation Guide (STIG) controls remains a demanding operating-system administration task. Each natural-language security requirement must be translated into a precise and persistent configuration change. These changes span Secure Shell (SSH) configuration, authentication policy, audit rules, and kernel parameters. Existing benchmarks do not measure whether a model can perform this task on a live system. Code benchmarks evaluate isolated programs without persistent system state, while agent benchmarks largely focus on applications rather than operating-system configuration. In this paper, we introduce \textbf{HardEval}, an execution-verified benchmark for evaluating language-model-assisted security hardening. HardEval is built from Red Hat Enterprise Linux 8 STIG controls that fail on an unhardened baseline system. Expert-written reference remediations and Open Vulnerability and Assessment Language (OVAL) checks serve as hidden ground truth for grading; they are never shown to the model, and each task states only the required security outcome while withholding the implementation. The model produces …
Researchers propose a unified label scheme and efficient detector for broad PII detection across merged public datasets.
arXiv cs.CR (Cryptography & Security)piiprivacydetectionFeed excerpt
arXiv:2610.22597v1 Announce Type: cross Abstract: Personally Identifiable Information (PII) detection models must efficiently find identifiers across diverse contexts while maintaining a low false-positive rate (FPR) on high-volume traffic. Recent detectors increasingly rely on complex architectures that raise deployment cost, yet many are fine-tuned on only a few synthetic datasets that limit their coverage. Combining public datasets is challenging because their taxonomies differ, and even after categories are mapped to a common schema, labels can disagree on what counts as a detection, producing inconsistent training and evaluation signals. To address these problems, we present a practical 141M-parameter encoder-based detector trained on 1.12 million examples from 77 public datasets, relabeled under a detailed definition of broad contextual detection for 12 structured PII categories. Evaluated on the AI4Privacy and Nemotron-PII benchmarks at a low-FPR operating point, our model achieves the highest recall against larger baselines in 11 of 14 comparisons under our labels and 9 of 14 under the original labels. Its largest recall gains include useful additional coverage, such as mul…
VulnSAGE uses LLM reasoning tied to program structure to adjudicate which static analysis (SAST) findings are real defects.
arXiv cs.CR (Cryptography & Security)sastllmappsecFeed excerpt
arXiv:2610.23035v1 Announce Type: cross Abstract: Static Application Security Testing (SAST) reports flag operations whose safety depends on project-specific context, and maintainers must decide which reports describe real defects. Large language models (LLMs) can interpret this context, but adjudicating a report with them requires the decisive code, which often lies far from the reported line, and a decision basis that program analysis can check. We present VulnSAGE, an adjudication system for SAST reports that connects LLM reasoning to program structure in both directions. Its report-centered slicer recovers the dependencies of the reported operation together with the program structure that explains them, such as the caller object on which a helper acts. CLAIM, an intermediate representation for report judgments, records each model interpretation as a semantic fact that cites the program relations it assumes. Program analysis checks these premises, and the verdict follows from the facts whose premises hold. Both mechanisms share a program graph, which lets the model cite the code it reads and lets the checker query those citations. Statically supported true positives then guide p…
Study of 10,000+ Google Play health apps finds consent and data collection practices often inadequate given sensitive medical data.
arXiv cs.CR (Cryptography & Security)privacymhealthandroidFeed excerpt
arXiv:2610.23851v1 Announce Type: cross Abstract: Mobile health (mHealth) apps collect personally-identifiable information while handling uniquely sensitive medical data, ranging from mental health records to real-time glucose or heart rate monitoring -- yet they remain poorly understood at scale. We present the first comprehensive analysis of consent and data collection practices across 10,000+ mHealth apps on the Google Play Store, combining static analysis and privacy policy examination. We develop a rigorous operational definition to distinguish health apps from general wellness programs, and design a measurement framework to detect misuse of permissions and violations of consent. Our analyses reveal a troubling ecosystem: 69.15% of apps request at least one permission unrelated to their stated purpose, with over 52.9% apps requesting location data, and 50.5% and 34.9% apps requesting camera and microphone access, respectively -- despite no functional justification based on app descriptions and stated purposes. Most alarmingly, nearly 93% of apps fail to provide users with a consent form, directly violating regulatory requirements such as GDPR; and even among the remaining 7%, …
MICA system proposes attestable confidential-computing workflows that constrain shared channels between mutually distrustful TEE components.
arXiv cs.CR (Cryptography & Security)teeconfidential-computingFeed excerpt
arXiv:2603.03403v3 Announce Type: replace Abstract: Trusted Execution Environments (TEEs) protect private memory and attest initial code and configuration, but neither constrain nor attest shared channels between TEEs or with the untrusted host. Confidentiality thus depends on the functional correctness of all in-TEE code accessing these channels: a single misuse can leak data and compromise a pipeline. This assumption is increasingly untenable for agentic applications that generate code at runtime and cloud pipelines of mutually distrustful components. We present MICA, a confidential-computing firmware extension that decouples confidentiality from trust in in-TEE code. MICA lets tenants define, restrict, and attest channel constraints between TEEs and with the untrusted host, including transitive constraints spanning a pipeline. It extends attestation to groups of communicating TEEs, letting external parties verify the confidentiality properties induced by these constraints across a pipeline. We implement MICA on Arm CCA by extending the Realm Management Monitor with a small policy language, requiring no hardware changes and minor QEMU and KVM changes. Our evaluation demonstrates …