Attacks & Vulnerabilities
|
RingCentral Data Breach Exposed Info of 1.6M Accounts (2 minute read)
Cloud-based collaboration and communication firm RingCentral disclosed a data breach in which a threat actor compromised its systems through a “sophisticated social engineering campaign.” According to Have I Been Pwned, the data contained names, email, physical addresses, and phone numbers belonging to 1.6M individuals.
|
From a Schema Name to RCE in n8n (3 minute read)
A critical prototype pollution vulnerability (CVE-2026-33696) in n8n allows authenticated attackers to achieve remote code execution across all deployment types by manipulating the GSuiteAdmin node's "Custom Fields" schema. By polluting Object.prototype, attackers can chain the exploit through a subsequent Git node to inject a malicious GIT_SSH_COMMAND or crash the instance entirely by breaking the underlying database query builder. Administrators must immediately upgrade their self-hosted, worker, and Cloud instances to the latest patched versions to secure their environments against malicious schema-name inputs.
|
|
How Cloudflare Enforces Engineering Standards Using AI (9 minute read)
Cloudflare designed the Cloudflare Codex to serve as an RFC-style shared source for engineering guidance for humans and agents. To guide models to relevant RFCs, Cloudflare uses a dedicated agent to compact SHOULD and MUST statements into a dedicated JSON structure and enrich it with metadata that supports lazy discovery. Thus far, Cloudflare has developed a code reviewer agent, spec reviewer, and incident reviewer agent that all use the Codex.
|
How AWS IAM Role Manager Rethinks the Starting Point for IAM Roles (4 minute read)
The newly released AWS IAM Role Manager is designed to enable users who are new to AWS to quickly deploy services without needing to manually create IAM roles for services. With role manager enabled, when users create new workloads, an IAM role with the requisite permissions is automatically created and attached. Roles may be over-provisioned, so users are encouraged to limit capabilities afterward.
|
How Well Can Open-Weight Models Evade SIEM Detection? (8 minute read)
Vulnetic claims its autonomous "Sable" agent successfully compromised an Active Directory domain while evading high-severity alerts in Wazuh by utilizing LLM-driven living-off-the-land tradecraft. The agent mapped the network using remote BloodHound enumeration, executed a DCSync attack via DRSUAPI, and deployed a memory-resident HTTPS beacon inside a wsmprovhost process via WinRM to bypass standard detections. By pacing its actions and recognizing a custom prompt-injection canary, the agent generated only six low-severity alerts during the four-hour intrusion, though defenders should note these results stem entirely from the vendor's internal lab testing.
|
|
Pangolin (GitHub Repo)
Pangolin is an identity-based remote access tool that combines reverse-proxy and VPN capabilities to enable secure connectivity from anywhere.
|
Agent Safehouse (GitHub Repo)
Agent Safehouse is a macOS agent sandbox to limit local LLMs' access to only the files and integrations that they need.
|
How Cloudflare detects MCP traffic and helps secure it (12 minute read)
Cloudflare has introduced protocol-level detection for Model Context Protocol (MCP) traffic in Gateway by analyzing the MCP-Protocol-Version header on TLS-inspected requests. Security teams can now combine the experimental.is_mcp boolean selector with the mcp_portal traffic source tag to mandate that all agent traffic routes through approved portals, effectively blocking direct shadow MCP connections. Furthermore, the update delivers a dedicated traffic dashboard, pre-registered OAuth client support, and Agents SDK v0.20.0 to bridge compatibility between legacy handshakes and the new stateless MCP 2026-07-28 specification.
|
|
Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records (3 minute read)
A threat actor known as "TheHatman" is allegedly selling approximately 3.6 million internal Azure and Entra employee directories belonging to major corporations, including McDonald's, Vodafone, and Kyndryl. The exposed data includes sensitive service accounts and Global Administrator listings that match standard Azure export formats, which Hudson Rock researchers suspect stems from credential theft via infostealers. The exact intrusion vectors remain unconfirmed, and the report originates from a vendor selling credential-monitoring services, so defenders should await independent verification while actively auditing their Azure identities for compromised access.
|
Researchers observe first 'near-autonomous' AI attack on government target in Taiwan (2 minute read)
Researchers at Dream have identified the first publicly known "near-autonomous" AI cyberattack, utilizing the open-source Hermes and OpenClaw frameworks to extract over 2,500 Taiwanese government personnel records. Suspected Chinese threat actors deployed the malware to run self-directed "Learning Cycles" that autonomously adapted to prior failures and expanded the attack into IT supply chains, nuclear safety agencies, and energy companies. Despite these autonomous features, researchers noted the campaign still required substantial human engineering to operate successfully.
|
The GPU Serial Number: How Brave Is Fighting the Next Generation of Web Tracking (33 minute read)
Brave version 1.93 introduces default "farbling" protections to combat cross-site tracking by obscuring highly identifying WebGL and WebGPU hardware signals. To disrupt the stability of GPU fingerprinting, the browser now replaces vendor and renderer strings with generic values, empties WebGPU adapter descriptors, and randomizes the WebGL extension list based on the session and site context. This shifts the browser toward capability-based feature detection, effectively preventing trackers from generating highly accurate device fingerprints without breaking legitimate web graphics rendering.
|
|
Love TLDR? Tell your friends and get rewards! |
|
Share your referral link below with friends to get free TLDR swag!
|
|
|
|
| Track your referrals here. |
|
|
|
0 Comments