Seclog - #184

In this week's Seclog, a dominant theme is the expanding role of Artificial Intelligence across the security landscape, presenting both powerful defensive and offensive capabilities, alongside novel attack surfaces. We observe critical vulnerabilities in widely used software like FFmpeg, which can turn benign media files into weapons, and complex exploit chains in applications like Discuz leading to Remote Code Execution. The discussion around AI extends to its impact on development velocity and security testing, with reports highlighting how AI-assisted coding is outstripping traditional security efforts and how AI is being leveraged for autonomous vulnerability hunting and OSINT. Concurrently, new attack vectors targeting AI models, such as prompt injection framed as role confusion, are gaining prominence, necessitating advanced guardrails. The week also features debates on vulnerability disclosure and CVE allocation, supply chain compromises impacting NPM packages, and new HTTP methods, all contributing to a rapidly evolving threat and defense paradigm.

📚 SecMisc #

New HTTP QUERY Method RFC - rfc-editor.org

RFC 10008 formally introduces the HTTP QUERY method, defining a new standard for data retrieval that could influence future API designs and data interaction models. This development may require security professionals to re-evaluate web application firewall rules, API security policies, and potential new attack vectors associated with a distinct querying mechanism.

📰 SecLinks #

AI Transforming Penetration Testing Report - aikido.dev

This report, based on insights from 400 security and engineering leaders, reveals how AI is fundamentally changing penetration testing practices. Traditional testing methods are struggling to keep pace with modern development speeds, driving expectations for AI-driven solutions to enhance and accelerate vulnerability discovery and assessment.

curl Project's CVE Authority Explained - daniel.haxx.se

The curl project, acting as a CVE Numbering Authority (CNA), maintains autonomous control over allocating CVE identifiers for vulnerabilities within its scope. This authority ensures that decisions regarding CVE assignment are made by project experts, aiming to prevent the proliferation of inaccurate or irrelevant CVEs and streamline the disclosure process.

Comparing AI AppSec Testing Platforms - doyensec.com

This post offers a comparative analysis of AI-powered Application Security Testing (AST) platforms, evaluating their effectiveness and methodologies. Security teams can use this information to assess which AI AST solutions are best suited for integrating into their CI/CD pipelines to proactively identify and mitigate application vulnerabilities.

Hacking an AI Assistant Experiment - fernandoi.cl

An experiment where 2,000 participants attempted to hack an AI assistant provides practical insights into common adversarial techniques against AI models. This highlights the real-world attack surface of AI systems and the types of vulnerabilities, such as prompt injection, that security practitioners need to defend against.

GitHub Actions Read-Only Cache Security - github.blog

GitHub has implemented a read-only Actions cache for workflows triggered by untrusted sources, enhancing CI/CD supply chain security. This change prevents malicious actors from poisoning the cache with arbitrary data, thereby mitigating a significant vector for injection attacks within automated build processes.

Immobiliarelabs NPM Packages Compromised - github.com

A GitHub issue reports the compromise of Immobiliarelabs NPM packages, signaling a potential software supply chain attack. Organizations using these packages must immediately assess their dependency trees for indicators of compromise and prepare for remediation to prevent malicious code execution or data exfiltration.

FFmpeg Vulnerability Exploits Media Files - jfrog.com

A critical vulnerability in FFmpeg, dubbed "PixelSmash," enables attackers to craft malicious media files that can execute arbitrary code upon processing. This transforms commonly shared media into a potent attack vector, posing a significant risk to applications that rely on FFmpeg for media handling.

Discuz RCE via Chained Race Condition - karmainsecurity.com

This write-up demonstrates how to achieve Remote Code Execution (RCE) in Discuz by chaining multiple vulnerabilities, specifically exploiting a race condition. This showcases the critical impact of Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities when combined with other flaws, enabling a complete system takeover.

Google's "Not a Vulnerability" Blind Spot - medium.com

A 19-year-old researcher details a significant security concern in Google's systems that was allegedly dismissed as "not a vulnerability." This incident highlights potential challenges in vulnerability disclosure processes and the disparity between a researcher's assessment of impact and a vendor's internal classification, potentially leaving critical issues unaddressed.

Incident Report: CVE-2026-LGTM Details - nesbitt.io

This incident report details CVE-2026-LGTM, providing insights into a specific vulnerability and its impact. Such reports are invaluable for security professionals to understand the root causes, exploitation techniques, and mitigation strategies for recently disclosed flaws, aiding in proactive defense.

OpenClinic GA XSS to RCE - partywave.site

This research outlines a critical vulnerability, CVE-2026-25860, in OpenClinic GA, demonstrating how a reflected Cross-Site Scripting (XSS) can be escalated to Remote Code Execution (RCE). This illustrates the severe consequences of even seemingly client-side vulnerabilities when they can be leveraged to compromise server-side operations.

AI Coding Impact on Cybersecurity Report - projectdiscovery.io

ProjectDiscovery's 2026 report, based on a survey of 200 cybersecurity practitioners, highlights that while AI-assisted coding significantly speeds up development, it also places immense strain on security teams. This suggests an urgent need for security practices and tools to adapt to the accelerated pace of software delivery to prevent increased vulnerability exposure.

Prompt Injection as Role Confusion - role-confusion.github.io

This article conceptualizes prompt injection attacks against Large Language Models (LLMs) as "role confusion," where attackers manipulate the model's understanding of its assigned persona or instructions. This framework helps in understanding how to design more robust LLM guardrails and develop detection mechanisms for adversarial prompts.

Autonomous 0-Day Hunting with LLMs - zsec.uk

This article explores leveraging Large Language Models (LLMs) for autonomous vulnerability hunting, aiming to discover zero-day exploits at scale. It details how guiding LLMs through security analysis tasks could significantly accelerate offensive security research and uncover novel flaws more efficiently than traditional methods.

💻 SecGit #

AutoGuardrails for LLM Policy Alignment - github.com

AutoGuardrails provides an alignment-research scaffold for developing and testing guardrails for Large Language Models (LLMs), focusing on policy definition. This tool supports security professionals in researching and implementing effective mechanisms to control LLM behavior, thereby reducing risks like hallucination or malicious output.

Graphify: AI Code Knowledge Graph - github.com

Graphify is an AI coding assistant that transforms diverse codebases, SQL schemas, scripts, documents, and multimedia into a queryable knowledge graph. This tool aids security analysts and developers in understanding complex systems by providing an integrated, searchable view of application code, database structure, and infrastructure, facilitating impact analysis and vulnerability identification.

Claude Code Worktree Sandbox Escape - github.com

This GitHub resource documents a sandbox escape vulnerability related to "Claude Code Worktree," likely providing a write-up or proof-of-concept. Security researchers can analyze this to understand exploitation techniques against containerized or virtualized code execution environments, which are common in AI coding assistants and CI/CD pipelines.

Pivot Atlas Penetration Testing Tool - github.com

Pivot Atlas is a GitHub repository likely containing a tool for penetration testing and network pivoting. Security testers can leverage this utility to facilitate lateral movement, reconnaissance, and interaction within compromised networks, enhancing their ability to simulate complex attack paths.

Taranis AI: Advanced OSINT Tool - github.com

Taranis AI is an advanced Open-Source Intelligence (OSINT) tool that leverages Artificial Intelligence for information gathering and situational analysis. This tool can significantly enhance threat intelligence capabilities by automating and refining the collection and correlation of publicly available information, aiding in target profiling and risk assessment.