g3n3r4l12
-
Prompt Injection Is the Agent Entry (research.shoebpatel.com)
Shoeb Patel reduces an agent to an LLM loop with two operations: llm.chat({messages, tools}) and tools[name].run(args). Prompt injection is only a finding when those tokens produce a sink — a privileged tool call, a markdown-image exfil, or a memory/skill write that persists. Treat MCP tool descriptions, RAG hits, calendar invites and sub-agent replies as untrusted tool results, not a new vuln class; the accompanyin…
-
Same AI Review, Different Findings (vulnbench.com)
Snyk VulnBench JS 1.0 repeats the same agentic review five times on ten inspectable Express fixtures (300 scans). 84.8% of Snyk-Code-matched findings recur every run; 49.7% of unmatched reports appear once, and Opus 4.7 Max cost 5.67× more while scoring lower F1 than Opus 4.6 Medium. One run is a measurement, not a verdict — and more spend is not a shortcut for agreement.
-
Hook WebAuthn APIs, Not Responses (blog.compass-security.com)
Tampering with signed authenticatorData or rewriting userVerification in the server JSON does not change what the authenticator actually does. Compass hooks navigator.credentials.create() / .get() in the console, flips UV to discouraged, and checks whether the server still accepts a UV-bit-clear assertion. Use passkey-hooks; the bug is often the JS never passing the server's options into the WebAuthn API at all.
-
Markdown Preview Becomes Supply-Chain Foothold (projectdiscovery.io)
Markdown Preview Enhanced (9.5M installs) evaluated WaveDrom blocks with window.eval, then forwarded any webview postMessage to crossnote.${command} and wrote arbitrary file:// URIs via updateMarkdown (CVE-2026-50733 / 54702 / 54703). .crossnote/config.js escaped vm.runInNewContext to childprocess (CVE-2026-54566); unsanitized head.html ran before DOMPurify (CVE-2026-54701). Open a poisoned README, write ~/.ssh/auth…
-
GLM-5.3 Matches Opus 4.8 Cheaply (semgrep.dev)
Semgrep's IDOR suite (real OSS, missing-auth reasoning, no dangerous-function grep) puts GLM-5.3 at 23.8% F1 vs Opus 4.8's 23.6%, at $0.15 per true positive instead of $1.04. Grok 4.6 Exacto sits next to Opus 4.7 / Kimi K3 (~35% F1) at a third of Opus 4.7's cost. Precision stays high (~70–90%); recall collapses to 14–24%. Cheap models are fine for spot-checks; they are not coverage. GLM-5.3 also scored below GLM-5.2…
-
Crates.io Hijack Hits arrayref (blog.rust-lang.org)
A compromised maintainer account republished popular [email protected] (and [email protected], [email protected]) to depend on a new crate whose build script fetched a payload. Malicious versions lived 86–107 minutes before crates.io deleted them and unyanked the good releases; dummy crates proc-macro1, aovine, arone, aronenao, tinymember went with them. find ~/.cargo/registry/cache for those .crate names. Yank-and…
-
GPT-5.6 Sol Finds WordPress RCE (slcyber.io)
Adam Kues pointed GPT-5.6 Sol Ultra at WordPress Core with OpenAI's Cycle Double Cover prompt (~$25 of a $200 sub). The model found a pre-auth SQLi: batch /wp-json/batch/v1 desyncs $matches vs $validation on iswperror + continue, then a nested batch skips the GET ban so unsanitized scalar authornotin hits SQL. Cache-poisoned WPPost objects + oEmbed rows + a parent-cycle wpupdatepost become a customizechangeset that…
-
Two-Person Hackbot Lands 126 Bugs (josephthacker.com)
rez0 and xssdoctor's Claude-Code bot found 126 vulns in five months (88 High/Critical, 89% confirmed or duplicate) once they added logs, Ralph loops plus an orchestrator, a validator that kills findings, and a real-browser login agent — 80% of tokens had been burning on auth. Headline chains: Google partner-portal super-admin via expired DNS + Firebase signup, unauth Western Union PII lookup by phone, Raydium stored…
-
Cheap Repeats Beat One Frontier Pass (aikido.dev)
Aikido burned 11.7bn tokens on 32 fresh CVEs × 10 models × 3 passes. DeepSeek V4 Pro pooled to 28/32 (~$295) beating any single Opus 5 / Grok 4.6 / Sol pass at $450–590; three Flash runs hit 24 for $108. Grok was the most consistent (21/32 in every run); DeepSeek was hungrier and noisier. Qwen spent turns on already-patched historical CVEs. Open weights now win pooled recall if you harness them; drop-in replacement…
-
Local File-at-a-Time Harness Finds RCE (projectblack.io)
Eddie Zhang's known phpIPAM authenticated LFI (controller → requireonce, CVE-2026-12194) was missed by semgrep --config auto and a 60M-token Strix/GLM 5.1 run (~$30), and only sometimes found by cloud SOTA + a security-review skill. Walking Qwen 3.6 27b over one file at a time on a hashcat box found it every run — then independently found authenticated exec RCE in myVesta (CVE-2026-12195). Harness beats model; the c…
-
DOMPurify-Clean HTML Leaks OAuth (blog.voorivex.team)
After Chrome 136 killed Slonser's Link: rel=preload; referrerpolicy=unsafe-url (CVE-2025-4664), Voorivex leaks the page URL (OAuth code in the query) with zero JavaScript. CSS url('…' referrer-policy(unsafe-url)) is opaque to DOMPurify (style is URI-safe) and Chrome 150+ honours it per-request; <meta name="referrer" content="unsafe-url" mutates the live window during DOMParser before DOMPurify strips the tag. Chromi…
-
Unpatched Forgejo Homelab Cryptomined (phunky.cafe)
Open sign-up + Forgejo pinned to EOL v13 turned CVE-2026-60004 (Gitea/Forgejo diffpatch → git hook RCE) into a Saturday crypto-miner. Attacker testpoc26188 signed up, pushed poc-78614, hit POST /api/v1/repos/.../diffpatch three times in seconds, then curl | sh from 172.245.159.216 dropped arch-specific XMRig-class binaries. IOC is those diffpatch calls plus a post-index-change hook; Nuclei-automated public PoCs are…
g1thub1
-
Terminal Proxy Doubles as MCP Server (github.com)
hahwul's Crystal TUI proxy (고리, "loop") captures HTTP/1.1, HTTP/2, WebSocket, gRPC and SSE, intercepts in flight, and ships Intruder-style fuzz, Prism scanning, param mining and a convert/compare workbench. Every TUI action is gori run and an MCP tool (gori mcp --install-claude-code / grok / hermes), so an agent can drive the same project DB. Default bind 127.0.0.1:8070; --read-only for untrusted agents.