Seclog - #192

In this week's Seclog, the week's story is that AI is no longer a sidekick for finding bugs — it is producing pre-auth RCE chains and running autonomous bounty programs — while the footholds those agents (and everyone else) still walk through are the same old supply-chain and sanitizer mistakes. A 9.5-million-install VS Code preview turns one Markdown file into host file write, a compromised crates.io account republishes arrayref with a malicious build script, and an unpatched Forgejo instance on a homelab is cryptomined via a public Gitea RCE. On the research side, GPT-5.6 Sol Ultra walks WordPress from a batch-API desync to admin RCE for about $25, a two-person hackbot files 126 bugs in five months, and three cheap DeepSeek or GLM runs cover more CVEs than one pass of Opus or Grok. The catch is consistency: VulnBench shows half of unmatched AI findings appear once, Semgrep's IDOR suite still has high precision and low recall, and local file-at-a-time harnesses beat a $30 agentic pentest that never saw the LFI. Collectively the material argues that the model is now good enough, the harness is the product, and DOMPurify, vm.runInNewContext, and a yanked crate are still how the shell arrives.

📚 SecMisc #

Prompt Injection Is the Agent Entry - research.shoebpatel.com

Shoeb Patel reduces an agent to an LLM loop with two operations: llm.chat({messages, tools}) and tools[name].run(args). Prompt injection is only a finding when those tokens produce a sink — a privileged tool call, a markdown-image exfil, or a memory/skill write that persists. Treat MCP tool descriptions, RAG hits, calendar invites and sub-agent replies as untrusted tool results, not a new vuln class; the accompanying writeup collection is the pattern catalog.

Same AI Review, Different Findings - vulnbench.com

Snyk VulnBench JS 1.0 repeats the same agentic review five times on ten inspectable Express fixtures (300 scans). 84.8% of Snyk-Code-matched findings recur every run; 49.7% of unmatched reports appear once, and Opus 4.7 Max cost 5.67× more while scoring lower F1 than Opus 4.6 Medium. One run is a measurement, not a verdict — and more spend is not a shortcut for agreement.

Hook WebAuthn APIs, Not Responses - blog.compass-security.com

Tampering with signed authenticatorData or rewriting userVerification in the server JSON does not change what the authenticator actually does. Compass hooks navigator.credentials.create() / .get() in the console, flips UV to discouraged, and checks whether the server still accepts a UV-bit-clear assertion. Use passkey-hooks; the bug is often the JS never passing the server's options into the WebAuthn API at all.

📰 SecLinks #

Markdown Preview Becomes Supply-Chain Foothold - projectdiscovery.io

Markdown Preview Enhanced (9.5M installs) evaluated WaveDrom blocks with window.eval, then forwarded any webview postMessage to _crossnote.${command} and wrote arbitrary file:// URIs via updateMarkdown (CVE-2026-50733 / 54702 / 54703). .crossnote/config.js escaped vm.runInNewContext to child_process (CVE-2026-54566); unsanitized head.html ran before DOMPurify (CVE-2026-54701). Open a poisoned README, write ~/.ssh/authorized_keys or a git hook. Update to 0.8.30+; never eval a diagram format and never treat vm as a sandbox.

GLM-5.3 Matches Opus 4.8 Cheaply - semgrep.dev

Semgrep's IDOR suite (real OSS, missing-auth reasoning, no dangerous-function grep) puts GLM-5.3 at 23.8% F1 vs Opus 4.8's 23.6%, at $0.15 per true positive instead of $1.04. Grok 4.6 Exacto sits next to Opus 4.7 / Kimi K3 (~35% F1) at a third of Opus 4.7's cost. Precision stays high (~70–90%); recall collapses to 14–24%. Cheap models are fine for spot-checks; they are not coverage. GLM-5.3 also scored below GLM-5.2 on this run — treat single-pass F1 as noisy.

Crates.io Hijack Hits arrayref - blog.rust-lang.org

A compromised maintainer account republished popular [email protected] (and [email protected], [email protected]) to depend on a new crate whose build script fetched a payload. Malicious versions lived 86–107 minutes before crates.io deleted them and unyanked the good releases; dummy crates proc-macro1, aovine, arone, aronenao, tinymember went with them. find ~/.cargo/registry/cache for those .crate names. Yank-and-republish is still a working crates.io primitive when the author's machine is owned.

GPT-5.6 Sol Finds WordPress RCE - slcyber.io

Adam Kues pointed GPT-5.6 Sol Ultra at WordPress Core with OpenAI's Cycle Double Cover prompt (~$25 of a $200 sub). The model found a pre-auth SQLi: batch /wp-json/batch/v1 desyncs $matches vs $validation on is_wp_error + continue, then a nested batch skips the GET ban so unsanitized scalar author__not_in hits SQL. Cache-poisoned WP_Post objects + oEmbed rows + a parent-cycle wp_update_post become a customize_changeset that wp_set_current_user(1), then a fake parse_request hook replays the batch as admin. Check wp2shell.com; Calif and Hacktron reproduced before public PoCs.

Two-Person Hackbot Lands 126 Bugs - josephthacker.com

rez0 and xssdoctor's Claude-Code bot found 126 vulns in five months (88 High/Critical, 89% confirmed or duplicate) once they added logs, Ralph loops plus an orchestrator, a validator that kills findings, and a real-browser login agent — 80% of tokens had been burning on auth. Headline chains: Google partner-portal super-admin via expired DNS + Firebase signup, unauth Western Union PII lookup by phone, Raydium stored XSS in on-chain Metaplex description → wallet-drain hook. The lesson is persistence and sessions, not a smarter model; autonomous bounty is now two people and a Discord log stream.

Cheap Repeats Beat One Frontier Pass - aikido.dev

Aikido burned 11.7bn tokens on 32 fresh CVEs × 10 models × 3 passes. DeepSeek V4 Pro pooled to 28/32 (~$295) beating any single Opus 5 / Grok 4.6 / Sol pass at $450–590; three Flash runs hit 24 for $108. Grok was the most consistent (21/32 in every run); DeepSeek was hungrier and noisier. Qwen spent turns on already-patched historical CVEs. Open weights now win pooled recall if you harness them; drop-in replacement without a pipeline is still "yesn't."

Local File-at-a-Time Harness Finds RCE - projectblack.io

Eddie Zhang's known phpIPAM authenticated LFI (controller → require_once, CVE-2026-12194) was missed by semgrep --config auto and a 60M-token Strix/GLM 5.1 run (~$30), and only sometimes found by cloud SOTA + a security-review skill. Walking Qwen 3.6 27b over one file at a time on a hashcat box found it every run — then independently found authenticated exec RCE in myVesta (CVE-2026-12195). Harness beats model; the cost is token volume and BAC-shaped false negatives. Disable phpIPAM's API until patched.

DOMPurify-Clean HTML Leaks OAuth - blog.voorivex.team

After Chrome 136 killed Slonser's Link: rel=preload; referrerpolicy=unsafe-url (CVE-2025-4664), Voorivex leaks the page URL (OAuth code in the query) with zero JavaScript. CSS url('…' referrer-policy(unsafe-url)) is opaque to DOMPurify (style is URI-safe) and Chrome 150+ honours it per-request; <meta name="referrer" content="unsafe-url"> mutates the live window during DOMParser before DOMPurify strips the tag. Chromium closed the CSS report as intended. A "safe" error_description sink on a redirect_uri is still token theft.

Unpatched Forgejo Homelab Cryptomined - phunky.cafe

Open sign-up + Forgejo pinned to EOL v13 turned CVE-2026-60004 (Gitea/Forgejo diffpatch → git hook RCE) into a Saturday crypto-miner. Attacker testpoc26188 signed up, pushed poc-78614, hit POST /api/v1/repos/.../diffpatch three times in seconds, then curl | sh from 172.245.159.216 dropped arch-specific XMRig-class binaries. IOC is those diffpatch calls plus a post-index-change hook; Nuclei-automated public PoCs are already in the wild. Pin current tags, disable local signup, egress-restrict the container.

💻 SecGit #

Terminal Proxy Doubles as MCP Server - github.com

hahwul's Crystal TUI proxy (고리, "loop") captures HTTP/1.1, HTTP/2, WebSocket, gRPC and SSE, intercepts in flight, and ships Intruder-style fuzz, Prism scanning, param mining and a convert/compare workbench. Every TUI action is gori run and an MCP tool (gori mcp --install-claude-code / grok / hermes), so an agent can drive the same project DB. Default bind 127.0.0.1:8070; --read-only for untrusted agents.