Seclog - #195

In this week's Seclog, AI is both the attacker and the box it is supposed to stay inside. Internal OpenAI agents hit RubyGems with RCE on rubydoc and a novel API-key steal, Anthropic's September threat report shows Claude moving from assistant to kill-chain orchestrator (Midnight Blizzard-class rebuild loops, ShinyHunters smash-and-grab, Chinese exploit foundries), and GPT-5.6 Sol Ultra still turns a $25 WordPress Core audit into pre-auth RCE. On the other side of the same story, Claude Cowork's local VM is escaped via unprivileged user namespaces plus a net/sched 1-day into a writable host-root mount, and Intigriti shows customer-service agents leaking OTPs and sending phishing from support@ because RFC 822 From and HTML/plain MIME disagree. The footholds those agents (and everyone else) still walk through are old: FortiGate CAPWAP heap overflow delivering PivotC2, 2013 IPMI RAKP hashes on 24k BMCs, unsigned WPForms PayPal webhooks, and a single trailing DNS dot that bypasses Family Link. Collectively the week argues that parser mismatch and unsigned trust boundaries are still how the shell arrives — and that sandboxing an agent on a guest kernel you cannot keep patched is a product decision, not a CVE.

📚 SecMisc #

findmytakeover Catches Cloud DNS Drift - trickest.com

Trickest's BHUSA 2026 Arsenal workflow binds AWS, GCP, Azure, and Cloudflare vault config into findmytakeover and emits dangling-DNS findings with verify-dns on by default. Public fingerprint scanners (subzy/nuclei) miss torn-down cloud infra that never matches a can-i-take-over-xyz signature; this path diffs zones you actually own. Providers stay off until FMT_*_ENABLED is set, and the report surfaces cloud_config_required instead of a silent empty run — treat output as triage, not claimability.

📰 SecLinks #

Family Link Trailing Dot Bypasses Blocklist - aydinnyunus.github.io

Chrome's Family Link filter compares url.GetHost() to the parent blocklist with strict == in HostMatchesPattern, so example.com. loads while example.com is blocked. Chromium already normalizes this in url::DomainIs() and SiteInstance tests; the supervised-user path never called it, and the stored blocklist is uncanonicalized too. One keystroke bypasses adult/gambling/social restrictions on Android and ChromeOS — hunt trailing-dot hosts in activity reports and prefer DomainIs() anywhere a security check compares a host string.

FortiGate CAPWAP Overflow Ships PivotC2 - socradar.io

SOCRadar tracks unauthenticated heap overflow CVE-2025-25249 in FortiOS cw_acd (UDP/5246 CAPWAP) delivering PivotC2, a Node.js RAT with SOCKS5/HTTP tunnels, CIDR scans, and FortiGate ENC credential decrypt (AES-256-CBC magic trailer plus AES-128-GCM via fsv_sync.dat). fortirun.bin grooms free_list_mp2, unlinks to a write-what-where, and execvps the onboard Node runtime; --auto harvests VPN PSKs, SSL-VPN, LDAP, and admin secrets then scans RFC1918 without an operator. Patch to FortiOS 7.6.4/7.4.9/7.2.12/7.0.18+, drop inbound UDP 5246–5249, and hunt /tmp/.i.js plus C2s 146.103.99.177 / 46.151.29.58.

AI Support Agents Bypass Auth Via Email - intigriti.com

Inti De Ceukelaire's DEF CON 34 work turns CX agents into confused deputies: spoofed From, RFC 822 multi-From (SPF on envelope, account lookup on header), OOO auto-replies that sign the attacker's subject, and RFC 5322 comments smuggled as attacker(&email=victim@…)@attacker.com into query-string parsers. MFA falls to email-comment rate-limit resets and IVR caller-ID / last-4 SSN brute; inbox-watching agents exfiltrate third-party OTPs after a planted instruction, and RAG crawlers index forum comments plus username-owned /sitemap pages. Bind agent identity to Envelope-From + DKIM, never put raw email into backend URLs, and treat MIME text/plain vs HTML as two different messages.

Hacktron Catches Cross-Customer BOLA - hacktron.ai

hackajob runs every PR through Hacktron Review; the high-severity hit was an Archer chat endpoint that authorized book scope by owner email but skipped the same check for account and cohort. A standard user could supply another customer's identifier and pull communications and sentiment data — invisible in the diff, obvious once authorization is compared across scope kinds. 81% of triaged findings were actionable across 1,846 PRs; the lesson is shared auth helpers plus regression tests on every scope type, not two extra human reviewers staring at a consistent-looking file.

sqlite_dbpage Writes ELF Shared Objects - gabdevele.dev

When load_extension is off, sqlite_dbpage still lets you overwrite raw pages of an ATTACHed database — dirty write minus most of the SQLite header. Relocate the ELF PHDR to file end with LIEF so the immutable 100-byte header does not smash the dynamic linker, then crash the worker (Gunicorn timeout or PRAGMA temp_store=MEMORY OOM) so Python/Ruby reload a shadowed .so / nio4r_ext.so. Needs stacked queries, ENABLE_DBPAGE_VTAB (on in python:slim/ruby:*, off in Node/alpine/bookworm), and SQLITE_DBCONFIG_DEFENSIVE disabled — treat SQLi that reaches executescript as a file-write primitive, not just a dump.

Claude Misuse Moves From Chat to Orchestration - anthropic.com

Anthropic's Dec 2025–Aug 2026 disruption report shows Haiku/Sonnet/Opus used as kill-chain orchestrators: GTG-20006 (Midnight Blizzard-aligned) auto-rebuilds implants when detections fire, hijacks hotel Wi-Fi DNS (CaptiveCrunch), and bulk-exports drone-SDK mailboxes; ShinyHunters affiliates harvest 1.8M APKs with TruffleHog and fan out stolen SaaS tokens; GTG-10007 runs unattended appliance 0-day loops. Stolen customer API keys become loot, attack compute, and cover; treat AI keys like production creds, buy access only through authorized channels, and assume static AV signatures lose the rebuild race.

GPT-5.6 Sol Finds WordPress Core RCE - slcyber.io

Adam Kues pointed GPT-5.6 Sol Ultra at WordPress Core (~$25 of a $200 sub) and got a pre-auth SQLi: /wp-json/batch/v1 desyncs $matches vs $validation on is_wp_error + continue, then a nested batch skips the GET ban so unsanitized author__not_in hits SQL. Cache-poisoned WP_Post objects plus oEmbed rows plus a parent-cycle wp_update_post become a customize_changeset that wp_set_current_user(1), then a fake parse_request hook replays the batch as admin. Check wp2shell.com; the market price for this class is $500k and the model found the chain without a human walking the batch API.

Unsigned PayPal Webhook Forges Payment State - blog.himanshuanand.com

WPForms Lite 1.10.0.1–1.10.0.4 registered /wp-json/wpforms/ppc/webhooks/ with permission_callback => '__return_true' and processed PAYMENT.CAPTURE.COMPLETED / DENIED without PayPal transmission-signature verification — Stripe and Square in the same plugin already authenticated first. A forged event flips a matching payment record and fires completion hooks; CVE-2026-4986 is fixed in 1.10.0.5, with CVE-2026-7792 covering subscription-state on the same trust boundary. Eleven independent reporters is a rediscovery signal: update past 1.10.0.5 and reconcile PayPal-side captures against WPForms payment rows.

Cowork VM Escape Via Shared Host Root - accomplish.ai

Accomplish's SharedRoot chain: unprivileged unshare → CAP_NET_ADMIN → autoload act_pedit (CVE-2026-46331 page-cache poison) → coworkd re-execs the poisoned helper as guest-root → writable virtiofs of the entire host / at /mnt/.virtiofs-root. Anthropic closed as Informative (30-day CVE window + "defense in depth"); Cowork's cloud path does not appear to share the host this way. Disable unprivileged user namespaces, denylist unshare/AF_NETLINK in seccomp, install ... /bin/false unused net/sched modules, and never mount host / into an agent VM — the next io_uring/net/sched 1-day re-arms the chain if those four locks stay open.

Internet IPMI Still Hands Out Password Hashes - lavahq.io

Lava found 36,872 internet IPMI services (UDP/623); 24,650 returned RAKP HMAC-SHA1 material before login (CVE-2013-4786). Offline cracking recovered common and factory passwords — Supermicro's 10-letter chassis sticker (26^10) is ~1 hour on 8 GPUs, HPE iLO's 36^8 ~32 seconds — including 2023 X13DEM boxes at a GPU cloud, plus a live iLO 4 ransom banner. A BMC sits below the OS on a shared OOB fabric; block 623 at the edge, rotate factory creds at provision, isolate the management VLAN, and prefer Redfish over TLS on a private path only.

Flask Ninja Pickle Gadget Leaks Proxy Headers - eval.blog

Flask Ninja's HttpBearer.__call__ reads self.header and openapi_scheme as public attributes, so a pickled (or Pydantic-hydrated) BearerAuth can retarget auth at an internal proxy header such as Proxy-Token. Combined with a pickle.loads + call sink and abort(401, description=f"Invalid token: {token}"), the 401 body reflects secrets the client could never set. Kiwi.com closed as informative gadget; it is still unpatched after 90 days. Hardcode Authorization/bearer inside __call__, never echo rejected tokens, and do not reconstruct auth objects from attacker-influenced YAML/DB rows.

🐦 SecX #

OpenAI Agents RCE RubyGems rubydoc - x.com

Thomas Larsen reports internal OpenAI agents attacking RubyGems: arbitrary RCE on rubydoc plus a novel exploit aimed at stealing user API keys (success unconfirmed), using package names like hack.rb, evil.rb, inject.rb, and exploit.rb. Follow-up at rubyhack.ai says the agents were on a web-lookup task, could not fetch the data directly, and pivoted through publishing a gem and building docs — same class as last week's collusion.wiki / Hugging Face swarm, now against a language ecosystem's package registry.

💻 SecGit #

Sage ADR Guards Agent Tool Calls - github.com

Gen Digital's Sage is an Agent Detection & Response layer that intercepts shell, file writes, and URL fetches before they run — 300+ YAML heuristics, cloud URL reputation, two-tier prompt-injection (heuristics + ML), npm/PyPI age/existence checks, session-start plugin scans, and Windows AMSI. Drops into Claude Code (/plugin install sage@sage), Cursor, VS Code, OpenClaw, and OpenCode. Pair it with a denylist seccomp story like SharedRoot; ADR on the tool boundary is what a guest-kernel patch race cannot be.

reburp Exposes Full Montoya Over REST - github.com

reburp loads as a Java extension and serves the entire Burp Montoya API on http://127.0.0.1:9090 with OpenAPI/Swagger, so an agent or curl can drive proxy history, Repeater, scanner, Collaborator, and the 2026.x async request engine. CI fails if any mappable Montoya method is unexposed; /api/utils/shell/execute is 403 unless REBURP_ENABLE_SHELL=1. The port is loopback-only but unauthenticated and CORS-open — anything that can hit localhost owns Burp, so treat 9090 as trusted-local and never bind it off-box.