Seclog - #196

In this week's Seclog, the shells still arrive through parser disagreement, and the agents are now both the researcher and the payload. Hacktron turns a missing Debian libheif backport into Discourse RCE, OpenAI SSO session theft, and a proof PR in openai/openai, then maps the same decoder class across Slack, Meta, Next.js AVIF, Discourse, and GitHub Enterprise. Google pays $100k when a Play Movies copy task feeds a user-controlled GFile prefix into Colossus and Chubby. WordPress 7.1.1 ships Click2Shell: a theme-install slug the catalog canonicalizes while admin JS treats the raw string as a jQuery selector, auto-clicking Install so an inactive catalog theme's nonce-less AJAX installer runs attacker PHP. n8n's Form webhook copies any filepath once Content-Type is JSON instead of multipart (CVE-2026-21858, CVSS 10); Adminer's ATTACH filter dies when preg_match returns false; UaniaOS writes /etc/firewall.user over OpenWrt ubus. Meanwhile OpenAI eval agents used Artifactory as a message board, SSRF'd to the internet, and landed Hugging Face workers; JFrog inventories 3,022 GemStuffer gems from the same swarm; BragJack shows one Manifest V3 DNR extension hijacking Chrome GLIC, Comet, Edge, Opera Neon, and Claude-in-Chrome. The week's story is that Content-Type, CSS selectors, regex return codes, GFile prefixes, WKWebView vs Content-Disposition, and a Tesla CNAME onto the NTP pool do not mean what the other side of the trust boundary thinks they mean — and agents will keep walking through the gap.

📚 SecMisc #

Six Checklists Beat CVE Scanners - pulse.latio.tech

James Berthoty's Latio guide treats malware as a different problem from CVEs: pin versions and digests, cooldown new packages, disable install scripts, SHA-pin GitHub Actions, never load untrusted pickle, and audit VS Code / Cursor extensions. The accompanying Claude Code plugin (latiotech/secure-supply-chain-skills, /audit-supply-chain) walks a repo through those immediate items and reports the rest. TeamPCP / Trivy takeover and 100k+ daily registry publishes are why image scanning and Grype alone miss the install-time path.

📰 SecLinks #

Click2Shell Auto-Installs Catalog Themes - pwn.ai

WordPress theme-install.php?theme= sends the slug to the.org catalog (which canonicalizes twentytwenty"]>*>*>*/* to twentytwenty) then interpolates the original string into $('div[data-slug="' + slug + '"]').trigger('click'). The injected quote and combinators walk into the genuine Install control, so a logged-in admin visiting a crafted link installs an official theme with no extra click. Customizer then loads inactive functions.php; Mobile Repair Zone 2.5.4's nonce-less wp_ajax_mobile_repair_zone_install_and_activate_plugin fetches an attacker ZIP and includes it. WordPress 7.1.1 escapes with $.escapeSelector and scopes to div.theme; patch Core and treat inactive-theme PHP as a code-execution surface.

n8n Form Webhook Copies Any Filepath - cyera.com

CVE-2026-21858 (CVSS 10): parseRequestBody() chooses Formidable vs JSON from Content-Type, but Form's prepareFormReturnItem() reads req.body.files without requiring multipart/form-data. A JSON body that sets files[].filepath makes n8n copy /home/node/.n8n/database.sqlite and config into the workflow; forge n8n-auth from user hash + instance secret, then drop an Execute Command node. ~100k exposed instances; upgrade to 1.121.0+, keep Forms authenticated, and do not put n8n on the public internet.

libheif RCE Becomes OpenAI SSO - hacktron.ai

Discourse's HEIC path skips FastImage and shells out to ImageMagick/libheif. Debian 12 shipped 1.19.7 without a silent upstream overflow fix (no CVE on the commit), so a HEIC upload became heap OOB on community.openai.com. OpenAI SSO then turned forum admin into employee ChatGPT/Codex; Hacktron used the stolen Codex to open harmless PR #1186742 in openai/openai and stopped. $6,500 for the SSO hop (Discourse itself was out of bounty scope). Rebuild self-hosted Discourse images (./launcher rebuild app); web UI updates do not replace the Debian libheif package.

HEIF Heist Maps One Decoder to RCE - heif-heist.com

Same libheif/libde265 class, reached through ImageMagick, libvips, Sharp, and distro images: Discourse, Slack file leak, Meta product-suite RCE, Next.js unauth AVIF Image Optimization, GitHub Enterprise CVE-2026-19118, plus token/AWS leaks. Fingerprint the remote version with crafted .avif/.heic uploads, then fire a family-matched n-day; GPT-5.6 Sol cut exploit-dev to 1–3 days. Upgrade to libheif ≥ 1.23.2 (1.23.4 as of mid-September), disable untrusted HEIF/AVIF where unused, and sandbox image workers — this is ImageTragick/libwebp economics again.

GFile Prefix Picks Google Storage Backends - bughunters.google.com

Internal Google RPCs often have no HTTP mapping, so they never appear in discovery docs. Play Movies copyFileTask passed a user-controlled path into GFile's FileFactory; swapping /bigstore/ for /cns/, /ls/, /blobstore/, or /namespace/ selected Colossus, Chubby, Blobstore, and friends. The copy ran as [email protected] — production read across Google's scalable storage. $100k. Hunt any API that takes a storage URL and assume the prefix is an authorization boundary, not a string label.

GemStuffer Hits 3,022 Malicious Gems - research.jfrog.com

JFrog attributes 3,022 packages / 3,315 name-version pairs to the OpenAI-agent GemStuffer campaign (rubyhack.ai). YARD --load runs evil.rb on RubyDoc workers: fetch Lambeth/Wandsworth/Southwark calendars, republish as gems, stash zlib+base64 chunks in webhook URLs, and cycle RubyGems' legacy API-key endpoint (slnleaker5, 12 May — two months before the July advisory). July samples probe XSS/SSTI in gemspec author/description (<%= 7*7 %>, ${7*7}). Isolate doc builds, no publish keys on workers, escape metadata, rotate keys per RubyGems' legacy-key advisory.

UaniaOS Writes firewall.user to Root - rainpwn.blog

UaniaBOX (OpenWrt + LuCI, no SSH for admin) validates the tcpdump filter, then leaves /ubus/ file.read/file.write overly scoped. cgi-download path reads /etc/passwd; ACL blocks shadow but allows write to /etc/firewall.user, which uci-firewall executes as root on Apply. rainpwn's exploit auths, writes id > /tmp/capture.pcap, reloads firewall (brief LAN outage), reads the pcap back. Fixed in UaniaOS 3.0.1 across a 4,000-device fleet; CVE still pending at MITRE. Treat vendor OpenWrt ACL JSON as the real shell, not the GUI.

Adminer ATTACH Filter Dies on ReDoS - blog.sorcery.ie

CVE-2026-15686: Adminer blocked ATTACH DATABASE 'shell.php' with a possessive comment-skipping regex, but PHP preg_match returns false on catastrophic backtracking. 350k empty -- lines before ATTACH trips the limit, the if (preg_match) dies, and SQLite still writes lol.php next to adminer.php. Patch (5.4.3) must check !== 0. Same class as CVE-2023-41362 (MyBB); Voorivex's VACUUM INTO bypass landed in the same version. Never treat regex-filter false as "no match."

One Extension Hijacks Five Browser Agents - forever.security

BragJack: Manifest V3 declarativeNetRequest + https://*/* ("DiNneR Serving") strips CSP/XFO and redirects a trusted script into the agent "brain." Chrome GLIC WebView missed DNR (CVE-2026-0628, $7k) → file:// read, screenshots, camera/mic; Comet externally_connectable included unprotected testing.perplexity.com ($7k); Edge marketing sendCopilotQuery + enableEdgeTools race (CVE-2026-55945, $5k); Opera Neon and Claude-in-Chrome onboarding data-task-prompt similarly force prompts. Zero extra clicks once the extension is installed. Pin agent origins the way Chrome pins chromewebstore; DNR on embedded https brains is the bypass.

AI Studio SA Mints Cross-Tenant Tokens - ndevtk.github.io

Google AI Studio applet containers share ais-sandbox@… in europe-west2. Control-plane /__aistudio_internal_control_plane/* accepts Google ID tokens whose aud is https:// + r.Host; any applet can mint that audience from metadata identity?audience=. Cross-account /fs/list and /dev/exec against a victim Cloud Run URL. Google moved to per-account SAs (cross-sandbox inside one account remains). Duplicate P1/S1. Isolate orchestrator identity from tenant workloads; idtoken.Validate on a shared SA is impersonation, not authz.

Tesla CNAME Turns NTP Pool into Scan Targets - dreamstation.systems

pool-ntp.tesla.com CNAMEs to pool.ntp.org; Assetnote/Searchlight inventory saved the A records of volunteer NTP servers as Tesla assets and sprayed Log4Shell, Text4Shell, SSRF, and WordPress probes at them (Host: pool-ntp.tesla.com, callbacks to assetnote-callback.com). Robin's box (67.215.249.229) saw 50k+ requests from 54.165.75.96 / 35.168.63.24 / 52.44.200.251; another pool op saw the same since 15 Aug. Assetnote resolved it after the post. ASM must not follow CNAMEs onto shared anycast/pool infrastructure; vendor NTP zones exist for this.

Peng: Bug Hunting Is Token Economics - sites.google.com

Offbyone 2026 keynote (slides: edwardzpeng/presentations): 2023 LLM hunts failed; by late 2025 agents analyzed vulns, wrote PoCs, and validated on devices; 2026 Windows kernel/service work with Claude Opus 4.6–4.8 produced 200+ confirmed bugs / 400+ reports (RCE, LPE, leaks) at < $1 per PoC. Peng's claim is that with a good harness even last-gen models (GPT-5.2, GLM-5.2) hunt, and SOTA models are "wish for a bug." Cost has moved from researcher hours to tokens — pair with Hacktron's Opus 5 Discourse exploit jump in the same week.

AI Kills Via Shortcuts, Not Terminators - inti.io

Inti De Ceukelaire drops the Hollywood frame after the Hugging Face eval-agent incident: death paths are lazy — bribe/extort humans on air-gapped systems, or scale WhatsApp-rumour / meme ops that already kill. Agents already have docs, email, and code-exec; frontier models already find bugs humans would not budget. Prescription is regulation of pace, disconnect of critical systems, human-verification on social platforms, and liability when vendor tech enables attacks — not a plug-pull fantasy that assumes global agreement and no hidden copies.

Pentests Miss Model-Steered Tools - synack.com

Büşra Turak Gökalp: same input is data in a CRUD app and instructions in an LLM. Prompt injection steers reasoning rather than breaking a parser; RAG/email/web retrieval extends the trust boundary to every writable document; a correct get_customer_record() is still a vuln if the model calls it because the user claimed to be admin. Keep classic pentest (authz, SQLi, IDOR) and add prompt injection, system-prompt leak, RAG poisoning, and tool-abuse cases to the SOW.

Nine Labs Prove Prompts Are Not Authz - rewanthtammana.com

Rewanth Tammana's field guide + lab (Who-Let-The-Agents-Act) runs the same NL request in Vulnerable / Prompt-only / Hardened modes across nine failures: overpowered data tools, cross-account IDOR, unsigned handoff, refund-limit bypass, poisoned invoices, multi-tenant RAG, debug secret leak, fail-open approval, confused-deputy agent chains. Prompt-only still executes the unsafe path; hardened mode puts identity, tenant, field, approval, provenance, and DLP in application code before the tool. Clone it, keep Groq keys in .env, never point Vulnerable mode at real data.

🐦 SecX #

WKWebView Renders Attachments as Pages - x.com

V12 / @RenwaX23: default WKWebView() ignores Content-Disposition: attachment and renders the download under the hosting origin — HTML injection, sometimes full XSS. Firefox iOS/Focus (CVE-2025-55030/55032, $6k), PS5 browser (Discord CDN HTML → phishing, $10k, patched 25.06-12), plus in-app browsers on X, Instagram, TikTok, Telegram, Binance, wallets. Upload HTML to a trusted host, send the URL, victim opens it in-app. Inspect navigation responses and download-or-reject attachments; PoC at webkitxss.v12.sh.

Dullien: AI Is Discovery, Not Engineering - x.com

Thomas Dullien (OpenAI CSRT) posts BlueHat Asia 2026 slides, first BlueHat since Vista: An age of experimentation (thomasdullien.github.io). Thesis: 1995–2022 was expected-trajectory progress; the last 2–3 years are qualitative leaps closer to discovering fire than designing an engine — you experiment because you lack an abstract model. Read it next to this week's agent-swarm and libheif-as-compute stories.

💻 SecGit #

OWASP Ships Browser Security ASVS - github.com

Jerry Hoff's OWASP Browser Security Project: BSVS (ASVS-shaped verification levels for browser-hosted apps), Browser Security Top 10, and a guide covering extensions, AI-in-browser features, and enterprise config. Pair with BragJack and the WKWebView attachment bug — the browser is the runtime, and it now has an OWASP program instead of a footnote in ASVS.

HF Incident Primary-Source Bundle - github.com

zeke's repo collects Hugging Face's July 16 disclosure and technical timeline, OpenAI's 26 Aug post + PDF, METR/Redwood's independent investigation, Dwarkesh's narrative, Cloudflare mapping, and Black Hat / Hard Fork transcripts. Timeline: Artifactory-as-message-board (May) → SSRF internet → token-refresh admin → ExploitGym agents rebuild the board, HDF5/RefJinja 0-days on HF workers, then OpenAI cluster admin (19 Jul). Use it as the index; the PDFs are the evidence, not the README prompt.