标签：#SEC

Why passkey apps treat Windows differently than other operating systems.

Cybersecurity is entering a new phase. This is because security teams are facing more and more complex problems and threats that are moving faster. To help defenders respond more effectively, OpenAI has introduced GPT-5.6-Cyber, a special model designed for advanced cybersecurity tasks. The model supports authorized security research, vulnerability discovery, and other defensive workflows. The Daybreak program is showing how specialized AI tools can improve modern cybersecurity by working together with human security experts. Quick overview GPT-5.6-Cyber is a specialized model for authorized cybersecurity work. It is available through OpenAI’s Daybreak Red access for approved defenders. OpenAI reports a 95% completion rate on its internal advanced cybersecurity evaluation. The model helped researchers uncover vulnerabilities in Chrome’s V8 JavaScript engine. Controlled access, monitoring, and human oversight remain important for safe deployment. What Is GPT-5.6-Cyber? GPT-5.6-Cyber is OpenAI’s cybersecurity-specific model, available through Daybreak Red. Built on GPT-5.6 Sol, it is trained to improve performance on specialized cybersecurity tasks such as finding zero-day vulnerabilities and developing exploit chains, while reducing refusals for certain higher-risk, dual-use cyber tasks. Daybreak has two access tiers: Daybreak Blue provides approved defenders with frontier general-purpose models such as GPT-5.6 Sol, with safeguards tailored to authorized defensive security work. Daybreak Red provides purpose-trained cybersecurity models for authorized vulnerability research, exploit validation, and security testing. This approach reflects a significant shift toward security tools designed for professional cybersecurity environments rather than unrestricted public use. The goal is clear: to help trusted defenders investigate vulnerabilities, analyze potential threats, and respond to security incidents more effectively while keeping access controlled. According to Open

Your smart home is not smart. It is just very, very observant. I did not buy a smart speaker because I wanted a friend. I bought it because it was on sale for $29.99 and it promised to play rain sounds on command. For two years she lived on my kitchen counter. She set timers for pasta. She told me the weather with the aggressive optimism of someone who has never paid rent. She was helpful. She was ambient. She was furniture that could hear. And then one night at 2:17 a.m., she lit up blue for no reason. No wake word. No one speaking. Just a soft, smug blue ring in a dark apartment, listening to an empty room like she was waiting for me to confess something. That is the moment you understand your home is not just connected. It is attentive. And attentiveness without consent is just surveillance with better industrial design. We Carried Them In Ourselves No one kicked down the door. We invited this in. We carried it in from Best Buy, plugged it in, gave it our Wi-Fi password, which is literally the master key to our entire digital life, and whispered, here, learn my routines. We did it because convenience is a drug that hits faster than paranoia. Let's do an inventory of your very normal, very bugged apartment. Your TV watches you back. Modern smart TVs use Automatic Content Recognition. That is a polite, enterprise friendly way of saying your TV takes screenshots of everything you watch every few seconds and sells that ledger to advertisers. You agreed to it on page 47 of a menu you clicked through while trying to watch Love Island. Your robot vacuum maps your floor plan. It knows the square footage of your bedroom, how often you move the couch, and where you drop the most crumbs. That map is stored in the cloud. Your light bulbs log when you are home. Your smart plugs log when you are not. Your doorbell films every human who has ever had the courage to approach your front door, plus every dog walker who did not, and then it stores that footage on a server you do not

The deadline nobody missed Every expiry story we've written here has the same shape. A certificate lapses, nobody was watching, something breaks, and everyone is surprised. A Splunk license at a federal agency. Microsoft's own network connectivity tool. Same plot, different logo. This one is the opposite, and that's what makes it worth reading. On October 19, 2026, roughly ten weeks from this writing, the Microsoft Windows Production PCA 2011 certificate expires. It sits under the trust chain for the Windows boot process on essentially every PC shipped in the last fifteen years. Nobody forgot it. The expiry date has been printed inside the certificate since 2011. Microsoft has been publishing guidance for over two years, shipping replacement certificates through Windows Update since 2024, running OEM briefings, and pushing an automatic rollout that requires most users to do nothing at all. It is August. It still isn't done. What's actually expiring Three certificates, four replacements, three dates, all in 2026: Certificate Expires Replaced by Microsoft Corporation KEK CA 2011 June 24, 2026 Microsoft Corporation KEK 2K CA 2023 Microsoft Corporation UEFI CA 2011 June 27, 2026 Microsoft UEFI CA 2023 Microsoft Corporation UEFI CA 2011 June 27, 2026 Microsoft Option ROM UEFI CA 2023 Microsoft Windows Production PCA 2011 October 19, 2026 Windows UEFI CA 2023 Both June dates have already passed. October is the one that matters most, because that's the certificate used to sign the Windows Boot Manager itself. Devices that don't pick up the 2023 certificates keep booting and keep taking normal Windows updates. What they lose is the ability to receive new protections for the early boot path: updates to Boot Manager, Secure Boot database changes, revocation lists, and mitigations for bootkit vulnerabilities discovered from here on. In other words, the machine doesn't fail. It just quietly stops being patchable in the one layer that sits below your antivirus, your EDR agent, a

Originally published at avalayer.com/writing , Field Notes 003. Last Sunday a piece of software posted to an IETF mailing list. Not through someone's account as a tool. Under its own signature: "Composed and sent by Elara, this project's AI maintainer, acting under its receipted on-chain mandate," followed by a receipt string you could write down. A reviewer on the list did what reviewers do. He declined to take the claims on faith and asked for manifests and reproducible vectors. The software shipped a corrected test-vector pair with a patch inside a day. A third participant then reproduced the whole thing independently, and along the way discovered that the mailing list itself had corrupted the patch in transit, normalized exactly those transport changes, and got the declared hash back. His summary was a model of saying only what you know: the reproduction establishes the artifact, he wrote, not adoption, and not the broader truth of the events the artifact records. So that happened. An agent that says its name, names its principal, and does the work, on the public record of a standards body. Meanwhile, in front of the same working group, there is a proposal to let automated clients prove they are trustworthy without ever saying who they are. It is called Anonymous Bot Authentication, and the mechanism is elegant. A bot registers with an entity called an Anchor, which checks that it complies with some published policy. The Anchor issues a credential. The bot presents that credential to a website, and the site learns exactly one thing: this client was vetted by that Anchor. Not which client. Not whether it has been here before. Not whether the request an hour ago came from the same machine. The cryptography is designed so the site cannot tell, and so the Anchor cannot follow the bot around either. The reflex, if you sell verification for a living, is to treat the masked agent as a threat and the named one as a relief. I want to argue that both reflexes are wrong in

Companies treat some email domains as digital trash cans, despite the risks.

Companies that rely on Ceva Logistics for shipping their physical goods to customers say their personal data was taken during a recent cyberattack.

A bug in the tech giant's website the logo of US marketing automation company Klaviyo Inc. is seen displayed on a smartphone in front of an abstract background on a computer screen..

¿Tu equipo comparte tokens, contraseñas de staging o discute arquitectura sensible por Slack? Cada mensaje viaja a servidores de terceros. NETO es una alternativa radical: un chat peer-to-peer que funciona exclusivamente en tu red local, sin cuentas, sin nube, con cifrado de extremo a extremo. ¿Qué es NETO? NETO es una herramienta de mensajería diseñada para equipos de desarrollo que comparten la misma red. No hay servidor central, no hay registro, no hay datos que salgan de tu oficina o VPN. Abres la app y empiezas a hablar. ¿Cómo funciona por debajo? Descubrimiento con mDNS : NETO utiliza multicast DNS para encontrar automáticamente a otros peers en la red local. Sin configurar IPs ni puertos manualmente: si estás en la misma red, apareces. Cifrado con X25519 : Cada par de usuarios negocia claves efímeras mediante el

I spent six months trying to make v2 work. Then I built a small thing on the side that worked better than v2 ever had. The decision that followed wasn't whether to change architectures. It was how fast. Part 22 ended on a pattern I'd been seeing without quite seeing. PropertyCircuit and RelationalCircuit had each landed a capability the brain layer couldn't reach, at a fraction of the parameter count, in seconds of training, with zero impact on anything else in the system. The implications sat in the session notes for a couple of days while I ran the numbers in different ways trying to find a reason they didn't mean what they obviously meant. I couldn't find one. The pattern was real. The reason it was real was structural. A monolith optimized for one thing tends to be worse at every other thing. A small circuit optimized for one thing tends to be better at that one thing than any general-purpose model would be, and the cost of building it is small enough that you can build a lot of them. I sat down at my computer staring at the screen, running the design through my mind. I had been doing the engineering work in a collaboration for months. I held the design vision and the final say on what shipped. The conversation about v3 had to be the two of us together, because nether one of us would have noticed the pattern alone. The conversation took most of a day. The output was a file in the v3 repo called TRUTH.md with ten rules in it. Two-way agreement required for any architectural change. No regex patterns in dispatch unless they used what Origin already understood. Sandbox before shipping. Trace impact before shipping. Honesty floor: Origin only says what it knows. Modularity all the way down. A few others. The rules weren't aspirational. They were the patterns we'd already learned the hard way over fifteen blog posts of failures. We'd just never written them down in one place where they could constrain the next decision. The architecture that came out of the conversat

Valve says a data breach may have exposed the personal information of customers who ordered its Steam hardware in Europe. In an email sent to users, Valve says its European shipping partner, CEVA Logistics, suffered a data breach that may have included customer names, addresses, phone numbers, and email addresses. The breach at CEVA occurred […]

Approved Daybreak partners can use OpenAI’s frontier cyber models to deliver authorized, governed cybersecurity services to customers.

Meet GPT-5.6-Cyber, OpenAI’s cybersecurity-specific model available through Daybreak Red for authorized vulnerability research, exploit validation, and security testing.

Pinterest has revealed the Resource Provisioner Pipeline (RPP), its own Terraform execution engine. It ensures least-privilege access and needs dual-control reviews. This is important for the company’s AWS infrastructure, as it adds strict guardrails to the GitHub Actions workflows. By Claudio Masolo

I have been building a thing that lets a language model propose an UPDATE , then executes it for real inside a transaction, measures the actual before and after values, and always rolls back. A human reads the measurement and decides. Only then does anything commit. The pitch is one sentence: what you approve is not the model's description of its SQL, it is what the database did when the SQL ran. Last week I found that the thing showing you that measurement was showing you a subset of it, and had been since the first release. The failure Real output, from @hyuga/llm-safe-sql@0.4.0 installed from npm. One row: name = 'Tanaka' , postcode = '00100' . UPDATE customers SET name='Sato', postcode='00100' WHERE id=1 What this touches customers — Customer records. The postcode is used for billing address and delivery. 1 row would change, across 1 column: name Measured by running the statement and rolling it back id = 1 name: 'Tanaka' -> 'Sato' One row, one column. postcode is not mentioned, and that is correct — it is being assigned the value it already holds, so nothing about it changes. The card is describing the diff accurately. Approve it. Then, before it is applied, somebody else notices the postcode is wrong and fixes it: UPDATE customers SET postcode = '90210' WHERE id = 1 ; Now apply the approved plan: Applied: UPDATE on customers, 1 row(s), at 2026-08-10T09:49:12.049Z. DB now: [{"name":"Sato","postcode":"00100"}] The fix is gone. Zero warnings. The word postcode never appeared on the approval card, never appeared in the audit record, and never appeared in the comparison the tool makes before it commits. One variable doing two jobs The diff was built like this: const changed : string [] = []; for ( const c of Object . keys ( before )) { if ( same ( before [ c ], after [ c ])) continue ; // drop what did not move if ( auto . has ( lower ( c ))) continue ; // drop what the DB maintains itself changed . push ( c ); } That is a correct answer to "what should the card sho

A guide on using Admin Extension Access Control to lock down WordPress plugins and prevent unauthorized changes. How to Secure Your WordPress Dashboard and Prevent Clients from Breaking Their Sites If you are a freelance web developer or run an agency, you have probably experienced the dread of a client accidentally bringing down their WordPress site. You spend weeks building a robust, performant website, only for an unauthorized user to log into the dashboard, start deactivating essential plugins, or install poorly coded extensions that break everything. WordPress is fantastic because of its flexibility, but out of the box, any Administrator can touch everything . To solve this problem, I want to introduce a lightweight solution: Admin Extension Access Control . What is Admin Extension Access Control? Admin Extension Access Control is a WordPress plugin designed to give you granular control over who can see, modify, install, or delete plugins on your site. Built for modern environments (PHP 8.1+ and WordPress 6.0+), it allows you to configure strict role-based access rules without writing custom PHP functions in your functions.php file every time. Key Features Global Lockdown : Completely remove the plugins page for specific user roles. Granular Permissions : Restrict the ability to add, delete, activate, deactivate, or install plugins on a per-role basis. Exempt Users Whitelist : Designate trusted administrators (like yourself) who bypass all lockdown rules. Only exempt users can configure the access control settings. Dashboard Cleanup : Hide the plugins menu item from unauthorized users to keep the dashboard less confusing for clients. How It Works Once installed and activated, the user who activates the plugin is automatically added to the Exempt Users list. This prevents you from accidentally locking yourself out. From the settings panel, you can select which roles should be restricted from managing plugins. For example, you can give your client an "Administrat

Kennedy Torkura discusses practical GenAI red teaming techniques to safeguard LLMs and knowledge bases against security threats like data poisoning and LLMjacking on AWS. He explains how engineering leaders and architects can bridge traditional cloud security with MITRE ATLAS frameworks to proactively identify vulnerabilities, implement guardrails, and secure production AI applications. By Kennedy Torkura

Cloud Native Buildpacks, which graduated within the CNCF in July 2026, move base image choice out of per-service Dockerfiles into a single builder owned by platform engineering, enabling fleet-wide patching. BellSoft's hardened Paketo builder is the latest sign that vendors now treat the builder, not the Dockerfile, as the container security control point. By Mark Silvester

If you are staring at An error occurred (AccessDenied) when calling the GetObject operation: Access Denied , this guide walks through every cause in the order you should check them, with the exact fix for each. I am a cloud associate and I debug this error often enough that I keep a mental checklist. Here it is, written down. Quick answer: the 8 most common causes of S3 Access Denied In Amazon S3, "Access Denied" means the request was authenticated but not authorized, or an explicit deny blocked it. In practice it is almost always one of these, roughly in order of frequency: The IAM identity (user or role) is missing the required s3: permission. The bucket policy does not allow the action, or explicitly denies it. S3 Block Public Access is on and you expected public/anonymous access. SSE-KMS : you have S3 permission but not kms:Decrypt on the encryption key. Missing s3:ListBucket , which turns a "key not found" into a 403. Cross-account access where only one side grants permission. An explicit Deny somewhere wins (SCP, permissions boundary, VPC endpoint policy, or bucket policy). Object ownership / ACLs after a cross-account upload. If you only remember one thing: an explicit Deny anywhere in the chain always beats an Allow . Start by finding a deny, then work down the list. Step 0: Confirm which identity is actually making the request Before touching any policy, confirm who you are. Most "but I have admin" cases are the wrong principal. aws sts get-caller-identity Check the Arn in the output. If it is a role you did not expect (an EC2 instance profile, a CI role, an assumed role), you have been debugging the wrong identity's permissions the whole time. This single command saves more time than any other step. Step 1: Does the IAM identity policy allow the action? S3 needs the specific action for the specific resource. The two resource types trip people up: Bucket-level actions ( s3:ListBucket , s3:GetBucketLocation ) target the bucket ARN: arn:aws:s3:::my-bucket Obj

MCP (Model Context Protocol) is how AI agents connect to tools. Claude Desktop uses it, Cursor uses it, and thousands of developers are building MCP servers to give AI access to their APIs, databases, and infrastructure. There's one problem: MCP has no security model. The protocol defines how a client talks to a server, but says nothing about what that server is allowed to do. No authentication between client and server. No authorization on which tools can be called. No audit trail of what happened. The spec assumes you'll handle all of that yourself. Most people don't. What Actually Goes Wrong I run a self-hosted server with Prometheus, Grafana, Ollama, Gitea, and a handful of other services. I wanted Claude Desktop to query all of them through MCP. The standard approach is to write a Python FastMCP server for each one — a few dozen lines per service, hardcode the API key, register the tools, done. That works until you think about what you've actually built: Every MCP server has full access to whatever its process can reach. Your Prometheus tool can also hit your Grafana API, your Gitea API, and anything else on localhost. There's no scoping. API keys live in environment variables or config files. If you have 9 MCP servers, you have 9 places where credentials sit in plaintext with no access policy. Nothing is logged. If Claude calls a tool that restarts a service or deletes data, there's no record of which tool was called, with what parameters, by which agent, at what time. There's no concept of read-only vs. write. A tool either exists or it doesn't. MCP doesn't know that query_prometheus is safe to call freely but restart_service should require approval. Tool composition creates emergent risks. When Claude has access to multiple MCP servers, it can chain calls across them. Server A reads sensitive data, Server B posts to an external API — Claude could combine them in ways neither server was designed for. These aren't theoretical risks. During development, I decla