标签：#SEC

Every developer I know now runs an AI coding agent in something like auto-accept mode. Claude Code, Codex, Cursor: you give it a task, it runs commands, edits files, installs packages, and you review... the diff, maybe. The commands? The installs? The thing it did in that folder outside the repo? Nobody looks. The activity scrolls off the terminal and is gone. That asymmetry bothered me. We built an entire industry around audit trails for humans (git blame, CI logs, access logs), then handed the keyboard to agents and kept none for them. So I built Tracon: a local flight recorder for AI coding agents. The name is the FAA's term for Terminal Radar Approach Control, the radar room that tracks every aircraft in an airspace. This one tracks every agent on your machine. What it does Tracon is a Mac and Windows desktop app (Tauri 2, Rust core, React UI, SQLite store) that sits in the tray and records what your agents do: A timeline per session: every command, file edit, package install, and prompt, attributed to the agent and session that did it Danger flags as they happen: recursive deletes, pipe to shell installs, credential access, force pushes, permission bypasses. Tracon flags; it never blocks A Live page: one monitor per active session, like a security room, streaming recent commands with flagged ones highlighted in red, plus which subagents the session has spawned A conversation reader: the actual chat behind any event, read straight from the agent's own transcript, read only A package watch across npm, pnpm, pip, cargo, and brew, with opt in threat intelligence against osv.dev Capture is deliberately passive. Hooks give real time events over localhost; transcript tailing (filesystem notify, read only) covers everything else, so CLI sessions show up live even with zero setup. A dead or closed Tracon never slows an agent down. Everything stays on your machine: no telemetry, no accounts, AGPL. The recursive part Here is the part I find genuinely funny: Tracon was lar

Article Summary: This article argues that EDR evasion testing does not depend on access to a cloud management console. Instead, the core requirement is a reproducible test environment employing single-variable controlled experiments to pinpoint detection triggers. It introduces the open‑source Detonator framework for automated EDR testing, supporting CrowdStrike and other major EDRs. The methodology emphasises a snapshot‑per‑run and one‑variable‑per‑test approach, and the article also notes the availability of authorised EDR test tokens. Categories: Cybersecurity, Red Teaming, Security Tools Executive Summary This briefing addresses a common challenge faced by red team practitioners: testing a new loader against a CrowdStrike‑protected endpoint without access to the cloud‑based Falcon console. Many assume that the absence of logs renders testing futile. However, the author contends that the console provides only a conclusion (whether the sample was killed), whereas what the tester truly needs is the point of failure in the attack chain. By adopting a reproducible, single‑variable testing methodology—supported by the Detonator framework—one can systematically isolate the specific API call or technique that triggers detection, independent of console logs. This approach transforms debugging from a blind guessing game into a rigorous scientific process. Introduction Consider the following scenario: you have obtained a CrowdStrike endpoint with the sensor online and fully operational. You are ready to test a loader that you have been refining for three weeks. Then you realise— you have no cloud console . No logs, no detection strings, no rule triggers. The immediate reaction is often panic: "How can I test without visibility?" But the central thesis of this article is that the console is not as indispensable as it seems. The true value lies not in receiving a binary verdict, but in understanding where and why the detection occurred. The Console: A Mere Reporter of Result

An identity theft search site claimed to have more than 150 million driver's license photos stolen from an ID verification service. The crime site has now shut down.

I needed to automate Gumroad product creation — log in, create a product, set the price, upload a file, write the description, publish. Gumroad has no public API for this. The only option is browser automation. Here's what I had to get right, in order, and where each step breaks if you're not careful. The auth chain Step 1: Password reset The account had a password I didn't know. I triggered a reset from the login page. Gumroad sends a reset email with a link. The link expires fast — I don't know the exact TTL, but it was under 30 minutes. I used the AgentMail MCP to read the email and extract the reset link. The link is a Gumroad URL with a token parameter. Navigating to it shows a password reset form. Where it breaks: If you try to fill the new password field with input.value = 'newpassword' , React won't register the change. The form will submit with an empty password. You need to use the native value setter: const nativeSetter = Object . getOwnPropertyDescriptor ( HTMLInputElement . prototype , ' value ' ). set ; nativeSetter . call ( passwordInput , newPassword ); passwordInput . dispatchEvent ( new Event ( ' input ' , { bubbles : true })); This is because React overrides the value property on inputs with its own setter that tracks changes via a value tracker. The native setter bypasses React's tracker, and the input event tells React to sync state. Step 2: Two-factor authentication After password reset, logging in triggers 2FA. Gumroad's 2FA is email-based — not TOTP. There's no authenticator app. They email you a 6-digit token. The token appears in the email subject line: "Your authentication token is 126874" . This is convenient — you don't need to parse the email body. Just grab the subject, regex out the digits. const subject = " Your authentication token is 126874 " ; const token = subject . match ( /token is (\d + ) / )?.[ 1 ]; // "126874" Where it breaks: The email takes 5-15 seconds to arrive. If you check the inbox immediately after submitting the log

Trump’s secret reviews of frontier AI models may hide corruption, lawsuit says.

The source could be an ID verification service in Louisiana, though the FBI has opened an investigation.

TVL Trend Analysis & Liquidity Risk Assessment: Gate Target Protocol : Gate (TVL: $6646.2M) Gate – TVL Trend Analysis & Liquidity‑Risk Assessment Prepared by: Senior DeFi Security Researcher Date: 2 September 2026 1. Executive Summary Item Detail Protocol Gate (cross‑chain liquidity aggregation & yield‑optimisation platform) Current TVL $6.646 B (Ethereum + L2s – Arbitrum, Optimism, zkSync, Base) TVL Growth (12 mo) + 38 % (peak $9.1 B → current $6.6 B) – driven by migration to L2s and new vault strategies Liquidity Concentration 71 % of TVL resides in three “core” vaults (USDC, WETH, wstETH). The remaining 29 % is spread across 18 smaller pools. Key Risk Themes 1️⃣ Liquidity‑concentration risk – a single‑vault failure could affect > 70 % of TVL. 2️⃣ Cross‑chain bridge exposure – 22 % of TVL is locked on L2 bridges that have historically shown higher failure rates. 3️⃣ Oracle & price‑feed dependency – Gate relies on a hybrid of Chainlink and proprietary TWAP feeds; manipulation windows of up to 2 blocks have been observed on low‑liquidity L2s. 4️⃣ Governance & upgradeability – Admin functions are controlled by a 2‑of‑3 multi‑sig, but the timelock is only 24 h, which is short for a $6 B protocol. Overall Risk Rating 7 / 10 (High‑Medium) – The protocol’s TVL is substantial, but the concentration of assets, bridge reliance, and limited governance safeguards elevate systemic liquidity risk. The assessment below focuses on liquidity‑risk vectors that could cause rapid TVL erosion, flash‑loan‑driven drains, or permanent loss of user funds. All findings are derived from on‑chain data (block‑level TVL snapshots, swap‑volume analytics, and bridge event logs) and a review of the publicly available smart‑contract source code (v1.4.3, audited by CertiK – 2023). 2. Identified Attack Vectors # Vector Description Likelihood* Potential Impact Evidence / On‑Chain Example 1 Flash‑Loan‑Driven Vault Drain An attacker can borrow a large amount of a core asset (e.g., USDC) via a flash loa

HiddenLayer has raised a $100M Series B from Delta-v Capital, Ten Eleven Ventures, Morgan Stanley, Microsoft's M12, Booz Allen Hamilton, and others.

The Nordic country says wearable camera headsets need to be regulated given their privacy risks.

What can we learn from a BGP hijacking that poisoned production software? Plenty.

Every field above is part of the contract enforced by publisher validate . This post exists so the pipeline always has something real to plan against. Why tool-calling changes the threat model A language model that only emits text has one output channel: the reply. A model that can call tools has as many output channels as it has tools, and each of them is reachable by anything that can get text into the context window — a fetched page, a code comment, a file name, a CI log. The useful framing is that the context window is an untrusted input, and every tool is a sink . Prompt injection is not a new vulnerability class so much as a confused-deputy problem wearing a new hat. Three questions per tool For each tool exposed to a model, write down: What does it read? A tool that reads secrets turns any injection into an exfiltration primitive, whether or not the model "intends" it. What does it change? Distinguish reversible writes from irreversible ones. Deleting a branch and deleting a production table sit in different buckets. Who authorised it? Authority should ride with the request, not with the agent process. An agent running as a service account is an agent with the union of every user's permissions. A minimal mitigation set Scope credentials per invocation, not per deployment. Make irreversible tools require an out-of-band confirmation that the model cannot itself produce. Log the full tool-call payload, not a summary. The summary is written by the thing you are investigating. None of this is exotic. It is ordinary least-privilege design applied to a component that happens to take instructions from strangers.

Cyber Security and Cloud Computing are consistently named among the top-paying, highest-demand IT career tracks for 2026 — and they’re also deeply connected, which is exactly what makes choosing between them confusing for freshers. Most cloud roles require security awareness, and most modern security roles require solid cloud knowledge. So the real question isn’t “which field is better” — it’s which one should be your primary specialization, with the other as a supporting skill. Here’s a practical roadmap to help you decide. What Each Field Actually Involves Day to Day Cloud Computing professionals design, deploy, and manage infrastructure on platforms like AWS, Azure, or Google Cloud. Day-to-day work includes provisioning servers, managing storage and networking, setting up CI/CD pipelines, and optimizing costs and performance. It’s closely tied to DevOps practices — automation, containers (Docker, Kubernetes), and infrastructure-as-code. Cyber Security professionals protect systems, networks, and data from unauthorized access and attacks. Entry-level work often starts in a Security Operations Center (SOC), monitoring alerts, investigating incidents, and managing tools like firewalls, SIEM platforms, and vulnerability scanners. It branches later into specializations like penetration testing, cloud security, or governance and compliance. Skill Overlap vs Skill Divergence They share a foundation: networking fundamentals, operating systems (especially Linux), and increasingly, cloud platform basics — since most organizations now run infrastructure on AWS, Azure, or GCP rather than fully on-premises. Where they diverge: Cloud Computing leans toward building and automating — you’re constructing and scaling systems. Cyber Security leans toward defending and investigating — you’re protecting what’s already built and reacting to threats against it. If you enjoy building things and seeing systems run efficiently, cloud tends to be the more natural fit. If you enjoy problem-

Cloudflare has added optional OAuth scopes, letting client owners mark which permissions users may deselect at consent. The company names MCP servers as the motivating case, since agents request the union of everything they might do. Partial consent exists elsewhere, but developer control over which scopes are droppable does not. By Steef-Jan Wiggers

Microsoft is getting ready to roll out its memory integrity security feature of Windows 11 to more devices next month. The kernel-level protection feature is designed to stop malicious code or drivers running on a Windows 11 machine, but Microsoft previously warned it can also impact PC gaming performance. "Windows quality updates will begin enabling […]

Security controls in AI systems often end up duplicated across applications. One team adds prompt validation, secrets detection, PII filtering, authentication, logging, and rate limits to an LLM application. A second team builds similar controls around another provider. Once agents enter the mix, the organization has several implementations of policies that should be shared. An AI gateway provides a central place to enforce those controls. Traditional infrastructure already centralizes TLS termination, authentication, rate limiting, traffic routing, and observability instead of rebuilding them in every microservice. The same pattern applies to AI traffic. What is an AI gateway? Without a gateway: +--> OpenAI Application -------+--> Anthropic +--> Gemini With a gateway: Applications | v +-------------------------+ | AI Gateway | | | | Authentication | | Rate limits | | Guardrails | | Routing | | Logging / observability | +------------+------------+ | +------+------+ | | | v v v OpenAI Anthropic Gemini Products in this space include Bifrost , Kong AI Gateway , LiteLLM , and Cloudflare AI Gateway . Their feature sets differ, but each can route model traffic through a common control layer. Security policy can run at that layer before traffic reaches a provider. Why application-level guardrails become painful To prevent users from accidentally sending credentials to an LLM, a simple implementation might look like this: def ask_llm ( prompt ): if contains_secret ( prompt ): raise SecurityError ( " Potential secret detected " ) return llm . chat ( prompt ) For one application, this is reasonable. Across 30 services, enforcement starts to drift. Some services call OpenAI directly, others use Anthropic, and several teams maintain their own wrappers. One application omits the secret check, another uses an old version, and a third checks prompts but no other AI interactions. Policy enforcement now depends on convention. Moving enforcement to the gateway changes the model: Requ

Imagine a website where users can post comments. Someone submits this as their comment: <script> alert ( " Hello " ); </script> If the application takes that input and places it directly into the HTML it serves to other users, the browser doesn't see a comment. It sees a script tag. The vulnerability isn't that JavaScript exists on the page. JavaScript belongs on web pages. The problem is that untrusted user input ended up in a context where the browser interpreted it as executable content rather than inert text. The Core Problem A browser rendering a webpage doesn't distinguish between HTML the developer wrote and HTML that arrived through a comment field. It parses what it's given. If user input gets embedded into the page without being handled carefully, the browser processes it the same way it processes everything else. User Input ↓ Web Application ↓ HTML / DOM ↓ Browser ↓ Input interpreted as executable content Untrusted data should remain data. XSS occurs when the application allows that data to cross into a context where the browser interprets it as code or executable markup. The boundary between "string containing angle brackets" and "HTML the browser will parse" is where the vulnerability lives. Three Forms of XSS XSS shows up in a few different ways depending on where the injection happens and how the input travels. Stored XSS is when untrusted input gets saved to a database and later served to other users. The comment example above is stored XSS. An attacker submits input once, and every user who views that page subsequently receives it. The application acts as an unwitting distribution mechanism. Reflected XSS involves input that isn't stored but gets reflected back in an immediate server response. Search pages are a common example: if a query is echoed into the page as "You searched for: [query]" and the query isn't handled carefully, an attacker can craft a URL whose query parameter contains a payload. When another user visits that URL, the server refl

developer context switching security DevSecOps flow state developer velocity security alerts batch security patching ROI cost of context switching developer productivity security security alert fatigue developer cognitive load ad-hoc security patching interrupting developer flow engineering vp productivity metrics DevSecOps velocity context switching recovery time 23 minute recovery context switch batching security alerts SLA-backed fix campaigns security SLA for developers minimizing context switching feature delivery vs security developer experience DevSecOps The Real Cost of Context Switching What Security Alerts Actually Do to Developer Flow Back to blog What interruptions actually cost Is it worse for developers specifically? The research says probably yes The alert volume isn't imaginary — but be careful which numbers you cite The fix: batch the routine work, protect the calendar The important exception: not everything can wait for the batch A more honest way to estimate the ROI The takeaway Sources The Real Cost of Context Switching: What Security Alerts Actually Do to Developer Flow Companies keep investing in better frameworks, tighter deployment gates, and broader platform suites — and feature delivery keeps getting slower anyway. For engineering leaders trying to explain that paradox to the board, the usual suspects (headcount, tooling, talent) rarely hold up. The more useful place to look is something less visible: how often developers get pulled out of what they're doing, and what it costs them to get back in. As "shift-left" security practices spread, developers absorb a steady stream of vulnerability alerts, automated pull-request comments, and one-off Jira tickets throughout the day. The goal — a more secure codebase — is the right one. The delivery mechanism is often the problem. Scattering fixes across random moments in the workday erodes productivity without necessarily making the codebase safer any faster. The alternative a growing number of engi

Pessoal, eu quase mandei uma lista de 23 "vulnerabilidades" pra mantenedores de código aberto. XSS, CORS, CSP, um SVG suspeito. O modelo tinha devolvido volume. Eu sentia que tinha trabalhado. Aí parei. Se eu fosse o cara do outro lado da issue, eu levaria isso a sério? A conta virou quando eu parei de pedir "audita meu código". Passei a escrever o contrato antes de abrir o repo. Direção (o que o modelo pode afirmar) e disciplina (o que ele não pode). Isso não deixa o LLM mais inteligente. Controla o comportamento. Em segurança, isso é o que separa auditoria de lista. O que você leva daqui: o contrato (esqueleto), por que o scanner não substitui hunt, e as três portas pra não colar relatório no tracker. Os repos no meio são prova. Não são o ponto. Tabela de Conteúdo 1. Direção e disciplina não deixam o modelo mais inteligente 2. O scanner vê o que está. O hunt vê o que falta 3. Silêncio também é resultado 4. As três portas 5. O que você monta amanhã 1. Direção e disciplina não deixam o modelo mais inteligente Esse é o ponto que eu demorei pra aceitar. O modelo já conhece OWASP. O que muda é o que ele tem permissão de afirmar. Sem isso, "audita meu código" devolve XSS fantasma, CORS, CSP, um SVG. Volume. A pergunta de segurança some: disto aqui, o que vira issue, o que vai pro e-mail privado, o que é silêncio? Direção amarra três coisas antes da leitura: Padrão externo. OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante em uma frase, falsificável. "Webhooks deveriam ser autenticados" é opinião. "Todo handler de webhook de entrada verifica autenticidade do remetente antes de mutar estado" é hunt. Formato único. Finding, observação e hipótese não misturam. Disciplina é o que corta o teatro. O texto que o modelo vê antes de abrir arquivo: Padrão: OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante: uma frase, falsificável. Relatório: finding, observação e hipótese não misturam. Sem arquivo:linha → não é finding. CWE inv

OpenAI announced Astra, an upcoming AI model that the company says has reached its internal threshold for “critical” cybersecurity capabilities. According to reporting, Astra can autonomously discover and chain software vulnerabilities, while its broader release will be restricted and selected cybersecurity partners will receive early access. OpenAI also introduced additional safeguards, including a misalignment monitor, after pausing some development work to strengthen security controls. Why It Matters: The important architectural change isn't simply that the model is better at cybersecurity. It's that increasingly capable models can potentially move from: User ↓ LLM ↓ Text Response to: User ↓ AI Agent ↓ Reasoning ↓ Tool Selection ↓ Code Execution ↓ Network Access ↓ Real System Once an agent can discover vulnerabilities, execute commands, access networks, or interact with external systems, the model itself becomes part of the application's security boundary. That changes how we should design agentic applications. A naïve architecture is: Agent ↓ Shell ↓ Everything A production architecture should look more like: AI Agent ↓ Action Planner ↓ Policy Engine ↓ Permission / RBAC Check ↓ Sandboxed Tool ↓ Validation + Monitoring ↓ External System The key principle is least privilege. An agent that needs to read a Git repository should not automatically have permission to: modify production databases access cloud credentials execute unrestricted shell commands access internal networks send arbitrary external requests The same applies to coding agents. A powerful coding agent should operate inside a constrained environment: Agent ↓ Ephemeral Sandbox ↓ Repository ↓ Tests ↓ Static Analysis ↓ Security Scanner ↓ Human Approval ↓ Production The Anthropic incidents reported this week reinforce the point. Anthropic disclosed operational security failures involving Claude accessing external systems during testing and subsequently introduced stronger isolation, monitoring, and contro

Flash Loan Attack Vector Analysis: PancakeSwap AMM Target Protocol : PancakeSwap AMM (TVL: $1859.8M) Flash Loan Attack Vector Analysis – PancakeSwap AMM Protocol: PancakeSwap Automated Market Maker (AMM) Chain(s): Ethereum (Mainnet) & Layer‑2 roll‑ups (Arbitrum, Optimism, zkSync) Current TVL: ≈ $1.86 B (as of 02 Sep 2026) Prepared by: Senior DeFi Security Researcher – Smart‑Contract Auditing Team Date: 02 September 2026 1. Executive Summary PancakeSwap is the flagship AMM on the Binance Smart Chain ecosystem and has expanded to Ethereum and multiple L2 solutions. Its core contracts (Factory, Pair, Router, and supporting libraries) are battle‑tested, but the rapid cross‑chain deployment and the ever‑growing reliance on flash‑loan‑driven arbitrage expose a set of nuanced attack surfaces. Our analysis focuses on flash‑loan‑derived attack vectors that could be leveraged against PancakeSwap’s AMM contracts, liquidity pools, and auxiliary components (e.g., staking farms, lottery, and NFT marketplaces). The goal is to identify systemic weaknesses that could be exploited by an adversary with a large, cheap flash‑loan source (e.g., Aave, dYdX, Uniswap V3, or native L2 flash‑loan primitives). Key findings: # Attack Vector Likelihood Potential Impact Overall Risk 1 Manipulation of price oracle via flash‑loan‑driven swap‑sandwich (direct AMM price) Medium‑High (requires > $10 M flash loan) Temporary price distortion → profitable arbitrage, slippage‑driven liquidation of leveraged positions on downstream protocols 7 2 Flash‑loan‑driven liquidity‑drain & re‑add (Liquidity‑Pump‑Dump) Low‑Medium (requires coordinated pool‑specific attack) Short‑term loss of pool depth, front‑running of large trades, possible token‑price manipulation 5 3 Re‑entrancy via malicious token callbacks in swap / addLiquidity (ERC‑777 / ERC‑4626) Low (protected by nonReentrant in core contracts) Drain of pool reserves if a new token bypasses the safeTransfer guard 4 4 Flash‑loan‑driven “price‑oracle” manipu