标签：#Security

AI-Powered Privacy Policy Generators LLM‑driven privacy policy generators have moved from experimental prototypes to production‑grade services in 2026, offering on‑demand, jurisdiction‑aware drafts that can be directly embedded into compliance pipelines. Tools such as PrivacyGPT and PolicyCraft combine retrieval‑augmented generation with rule‑extraction models, turning natural‑language privacy intents into enforceable policy clauses that can be exported as JSON‑LD or plain‑text templates. Deep Dive Architecture PrivacyGPT leverages a hybrid architecture: a domain‑specific transformer fine‑tuned on 10 million privacy statements, paired with a deterministic rule engine that maps extracted obligations to GDPR, CCPA, and emerging AI‑Act provisions. PolicyCraft adds a feedback loop where the generated draft is automatically validated against an internal compliance knowledge graph; mismatches trigger a self‑correcting prompt that iteratively refines the text until a confidence score above 92 % is achieved. Real-World Engineering Examples A fintech startup integrated PrivacyGPT via its CI/CD pipeline; each pull request that modifies data‑collection code triggers an API call that updates the “Data Retention” clause, keeping the public policy in sync with code changes. A multinational e‑commerce platform deployed PolicyCraft to generate locale‑specific consent banners; the system produced 27 variants in under five minutes, each certified against the EU’s Digital Services Act. Zero‑Trust Architecture for Rule Enforcement Zero‑trust architecture (ZTA) starts from the assumption that no network segment—whether on‑prem, cloud, or edge—can be implicitly trusted. Instead of a perimeter, every request is evaluated against a continuously refreshed identity profile that fuses user credentials, device posture, and behavioral risk scores. In practice, this means deploying a Policy Decision Point (PDP) that consumes attributes from an identity provider, a device‑trust service, and a tel

If you're wiring MCP servers into an agent and want to check them for prompt injection, tool poisoning, or supply-chain risk before you trust them, there are now a handful of open-source options. This is a factual, no-benchmarks comparison of the three I could actually find and read the docs for: our own sentinel-scan-cli , Cisco's mcp-scanner , and what used to be Invariant Labs' mcp-scan . One thing worth flagging up front: Invariant Labs' mcp-scan repo ( github.com/invariantlabs-ai/mcp-scan ) now redirects to github.com/snyk/agent-scan . The project has been absorbed into Snyk and rebranded as "Agent Scan" (package snyk-agent-scan ). If you're comparing tools based on older blog posts that reference "Invariant Labs mcp-scan" as a standalone, no-account CLI, that's out of date — running it now requires a free Snyk account and an SNYK_TOKEN API key ( export SNYK_TOKEN=... ) before the CLI will scan anything. I'm comparing against the current Snyk Agent Scan README since that's what the repo actually ships today. All claims below are pulled directly from each project's public README as of 2026-08-24. No invented features, no synthetic benchmarks — this is a "what does the doc actually say" comparison, not a lab test. Feature comparison sentinel-scan-cli Cisco mcp-scanner Snyk Agent Scan (fka Invariant Labs mcp-scan) License MIT Apache 2.0 source-available on GitHub; requires Snyk account/token to run Install zero dependencies, single Python file or pip install / npx github:... uv tool install , Python 3.11+ uvx snyk-agent-scan or standalone binary Signup / API key required to run at all No ( --demo needs nothing; scanning your own endpoint needs only your own endpoint's key) No (core YARA/static scanning works with zero keys; LLM/Cisco AI Defense/VirusTotal analyzers are opt-in extras) Yes — Snyk account + SNYK_TOKEN required before any scan runs What it scans Live LLM endpoint (prompt-injection/jailbreak suite) and static MCP tool manifests ( mcp.json ) Live MCP se

1. Basic Information Article Title : The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile Publisher : Zimperium zLabs Publication Date : 2026-08-19 Update Date : None Severity : high Original Source : Zimperium zLabs Related Sources : Zimperium IOC repository , ToxicPanda Android malware uses VPN permissions to block Google Play , Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight Related Entities : malware: ToxicPanda 2.0 groups: Not specified in public reports cves: None products: Android 11 and later, Android Accessibility Service, Wireless Debugging, Android Debug Bridge (ADB), Google Play, Google Play Services, Amazon Web Services (AWS-hosted buckets) 2. Executive Summary ToxicPanda 2.0 is an Android banking malware. It uses fake installation screens to gain VPN and Accessibility permissions. Then, it automatically operates Android settings to connect to the local ADB daemon. Without rooting the device, it uses shell privileges to change settings and add persistence. Finally, it steals financial information using Accessibility and fake screens or overlays. 3. Attack Flow 1. Distribution and Initial Setup The attacker uses Amazon Web Services storage to distribute ToxicPanda 2.0 samples. The specific method to trick users into downloading the file is not public. The dropper shows a fake installation screen and asks the user to allow an Android VPN connection. After permission is granted, the local VPN blocks network traffic to Google Play and Google Play Services. The dropper decrypts and installs an encrypted payload from its assets, then asks the user to enable the Accessibility Service. 2. Exploiting Wireless Debugging and ADB The Accessibility Service reads the Android settings screen. If Developer Options are disabled, it automatically taps "Build number" seven times to enable them. It goes to the Wireless Debugging screen, enables the feature, and opens "Pair device with pairing code." It uses Accessibility to rea

Cloudflare recently open-sourced Cloudflare OS. It allows enterprise teams to output work artifacts grounded in enterprise knowledge, know-how, and provisioned connectors, automate repetitive workflows with optimized token cost (with AI assistance only where needed), and build personal, shareable, customizable work software that caters to specific, complex use cases within a secure sandboxed model By Bruno Couriol

Quick one: if PyRIT (Microsoft's Python Risk Identification Tool) is on your shortlist for LLM red-teaming, check the repo first. Azure/PyRIT was archived on GitHub on March 27, 2026. It's read-only now: no commits, no releases, no issue triage, nothing. Whatever version you pip-installed is the last version you'll ever get. That matters more for PyRIT than it would for most tools, because PyRIT was never a turnkey scanner. It's a framework for scripting multi-turn attack orchestration, the kind of thing a red team builds custom attack sequences on top of. A framework that's stopped shipping fixes is a worse foundation to build on than a finished tool that's stopped shipping features, because you were relying on it staying flexible to your needs, and now it can't. So what do you use instead? Depends on what you were actually using PyRIT for: You wanted a broad, actively maintained app-layer scanner -> promptfoo . Zero-install via npx promptfoo , 50+ red-team plugins, OWASP/NIST/MITRE ATLAS report mappings, and it's still getting regular releases. You wanted model-layer testing (jailbreaks, encoding tricks, data leakage on the base model itself, not your app) -> garak . NVIDIA-maintained, pip installable, 8k+ stars, actively developed. You wanted OWASP-mapped detectors and don't mind a paid tier for continuous scanning -> Giskard . The open source scanner is real and current; the always-on Hub is commercial. You wanted a fast, zero-setup smoke test before reaching for any of the above -> that's the gap we built sentinel-scan-cli for. Dependency-free CLI (Python and npm ports, identical output), 15 attack patterns each tagged to its OWASP LLM Top 10 category, --demo runs with no config and no API keys in under a minute. None of these replace PyRIT's specific multi-turn orchestration model one-for-one, if that's genuinely what you need, Microsoft's PyRIT Community fork discussion or building your own harness on top of a maintained model API is probably the honest answe

Envelope encryption con clave por usuario, qué se cifra y qué no, cómo lo puso a prueba una auditoría externa, y el incidente de rendimiento que provocó nuestro propio hardening de seguridad. Montaste tu app con IA rápido: le pides unos datos al usuario, llamas al modelo, guardas el resultado en la base de datos y a producción. Cómodo, sin complicaciones. Hasta que un día miras bien qué estás guardando. En Cuentopia generamos cuentos personalizados para niños. Para personalizar, un padre nos cuenta cómo es su peque: su carácter, qué le da miedo, qué está pasando en casa. El modelo no improvisa sobre la marcha: se apoya en un marco de criterios clínicos y pedagógicos para decidir cómo abordar cada situación, y luego lo reescribe todo en prosa. Visto de golpe, lo que teníamos en la base de datos era el diario emocional de un montón de menores. El RGPD lo trata como categoría especialmente protegida. El sentido común, también. ¿Y si se filtra la base de datos? ¿Y un backup mal guardado? ¿Y un acceso indebido con privilegios de admin? Relájate —bueno, primero asústate un poco; luego relájate—. Te voy a contar cómo pensamos el cifrado en reposo en serio: una arquitectura de tipo envelope encryption , con una clave maestra que no sale nunca de Cloud KMS (Google Cloud) y una clave por usuario que cifra los campos sensibles antes de que toquen la base de datos. Un aviso antes de seguir: te cuento el criterio y las decisiones, no el plano. No vas a encontrar aquí nombres de recursos, rutas de repositorio, ni el detalle exacto que le serviría de receta a alguien con ganas de probar suerte con nuestros datos. Y porque la seguridad honesta se cuenta entera, también te cuento dónde decidimos no llegar y por qué. ✨ Promesa: al terminar vas a entender, con criterio real de producto, cómo una familia sin ser expertos en cripto se planteó cifrar datos de menores — y por qué ciertas decisiones muy concretas no se hacen públicas nunca, ni en el artículo más honesto. El mapa Lo constru

Overview The box ships a mostly-stock WordPress 7.0.0 install on PHP 8.2 / Apache, running on a Debian Trixie base image, packaged as a Docker/Kubernetes challenge deployment. Initial access comes through a deliberately vulnerable plugin ( wp2shell ) that hands over a www-data shell. Privilege escalation is the real puzzle: the box is hardened against the usual container-escape and SUID tricks, and the intended path is a real, recent CVE in sudo itself. Recon The challenge source was distributed as a zip ( boot2root_wordpressed-to-root.zip ) containing the Docker build context: . ├── docker │ ├── entrypoint.sh │ ├── install.php │ └── seed.php ├── docker-compose.yml ├── Dockerfile └── theme └── brunnerne-docs ├── footer.php ├── functions.php ├── header.php ├── index.php └── style.css Dockerfile pins the interesting versions: FROM wordpress:7.0.0-php8.2-apache@sha256:0b6e5bf0ed2518696a34ba3812370743b0ad3e2676882967ff5c712e51425c03 AS wordpress-source FROM debian:trixie-20240408-slim@sha256:70955dce615f114142818e95339f6ae9b461cf424d79d59ca2b04ec725d4dbc8 ... apache2 ca-certificates curl gcc libc6-dev libapache2-mod-php8.2 \ php8.2 php8.2-curl php8.2-gd php8.2-mbstring php8.2-mysql php8.2-xml php8.2-zip sudo Two details stand out immediately: gcc and libc6-dev are installed in the runtime image, not just a build stage. That is a strong hint that compiling a local privilege-escalation PoC on-box is part of the intended path. sudo is installed, which combined with the previous point points straight at a sudo local-root bug rather than a container escape. docker-compose.yml also leaks the DB credentials up front (default WordPress dev creds - not the actual privesc path, but useful context): MARIADB_DATABASE : wordpress MARIADB_USER : wordpress MARIADB_PASSWORD : wordpress MARIADB_ROOT_PASSWORD : rootpassword docker/entrypoint.sh is the key file for understanding the box's behavior at runtime. On first boot it generates a random WordPress admin account and exports the cred

If you’ve ever built an Express API, you’ve probably reached for standard rate-limiting middleware to protect your login or payment endpoints from DDoS and brute-force attacks. Under the hood, most simple limiters use a Fixed-Window Counter . It’s easy to write: count incoming requests, and once the minute rolls over, reset the counter to zero. However, from a security and algorithmic standpoint, Fixed-Window counters have a massive blind spot. The Boundary Vulnerability (The 2-Second Spike) Imagine your endpoint allows a maximum of 100 requests per minute , resetting every full minute on the clock ( :00 ). Here is how an attacker bypasses that limit without breaking your rules: At 12:00:59 , the attacker fires 100 requests. (Allowed: 100/100 used). At 12:01:00 , the clock resets your counter back to 0. At 12:01:01 , the attacker fires another 100 requests. (Allowed: 100/100 used). To your server code, everything looks fine. But in reality, 200 requests slammed your backend within a 2-second window. In FinTech or authentication systems, that burst is more than enough to overwhelm payment gateways or run a successful credential-stuffing attack. The Algorithmic Fix: Sliding Window Counter To stop boundary spikes, we need a continuously sliding window rather than a rigid clock reset. Attempt 1: The Sliding Window Log (High Memory) You store a timestamps array (a Deque) for every user request and drop timestamps older than 60 seconds. While accurate, storing every single request timestamp takes $O(N)$ space. If your API receives millions of requests, your server memory dies instantly. Attempt 2: Sliding Window Counter (Optimal O(1) Math) Instead of keeping thousands of timestamps, we track only two integers : the request count of the previous window and the count of the current window . When a request arrives, we calculate an estimated request count by weighting the previous window based on how much time has passed in the current window: Estimated Requests = Current Cou

Security researcher Christopher Domas developed skitter-creek-bath-salts, an open-source hardware security tool that disrupts CPU privilege boundaries by manipulating memory controller translation registers. This allows unprivileged software to access protected memory regions, revealing a vulnerability in modern processor architectures that could affect cloud and confidential computing security. By Olimpiu Pop

mcp-drift-monitor detecta cambios no autorizados en servidores MCP (Model Context Protocol). Implementa el control primario faltante descrito en arXiv:2608.00997 : un barrido completo periódico del catálogo que re-descarga todos los servidores y recomputa hashes. Problema arXiv:2608.00997 ( MCP Registry Drift: A 88.6-Day Measurement of 19,099 Servers ) reporta un punto ciego crítico: los enfoques tradicionales de detección de cambios fallan en identificar dos modos de fallo: Cambios silenciosos — un servidor cuyo hash de descripción cambia, pero el monitor ya lo conocía y lo rankinga por historial pasado. Nuevas adiciones — servidores que aparecen en el registro sin que el monitor tenga registro previo. El paper mide 15,845 eventos de cambio, 19,877 adiciones y 911 eliminaciones, pero los modelos que rankean por historial previo pierden una fracción significativa de estos eventos. Este monitor cierra esa brecha con el control primario que el paper propone pero no implementa: un full-catalog sweep periódico. Solución mcp-drift-monitor implementa un motor de diferencias único ( compute_events ) que sirve tanto para polling incremental como para barridos completos. No hay lógica duplicada. Cada vez que un hash de descripción cambia, el motor revalida el contenido ( len(drifts) > 0 es el único disparador). Si el registro responde 429, aplica backoff con Retry-After . Si el payload está malformado, lanza SchemaDriftError y registra el payload ofensor a nivel ERROR. Arquitectura core/ diff.py — CatalogEntry, DriftEvent, NewArrivalEvent, RemovalEvent, compute_events hasher.py — normalize_description (NFC), hash_description state.py — StateStore (sqlite), FetchStatus, removed flag, get_all_hashes poller.py — Poller.fetch_catalog, PollConfig, SchemaDriftError, backoff sweep.py — run_sweep (control primario), SweepReport calibrate.py — replay (FR-6), ReplayReport, external validity vs panel Resultados de calibración El monitor se calibró y verificó contra el panel real del pa

A new study finds leading AI labs have few publicly documented plans for containing rogue models, raising questions about preparedness as AI systems increasingly demonstrate unexpected and potentially dangerous behavior.

Your prompt can ask a model what it is. Your production system should not trust the answer. A model can say it is GPT, Claude, Gemini, Llama, Qwen, or anything else. That does not prove what is behind the endpoint. A gateway can route requests silently. A provider can change a default model. A fallback can trigger during an outage. A proxy can strip metadata. A fine-tune can imitate another model's tone. Even honest teams can ship the wrong route because an environment variable, tenant flag, or retry rule changed. For a casual chatbot, that might be annoying. For an AI product with user-facing answers, tool calls, cost controls, compliance promises, and eval gates, it is a production risk. That is where LLM model fingerprinting helps. The goal is not to magically identify every model on earth. The goal is simpler and more useful: build a small verification harness that checks whether the endpoint behaves like the model, runtime, and policy you expected before you trust it with customer workflows. Why model identity became a production problem AI builders used to call one model directly. Now a typical stack may include: an LLM gateway model routing by task type cheaper fallback models regional endpoints self-hosted open-weight models vendor proxies MCP tools RAG pipelines structured output validation tenant-specific policies That flexibility is useful, but it creates a new question: How do you know the model you evaluated is the model your users are getting? A label in a config file is not enough. A response that says, "I am Model X," is not enough. Prompt-based identification is weak because model behavior is flexible. System prompts, fine-tunes, wrappers, and style instructions can change how a model describes itself. Infrastructure artifacts are harder to fake. Token counts, chat-template overhead, validation errors, context limits, stream behavior, tool-call formatting, and latency profiles tend to reveal the serving path more reliably than conversational claims.

A webpage that just sits there, encrypted blob and all, waiting for an LLM agent to walk in and decrypt its own attack. That's the part of this one that should bother you more than the exfiltration itself. What happened Researchers at Adversa AI disclosed an attack technique called Cryptographic Context Injection, aimed at Grok, with a similar jailbreak variant shown against Gemini. The core idea: a malicious webpage embeds an encrypted payload. Grok's code execution runtime decrypts it as part of normal processing. Because the malicious instructions only exist in plaintext after decryption happens inside the execution environment, content classifiers scanning the page (or the request) never see anything to flag. There's no suspicious string sitting in the DOM. There's ciphertext. Once decrypted, the payload's instructions convince Grok to invoke its navigation tool and send the user's name, location, subscription tier, and chat history to an attacker-controlled URL. No malware. No exploit in the traditional sense. Just an agent doing exactly what it was told, by a source it had no business trusting. The write-up has zero HN points and zero comments as I write this, which is a little concerning given what it describes. This isn't a theoretical edge case, it's a working technique against a production model with tool-calling access to a browser. How the attack actually works Break it into three stages: Delivery. The victim's browser session includes an agent (Grok) with code execution and navigation tool access. The attacker doesn't need to compromise anything, they just need the agent to encounter their page. Decryption as obfuscation. The payload sits on the page encrypted. Grok's runtime, doing what it's built to do, decrypts it during execution. This is the clever part: encryption here isn't protecting the payload from the attacker, it's protecting it from the defender's classifiers. Static and even semantic content filters scanning page content pre-execution see

A router, an IP camera, an industrial controller: somewhere in that device's firmware there's a Linux kernel with modules, a handful of statically linked binaries, and a userspace built from a dozen open source components. You don't have the vendor's source tree. What you have is a .bin file, or after unpacking it, a pile of .ko , .o and stripped ELF binaries. The question you actually need answered is boring but important: is any of this running something with a known CVE? This comes up constantly in embedded and IoT work, and it's a different problem from auditing your own codebase. You're not hunting for a new bug, you're checking for old ones the vendor never patched. In practice that's the more common finding: not a novel zero-day, but a five-year-old OpenSSL or BusyBox build nobody was tracking. Unpack first, guess later binwalk is still the first move. Point it at the firmware image and let it scan for known magic bytes: SquashFS, CramFS, JFFS2, gzip streams, kernel headers. Most consumer and SOHO firmware is a bootloader plus a compressed filesystem, and binwalk's extraction mode gets you the actual filesystem tree instead of one opaque blob. Once you have that, you're auditing files, not guessing at a blob. Fingerprint by version string, not by hash Hash-matching binaries against known-vulnerable databases sounds appealing and mostly doesn't work here, because vendors relink, strip and sometimes patch without touching anything else. What works more often: grep the extracted binaries for version banners. strings on busybox , openssl , dropbear , lighttpd , zlib and similar userspace binaries usually still leaks a version string even when the binary is stripped of debug symbols, because those strings are compiled-in constants the program itself prints or logs, not debug metadata. strings <binary> | grep -iE "openssl|busybox|dropbear|zlib" is unglamorous and it's the single highest-signal step in this whole process. Cross-reference what you find Once you have

Plus: Apple sends out an “unprecedented” number of spyware warnings, Ukraine hits a Russian ecommerce giant with cyber and drone attacks, and more.

The cloud ecosystem in 2026 isn't just about moving VMs to the public cloud—it's heavily driven by hybrid operations, unified security telemetry, AI integration, and complex governance across multi-region architectures. As enterprise tech stacks evolve, Microsoft Azure certifications remain a primary yardstick for technical competence, but knowing which track to target is where most engineers get stuck. As someone who works closely with cloud certification blueprints and enterprise deployments, I wanted to map out where Microsoft credentials stand today, what the market actually demands, and how specific exams fit real-world scenarios. Market Trends: Why Azure Credentials Still Drive Real ROI in 2026 The value of certification has shifted from basic feature recognition to proving operational problem-solving under real constraints. Hands-on Scenario Focus: Exams increasingly test scenario-based trade-offs—balancing performance, cost, and strict security requirements rather than simple definition checks. Role-Based Specialization: Instead of broad, generic tracks, Microsoft continues to refine specialized pathways for developers, security analysts, and hybrid infrastructure specialists. Continuous Free Renewal: Earning the badge is step one, but maintaining active status requires passing annual, open-book renewal assessments directly through Microsoft Learn, ensuring skills don't stall out. Mapping Azure Exams to Real-World Enterprise Scenarios Depending on your daily engineering focus or career targets, here is how the core role-based tracks align with active projects: App Modernization & Cloud-Native Dev: AZ-204 (Azure Developer Associate) The Scenario: Refactoring monolithic legacy apps into containerized microservices using Azure App Service, Azure Functions, and Cosmos DB while setting up secure authentication via Microsoft Entra ID. Hybrid Infrastructure & Server Ops: AZ-800 (Administering Windows Server Hybrid Core Infrastructure) The Scenario: Managing mixed e

Cómo solucionar el error “Enable JavaScript and cookies to continue” Este mensaje aparece cuando Cloudflare (u otro proxy de seguridad similar) bloquea la solicitud porque detecta que el cliente no cumple con los requisitos mínimos de seguridad: JavaScript deshabilitado o cookies deshabilitadas/expiradas . 🔍 Causa técnica Cloudflare implementa mecanismos de protección como: JavaScript Challenge : El navegador debe ejecutar un script para demostrar que no es un bot. Cookie de verificación : Tras superar el desafío, Cloudflare emite una cookie ( __cf_bm o cf_clearance ) que valida la sesión. Si el cliente (navegador o cliente HTTP personalizado) no ejecuta JavaScript o no maneja cookies correctamente, la validación falla y se muestra este mensaje. ✅ Solución definitiva (por escenario) 🌐 Si eres un usuario final (navegador) Habilita JavaScript : Chrome: Configuración > Privacidad y seguridad > Sitios web no seguros > Habilitar JavaScript . Firefox: Preferencias > Privacidad y seguridad > Permisos > Habilitar JavaScript . Habilita cookies de terceros (si usas extensiones como uBlock Origin o Privacy Badger): Añade el dominio a la lista blanca. Desactiva temporalmente los bloqueadores para probar. Borra cookies y caché del dominio afectado. Reinicia el navegador y vuelve a cargar la página. 🧪 Si eres desarrollador (automatización / scraping / cliente HTTP) ❌ No uses requests o curl sin soporte JS/cookies → fallarán siempre . ✅ Opción recomendada: Usa un navegador headless con soporte JS y cookies # Ejemplo con Playwright (recomendado) from playwright.sync_api import sync_playwright with sync_playwright () as p : browser = p . chromium . launch ( headless = True ) context = browser . new_context () page = context . new_page () # Navega a la URL (Cloudflare se resolverá automáticamente) page . goto ( " https://ejemplo.com " , wait_until = " networkidle " ) # Si aún falla, fuerza espera tras el desafío try : page . wait_for_selector ( " #challenge-error-text " , timeout = 5

When I started GSoC in May, my plan was to build a runtime sandbox for community plugins. By week two my mentor had talked me out of it, and I ended up spending the rest of the summer building a review queue instead. This post is about how that happened and what I actually shipped. Quick summary Project: Community Driven Plugin Ecosystem for OWTF Org: OWASP Foundation Mentors: Abraham Aranguren, Viyat Bhalodia What got shipped: Six pull requests against owtf/owtf , around 6,000 lines of Python and TypeScript, 153 backend unit tests, and a trust model doc. Working mirror of this post: gist If you only want the code, here are all my PRs on OWTF . The problem I was trying to solve OWTF is a security testing framework, and until this summer its plugin catalogue was static. If you wrote a detection for some new attack pattern, your options were: open a PR against the framework itself (high bar, slow), or keep the plugin to yourself. Most useful plugins never made it upstream because of that. The Community Plugin Marketplace fixes this. Any authenticated user can upload a Python plugin through the web UI. The plugin is validated at upload time, lands in a pending queue, and waits for an admin to look at the source. Once approved, the plugin gets mirrored into OWTF's standard plugin table. From that point on, the runner, the worklist, and the report generator all treat it exactly like a built-in plugin. The pivot My accepted proposal called for a sandbox. Community plugins would run inside something like a subprocess with dropped privileges, so that a malicious plugin could not do too much damage. Then Viyat said this in Slack: A sandbox in Python that talks to the same postgres, the same file system, the same target scope as OWTF itself is not really a security boundary. I sat with that for a couple of days and realised he was right. A plugin that runs inside OWTF has to see the target, has to read config, has to write results. Any "sandbox" I put around that is going to

security, #api, #cybersecurity, #discuss On July 30, 2026, my batch job finished 300,000 domain-to-company lookups. 39,847 of them (13.3%) resolved to defense contractors, military-adjacent parent companies, or headquarters within a few miles of named bases. I wasn't hunting for that. I was just trying to clean a CRM. The same day, lina published a post about hijacking e164.arpa zones and accidentally logging hundreds of thousands of phone calls to military bases. Different protocol, same smell: an infrastructure lookup that was supposed to be boring turned into a classified-adjacent data spill. That parallel is what made me sit down and write this. Here is the exact call I used, with the live response for github.com so you can see the shape of the data before I explain what went wrong. import requests , json , time # Full source notes: https://github.com/On13uka/company-info-api RAPIDAPI_KEY = " YOUR_RAPIDAPI_KEY " BASE = " https://company-info1.p.rapidapi.com " def lookup ( domain ): r = requests . get ( f " { BASE } /lookup?domain= { domain } " , headers = { " X-RapidAPI-Key " : RAPIDAPI_KEY , " X-RapidAPI-Host " : " company-info1.p.rapidapi.com " }, timeout = 20 ) return r . json () print ( json . dumps ( lookup ( " github.com " ), indent = 2 )) The response I got back looked like this. It is a cached sample from a real call — the endpoint was asleep when I drafted this, but the fields are exactly what the pipeline consumed. { "domain" : "github.com" , "company_name" : "GitHub Inc" , "wikipedia" : "GitHub is a developer platform..." , "ceo" : "Thomas Dohmke" , "founded" : "2008" , "headquarters" : "San Francisco, California" , "employees" : "3000+" , "parent_company" : "Microsoft" , "twitter" : "@github" , "github_org" : { "repos" : 200 , "stars" : 50000 , "followers" : 12000 }, "health_score" : 78 } The Finding I started the job because a sales team had 300,000 stale domain records and wanted company names, headcounts, and a rough health score for each. The pla

I ran a penetration test on my own infrastructure last week. No Burp Suite, no exploit fired at production, no CVE popped. The whole engagement came down to one habit: refusing to believe a control was working until I had watched it work. The target is a small observability hub I built for my own AI-assisted coding. Six services in one compose file: a tunnel, an OpenTelemetry Collector taking metrics and logs from Claude Code, Prometheus, Grafana, Loki, and a status API. The public surface is three aggregate numbers. Everything else stays private. That boundary, three numbers out and nothing else, was the whole thing I was testing. The word "pentest" carries a picture that does not match, so: no attack traffic at the live system. The platform bills by usage and there is a WAF in front, so a flood of probes would have cost money and poisoned its own results. What I did was a read-only audit of the code and config, plus a dynamic run against the whole stack brought up locally in Docker. I expected the findings to cluster around the parts nobody had looked at. They did the opposite. Nearly every serious defect sat inside a control written days or hours earlier, usually by me, usually with a comment beside it naming what it protected against. Old code has been observed: it has run against real traffic and somebody has been surprised by it. A defence written yesterday has only been reasoned about, which feels like the same thing and is not. "Independent" is a measurement, not a comment The privacy boundary is an allow-list rather than a deny-list, and that part was right. Claude Code was measured sending five identity attributes, user.email among them carrying a real address, and no flag turns them off. A delete_key for each works until the client adds a sixth, and this telemetry is beta: its attribute set is not a contract. - context : resource statements : - keep_keys(resource.attributes, ["service.name"]) - set(resource.attributes["service.name"], "claude-code") The s