Good morning. This is your security briefing for Sunday, March 08, 2026, covering eight articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
Mandiant has released comprehensive hardening guidance for 2026, addressing the growing threat of destructive cyberattacks using wipers and ransomware. The report emphasizes that these attacks, particularly during geopolitical conflicts, aim to destroy data, disable systems, and erase forensic evidence, with detailed technical recommendations spanning external-facing assets, network segmentation, virtualization platforms, cloud environments, and Windows endpoints.
StepSecurity reports that an AI-powered bot named Hackerbot-claw has been actively exploiting GitHub Actions CI/CD pipelines across multiple high-profile projects. The campaign used branch name injection, filename injection, and prompt-injection techniques to achieve remote code execution and token exfiltration, successfully compromising projects from Microsoft, DataDog, CNCF, and aquasecurity/trivy, with at least one case resulting in complete repository takeover.
Black Hills Information Security has developed a proof-of-concept tool called PAM Skeleton Key that demonstrates a sophisticated Linux persistence technique. The method exploits Pluggable Authentication Modules by replacing legitimate PAM libraries with malicious versions, creating a universal skeleton key password for all user accounts while exfiltrating credentials in clear text, maintaining access even after password changes.
Sublime Security has built a high-speed threat hunting system for email security that dramatically reduces investigation time. The system uses a two-phase approach of candidate selection and evaluation, employing a Message Data Model with warm and cold storage architecture, translating queries from MQL to SQL for efficient processing, and using parallel processing to enable rapid analysis of historical email data.
Developer m1k1o has released Neko, a self-hosted virtual browser running in Docker that uses WebRTC to stream desktop environments. Designed as an open-source alternative to collaborative browsing services, the tool provides isolation through containerization, privacy by keeping sensitive data contained, and can be configured with Tor Browser and VPN for enhanced anonymity, serving as a secure testing environment and jump host for internal applications.
Researchers Nancy Lau, Louis Sloot, and their team have introduced ZeroDayBench, a new benchmark for evaluating Large Language Model agents' ability to identify and patch unseen zero-day vulnerabilities. The research, which tests LLMs on real CVEs with CVSS scores of 7.0 or higher ported into different codebases, reveals that current frontier LLM agents cannot yet autonomously find and patch critical zero-day threats without human oversight.
Rahul Marchand and colleagues have developed SANDBOXESCAPEBENCH, an open benchmark measuring Large Language Model capabilities to escape containerized sandbox environments. The research demonstrates that frontier LLMs can identify and exploit vulnerabilities across orchestration layers, container runtimes, and kernel-level weaknesses including misconfigurations and known CVEs, posing significant security risks for organizations deploying autonomous LLM agents in sandboxed environments.
Orange Innovation Poland researchers have published an examination of how Cyber Threat Intelligence must evolve to address AI system vulnerabilities. The article details novel attack vectors including adversarial attacks, data poisoning, model manipulation, and exploitation of training data that can cause misclassification and evasion of detection, with finance, energy, and healthcare sectors facing heightened risk as attackers leverage AI for automated malware production, targeted phishing, and deepfakes while defenders struggle with AI's black-box nature complicating incident response.
That concludes today's briefing.