Security news from BlueTeamSec on infosec.pub for Tuesday the 11th of August 2026. A busy one today, with eighteen stories to get through.
AWS have published a detailed guide on hunting down over-permissioned S3 buckets and fixing them before they become an incident. Five-phase methodology using Config, Security Hub, and Lambda to detect misconfigurations and automate remediation — one for anyone running infrastructure in AWS.
Cracken have released Blacksea, an active honeypot designed to counter LLM-driven attackers. The clever bit: when an AI agent touches a canary credential, the defender gets arbitrary code execution on the attacker's infrastructure, letting you fingerprint and gather intel on autonomous reconnaissance tools.
U.S. Cyber Command has kicked off Cybercom 2.0, its biggest organisational shake-up in sixteen years. The transformation reclassifies cyber personnel from support staff to direct warfighters, emphasising operational velocity and meritocracy. It started last autumn and reshapes force generation, talent management, and how cyber sits within the broader defence strategy.
OpenSSF's Alpha-Omega project released an automated threat modelling framework for open-source projects. Unlike traditional vulnerability scanners, this generates formal security contracts that define boundaries, adversary models, and who's responsible for what — useful background if you maintain or depend on open-source infrastructure.
Semperis disclosed ResetNightmare, CVE-2026-27912, a critical flaw in the Kerberos Change Password protocol. Attackers can reset any Active Directory user or computer account password without knowing the original, including Domain Admin accounts, by manipulating the user principal name attribute to trick domain controllers. Proof-of-concept tool is out.
And another privilege escalation, this time in Microsoft 365. SafeBreach found CVE-2026-45459 in Python-in-Excel, which bypassed Trusted Records and Mark of the Web protections. Rich value objects forced silent network requests on workbook open, enabling data exfiltration without user interaction or Python environment isolation.
SpecterOps demonstrated NotWSUSpicious, a technique that weaponises Windows Server Update Services infrastructure through NTLM relay. If your WSUS deployment uses an external MSSQL database without Extended Protection for Authentication, attackers can manipulate the update database to push malicious payloads with system-level privileges across managed endpoints. We saw similar update server abuse back in early August.
Alejandro Hernando and Borja Martinez disclosed a Windows Plug and Play flaw that delivers system-level code execution via USB device emulation. The attack forces automatic driver installation using signed but insecurely designed vendor packages, bypassing UAC. It works over RDP USB redirection, so no physical hardware required — vulnerable drivers from Sierra Wireless, Sony, and others enable escalation through logical flaws rather than memory corruption.
Researchers at Shells Systems showed how to bypass Windows Application Control for Business by manipulating NTFS Kernel Extended Attributes to simulate trusted file status. The attack modifies NTFS structures offline via a non-Windows OS or online using vulnerable kernel-mode drivers. Full-disk encryption and minimising driver availability are your mitigations here.
DotSec disclosed CVE-2026-25166, an insecure deserialisation flaw in imgmgr.exe from the Windows Assessment and Deployment Kit. It allows attackers to bypass application control policies and execute arbitrary code by exploiting the BinaryFormatter class without proper validation — ysoserial.net does the heavy lifting for payload crafting.
Metabase identified and patched a zero-day in versions 0.58 and above that was actively exploited to gain administrator-level access. The vulnerability enables SQL injection, credential theft, and data exfiltration from connected databases. Cloud customers were auto-patched; self-hosted users need to upgrade immediately.
Kaspersky reported on Head Mare APT exploiting two vulnerabilities in unpatched TrueConf servers to deploy PhantomCore and PhantomGraph backdoors. The campaign targeted Russian manufacturing, energy, and IT organisations, and included supply chain compromise by replacing legitimate client installers with malicious versions. PhantomGraph uses Microsoft OneDrive for command and control to evade detection.
Genians published analysis of North Korean group Kimsuky integrating AI into Operation GitPower. They're using local LLM environments — Ollama, GPT4All, Msty — to generate convincing spear-phishing documents and analyse stolen data via retrieval-augmented generation. The campaign targets diplomatic, military, academic, and financial entities, and the AI enhancement significantly erodes traditional phishing detection methods.
S. Nakano presented Forensia, a methodological framework that lets digital forensic investigators leverage local large language models while maintaining data sovereignty. It's designed to support investigations using LLMs securely without compromising sensitive material.
ADhammer is a cross-platform Active Directory security assessment toolkit written in Rust. It combines PingCastle-class auditing with red-team validation on a from-scratch protocol stack covering DCE/RPC, NTLM, SMB2, and Kerberos, validated against Windows Server 2022 and 2025. One for authorised engagements and security research.
William Ortiz released claude-red, an open-source library of thirty-eight offensive security skills for the Claude AI system. The modular files cover SQL injection, shellcode development, EDR evasion, and certificate services abuse, enabling the AI to adopt red team operator personas for specific attack surfaces — which does rather lower the barrier to entry for sophisticated techniques.
HotStartLabs released SIFT, an incident response and forensic triage tool for identifying exposed credentials and sensitive data on file shares. It addresses gaps left by code repository scanners by focusing on Office documents, configuration files, and deployment artifacts. Built-in controls include opt-in credential validation and local evidence storage to prevent the tool itself becoming an exfiltration vector.
And finally, Washizukami-Collector is a Rust-based forensic evidence collection tool for live Windows incident response. The portable utility helps security professionals quickly gather forensic artifacts during the initial stages of investigating a potential compromise — a defensive tool for incident responders.
That's your briefing for today. The articles are the work of their original authors — the analysis here was automated. We'll be back tomorrow.