BlueTeamSec briefing for Sunday the 16th of August 2026, quite a busy one with eighteen stories from the infosec.pub community. Starting with defence.
Anton Ovrutsky has released ATEN, a proof-of-concept telemetry tool designed to monitor AI coding agents in development environments. It logs prompts, commands, network requests, and file operations, aiming to catch supply chain compromises, prompt injection, and data exfiltration by AI agents before they become incidents. Worth a look if you're running Cursor, Claude Code, or similar tools in your organisation.
Dirkjan Ochtman has announced OxiSH, a new SSH server written entirely in Rust after twenty months of development. It's designed as a memory-safe alternative to OpenSSH, addressing the historical vulnerability class that's plagued implementations written in C. Not production-ready yet, but one for those tracking the memory-safety transition.
Moving to vulnerabilities. Rapid7 has published a detailed technical breakdown of CVE-2026-55040, an authentication bypass in SharePoint Server Subscription Edition. The flaw allows unauthenticated attackers to forge JWT tokens and impersonate administrators by chaining four separate validation failures in the token handler. This one's actively exploited following Rapid7's proof-of-concept release, so if you're running SharePoint, flag this immediately.
A researcher has released a zero-day called ShieldBreak that fully bypasses Microsoft's patch for CVE-2026-50656 in Windows Defender. The exploit affects Windows 11, Windows Server 2025, and Windows 10, reportedly achieving a hundred percent evasion rate. Public proof-of-concept is already available.
Researchers Talal Haj Bakry and Tommy Mysk have found WebKit vulnerabilities affecting proxy browsers on iOS and macOS. Three features—DNS prefetching, WebAuthn, and WebTransport—ignore configured proxy settings entirely, exposing users' real IP addresses and DNS queries. This impacts privacy-focused browsers and Apple's iCloud Private Relay, so relevant if you're relying on those for anonymity.
Security researchers have discovered an exploit chain in Microsoft Exchange Server's Mailbox Replication Proxy Service that can achieve SYSTEM-level remote code execution. The attack bypasses Exchange authentication policies, writes arbitrary PST files, and leverages NTLM relay via an old PetitPotam technique to compromise multi-server deployments. The researchers note it requires specific conditions unlikely in hardened production environments, but it's worth understanding the primitives involved.
NIST has issued a request for information as part of modernising the National Vulnerability Database to address AI-enabled vulnerability discovery and exploitation. They're developing V-etalon, an AI-powered enrichment tool, and revising CPE specifications for better scalability and automation. If you work in vulnerability management or tooling, this is your chance to shape the next iteration.
On to offensive techniques. Researchers at the University of North Carolina at Chapel Hill have demonstrated that inter-keystroke timing data captured via cache side-channels can be turned into readable text with high fidelity. The KeyTAR technique uses large language models trained on human typing patterns to reconstruct typed input from timing alone. Timing side-channels were previously thought to be low risk—that assumption no longer holds.
SpecterOps has detailed a post-exploitation technique called Return of the Cookie Monster that uses Chrome DevTools Protocol to bypass device-bound session cookies in Chromium browsers. The method involves process injection to force-enable debugging interfaces, giving attackers with local system access complete control over browser sessions and the ability to extract cookies, credentials, and browsing history from Chrome and Edge on Windows. We've covered related evasion suites from SpecterOps back in July.
A researcher has released TrustMeBro, an offensive toolkit for manipulating Windows Authenticode signatures to disguise malicious code as trusted binaries. It exploits the Subject Interface Package and WinVerifyTrust architecture, supporting signature theft, metadata cloning, and SIP hijacking across nineteen file types. This follows coverage earlier this week of malware crypting services, which are increasingly commoditised.
Andrew Gomez of SpecterOps has developed SilentChrome, a tool that weaponises Chromium browser extensions for persistent command and control. It silently installs malicious extensions, isolated web applications, and native messaging hosts by modifying the Secure Preferences JSON file, bypassing all browser security prompts. The technique enables multi-layered persistence on Windows systems running Chrome or Edge.
Security researcher Gareth Heyes at PortSwigger has demonstrated CSS-based vulnerabilities in webmail clients that enable data exfiltration and exploitation without JavaScript. The research shows CSS has effectively evolved into a programming language capable of logic, flow control, and DOM querying through features like the has selector. Modern webmail interfaces are caught between rich functionality and security as browser CSS capabilities expand the attack surface considerably.
Two exploitation stories. Malwarebytes is reporting attackers are distributing fake installers for CCleaner, 7-Zip, and Adobe Acrobat through malicious advertising and typosquatted domains. The malware installs GhostDesk, a hidden Chrome extension designed for covert surveillance and credential theft. Windows users searching for legitimate software via search engines are the primary targets—so the usual advice applies: download directly from vendor sites, not search results.
Moving to tooling and techniques. Z.ai has released GLM-5.3, an AI model that achieved significant advances in complex coding and, somewhat unexpectedly, autonomous cyber exploitation capabilities through scaling post-training techniques. The model developed rapid vulnerability discovery and exploitation abilities after being trained with vulnerability data and environments. Testing was conducted in collaboration with security teams in China against real-world codebases, which is notable given how widely this kind of model could be deployed.
SpecterOps has released Blacklight, an open-source toolkit designed to detect and analyse artifacts left by local AI agents like Cursor or Claude Code on developer endpoints. The tool identifies sensitive data exposure including credentials, API keys, and chat histories stored by these agents, which create significant attack surface for adversaries targeting development environments. This pairs well with the ATEN telemetry tool we mentioned earlier—both are addressing the same emerging risk.
ServiceNow Red Team has released Dark, an open-source command-and-control agent for the Mythic framework that brings Windows-style Beacon Object File execution capabilities to macOS and Linux. Dark executes compiled C code entirely in-memory without disk writes or child processes, using manual symbol resolution and platform-specific memory protections including Apple Silicon's hardware-enforced write-xor-execute via MAP_JIT. One for red teamers expanding their macOS and Linux tooling.
And finally, Cisco Talos has dissected the JWR phishing framework, a sophisticated phishing-as-a-service platform likely a variant of something called The Outsider. The framework uses AES-encrypted WebSocket command-and-control and Vue.js interfaces to conduct real-time, operator-driven phishing campaigns impersonating toll authorities and postal services across Southeast Asia and the Middle East. Attackers capture payment card data, credentials, personally identifiable information, and two-factor tokens through live session manipulation with over forty operator commands. This follows our coverage of similar phishing frameworks earlier in the summer.
That's everything for today from BlueTeamSec. The articles are the work of their original authors—the analysis here was automated.