InfoSec Briefing - September 26, 2026

🎧 Audio Briefing

Playback Speed:

Security news from the BlueTeamSec community for Saturday the 26th of September 2026. A busy one, with sixteen stories — we'll start with a pair of CISA alerts that need immediate attention.

CISA have added a critical WordPress vulnerability to the Known Exploited catalogue — CVE-2026-87902. It's an unauthenticated path traversal in the template loader that chains into remote code execution, affecting WordPress versions 4.7 through 7.1.1. Exploitation was confirmed in the wild within hours of disclosure, so if you've got WordPress installations anywhere, patch to 7.1.2 immediately and hunt for web shells.

And the second CISA alert covers CVE-2026-67279, a pre-authentication SSH bypass in MikroTik RouterOS. This one's part of the MikroTrick exploit chain we covered earlier in the week — when combined with another vulnerability, it gives unauthenticated attackers full administrative control over internet-facing routers. Patch to the latest stable release and lock down SSH to trusted management IPs until you do.

Viettel Cyber Security have detailed CVE-2026-65660, a SharePoint vulnerability Microsoft initially classified as a spoofing issue but which actually enables remote code execution. The researchers demonstrated it can be chained for pre-authentication RCE through a type-check bypass in the editing page parser component. Microsoft patched in August, but worth revisiting if you've got SharePoint deployments.

Patrick Wardle's published a proof-of-concept for a local privilege escalation in the Muse application — unprivileged processes can modify an undocumented configuration setting to redirect dictation traffic to attacker-controlled endpoints. It's a local exploit, so requires existing code execution, but it abuses Muse's elevated permissions to intercept data and inject prompts. One for macOS environments running Muse.

Researchers from Flashpoint have disclosed a novel EDR evasion technique called Process Parameter Poisoning. It works by embedding malicious shellcode in process initialisation structures — specifically in undocumented fields like the STARTUPINFO reserved parameter — which lets attackers inject and execute payloads without triggering the usual API hooks. Traditional EDR solutions that rely on hooking memory allocation calls will miss this one.

Socket discovered a malicious Firefox extension masquerading as a PDF identity verification tool on the official Add-ons store. It targets Portuguese and Spanish-speaking users, hijacks Google accounts by stealing session tokens, intercepts password reset flows, and uses dynamic payload fetching to evade static analysis. Worth flagging if you've got centralised extension management policies.

And on a similar note, a researcher has documented malicious drivers signed through the Windows Hardware Compatibility Program. Attackers obtained legitimate Microsoft signatures for kernel-mode drivers that operate at the highest privilege level, bypassing signature verification entirely. Detection rates remain low, and the signing entities include both corporate and individual certificate holders.

A research team from ETH Zurich and Anthropic have demonstrated a scalable deanonymisation attack using large language models. The technique analyses writing style and personal disclosures across platforms to link anonymous content to real identities, using embedding-based retrieval followed by reasoning to exploit what they call contextual collapse. The implication is that writing habits create biometric-like identifiers even without explicit personal information.

Project Black have published research showing how an uncensored local language model can autonomously generate and refine credential-dumping malware that evades EDR. The AI iteratively implemented behavioural obfuscation and signature avoidance, all on about five dollars of compute. It's a fairly stark demonstration of how accessible sophisticated malware development has become.

ThreatDown have written up CARBONATO, a Docker-based botnet that exploits unauthenticated Docker daemons to gain access and spread as a worm. It uses an AI-driven Telegram command interface to perform targeted credential harvesting, with primary focus on exfiltrating API keys from fourteen major AI providers including OpenAI and Anthropic. It's been active since October last year and scans for new victims every five minutes.

NetAskari have analysed leaked internal documents from Chinese firm ZRON, which appears to operate as an espionage-as-a-service provider for government and security institutions. The company targets foreign embassies, ministries, and individuals globally whilst publicly presenting itself as a legitimate cyber forensics business. Adds useful context to the broader Chinese contractor ecosystem.

Christian Harris has presented on the forensic limitations of Google Workspace during incident response. The core issue is that native logging tools lack the granularity needed to determine exact scope of unauthorised access via OAuth compromises — investigators can't identify which specific files or emails were accessed, and there are significant gaps around correlation IDs and log latency. Forces you to assume worst-case during breach investigations.

A researcher discovered that the ZCode AI coding assistant was silently exfiltrating entire Git repositories — including history, configuration files, and large file storage assets — to Aliyun cloud storage without user consent. The data collection was encrypted and executed automatically at startup with no ability to disable it through the interface. One to remove if it's deployed anywhere in your estate.

PwnDefend have released Agentic Swarm, a repository of synthetic enterprise telemetry datasets designed for security research into AI agent behaviour. It provides five thousand events of ground truth data to help teams analyse agent-to-agent communication patterns and build detection signatures for malicious autonomous activity. Useful resource if you're working on detection engineering for agentic systems.

And finally, researchers have released REx-Skill, a multi-agent reverse engineering framework for discovering and validating vulnerabilities in compiled binaries. It uses seven independent subagents analysing decompiled code, disassembly, and runtime data to confirm bugs across ELF, PE, and Mach-O formats. Built on reproducible tooling including Ghidra and symbolic execution engines.

That's all for today. Attribution goes to the original authors — the analysis here was automated. We'll be back with the next briefing shortly.

📰 Articles Covered

CVE-2026-87902 - CISA KEV

CVE-2026-87902 is a critical security vulnerability currently being actively exploited in the wild. Below is the intelligence summary based on current reports as of September 26, 2026.

### Vulnerability Overview
| Attribute | Detail |
| :--- | :--- |
| **Vendor** | WordPress |
| **Product** | WordPress Core (Page-Template Resolution) |
| **CVE ID** | CVE-2026-87902 |
| **Severity** | Critical (CVSS 9.2) |
| **Vulnerability Type** | Unauthenticated Path Traversal / Local File Inclusion (LFI) |

### Impact and Exploitation
The vulnerability exists within the page-template resolution logic of WordPress. An unauthenticated attacker can manipulate the `pagename` parameter to force the `get_page_template()` function to include arbitrary, readable local PHP files located outside of the designated theme directories .

* **Remote Code Execution (RCE):** While primarily a path traversal/LFI flaw, it can be chained to achieve Remote Code Execution. Attackers are successfully achieving RCE by including files like `pearcmd.php` (a common PEAR package file) or other locally available files to execute arbitrary PHP code under specific server and theme environment conditions .
* **Exploitation (T1190 - Exploit Public-Facing Application):** Active exploitation began within hours of the public disclosure. Attackers are performing widespread scanning and reconnaissance, often attempting to include core WordPress files to identify vulnerable instances before launching the full RCE payload .

### Affected Versions
The vulnerability affects WordPress Core versions ranging from **4.7.0 through 7.1.1** .

### Immediate Recommendations for Defenders
1. **Update Immediately:** Upgrade to **WordPress version 7.1.2** or later. Fixes have been backported for all branches down to version 4.7.0 .
2. **Audit for Compromise:** Review server access logs for anomalous `pagename` parameters or attempts to access `pearcmd.php` or other unexpected system files. Check for the creation of suspicious or unauthorized PHP files in the web root or theme directories.
3. **Implement Compensating Controls:** If immediate patching is not possible, ensure a Web Application Firewall (WAF) is deployed with rules to block malicious path traversal patterns targeting the `pagename` parameter.
4. **Legacy Systems:** Note that versions prior to 4.6 will not receive a fix; sites running these legacy versions are at high risk and should be migrated or firewalled aggressively.
CVE-2026-67279 - CISA KEV

CVE-2026-67279 is a critical vulnerability affecting MikroTik RouterOS. It is a key component of a dangerous exploit chain identified by CERT Polska known as "**MikroTrick**," which allows unauthorized, unauthenticated actors to gain full administrative control over exposed devices .

### Vulnerability Overview
* **Vendor:** MikroTik
* **Product:** RouterOS
* **Affected Versions:** Versions up to 6.49.20, 7.23.3, and 7.24.1 .
* **Description:** The vulnerability exists in the RouterOS SSH implementation. It allows the system to enter the connection protocol following a client-requested rekey, even though no user authentication has been attempted .

### Impact and Exploitation
* **What it allows:** When combined with **CVE-2026-86060**, it forms the "MikroTrick" chain, which bypasses all password or key-based authentication requirements, granting the attacker full administrative access to internet-facing MikroTik routers .
* **MITRE ATT&CK Mapping (T1190):** Attackers exploit this vulnerability to achieve unauthorized access to public-facing applications (specifically the SSH service on MikroTik routers) without needing valid credentials. This is a remote, unauthenticated exploit .

### Threat Landscape
As of late September 2026, the MikroTrick chain is actively monitored due to its potential for severe impact on exposed infrastructure. While specific threat actor names are still being attributed, the nature of the vulnerability—which provides full administrative control—makes it a high-value target for botnets and groups focusing on networking infrastructure compromise .

### Immediate Recommendations for Defenders
1. **Update Immediately:** Ensure all MikroTik devices are upgraded to a version later than 6.49.20, 7.23.3, or 7.24.1.
2. **Harden SSH Access:** If not already done, restrict SSH access. Avoid exposing the SSH service to the public internet. Use access control lists (ACLs) to limit access to known, trusted management IP addresses.
3. **Audit Logs:** Review device logs for unusual connection attempts or unauthorized configuration changes, particularly focusing on the period following the public disclosure of these vulnerabilities in September 2026 .
SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass - Viettel Cyber Security

The following is a detailed précis of the security vulnerability CVE-2026-65660, based on recent disclosures.

### **Overview: What Happened**
CVE-2026-65660 is a critical vulnerability affecting Microsoft SharePoint Server. Originally, Microsoft classified the flaw as a "spoofing" vulnerability with a relatively low CVSS score of 6.5. However, research published on September 22, 2026, by Dinh Ho Anh Khoa of Viettel Cyber Security revealed that the vulnerability is significantly more severe, enabling **authenticated Remote Code Execution (RCE)**. The National Vulnerability Database (NVD) has subsequently updated the assessment, assigning it a CVSS score of 8.8 【2】【3】.

### **Who Is Affected**
The vulnerability impacts on-premises versions of SharePoint Server. Specifically, the following versions are vulnerable:
* SharePoint Server 2013, 2016, 2019, and Subscription Edition (SE) 【1】.

### **Security Implications**
The misclassification by Microsoft initially masked the true risk of the flaw. Because it allows for RCE, a malicious actor—even one with low-level authenticated access—could execute arbitrary code on the underlying server. Furthermore, researchers noted that this vulnerability can be chained with other issues to achieve pre-authentication RCE, significantly increasing the potential for full system compromise and the deployment of "memshells" (in-memory webshells) for persistent access 【1】.

### **Technical Details**
The vulnerability stems from a code-injection weakness (CWE-94) related to how SharePoint validates server-side controls against its `SafeControls` allowlist.
* **Root Cause:** The flaw originates in the `ToolPane` component, where insufficient validation allows attackers to bypass the Safe Type check 【4】.
* **Exploitation:** By manipulating `XamlServices.Parse()`, an attacker can inject malicious code. Even when the specific `SafeControls` bypass is patched, the underlying `XamlServices.Parse()` mechanism remains a potential vector for creating memshells, according to Viettel Cyber Security researchers 【1】.

### **What Defenders Should Know**
* **Patch Status:** Microsoft released security updates addressing this vulnerability on **August 11, 2026**. Organizations running any of the affected SharePoint versions must ensure these patches are applied immediately 【2】.
* **Risk Assessment:** Do not rely on the initial "spoofing" classification. Security teams should treat this as a high-priority RCE risk and conduct internal audits to ensure their SharePoint environments are updated.
* **Monitoring:** Defenders should monitor for suspicious activity involving the `ToolPane` and check for the presence of unusual in-memory webshells, as the exploitation chain can be used to bypass traditional file-based detection 【1】.
Process Parameter Poisoning: Inside a Novel EDR Evasion Technique - Flashpoint

This report summarizes the "Process Parameter Poisoning" technique, a sophisticated method for Endpoint Detection and Response (EDR) evasion as detailed in the research by Max Hirschberger and Ogulcan Ugur.

### What Happened
Researchers discovered a novel code injection technique that circumvents conventional EDR monitoring by sidestepping commonly hooked Windows APIs. Instead of utilizing standard memory allocation and writing functions, the technique exploits the process creation lifecycle to smuggle malicious payloads into a target process 【1】.

### Affected Entities
Any environment relying on traditional, API-hooking-based EDR solutions is potentially vulnerable. Because the technique evades the initial hooks that security products use to monitor process creation and memory allocation, most Windows-based endpoints using standard defensive configurations are susceptible to this evasion method 【1】.

### Technical Details
The technique exploits the standard process initialization phase rather than invoking suspicious memory manipulation functions like `VirtualAllocEx()` or `WriteProcessMemory()`:
* **Payload Embedding:** Malicious shellcode is embedded within process initialization structures, specifically the `STARTUPINFO` structure (using the undocumented `lpReserved` field).
* **PEB Manipulation:** Upon process startup, this data is moved into the "ShellInfo" entry of the Process Environment Block (PEB). Alternative structures, such as `WindowTitle`, `CommandLine`, or `Environment` fields, can also be used.
* **Execution:** Attackers locate the PEB using `NtQueryInformationProcess()`, modify the memory permissions of the embedded shellcode, and hijack a thread to execute it. This is achieved by manipulating the thread's instruction pointer via `GetThreadContext()` and `SetThreadContext()` 【1】.
* **Constraints:** To succeed, the shellcode must be free of NULL bytes. Furthermore, because it requires non-standard payload crafting, automated tools like MSFVenom are generally insufficient 【1】.

### Security Implications
* **EDR Evasion:** By avoiding API hooks, the technique significantly lowers the noise generated during the injection process, allowing it to bypass initial behavioral triggers.
* **Synergistic Evasion:** Its efficacy can be further amplified when combined with other techniques, such as DLL unhooking and the implementation of Microsoft's non-Microsoft block DLL policy 【1】.

### What Defenders Should Know
Defenders should move beyond simple API-based detection rules. Key mitigation and detection strategies include:

| Defensive Approach | Details |
| :--- | :--- |
| **Entropy Analysis** | Monitor process initialization strings (like those in `STARTUPINFO`) for high entropy, which often indicates embedded, obfuscated shellcode. |
| **Memory Monitoring** | Inspect memory for execution occurring in abnormal locations, specifically within PEB parameter buffers, and track unusual memory permission changes. |
| **Thread Hijacking** | Monitor for suspicious manipulation of thread contexts, while remaining aware that traditional rules monitoring process suspension/resumption APIs may not trigger 【1】. |

**Relevant MITRE ATT&CK Mapping:**
* **T1055:** Process Injection
* **T1055.003:** Process Injection: Thread Execution Hijacking
* **T1564.010:** Hide Artifacts: Process Argument Spoofing 【1】
Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts - Socket

The cybersecurity article from Socket.dev details the emergence of a sophisticated malicious Firefox extension that targets Google accounts. Below is a detailed precis of the incident.

### What Happened
A malicious Firefox extension named "PDF Identity Verifier" (ID: `pdf-para-texto@extensao.local`) was identified on the official Firefox Add-ons store. Although it was first published on September 3, 2026, the malicious functionality was introduced in version 1.4 on September 11, 2026. The extension masquerades as a tool for verifying user identity before opening protected PDFs; however, it is designed to hijack Google accounts 【1】.

### Who is Affected
The attack primarily targets Portuguese and Spanish-speaking users, evidenced by localized strings and lure pages for `pt`, `pt-PT`, `es`, and `en` locales. While the current scale of the infection is considered small, the threat is significant due to its advanced design and evasion techniques 【1】.

### Security Implications
The extension facilitates full Google account takeover by performing the following actions:
* **Session Hijacking:** It captures sensitive `oauth_token` values from `Set-Cookie` headers via a `webRequest` listener on `accounts.google.com`.
* **Account Control:** If Google initiates a password reset, the malicious script intervenes to set a new password known to the attacker.
* **Real-time Exfiltration:** It maintains a live transcript of the victim's interactions with Google pages, allowing attackers to monitor the hijacking process in real-time 【1】.

### Technical Details
* **Detection Evasion:** The extension avoids static analysis by containing no hardcoded malicious logic upon initial installation. Instead, it uses a "dispatcher" in `background.js` to execute functionality fetched from attacker-controlled infrastructure after installation.
* **Infection Chain:** After installation, it directs users to a lookalike domain (`pdf[.]gusercontent[.]com`), where it uses FedCM to resolve identity and retrieve subsequent malicious configuration and payloads.
* **Injection:** It utilizes `browser.tabs.executeScript` to inject a payload (`load-addon.js`) directly into legitimate `accounts.google.com` pages. This allows the attacker to automate sign-in flows and bypass traditional bot-detection mechanisms 【1】.

### What Defenders Should Know
* **Remediation:** Users should uninstall the extension, revoke all active Google sessions and tokens, and reset account passwords from a secure, clean device. It is also advised to review account security settings, such as recovery methods and email forwarding rules.
* **Blocking:** Defenders should proactively block network traffic to the C2 domain `pdf[.]gusercontent[.]com`.
* **Threat Hunting:** Security teams should proactively scan browser profiles for the extension ID `pdf-para-texto@extensao.local` to identify and remove instances of the malware 【1】.
Malicious drivers - Mahmoud Zohdy

The article by Mahmoud Zohdy provides a critical overview of a phenomenon where malicious actors have successfully abused the legitimate Windows driver signing process. By leveraging the trust associated with Microsoft's hardware compatibility programs, attackers have been able to deploy harmful drivers that evade standard security controls.

### Summary of Findings

| Category | Details |
| :--- | :--- |
| **What Happened** | A collection of drivers, many of which carry valid signatures from Microsoft or other entities, have been identified as malicious. Attackers have effectively subverted the Windows Hardware Compatibility Program to sign their malicious code. |
| **Who is Affected** | Any system running the Windows operating system that relies on driver signature verification as a primary security check is potentially vulnerable to these malicious drivers. |
| **Security Implications** | **Compromised Trust:** The exploitation of the signing process undermines the entire model of trust for drivers. **Persistence & Privilege:** Operating at the kernel level, these drivers grant attackers deep, high-privilege access, enabling them to hide their activities from user-mode security software. |
| **Technical Details** | **Signers:** Attackers used "Microsoft Windows Hardware Compatibility Publisher" and entities such as "Gui Zou" and "Xue Sun." **Detection:** While many are flagged on VirusTotal, some show low or zero detection rates, necessitating reliance on threat intelligence beyond simple signature matching. |
| **Defensive Guidance** | **Beyond Signatures:** Do not treat signed drivers as inherently safe. **Behavioral Monitoring:** Implement robust kernel-level integrity checks and behavioral analysis. **IOC Utilization:** Use the provided SHA-256 hashes for scanning and blocking via SIEM and EDR solutions. |

### Technical Analysis
The core issue is that Windows driver signature enforcement is often used as a gatekeeper for system security. By obtaining legitimate signatures, these malicious drivers bypass these gates. Because they operate in the kernel (Ring 0), they possess the highest level of system privileges. This makes them ideal tools for sophisticated threat actors looking to achieve persistence or perform deep system manipulation that cannot be easily detected by traditional, user-mode antivirus applications.

### Guidance for Defenders
The catalog provided in the source is a vital resource for threat hunting. Defenders should:
* **Ingest IOCs:** Add the identified SHA-256 hashes to blocklists within EDR, XDR, and SIEM platforms to prevent execution.
* **Review Trust Policies:** Audit and harden driver loading policies. While blocking all but essential drivers is difficult in enterprise environments, consider more granular control over which signatures are trusted.
* **Prioritize Behavioral Telemetry:** Shift focus toward monitoring for suspicious kernel-mode behavior—such as unexpected memory modifications or unusual API hooking—rather than assuming that a valid signature equates to malicious-free code.
Large-scale online deanonymization with LLMs - Simon Lermen, MATS; Daniel Paleka, ETH Zurich; Joshua Swanson, ETH Zurich; Michael Aerni, ETH Zurich; Nicholas Carlini, Anthropic; and Florian Tramèr, ETH Zurich.

The provided summary accurately captures the core technical contributions, security implications, and defensive takeaways of the research paper "Large-scale online deanonymization with LLMs."

To supplement this analysis for a comprehensive overview, here are additional considerations for defenders and practitioners based on the research findings:

### Key Technical Takeaways for Defenders

* **The Power of Unstructured Data:** The attack pipeline highlights that LLMs effectively weaponize "writing style" and "idiosyncratic disclosure" as biometric-like identifiers. Defenders should recognize that even in the absence of explicit PII (Personally Identifiable Information), the combination of writing habits and mundane life details creates a unique fingerprint.
* **The "Contextual Collapse" of Anonymity:** The research illustrates that when LLMs aggregate data across multiple platforms, they facilitate "contextual collapse," where previously disparate, anonymized datasets are linked into a coherent individual profile. Defenders must treat all user-generated content as potentially linkable, regardless of the platform where it originated.
* **Adversarial LLM Efficiency:** Because the framework uses embedding-based retrieval (Stage 2: Search) before invoking the more expensive LLM reasoning (Stage 3: Reason), the attack is highly scalable and cost-effective. Defenders should prioritize detecting the *pre-processing/scraping phase* of such attacks, as blocking the massive collection of unstructured text remains the most effective disruption strategy.

### Recommendations for Platform Security

1. **Rate-Limiting and Behavioral Analysis:** Platforms should implement sophisticated rate-limiting that goes beyond IP-based throttling. Monitoring for patterns typical of bulk content scraping—such as iterative requests for individual profiles—is essential to hinder the "Search" phase of the pipeline.
2. **Differential Privacy and Noise Injection:** For platforms providing public access to data (such as API access for researchers), consider applying differential privacy techniques. By programmatically injecting controlled noise into textual metadata or summary data, platforms can reduce the utility of that data for automated linking while maintaining its general research value.
3. **User Awareness and Tooling:** Platforms should provide users with better tools to audit their own "digital trail." Providing a "privacy score" or highlighting potentially identifying incidental disclosures in their posting history could help users proactively sanitize their own data.
4. **Policy Shifts:** The research strongly suggests a move away from "open-by-default" data policies. Platforms should re-evaluate their public data exposure, moving toward authenticated or restricted access models where bulk data is only provided to verified researchers under strict, privacy-preserving agreements.

By treating the threat as a combination of *data availability* and *LLM-driven inference*, defenders can better shift their strategy from protecting static identifiers to protecting the contextual integrity of their users' online interactions.
Bypassing EDR with Local AI - Project Black

This precis summarizes the findings from the ProjectBlack article regarding the use of local, uncensored Artificial Intelligence (AI) to circumvent Endpoint Detection and Response (EDR) systems.

### What Happened
The author conducted an experiment to determine if Large Language Models (LLMs) could be utilized to develop evasive malware. Specifically, they focused on creating an executable capable of dumping the Local Security Authority Subsystem Service (LSASS) process—a target frequently accessed by attackers to harvest credentials—while successfully evading detection by modern EDR solutions.

### Who Is Affected
This research highlights a significant risk for any organization relying on EDR as their primary defensive layer. It demonstrates that the barrier to entry for developing sophisticated, obfuscated, and stealthy attack tools has been dramatically lowered, making such capabilities accessible to threat actors who previously lacked the specialized development skills.

### Technical Details
* **Model Constraints:** Commercially available, censored models (such as Claude) strictly refuse requests related to offensive cyber operations, even when prompted within authorized penetration testing contexts.
* **The Uncensored Advantage:** By running an "uncensored" model (specifically Qwen 3.8 27B) locally, the researcher bypassed safety guardrails that would otherwise block the generation of malicious code.
* **Iterative Evasion:** The AI autonomously refined the executable's code to minimize its detection signature. Key evasion techniques implemented included:
* **Access Mask Modification:** Reducing the privileges requested when interacting with the LSASS process.
* **Behavioral Obfuscation:** Implementing random execution delays (sleeps) and altering process spawning patterns to avoid triggering behavioral heuristics.
* **Signature Avoidance:** Scrubbing embedded strings and obfuscating output paths to thwart static signature-based detection.
* **Accessibility:** The researcher demonstrated that these powerful, iterative evasion capabilities can be achieved with minimal investment—estimated at roughly $5 in rented computing resources.

### Security Implications
The primary implication is the democratization of high-level evasion techniques. The ability to use local AI to rapidly prototype, iterate, and refine attack tools means that traditional signature-based and behavioral-based EDR detections are increasingly susceptible to being bypassed by AI-optimized threats that adapt faster than defenders can update their rules.

### What Defenders Should Know
The article emphasizes that as defensive tools like EDR become easier to bypass through automated AI-driven iteration, organizations must pivot back to foundational, "defense-in-depth" security strategies:
* **Attack Surface Reduction:** Actively minimize the number of entry points and exposed services.
* **Least Privilege:** Strictly enforce access controls so that even if a system is compromised, the attacker's ability to act is inherently limited by restricted permissions.
* **Credential Hygiene:** Prioritize rigorous auditing and management of credentials to limit the utility of dumped data, as EDR cannot be relied upon as a foolproof catch-all.
CARBONATO: a botnet built around an AI agent | ThreatDown - ThreatDown

The CARBONATO incident represents an evolving threat where AI-powered automation is leveraged to maximize the value of post-compromise activities. Below is a detailed précis of the incident based on research from ThreatDown.

### Incident Summary
CARBONATO is a sophisticated Docker-based botnet that exploits publicly exposed, unauthenticated Docker daemons to gain system access. Once inside, it functions as a worm, automatically scanning networks to spread, while providing its operators with an AI-driven command interface via Telegram to perform targeted credential harvesting, with a primary focus on exfiltrating AI API keys.

### What Happened
ThreatDown researchers identified the botnet while investigating a leaked archive of toolchain data active from October 2024 through August 2026. They discovered that the operators run two parallel, linked activities: a "factory" that produces trojanized cryptocurrency wallet applications and the CARBONATO botnet, which compromises and maintains control over Docker-based infrastructure.

### Who is Affected
The primary targets are any organizations or individuals running **Docker daemons exposed to the internet without authentication** (most commonly on port 2375).

### Security Implications
* **AI API Keys as Prime Loot:** The malware explicitly prioritizes the theft of AI API keys (from 14 major providers including OpenAI, Anthropic, Gemini, and others) above all other data, such as SSH credentials, access tokens, or database access.
* **Automated Persistence:** The botnet is designed to be highly resilient; it uses "watchdogs" to monitor its own existence and will re-pull the malware from the registry if it is deleted. It also utilizes file immutability flags to prevent defenders from easily removing persistence hooks.
* **Operational Security (OpSec) Risks:** By using an LLM-assisted command loop, the operators can perform complex, multi-stage attacks that adapt based on the specific information discovered on a victim's host in real-time.

### Technical Details
* **Infection and Propagation:** The botnet uses the Docker API to launch a privileged container with the host's filesystem mounted. It then scans internal networks and Docker bridges every five minutes to find and infect additional unauthenticated hosts.
* **Command & Control (C2):** The malware uses **Hermes Agent** (an open-source framework). The operators overwrite the agent's `SOUL.md` file with a specific persona prompt that mandates the exfiltration of AI keys and instructs the model on how to interact with the host.
* **Persistence Mechanisms:** Persistence is achieved via a multi-layered approach using `cron`, `systemd` timers, `rc.local`, and OpenRC. The malware marks these files as immutable to thwart cleanup attempts.
* **Reverse Tunnels:** The malware establishes reverse SSH tunnels back to a relay in Costa Rica. The remote ports for these connections are derived from the MD5 hash of the victim's IP address, allowing operators to easily calculate and reconnect to any specific host.
* **Attribution:** Indicators suggest the operators are based in **Costa Rica**, including evidence from the Telegram handle (`Carbo506`), timezone configurations, language usage (voseo Spanish), and infrastructure locations.

### What Defenders Should Know
* **Do Not Rely on Agent Blocklists:** Because the underlying framework (Hermes Agent) is legitimate software, you should not block the tool itself. Instead, hunt for the specific abuse signatures:
* The `SOUL.md` file containing the string "GH0ST".
* The presence of the `CARBONATO_API_KEY` environment variable.
* Unexplained outbound traffic to Telegram.
* **Network Detection:** Monitor for deterministic reverse SSH tunnels targeting network **AS262145**.
* **System Integrity:** Search for disguised processes (e.g., `[kworker/u2:0]`), suspicious files in `/root/.hermes/`, and files that have been set to immutable (where they should not be).
* **Immediate Mitigation:**
* Ensure Docker APIs are never exposed to the public internet without proper authentication and encryption.
* Treat AI API keys as high-value "bank credentials"; inventory their locations, rotate them frequently, and implement strict monitoring for any unusual usage patterns.
Back to ZRON: Espionage-as-a-service ! - NetAskari

The following precis summarizes the exposé on Zhengzhou Zhirong Network Technology (ZRON) as detailed in the provided article.

### What Happened
A substantial leak of internal documents, emails, and messages from the Chinese cybersecurity firm Zhengzhou Zhirong Network Technology (ZRON) has revealed that the company functions as a sophisticated "espionage-as-a-service" provider for Chinese government and security institutions 【1】. While publicly presenting itself as a legitimate provider of cyber forensics and crime-fighting services, internal records prove ZRON is a deeply integrated component of China’s digital espionage ecosystem, facilitating intelligence collection, processing, and analysis 【1】.

### Who Is Affected
ZRON's operations are wide-ranging and global, targeting both domestic and international entities. Specifically affected parties include:
* **Foreign Entities:** Embassies, ministries, and state employees across various countries 【1】.
* **Individuals:** Both Chinese nationals and foreign citizens who have been subjected to sweeping monitoring, espionage, and cyber attacks 【1】.

### Security Implications
The primary implication is the presence of an advanced, "full-service" intelligence entity operating under the guise of a private cybersecurity firm. Unlike traditional "hackers-for-hire" who may perform isolated data theft, ZRON provides state security agencies with:
* **Comprehensive Intelligence:** Collection, processing, and analysis capabilities 【1】.
* **Strategic Influence:** Online opinion monitoring, data analysis, and reporting to shape narratives and support institutional decision-making 【1】.

### Technical Details and Evidence
The confirmation of these activities stems from a massive leak of internal material, providing researchers with:
* **Official Tool Documentation:** Detailed insights into the specific software and methods used for their operations 【1】.
* **Internal Communications:** Developer chats and internal emails documenting the technical implementation of their intelligence gathering 【1】.
* **Sales Records:** Meeting notes from pitches to government security officials that clarify the state-sanctioned nature of their work 【1】.

### What Defenders Should Know
Defenders, particularly those working in government, international organizations, or sensitive sectors, should understand that ZRON is not merely a cybercriminal enterprise but a proxy for state-level intelligence operations. The documentation underscores that:
* The company’s "cybersecurity" services are a front for state espionage.
* The threat includes not only technical intrusion but also coordinated "opinion monitoring" and long-term data analysis campaigns.
* Security teams should treat potential tools or services originating from or associated with this entity as high-risk, state-affiliated threats.
Forensic Frustrations: What the Docs Don't Tell You About Google Workspace Incident Response - Christian Harris

This précis outlines the key insights from the "Forensic Frustrations" talk regarding the inherent difficulties of performing incident response (IR) within the Google Workspace ecosystem.

### Overview of the Issue
The presentation highlights significant "visibility gaps" within Google Workspace that hinder the ability of security teams to effectively investigate incidents, regardless of their licensing tier. The core problem is that Google's native logging and investigation tools often fail to provide the granularity required to determine the exact scope of unauthorized access.

### Incident Scenarios
The discussion focuses on two primary attack vectors:
* **OAuth App Compromise:** Attackers deploy or exploit third-party applications that have been granted OAuth scopes, allowing them to gain access to Google Drive or Gmail to exfiltrate data.
* **Supply Chain Compromise:** Malicious actors compromise a legitimate, already-authorized third-party application, thereby leveraging existing user trust to access mailbox data without alerting the user or security team.

### Technical Challenges
* **Licensing Restrictions:** While basic OAuth events are visible, the granular details—such as specific API methods invoked by an application—are restricted to Enterprise/Plus license tiers.
* **Lack of Granularity:** It is impossible to identify which specific files or emails were accessed. During an investigation, this forces IR teams to adopt a worst-case scenario approach by assuming a total mailbox compromise.
* **Correlation & Visibility:** Workspace logs lack unique correlation IDs, requiring manual effort to map events across different log types. Furthermore, the built-in investigation tool is limited to single-log searches, making it ineffective for complex, cross-table analysis.
* **Data Latency:** Log ingestion can experience delays of several hours, severely impacting the ability to respond to active incidents in real time.
* **Incomplete Log Exporting:** Native forwarding features are limited, capturing only a small fraction of the available log types, which leaves significant blind spots.

### Security Implications
The primary implication is the **inability to definitively scope the blast radius**. Because investigators cannot confirm which data was actually touched or exfiltrated, it is difficult to satisfy regulatory compliance requirements or provide accurate data breach notifications regarding the exposure of PII or sensitive secrets.

### Guidance for Defenders
To mitigate these frustrations, defenders should implement the following strategies:
* **Acknowledge Constraints:** Clearly understand the specific logging limitations imposed by your current Google Workspace license.
* **Externalize Logging:** Do not rely solely on built-in tools. Export logs to an external security information and event management (SIEM) or data lake to create an immutable "golden copy" that allows for better correlation and long-term analysis.
* **Adopt Conservative Posture:** When an OAuth-based compromise is detected, treat the account as fully compromised, as the data exfiltrated cannot be precisely determined.
* **Utilize Additional Tools:** Leverage Google Vault, which can be applied retrospectively to assist in data preservation and investigation.
Inside ZCode: Silently Uploading Your Entire Git History to the Cloud - Ferstar (ferstar.org)

The summary provided effectively covers the core aspects of the ZCode incident. Below is a structured precis based on the report.

### Executive Summary: The ZCode Data Exfiltration Incident

The discovery by a security-conscious user revealed that the **ZCode** AI coding assistant was performing unauthorized, silent exfiltration of complete user Git workspaces to third-party cloud storage (Aliyun OSS). This incident highlights critical risks associated with closed-source AI development tools that require deep integration into local development environments.

| Category | Details |
| :--- | :--- |
| **What Happened** | ZCode silently packaged and uploaded entire Git workspaces—including history, LFS assets, reflogs, and config files—to Aliyun OSS buckets without user consent or disclosure. |
| **Who is Affected** | Any ZCode user who was logged into the application, as the exfiltration pipeline was active by default and could not be disabled via the user interface. |
| **Security Implications** | Massive exposure of intellectual property, historical commit data, and potentially hardcoded secrets (API keys) found within repository histories. Users were denied control over their own data via server-side encryption with keys held exclusively by the developer. |
| **Technical Details** | The process was triggered at startup (`captureBeforePrompt`, `repo-wiki-update`). Data was archived as `tar.gz`, encrypted with AES-256-CTR (wrapped with RSA-OAEP), and sent directly to Aliyun OSS. |
| **Defender Advice** | When dealing with opaque binaries, rely on OS-level enforcement. Use filesystem locks (e.g., `chflags uchg` or `chattr +i`) on the application's checkpoint/staging directories to prevent files from being written, as standard application settings may not effectively disable malicious background processes. |

### Key Takeaways for Defenders
* **Trust Nothing by Default:** Even reputable-seeming software can contain telemetry or data-collection mechanisms that far exceed the scope of their advertised functionality.
* **Enforce Perimeter and Host Controls:** Relying on the application's own "opt-out" settings is insufficient. Defenders should monitor egress traffic and utilize OS-level file integrity/lock controls to prevent sensitive directories from being staged for exfiltration.
* **Transparency Gaps:** This incident serves as a reminder that privacy policies are not technical guarantees. For high-security environments, the use of proprietary AI coding assistants that require broad repository access remains a significant supply chain and data-loss risk.

Following the disclosure, the developers updated the ZCode client to remove this functionality and purged the affected cloud storage buckets. However, this case underscores the importance of rigorous network and filesystem monitoring when integrating third-party AI tools into development workflows.
Agentic Swarm Datasets - PwnDefend

The information available at https://swarm.agent.hosting/ does not describe a security incident, breach, or "happening" in the context of an attack. Rather, it serves as a **resource hub for cybersecurity research** focused on the emerging field of **AI agent security**.

Here is a detailed precis based on the available documentation:

### What This Is
This is a repository of **synthetic, enterprise-grade telemetry datasets** specifically designed for security researchers, data scientists, and security engineers to study the behavior and potential risks of autonomous agent swarms in enterprise environments.

### Who Is Affected (Target Audience)
This resource is intended for:
* **Security Researchers:** Individuals analyzing patterns in agent-to-agent communication or agent-to-infrastructure interaction.
* **AI/ML Engineers:** Those developing robust architectures for agentic workflows.
* **Defenders (SOC/Detection Engineers):** Professionals looking to build or tune detection signatures for malicious agent behavior (e.g., unauthorized data exfiltration, privilege escalation).

### Security Implications
The core implication is that as AI agents gain agency within enterprise networks, they introduce a new, complex attack surface. By providing "ground truth" data, this project helps defenders move beyond abstract theory and into empirical analysis of how agent swarms behave, which is critical for identifying and mitigating:
* Unauthorized lateral movement within an organization.
* Unexpected or malicious data access patterns.
* "Black box" agent decision-making that might be exploited by adversaries.

### Technical Details
* **Data Nature:** The datasets are **synthetic by design**, meaning they are purposefully generated to represent realistic, complex agent interactions while ensuring a "ground truth" is available for accurate labeling and analysis.
* **Content:** The preview contains 5,000 events. Data is formatted primarily in **newline-delimited JSON**, facilitating ingestion into SIEMs, data lakes, or research frameworks.
* **Access Mechanism:**
* **Public Access:** Data is hosted on AWS S3 (`jevalin-agent-datasets-095713295645`) in the `eu-central-1` region with public HTTPS access.
* **CORS:** Support is included for browser-based access.
* **Catalog:** A central `datasets_index.json` acts as the manifest for available datasets.
* **Tooling:** Researchers can use standard HTTP fetching or the `@storagesdk/core` (Node.js) package for integration.

### What Defenders Should Know
* **Proactive Analysis:** Defenders should leverage these datasets to train and validate detection models *before* agent-based infrastructure becomes a mainstream target.
* **Pattern Recognition:** Use the provided ground truth to understand the baseline of "normal" agent swarm activity versus anomalies that might indicate a compromise.
* **Integration:** Since the data is provided in standardized formats, it can be ingested into existing threat-hunting pipelines to test whether current SIEM alerts can successfully flag malicious agentic behavior.
REx-skill: REx@Skill - Agentic Reverse Engineering eXecution Skill for binary vulnerability discovery - Norbert Tihanyi

The following is a detailed précis of the REx-Skill project based on the provided documentation.

### **What Happened**
REx-Skill (Reverse Engineering eXecution Skill) is a specialized methodology and toolset developed to systematically identify and verify vulnerabilities within compiled binaries. Rather than relying on a single automated scan, it employs a multi-agent approach where seven independent subagents analyze a shared evidence base—comprising decompiled C code, disassembly, and runtime execution data—to confirm security defects.

### **Who Is Affected**
This project is primarily intended for **security researchers, reverse engineers, and binary analysts**. It is designed to evaluate binaries across diverse architectures (ELF, PE, and Mach-O), meaning it is applicable to a wide range of software environments, particularly those involving complex, compiled codebases where vulnerability discovery is non-trivial.

### **Security Implications**
The methodology introduces a rigorous framework for vulnerability validation. To minimize false positives and biases, REx-Skill enforces a strict reporting standard: a finding is only validated as a "confirmed bug" if four specific components are identified:
* **Source:** The point of entry for attacker-controlled data.
* **Sink:** The sensitive operation being compromised.
* **Broken Guard:** The specific validation check that failed to neutralize the threat.
* **Affected Principal:** The specific system or entity impacted by the vulnerability.

By prohibiting agents from sharing preliminary findings, the project forces independent verification, ensuring that vulnerabilities are backed by tangible evidence rather than subjective assessment.

### **Technical Details**
The framework is built for consistency and reproducibility, utilizing the **Nix package manager** to pin specific tool versions (e.g., Ghidra, AFL++, Angr). Key technical characteristics include:
* **Toolchain:** An orchestration pipeline consisting of 33 scripts that automate tasks ranging from decompilation (using Ghidra, radare2, and rizin) to static analysis (Semgrep, cppcheck, and capa) and dynamic execution (QEMU, AFL++, Valgrind, and Unicorn).
* **Advanced Analysis:** It incorporates symbolic and concolic execution using Z3 for arithmetic/bounds verification and Angr/Triton for path exploration.
* **Cross-Architecture Support:** The system supports ten architectures, including x86-64, ARM, AArch64, MIPS, RISC-V, and PowerPC.

### **What Defenders Should Know**
* **Host Requirements:** While static analysis can be performed on macOS, high-fidelity dynamic analysis and fuzzing require a Linux environment.
* **Transparency and Integrity:** The framework explicitly separates "findings" from "limitations." Defenders are provided with diagnostic scripts (`scripts/capabilities.sh` and `scripts/pipeline_status.py`) that clearly report if an analysis stage failed to run, ensuring that users do not mistake an unperformed scan for a lack of vulnerabilities.
* **Reproducibility:** Because the environment is managed via Nix, the analysis results are deterministic. Security teams can compare findings across different environments and timeframes with confidence that the toolset versions remain constant.
A proof-of-concept for a local Muse vulnerability 0day that can let an unprivileged local process redirect Muse’s dictation traffic and abuse the trust/access granted to the app. - Patrick Wardle

This precis outlines the security vulnerability documented in the "not-a-mused" repository, which describes a proof-of-concept (PoC) exploit targeting the Muse (muse.ai) application.

### Executive Summary
The vulnerability is a local security flaw in the Muse application that allows an unprivileged local process to hijack the application's dictation traffic. By redirecting this traffic to an attacker-controlled endpoint, a malicious actor can abuse the elevated permissions and context already granted to the Muse application, effectively gaining unauthorized access to user data and interactions.

### Who Is Affected
* **Target:** Users of the Muse application.
* **Attacker Requirement:** The attack is **local**. An attacker must already possess the capability to execute code as the logged-in user on the victim's machine 【1】.

### Security Implications
This vulnerability facilitates **privilege or access amplification**. Because Muse often operates with significant trust and broad permissions—greater than those typically available to standard local malware—compromising it allows an attacker to inherit that level of access 【1】. Potential impacts include:
* **Data Interception:** Capture of sensitive dictated audio and prompts 【1】.
* **Prompt Injection:** Injecting malicious prompts into the Muse environment 【1】.
* **Credential Theft:** Exfiltration of Muse authentication materials 【1】.
* **Abuse of Privileges:** Misusing any existing access, APIs, or data integrations the user has previously authorized for the application 【1】.

### Technical Details
The issue stems from an undocumented configuration setting within the Muse application, `endo_voyager_dictation_endpoint`. Crucially, this setting can be modified by any unprivileged local process—no special administrator or root privileges are required to alter the destination of the dictation traffic 【1】. Once an attacker redirects this endpoint, they can intercept, manipulate, or impersonate the expected service interactions.

### What Defenders Should Know
* **Context Matters:** While this is a local attack (meaning the attacker has already breached the initial perimeter), it demonstrates a critical risk where legitimate, high-trust applications become "stepping stones" for attackers to maintain persistence or escalate their impact.
* **Mitigation Strategy:** Defenders should monitor for unexpected modifications to application configuration files or environment settings, especially those that define network endpoints for sensitive services like dictation or AI integration.
* **App Trust:** Applications that act as central hubs for user data or AI interaction should be strictly audited for how they handle configuration, particularly regarding external network communication endpoints, to ensure they cannot be manipulated by other local processes.
WordPress 7.1.1-CVE-2026-87902 exploit - Harisec

This précis outlines the details of the critical security vulnerability CVE-2026-87902, as detailed in the provided article.

### Overview of CVE-2026-87902
CVE-2026-87902 is a critical security flaw with a CVSS score of 9.2, allowing unauthenticated attackers to achieve Remote Code Execution (RCE) on affected systems. The vulnerability exists within the WordPress template loading mechanism, which can be leveraged through a Local File Inclusion (LFI) chain.

### Impacted Systems
* **Affected Version:** WordPress 7.1.1.
* **Remediation:** The issue was patched in WordPress 7.1.2, which was released on September 22, 2026.

### Security Implications
The vulnerability allows an unauthenticated remote attacker to gain unauthorized code execution capabilities on the host server. By chaining LFI with secondary configurations (such as specific PHP environment settings), an attacker can move from simple file inclusion to full system compromise.

### Technical Details
* **Source of Vulnerability:** The flaw resides in the `get_page_template()` function within `wp-includes/template.php`.
* **Path Traversal & Encoding Bypass:** The system fails to correctly validate `pagename` query variables when constructing template paths. Attackers exploit this using double-encoding (e.g., representing slashes as `%252f`). Initial sanitization processes the encoded characters as harmless, but a subsequent `urldecode()` call later in the template resolution process reconstructs malicious path traversal sequences (`../`).
* **Exploitation Chain:**
* To succeed, the target must have an active theme with a `page-templates/` directory and must pass a valid `page_id` to satisfy the `is_page()` requirement.
* **RCE Sink:** The exploit frequently targets common environments (such as official PHP-Apache Docker images) that include `pearcmd.php` and have `register_argc_argv` set to `On`. This allows attackers to manipulate the PEAR configuration utility to inject and execute arbitrary PHP code within the webroot.

### Recommendations for Defenders
* **Immediate Action:** Upgrade all WordPress installations to version 7.1.2 or later immediately.
* **Defense-in-Depth:**
* **Configuration Hardening:** Disable `register_argc_argv` within the PHP configuration if it is not explicitly required for your application.
* **File Removal:** Identify and remove any unused `page-*` directories from active themes.
* **Asset Management:** Remove or restrict access to `pearcmd.php` on the server, as it is a frequent target for RCE chains in these types of vulnerabilities.