ARTICLES COVERED:

1. Beyond Lazarus: Organization of DPRK Cyber Capabilities (Kudelski Security and Sekoia)
2. Token Theft in Microsoft Entra ID (Part 2 of 4): Continuous Access Evaluation (ERNW)
3. Remote-Mapping-Injection: Remote Thread Hijacking + Remote Mapping Injection POC (emirbyte)
4. HandleRedirect: Handle Redirect via BYOVD Kernel Read/Write (S12cybersecurity)
5. endpoint-ai-agent-abuse: EAA is a curated catalog of techniques and real-world cases involving abuse of local AI agents through their runtime, configuration, state, tools, and inherited authority. (0x4D31)
6. Dntry: Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH) (MatheuZSecurity)
7. Darkcloak: Linux process identity cloakingDarkcloak: Linux process identity cloaking (0x574R)
8. OpenKustoExplorer: A fast, native desktop workbench for Azure Data Explorer (i-am-shodan)
9. tgrep: Trigram-indexed grep with a client/server architecture for fast regex search in large codebases locally (Microsoft)
10. pktz: pktz - eBPF-powered network traffic monitor (Immanuwell)
11. StrikeAgent_AtkBrain-Flash: 由夜安团队研发的AI渗透测试平台，涵盖红队打点、SRC、CTF，特别是在红队领域有极为亮眼的存在 - The AI penetration testing platform developed by the Night An team covers Red Team Placement, SRC, and CTF (夜安团队)
12. firmware-reverse-engineering: A full Claude and Codex skillsets for firmware reverse engineering. (OrbitCurve)
13. The Art of Exploit Development (Spectra Vulnerability Research Group)
14. mxc: Policy-driven, layered isolation and containment (Microsoft)
15. Politie | Herken jij de stem van de Odido hack? | Landelijke Opsporing & Interventies - Police | Do you recognize the voice from the Odido hack? | National Investigation & Interventions - ShinyHunters (Politie)

ARTICLES COVERED:

1. Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended (CERT Polska)
2. Security Incident Affecting JetBrains Cadence - The JetBrains Blog (JetBrains s.r.o.)
3. Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve (Genians)
4. Robobox: Self driven malware creation and execution - made in China (NetAskari)
5. Bring Your Own Trusted Caller (BYOTC): A New Way to Exploit Vulnerable Windows Drivers (Part 1) (Xusheng Li)
6. 0xM0nCrush: Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust. (DeathShotXD)
7. Frontier Models’ Vulnerability Patches are Often F.L.A.W.E.D. - Fix-Like Artifacts With Embedded Defects: Common failure modes of LLM-generated security patches (1password.com)

ARTICLES COVERED:

1. ASCII smuggling crosses over from AI prompt injection to phishing evasion (Microsoft)
2. Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing (Federal Bureau of Investigation)
3. CVE-2026-9586: Sangoma Switchvox RCE (Horizon3.ai)
4. Daisy-Chaining Trust: Investigating Faronics Deploy Abuse (Huntress)
5. From Patch to Exploit; Using Claude Code to reverse engineer a zero-day in Papercut NG (Kev Breen)
6. Peeling the Sentinel: A Market-Leading EDR Comes Apart With Undergraduate Tools (nullze)
7. Incident response guide for AWS CloudTrail investigations – Part 1 (Amazon Web Services (AWS))
8. Incident response guide for AWS CloudTrail investigations – Part 2 (Amazon Web Services)
9. New Entra role - Entra SOC Identity Responder (Microsoft)
10. Windows 365 - Placing a Cloud PC Under Review (Jörgen Nilsson)
11. APT-C-56（透明部落）近期攻击活动分析 -Analysis of Recent Attack Activities by APT-C-56 (Transparent Tribe) (奇安信威胁情报中心 (QiAnXin Threat Intelligence Center))

ARTICLES COVERED:

1. Password spraying campaign targets AWS root user accounts across 150+ organizations (Datadog)
2. Linux Detection Engineering - Fileless Execution (Elastic)
3. Getting Agents to tell on themselves (Thinkst Applied Research)
4. UK Cybercrime Journal: ExfilSquad Emerges (BushidoToken)
5. New backdoors from Toy Ghouls (Kaspersky Lab)
6. Kim Sooki again? This time, disguised as a seafood purchase request. (AhnLab)
7. DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors (Rapid7)
8. Malicious code executed on clone between 2026-08-29 and 2026-09-02 (BindsNET)
9. Impersonating IT support: how threat actors turn a remote session into enterprise-wide access | Microsoft Security Blog (Microsoft)
10. How to get a free .arpa domain (Ethan Hawksley)
11. Simulating legitimate Active Directory services on the network: the case of GPO exploitation (Synacktiv)
12. Modern Adventures in Azure Privilege Escalation (NetSPI)
13. pstrings: pstrings - Parallel strings extractor for very large files (herosi)
14. CouchPotato: another PrivEsc potato - Patches ETW & AMSI and uses indirect syscall to abuse SeImpersonatePrivilege. (Aaron Kidwell)
15. mythic_ornn: LLM-driven generator for Mythic Agents, Payload-Type and C2 Profiles. (n0qword)
16. How Forza Horizon 6 Breaks Your IDA (Radulf)

ARTICLES COVERED:

1. Communicating under pressure: Best practices for service providers (Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC))
2. ephemora-cell: Ephemora Cell — The execution layer for untrusted AI-generated code. Fast, capability-based WASM execution with explicit CPU, memory, time, I/O, and filesystem limits. (MichaelS1011)
3. Prince of Persia: Detecting the Next C2 (Whisper Security)
4. Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist - The Citizen Lab (University of Toronto)
5. Russian National Indicted For Exploiting Online Platform Used For Freelance Employment And Distributing Malware To Thousands Of Victim Users Worldwide For Financial Gain (United States Department of Justice)
6. Malicious Packages Served from Unauthorized Registry Server (Coder)
7. Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity (Huntress)
8. Sality Malware Disrupted in International Cyber Takedown (U.S. Attorney's Office, Central District of California)
9. Node.js: Old Technique Makes a Comeback (Broadcom)
10. Amir Yaryab – Rewards For Justice - a senior official in Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). Yaryab leads the IRGC-CEC’s Cyber Operations Command. (U.S. Department of State)

ARTICLES COVERED:

1. FalconFlank: Crowdstrike Falcon 0day Privilege Escalation Vulnerability (MSNightmare)
2. Persistent Engagement and the Illusion of Cyber Equilibrium (The Lawfare Institute)

ARTICLES COVERED:

1. SuperProxy: How Residential Proxy Networks Have Become Malware Delivery Platforms (Plume Design, Inc.)
2. Daisy-Chaining Trust: Investigating Faronics Deploy Abuse (Huntress)
3. FBI investigation leads to five Venezuelan nationals pleading guilty to attempting to jackpot Kansas ATMs (United States Attorney's Office for the District of Kansas)
4. Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams (Palo Alto Networks)
5. Update on Security at METR (METR)
6. The August 2026 Virtualizor Incident in BGPHorizon (BGPHorizon)
7. Financially Motivated Threat Actor BREEZE COMET Targets Brazil (Google)
8. Counterfeit installers to system compromise: Tracking a deceptive software download campaign (Microsoft)
9. Mirage Kitten switches to Node.js and JavaScript malware (AO Kaspersky Lab)
10. Enclave: We Raced Seven AI Models to RCE (Enclave)
11. vhf-morse-transmitter-monitor: Set radio to 148.500 MHz, selct FM, USB, or CW, set squelch to 0 or 1. xtend your radio's antenna toward monitor's HDMI - now transmit in Morse code from your monitor! (Efe Işık)
12. Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode (Check Point Research)

ARTICLES COVERED:

1. Good news about the Pixel 11. It still has at least bare minimum support for MTE at a hardware level - but disabled in Android firmware (GrapheneOS)
2. wyze-bulb-color-pwned: No-open firmware exploit for the Wyze WLPA19CV2 color bulb - or how to implant a lightbulb (nickdaria)
3. OEMpocalypse Now: A Generic Exploitation Strategy from Android untrusted app to root (Lukas Maar)
4. Improving our alignment and security practices - 'By default, all cyber evaluations should run inside a hardened sandbox (an isolated computing environment) with no internet access' (Anthropic)
5. Virtualizor Compromised (31st AUG): Virtualizor has been compromised, their BGP hijack a few days ago seems to have a deployed a malicious package. (LowEndBox & LowEndTalk)
6. pqc-embedded: Post-quantum signature verification on constrained parts: LMS/HSS in no_std Rust, measured flash/RAM/time budgets against ML-DSA, SLH-DSA, ECDSA and Ed25519 (Andrey Mnatsakanov)
7. Out-of-tree Linux driver stack and boot tooling for the Cavium CN6640-SNIC10E (Octeon II, PCI 177d:0092), exposing as two independent 10 GbE interfaces (oct0/oct1) over a BAR2 shared-memory datapath (Nicolo Giuliani)
8. Everything I own, owned (Chaz Schlarp)
9. Introduction - Windows Kernel Segment Heap Notes (mrT4ntr4)
10. Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader (LevelBlue)
11. How the Russians Got Inside My Phone (SpyTalk)
12. Caught in 4K: The Aurora Files (CloudSEK)
13. Fire Ant Evolves: From Hypervisors to Trusted Infrastructure (Sygnia)
14. ValleyRAT is spreading disguised as adware (Kaspersky Lab)
15. JavaScript obfuscation: From party trick to phishing kit (Cisco Talos Intelligence Group)
16. The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution - "Approximately 97% of AI-enabled malware samples exist only in research repositories, sandbox environments and secu (Palo Alto Networks)
17. Russian-speaking cybercriminals used SpaceX’s Cursor AI tool to hack seven companies (Reuters)
18. I Think the Military Commissary Freezers Were Hacked - 'the Pentagon now acknowledging a “possible refrigeration disruption” at numerous DeCA commissaries.' (M. Elizabeth)
19. Qualcomm BootROM code signing bypass CVE-2026-25262 - needs hardware replacements (Kaspersky)
20. lych: A monolithic ARM64 operating system written in Rust. (Rabindra789)

ARTICLES COVERED:

1. UAT-10147 Uses AI-Assisted Workflows to Deploy SPECTRE Backdoor (Swarm Technologies, Inc.)
2. recently identified a domain (passkeyconnect[.]com) that is likely associated with Com-affiliated threat actors (Palo Alto Networks)
3. Detect DLL search order hijacking with a single field (Elastic)
4. logtotal-sanitizer: Framework-agnostic log sanitizer for browsers and Node.js. Redacts secrets and infrastructure identifiers with stable HMAC tokens so event correlation still works. (SOC Prime)
5. Questions about Collective action on cybersecurity (Loren Kohnfelder)
6. Mini Shai-Hulud Strikes Again: openapi-react-query-codegen (SafeDep)
7. חשיפה: ההאקר מאשקלון - עובד IT ומומחה סייבר - he was charged with violations of the Computer Law, wiretapping and invasion of privacy. As far as is known so far, the suspected hacker – who, at the sam (People and Computers (אנשים ומחשבים))
8. The Hugging Face incident and the road ahead (OpenAI)
9. Incident Timeline // TeamPCP Supply Chain Campaign (Rami McCarthy)
10. Magneto CVE-2026-71362 — Root-cause walkthrough (dinosn)
11. CVE-2026-63077: TeamCity Pre-Auth RCE Explained (SecureLayer7)
12. PrettyPrague: GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability (MSNightmare)
13. JFrog Security Advisories: CVE-2026-82329 - Potential authentication bypass leading to administrative access in Artifactory - (JFrog)
14. GreenSection: Nvidia GreenSection Memory Corruption 0day vulnerability (MSNightmare)
15. HardBreacher: Kaspersky Antivirus For Endpoint ZeroDay Elevation of Privileges Vulnerability (MSNightmare)
16. TerminalFix campaign deploys a reverse tunnel through multistage intrusion (Microsoft)
17. ClickExfil: My iteration on ClickFix and FileFix (jbellcode)
18. iwa-tools — Offensive AD tradecraft in a browser tab (pkilla)
19. Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets (GreyNoise, Inc.)
20. PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE (Huntress)
21. DFIR-LABS: DFIR LABS - A compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: DFIR, Malware Analysis and Threat Hunting. (Azr43lKn1ght)
22. Gryxa: The AI-Built Toolkit That Watches How You Remove It (ReliaQuest)
23. The Video That Plays You: Fake MP4 File Carries Malicious Payload (Censys)
24. ClickFix / ClearFake PowerShell Stager — Static Analysis Report (Douglas Mun)
25. VRIG - Fuzzillai - goal of the project was to learn more about JavaScript engine fuzzing, V8 compiler internals, and the applications of AI systems to fuzzers like Fuzzilli. (RITSEC)
26. visa-vulnerability-agentic-harness: Visa Vulnerability Agentic Harness (Visa, Inc.)
27. vol-rs: Volatility 3 ported to Rust. Same output, much faster. (daffainfo)
28. GitHub Recon — Find Secrets on GitHub (T3L3M3TRY)
29. Operation RepoGhost: Exposing a Russian-Linked Malware Campaign Hiding in GitHub’s Open-Source… (Avyukt Security)

ARTICLES COVERED:

1. Android Intrusion Logs - A First Look (iVerify)
2. Hunting Abuse: Detecting Privilege Escalation Through the ADCS Database (GuidePoint Security)
3. Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation (Amazon Web Services (AWS))
4. Inside a Syrian Interrogation Room: The Detainee Files an Infostealer Stole From a Military Police Unit (Hudson Rock)
5. A Social Engineering Attempt Against ReliaQuest: What We Found (ReliaQuest)
6. A Real-World Law-Enforcement Hack: The Case of Encrochat (International Association for Cryptologic Research)
7. The QTFY Hunt: How Chinese Hackers Were Tracked and How the Internet Became the Sensor (ZeroTrace Lab)
8. Insights into Suspected DPRK Workers (Huntress)
9. Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption - Censys (Censys)
10. Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning (Confiant)
11. Abusing Azure VMs: When BitLocker Recovery Turns into an Attack Vector (Altered Security)
12. A scenario to evaluate your Agentic SOC (unsecure.sh)
13. URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026) (PaperCut Software)
14. Active exploitation of a software development platform within Australia (Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC))
15. I spent $200 a month to SEO-poison Google search results (Steven (Dongze) Yue)
16. Logging Reference Architecture (Cybersecurity and Infrastructure Security Agency (CISA))
17. 768 Leaked Corporate AWS Keys Held Full Admin Rights (Truffle Security Co.)
18. Online False Positive Reduction via Statistical Process Controls (Nikolas Bielski)
19. darwin-vm: Run iOS/ macOS in Qemu. Virtual iPhone 17, 16, 15, 14, 13, 12 and M5-M1 Apple Si Macs supported. (jprx)

ARTICLES COVERED:

1. Chinese Implants in the Supply Chain (VulnCheck)
2. Cambodia-focused cluster uses multistage infection chain with localized lures (Acronis)
3. Carry-On Compromise: TA4922 Packs PackClient (Proofpoint)
4. Dark Caracal Reloaded: New Malware, Same Hunting Grounds (Arctic Wolf)
5. BlueDelta Targets Defense and Diplomacy with HOOKEDGE (Recorded Future)
6. Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate | Australian Federal Police (Australian Federal Police)
7. CVE-2026-57910 — WatchGuard Agent improper authentication allows unauthenticated remote code execution (WatchGuard)
8. UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range (Olivier Boschko)
9. SonicWall GMS - Unauthenticated RCE and Encrypted Password Hash Extraction (CVE-2026-66145) (AmberWolf)
10. PRTremote: Extract PRT Cookies Remotely with InteractiveToken Scheduled Tasks (www.armadin.com)
11. When it Snows it Pours - Anatomy of a ServiceNow Red Team (MDSec)
12. GPUThor (gputhor.com)
13. idamcp: provides a Model Context Protocol (MCP) server for integrating IDA Pro with AI agents like Gemini, Claude, and Jetski. (Junfeng Yang)
14. Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More (TrendAI)
15. Aurora ransomware targets ESXi abuses Cursor Agent for exploitation (Gambit Security)
16. Treasury Announces the Quantum-Readiness Task Force (U.S. Department of the Treasury)
17. Just aClosing a Critical Internet Privacy Gap for Billions of Users: Android 17 Rolls Out ECH Support (Jigsaw)
18. Threat Intelligence Report: University Leak Exposes Russia’s Military Cyber Training Pipeline (DomainTools)

ARTICLES COVERED:

1. CERT.at Increased fraud attempts through BEC (CERT.at)
2. Declaring a National Emergency to Secure the United States Bulk-Power System (The White House)
3. Disruptive cyber activity highlights risk from internet-exposed systems and edge devices (National Cyber Security Centre (NCSC))
4. Compromising Signal's Contact Discovery Enclave (Verabit Labs Ltd)
5. tailcat: like netcat, but over Tailscale's data plane, without Tailscale's control plane (Tailscale)
6. OSINTClaw Part 2: Can an AI Agent Threat Hunt? (AaronCTI)

ARTICLES COVERED:

1. OpenAI agents hacked Hugging Face in 700-strong swarm, tried to cover tracks, investigations find (Reuters)
2. VMs won't contain cyber-capable agents - "The agent was started outside the VM, given SSH access into the VM environment, and permitted to do anything inside the VM." (Trail of Bits)
3. Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure (United States Department of Justice)
4. NSA Joins FBI in Issuing Warning about Chinese Hacking Group QTFY Cyber Activity (National Security Agency/Central Security Service)
5. Inside China-nexus cyber espionage infrastructure (Lumen Technologies)
6. Tortoiseshell: New Toolset and Operational Infrastructure Exposed (Group-IB)
7. Chinese national gets 20 years for hacking accounts of BTS' Jungkook, others | Yonhap News Agency (Yonhap News Agency)
8. log4j2-rce: Pre-auth RCE via FilteredObjectInputStream MarshalledObject bypass in Apache Log4j 2 (hypnguyen1209)
9. Not Another Log4Shell: A Serialized-Event Receiver Boundary (Pruva)
10. CyberMeowfia: 13-year-old UAF in Red Hat Enterprise Linux 10: CVE-2026-52923. - It was introduced in Jan 2013 and fixed upstream in May 2026, backported to RHEL on Aug 11 - local priv esc (NebuSec)
11. CyberMeowfia: Fedora 44, a signedness in io_uring, CVE-2026-52933 - It was introduced in Nov 2022 and fixed upstream in Apr 2026 - local priv esc (NebuSec)
12. MassDriver: Proxying sensitive API calls from shellcode to artifact for CET compatible clean call stacks. (Sizeable-Bingus)
13. I'm in your logs now: deceiving analysts and blinding EDRs (FalconForce B.V.)
14. Exploiting SMTP with Unicode Bidi Override Spoofing: The Gap Between Auth & Render (Security Joes)
15. Threat Hunting using Pair Probabilities (Stamatis Chatzimangou)
16. Internet Exposure Reduction Guidance (Cybersecurity and Infrastructure Security Agency)
17. Updated Analysis of PatchGuard on Microsoft Windows 10 RS4: A use case of REVEN, the Timeless Analysis Tool (eShard)
18. Microsoft Paint and Photos Embed Server-Issued GUIDs as Invisible Watermarks in Locally-Generated Images (Xusheng Li)
19. Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident (Model Evaluation and Threat Research (METR))

ARTICLES COVERED:

1. State-backed hackers targeted EU officials on WhatsApp, document shows (Politico)
2. ClickFix, EtherHiding & a DPRK Wallet Trail (Allsecure)
3. Venezuelan Man Sentenced to 8 Years in Prison for ATM Jackpotting Following Homeland Security Task Force Initiative (United States Attorney's Office for the District of Nebraska)
4. A Tale of Two SOCs: Insights From Two Red Team Assessments (Cybersecurity & Infrastructure Security Agency (CISA))
5. CYBERUK 2026 Tech Talk - How to justify security investments with actual evidence (Jawed Karim)
6. Detecting (Evil) Dylibs (Objective-See Foundation)
7. ditto: Powershell & Javascript Obfuscator (Airbus)

ARTICLES COVERED:

1. BengalSEO Part 1: Anatomy of the Operation (The DFIR Report)
2. Exploiting SharePoint: CVE-2026-55040 and CVE-2026-63520 RCE Chain | Blog | VulnCheck (VulnCheck)
3. More Criticals, Less Dopamine (Ananda Dhakal)
4. Playing whack-a-mole is losing (David Adrian)
5. MADHATTER: Gradient-Guided Token Perturbation for Qwen - MadHatter can be used as a defensive disruption layer against an offensive Qwen-based AI agent by introducing small, targeted token changes (AlloySecureGroup)
6. DNSRPC-BOF: Beacon Object File (BOF) implementation of the dnscmd.exe functionality used to obtain remote code execution on an ADIDNS server by using MS-DNSP. (Paradoxis)
7. Time as a Key: Breaking Rhysida Ransomware with the Attacker's Own Ciphertext (Adam Taguirov)
8. ghostdebug: Debugger utilizing stealth hooks to hide from debugger detection (VollRagm)
9. SLEEPWALKER: A Passive Backdoor With Its Own Command Language (Dominik Reichel)
10. Detection primitives for eBPF rootkits (Datadog Security Labs)

ARTICLES COVERED:

1. New Zealanders urged to take care as cyber security incidents become more complex (National Cyber Security Centre (NCSC))
2. AWS EKS forensics: data sources and investigation tooling (Synacktiv)
3. Auditing Microsoft Defender and Intune Configuration Changes (Jeffrey Appel)
4. Assessing Kimi K3 Against Offensive Security Benchmarks (Irregular)
5. Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant (TrendAI)
6. BRIDGEHEAD : An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer (CloudSEK)
7. GitHub - ThisIsTFS/Rogue-Framework: The Exploit Developers BurpSuite (ThisIsTFS)
8. We burned 11.7bn tokens to find the best cyber AI model | GLM5.3 and DeepSeek are now frontier (Aikido)
9. tmpout_v (genetix)
10. The Cure for Exceptional Zeek Package Testing (Part 3) | Corelight (Corelight)
11. The Cure for Exceptional Zeek Package Testing (Part 2) | Corelight (Corelight)
12. The Cure for Exceptional Zeek Package Testing (Part 1) | Corelight (Corelight)
13. natural-language-nmap: Experimental SLM fine tune project. CPU only local model converts natural language into nmap commands. (evets007)
14. fortitool: cracking FortiOS firmware end to end, and a key nobody had (Ali Mosajjal)
15. Anatomy of a macOS ClickFix Crimekit that Weaponises EtherHiding (NetbyteSEC Sdn. Bhd.)

ARTICLES COVERED:

1. N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it (Datadog)
2. First Android malware targeting automotive head units (AO Kaspersky Lab)
3. 无糖信息(NoSugarTech): about Chinese company NoSugarTech has been featured in multiple past reports, and analysis and investigation of i-SOON's leaked data have also mentioned its connection to China (misaki)
4. Inside Kimsuky's Abuse of Legitimate Remote Control Tools Across Northeast Asia (ENKI WhiteHat)
5. Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack (Aikido)
6. Supply chain attack on arrayref | Rust Blog (The Rust Project)
7. Malicious Rust Crate arrayref Runs a Build-Time Payload (SafeDep)
8. Defending Against an Active Threat to Siemens S7 Series PLCs (Cybersecurity and Infrastructure Security Agency (CISA))
9. Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your EDR Since 2025 (eSentire)
10. SynkLoader: when you throw in everything but the kitchen sink (Expel)
11. SMAP is Pre-Disarmed: How a Stack Pivot That Shouldn't Work Revealed a Kernel-Wide Design Compromise (Youssef Charfeddine)
12. NachoMDM - Weaponising Windows MDM for UAC Bypass and SYSTEM Execution via Malicious Enrollment (AmberWolf)
13. mora-hwbp: Hardware Breakpoint (DR0-DR7) based patch-less user-mode hooking & telemetry instrumentation engine (AMSI, WLDP & ETW PoC). (Dovughs)
14. Tag, You're Managed - Executing Code via Google's Own Signed Installer (AmberWolf)
15. VQL: Hunts Chromium profiles for enabled unpacked extensions and Native Messaging Host registrations associated with Chromium extension persistence (Matt Green)
16. needre: Self-made toy EDR project using AYA the Rust eBPF library (sunlife3)
17. Beyond the Hype: Evaluating LLM Integration and Practical Limitations in Security Operation Centers (Elnaz Rabieinejad, Ali Dehghantanha, Fattane Zarrinkalam, and Sarina Dastgerdy)
18. hexcymatix: patterns hiding in plain byte - You want similarity without specification. (Christopher Domas)
19. XPEViewer: PE file viewer/editor for Windows, Linux and MacOS. (horsicq)
20. lldp: Mythic Peer to Peer (P2P) Communication Protocol via. LLDP (Whispergate)
21. Vulnerability Analysis of CVE-2025-22226: Information Disclosure Due to OOB Read in VMware’s HGFS (NCC Group)

ARTICLES COVERED:

1. UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities (Cisco Talos Intelligence Group)
2. UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations (Cisco)
3. Benchmarking Automated Security Patch Backporting: How Far Are We? (Cornell University)
4. Improving LLM-Based SSH Honeypots Through Prompting and Fine-Tuning (Muris Sladić, Veronica Valeros, Eman Alibalić, and Sebastian Garcia)
5. From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation (Sepehr Ghaffarzadegan, Boubakr Nour, Makan Pourzandi, Mourad Debbabi, and Chadi Assi)
6. From Noise to Signal: Improving Security Log Anomaly Detection Using LLMs with Endpoint-Specific Logs (Cornell University)
7. I accidentally logged hundreds of thousands of phone calls to military bases (Lina)
8. CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence (Yutong Cheng, Changze Li, Qian Cui, Wei Ding, Lingzhi Wang, Yan Chen, and Peng Gao)
9. Reverse-engineering Find My People to stalk  ̶m̶y̶ ̶e̶x̶  a friend, cause I can (Zerotistic)

ARTICLES COVERED:

1. Trapping a Mustang Panda (IBM)
2. Distinct Clusters Target Individuals of Interest to Russia (Google)
3. Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns | Wiz Blog (Wiz)
4. A revisit of remote Spectre attacks on Cloudflare Workers (Cloudflare)
5. Langflow RCE: 34 minutes to server compromise (Bitbison)
6. Managing the cyber risk of agentic AI (National Cyber Security Centre (NCSC))
7. T-Mobile ‘chopped a cable’ to expel Chinese hackers from its network (Bloomberg)
8. BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive (Check Point Software Technologies)
9. MS-Nightmare Un-defend v2 — What Happens When Signatures Can’t Land (WeedHashPeddler)

ARTICLES COVERED:

1. North Korean Crypto-to-Fiat Activity (Royal United Services Institute (RUSI))
2. SilkParasite: Tracking a China-Nexus APT Across Central Asia (Bitdefender)
3. Defending Against an Active Threat to Siemens S7 Series PLCs (Cybersecurity and Infrastructure Security Agency (CISA))
4. BOFScale: A CDN-Fronted Tailnet from a BOF-PE (NetSPI)
5. Describing attacks with crime script analysis (Cisco Talos)
6. Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers (Horizon3.ai)

ARTICLES COVERED:

1. #StopRansomware: Medusa Ransomware (Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation, and Department of Health and Human Services)
2. 17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities (United States Department of Justice)
3. $10,000,000 USD FOR INFORMATION ON Iranian Hackers (U.S. Department of State)
4. Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor | Seqrite (Quick Heal Technologies Limited)
5. APT37 Strikes Again, This Time with NarwhalRAT (blackorbird)
6. PurpleDelta's Fraudulent Employment Operations (Recorded Future)
7. Defending Against DPRK IT Workers – An Implementation and Operational Guide (Bridewell)
8. Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect - Check Point Research (Check Point Software Technologies)
9. Сьогодні сервери АРМА зазнали хакерської атаки. Ведеться слідство - Today, ARMA servers were attacked by hackers. An investigation is underway. (Агентство з розшуку та менеджменту активів)
10. Revealed: Cyber spies used malware from GitHub to hack EncroChat cryptophone network (TechTarget)
11. Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 & Azure (Ontinue)
12. Reverse engineering Malwarebytes Browser Guard | msil.re (miltinh0c)
13. BusyWork: Sleep replacement that executes real, varied work to break behavioral pattern matching by EDR and anti-cheat systems (PatchRequest)
14. DutchOven: Application-scoped Windows network brownouts in native C and BOF form (loosehose)
15. smiiiiiiiiiiiiiiii: Exploiting System Management Mode with a very very very very very very very long interrupt. (Christopher Domas)
16. IDT Table Hijacking under VBS/HVCI/kCET in Windows 11 (Exploit Pack)

ARTICLES COVERED:

1. Threat Hunts for Shell Command Obfuscation on VMware ESX (CrowdStrike)

ARTICLES COVERED:

1. Technical Analysis of the Geedge Networks Firewall Source Code Leak (USENIX Association)
2. Dragon Breath (APT-Q-27): RONINGLOADER and Gh0st RAT Explained (Picus Security)
3. Pulling the Thread: APT should not usurp the identity of Leroy Merlin or there will be consequences (Axel Z.)
4. UK Cybercrime Journal: Qilin Ransomware Rampage in H1 2026 (BushidoToken)
5. How browser attacks are evolving in 2026 so far (Push Security)
6. windbg-bridge: windbg-bridge connects a live WinDbg session to AI agents like Claude Code or Codex through a named pipe. The agent can run debugger commands, read your command history, and watch outpu (Kevin Gosse)
7. Signed, sealed, injected: The mechanics of DCRat in 2026 (Trellix)
8. Deleting the Defenders: A Commodity BYOVD Toolkit That Erases Host Safeguards (VMRay)
9. The phishing link that died on purpose (Gen Digital)
10. ExfilSquad: New Data Extortion Group Leaks Microsoft D365 Data, Likely Linked to Misconfigured Power Pages (Fortra)
11. WS-Trust Autologon Endpoint: Password Spray Without Smart Lockout Blocking (Varonis)
12. The Mac With No Malware On It: When Consent Is the Attack Path (Ridgeline Cyber Defence)
13. Detecting macOS Gatekeeper Quarantine Attribute Removal with Sigma (Medium)
14. Device Roles in Microsoft Defender XDR: Better Context for Threat Hunting and Detection Engineering (Blu Raven Academy)
15. Consensual Forensics with Android Intrusion Logging (Kevin Pagano)
16. Release IRFlow Timeline 1.0.10 · adds ChatGPT Computer History as a new forensic artifact family, (r3nzsec)
17. NIST Digital Forensics Artifact Catalog: Where Digital Evidence Becomes Forensic Science (CKE Ltd.)
18. ETSI launches approval process for 17 European Standards supporting the Cyber Resilience Act (ETSI)
19. Quantum Computers Are Not a Threat to 128-bit Symmetric Keys (Filippo Valsorda)

ARTICLES COVERED:

1. Expired Malicious Domains Bring New Threats to Life (Infoblox)
2. CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit (AO Kaspersky Lab)
3. ETW for Security Research: Providers, Sessions, and Detection Engineering (Idov31)
4. CipherRun: A Fast, Modular, and Scalable TLS/SSL Security Scanner Written in Rust (Marc Rivero)
5. AzurePrivilegedIAM: Docs and samples for privileged identity and access management in Microsoft Azure and Microsoft Entra. (Cloud-Architekt)
6. How BitLocker PINs help protect your data and devices (National Cyber Security Centre)
7. JA4+ for Zeek - A compiled Zeek plugin implementing JA4+ network fingerprinting. Replaces the pure-script implementation with C++ BiF functions for performance-critical fingerprints. (FoxIO-LLC)
8. How a self-taught Vietnamese high schooler built the malware that infected 94,000 computers worldwide - VnExpress International (VnExpress)
9. Addressing Recent Incidents: Ongoing Findings and Path Forward - Irregular (Irregular)
10. Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia (Dream)
11. Akira Hits Safe Mode: Ransomware Rebooting Around EDR (Huntress)
12. Lose Control Flow: Unauthenticated Tool Execution in Dolt MCP (Pillar Security)
13. 0day-Rubbish: Redefining vulnerability disclosure in the AI era. We mass-produce exploitable 0days and disclose them directly (Exploit-Garbage)
14. SgrmFault: Process Impairment Exploit Chain. (Angelo Frasca Caccia and Alejandro Pinna)
15. Turning Chrome Remote Desktop into Pure Red Team Ops (ZeroTrace Lab)
16. Bring Your Own EDR: How to Turn a Commercial EDR into a Trojan Horse (Akamai)
17. AmnesiaStealer: macOS Infostealer That Hijacks Browsers (Jamf)
18. A 12 KB Backdoor Hid Its C2 Domain in desktop.ini Whitespace (Gen Digital)
19. Vipere: BOF exploiting the Visual Studio Installer Elevation Service for SYSTEM LPE and persistence via AppDomainManager hijacking, with native ETW evasion. For Cobalt Strike & Adaptix. (0xaled)
20. KernelSight: Windows kernel driver exploitation knowledge base — 28 case studies organized by driver type, grounded in real CVEs with build numbers and PoC references (splintersfury)
21. pentest-copilot: Pentest Copilot is an AI-powered browser based ethical hacking assistant tool designed to streamline pentesting workflows. (Bugbase)
22. Kimwolf v7: An Evolution of the Kimwolf Botnet (Palo Alto Networks)
23. Using Codex for Email Investigations (sh1katagana1)
24. Taiwan’s internet blackout drill tests cyberattack readiness (SPH Media Trust)
25. Water sector example added to the NCSC’s Secure connectivity principles (National Cyber Security Centre)
26. Windows Internals: Check Your Privilege - The Curious Case of ETW’s SecurityTrace Flag (Connor McGarr)

ARTICLES COVERED:

1. ATEN: Endpoint Telemetry for AI Coding Agents | Anton Ovrutsky (Anton Ovrutsky)
2. OxiSH: a modern, memory-safe SSH server – Dirkjan Ochtman (Dirkjan Ochtman)
3. Microsoft SharePoint JWT Token Authentication Bypass Technical Analysis (CVE-2026-55040) (Rapid7)
4. CVE-2026-55040: SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login (Viettel Group)
5. ShieldBreak: Windows Defender 0day vulnerability (MSNightmare)
6. IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relay (mysk.blog)
7. Hunting Exchange Server 0day like a detective (Jang & Mugmug of MB VRED)
8. Shaping the NVD for the Future: We Need Your Feedback on AI-Enabled Vulnerability Management (National Institute of Standards and Technology)
9. KeyTAR: Practical Keystroke Timing Attacks and Input Reconstruction (University of North Carolina at Chapel Hill)
10. Return of the Cookie Monster (SpecterOps)
11. TrustMeBro: Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, SIP hijacking across 19 file types etc. (KriyosArcane)
12. Attack of The Extensions (SpecterOps)
13. CSS:the bomb inside your inbox (PortSwigger)
14. Fake CCleaner installs GhostDesk Chrome spyware (Malwarebytes)
15. GLM-5.3: Frontier Coding with Emergent Cyber Capabilities (Z.AI Co., Ltd.)
16. Blacklight: Illuminating AI Agent Artifacts for Attackers and Defenders (SpecterOps)
17. Dark: A Mythic C2 Agent with In-Memory BOF Execution on macOS and Linux, Part 1 · Minor Impact (Royce Davis)
18. Dissecting the JWR phishing framework (Cisco Talos)

ARTICLES COVERED:

1. Bypassing Android Hardware Attestation from the Analyst's Chair - Quarkslab's blog (Quarkslab)
2. Digital Forensics: Attacking SAM and Extracting Hashes With 7z (Master OTW (Occupy the Web))
3. Design and Implementation of a Physical Implant Attack on the Boeing 737 (Stefan Savage)
4. skitter-creek-bath-salts: Unlocking _everything_ on the CPU with DRAM scrambling (Christopher Domas)
5. Malware Crypting Services and the Threat Actors Who Sell Them (Recorded Future)

ARTICLES COVERED:

1. Deadbugz: Currently Active MCP Supply-Chain Campaign (Pillar Security)
2. Bybit Sues North Korea and Lazarus Group, Secures Preliminary Injunction Freezing Stolen Assets in Landmark Crypto Asset Recovery Effort (Bybit)
3. Expanding Capabilities to Combat Transnational Cyber-Enabled Crime (The White House)

ARTICLES COVERED:

1. Com group member sentenced for campaign of abuse against 117 victims worldwide (National Crime Agency)
2. Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack - Check Point Research (Check Point Research)
3. Updated GPG key for signing Firefox and Thunderbird Releases – Mozilla Security Blog (Mozilla)
4. [Op Report] From ClickFix SpaceX1337 to Hands-on-Keyboard AD Attack (PKB Communications LLC)
5. Fabian Mosch: The Art of Evasion (Fabian Mosch)
6. Horcrux: AI Agent Skill to build secure, resilient , recoverable storage using Tahoe-LFS (AlloySecureGroup)

ARTICLES COVERED:

1. IP sharing has steadily increased over the past decade, with fewer than 0.2% of domains using a unique IPv4 address and up to millions of domains co-located on single IP addresses. (Zakir Durumeric)
2. Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads (Sonatype)
3. Inside a Russian-Speaking Operator's Ukrainian IP Camera Toolkit (Hunt Intelligence, Inc.)
4. #StopRansomware: Gunra Ransomware (Cybersecurity and Infrastructure Security Agency)
5. Smile, You’re on Camera! Part 2: Lazarus IT Workers Exposed (ANY.RUN)

ARTICLES COVERED:

1. Securing your Amazon S3 buckets: Identifying and remediating over-permissioned access | Amazon Web Services (Amazon Web Services (AWS))
2. blacksea: Blacksea is an active honeypot and canary-bait control system built to detect and drown LLM-driven attackers. Blacksea doesn't stop at watching LLM attacks. (Cracken)
3. CYBERCOM 2.0 (Department of War)
4. threat-model: Agent skill for producing threat models for open-source projects (OpenSSF)
5. ResetNightmare: POC tool for ResetNightmare (CVE-2026-27912) (Semperis)
6. Python in Excel Vulnerability: Root Privilege Escalation & Trusted Records Bypass (SafeBreach)
7. Weaponizing Windows Updates with NotWSUSpicious (SpecterOps)
8. plugandpwn.com :: Plug and Pwn (Alejandro Hernando and Borja Martinez)
9. Abusing Extended Attributes to Bypass Application Control For Business - Shells.Systems (Ian)
10. Bypassing Windows application whitelisting | dotSec (DotSec)
11. Head Mare доставляет бэкдоры PhantomCore и PhantomGraph через необновленный сервер TrueConf - The Head Mare APT group exploits vulnerabilities in an unupdated TrueConf server to deliver PhantomCore (АО «Лаборатория Касперского»)
12. Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM (Genians)
13. FORENSIA: ローカルLLMフォレンジックハーネス - FORENSIA: Local LLM Forensics Harness (S.Nakano)
14. adhammer: Active Directory security-assessment toolkit in Rust — PingCastle-class audit + authorized red-team validation, on a from-scratch DCE/RPC · NTLM · SMB2 · Kerberos stack. (icedracon)
15. claude-red: claude-red is a curated library of offensive security skills designed for the Claude skills system. (William Ortiz)
16. sift: Credential and sensitive-data exposure triage for file shares (Panos Gkatziroulis)
17. Washizukami-Collector: Rust-based Fast Forensics Tool for Windows (tadmaddad)
18. Security update available for Metabase - Please upgrade now - We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 (Metabase)

ARTICLES COVERED:

1. Incoming: Vanguard On-Demand - Microsoft built a Runtime Driver Attestation Report that lets Vanguard verify driver integrity without needing to be present at boot. (Riot Games)

ARTICLES COVERED:

1. Chinese espionage platform active in 13 countries – study (Ukrainian National News (UNN))
2. UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments (Google)
3. 해커와 손잡고 랜섬웨어 피해자 상대 영업…데이터복구업체 대표 실형 - Data recovery company CEO sentenced to prison for partnering with hackers to target ransomware victims (News1)
4. Canadian Man Pleads Guilty to Hacking U.S. Cloud Storage Provider and Extorting Its Customers for Millions (U.S. Department of Justice)
5. Coding agent security: Claude Code, tunnels and LaunchAgents (Elastic)
6. Atlassian Rovo Exfiltrates Data, Bypassing Controls (PromptArmor)
7. AD Research: Two new vulnerabilities could lead to full domain takeover (Semperis)
8. ENDLESSDOORS Is Phoning Home. Pick Up. (VulnCheck)
9. OT Security Analysis: Exposed Devices Attacked in US Water Systems (Forescout)
10. EkkoNtProtect: Use NtProtectVirtualMemory in Ekko timers without needing to use stack pivoting or other RSP shifting tricks (Meowmycks)
11. Borrowing Windows Hello keys for authentication and persistence (Dirk-jan Mollema)
12. Turning Enterprise Update Servers Into Backdoor Factories (0_o) - Part 2 (SpecterOps)
13. When Attackers Hijack Your Inbox: Detecting Mailbox Forwarding Rules with Microsoft Defender XDR (detect.fyi)
14. Alert Zero: Automate alert triage for the agentic SOC (Elastic)
15. ANIMO: ANIMO Azure Network Intel & Mission Ops a C2 based on Azure/Entra assessments (dmcxblue)
16. SOCKSRelayd: SOCKS-focused NTLM relay with persistent session packages and a long-lived SessionBank that owns authenticated TCP connections. (mverschu)
17. WinGuard: A User-Mode Windows Threat Detection Tool Inspired by EDR Techniques, To Help Monitor And Log Any Suspicious Activity On Your PC. (Poly0n)
18. Belarusian leader of international ransomware scheme known as “Ransom Cartel” sentenced to 16 years in prison (U.S. Attorney's Office for the Eastern District of Virginia)

ARTICLES COVERED:

1. ENISA scales up its role in the CVE Program | ENISA (European Union Agency for Cybersecurity (ENISA))

ARTICLES COVERED:

1. QuickFox Supply Chain Attack Used to Deploy FDMTP Implant (Fortinet)

ARTICLES COVERED:

1. omp-re: Reverse-engineering suite for omp: radare2 tools, evidence store, signed audit log, RE status band, and report generator. (lancejames221b)

ARTICLES COVERED:

1. OctLurk and SilkLurk: new Backdoors in Central Asia (Kaspersky)
2. Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers (U.S. Department of State)
3. Scanning 7.6 Petabytes of HuggingFace Training Data for Secrets - 221,000+ live creds (Truffle Security Co.)
4. ENISA Secure by Design and Default Playbook | ENISA (ENISA (European Union Agency for Cybersecurity))
5. Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis (Nanyang Technological University)
6. Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus) (memN0ps)
7. binja-diff: Binary Ninja diffing tool (matteyeux)

ARTICLES COVERED:

1. Implications of Recent CISA Disclosures on Iranian OT Targeting (Dataminr)
2. A new ETSI standard could rewrite the memory-safety debate (CHERI Alliance)
3. ADR: ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber. (Uber)
4. Apple Screen Sharing Pre-Auth RCE (macOS ≤ 26.5) (bl4sty)

ARTICLES COVERED:

1. Tracing SNOWLIGHT: A China-Nexus Campaign Against Government Infrastructure (SOCRadar® Cyber Intelligence Inc.)
2. CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft | Microsoft Security Blog (Microsoft)
3. Uncovering the Fuyao Enterprise: A Shift in Modern Ad-Fraud (Bitsight)
4. Technical Deep Dive into the Entropy Issue - in Coldcard bitcoin hardware wallet (Coinkite)
5. Tailscale in the Hugging Face intrusion: The good news and the bad news (Tailscale)
6. Anthropic's Fever Dream: Claude's package anthropickit that stole real keys (Aikido Security)
7. IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains (Cisco Talos)
8. screenlogger: Private, searchable screen history for macOS. (radkawar)
9. Inside the Falcon How CrowdStrike Catches You (0xDbgman)
10. A New SiliVaccine: North Korea’s Antivirus (Martyn Williams)

ARTICLES COVERED:

1. CosmosEscape: Taking Over Every Azure Cosmos DB (Wiz)
2. Stronger with every update: How we’re making Chrome and the web safer in the AI Era (Google)

ARTICLES COVERED:

1. Amazon identifies North Korean hacker group behind open-source supply chain attacks (Amazon Web Services)
2. @copilot-mcp/apex: A macOS Infostealer Re-Published on npm After Takedown (Safedep)
3. Two Joyfill npm Beta Releases Compromised to Deliver DEV#POP... (Socket)
4. PolinRider Caused Dozens of npm, Go, PHP Compromises (OpenSourceMalware)
5. Adform compromised to serve crypto stealer via supply chain attack (Kevin Beaumont)
6. Mitigation Guidance for Supply Chain Compromise | Google Cloud Blog (Google)
7. 2026 Minimum Elements for a Software Bill of Materials (SBOM) (Cybersecurity and Infrastructure Security Agency (CISA))
8. -[Joint Cyber ​​Security Advisory] Operation Double Barrel (The Relationship Between State-Backed Hacking Organizations and the Gunra Ransomware Group) (AhnLab)
9. Operation Double Barrel (AhnLab Security Intelligence Center (ASEC))
10. Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks (Palo Alto Networks)
11. ClickFix, EtherHiding & a DPRK Wallet Trail (AllSecure Corp)
12. The 73,000-server market reselling Western frontier AI into China - Infrawatch (InfraWatch)
13. Investigating three real-world incidents in our cybersecurity evaluations (Anthropic)
14. Credential Stuffing Campaign Hits SonicWall (Huntress)
15. Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions | Federal Bureau of Investigation (Federal Bureau of Investigation)
16. Welcome to Danglegeddon (Silent Push Inc.)

ARTICLES COVERED:

1. Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit | Proofpoint US (Proofpoint)
2. Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident (Hugging Face)
3. SakDriver: Reversing a Windows Kernel Driver Rootkit (oxfemale)
4. power-pages-security-utils: power pages security utils to analyse and audit power page apps / sites (DfE Digital)

ARTICLES COVERED:

1. "HermeticReader" , The Vulnerability That Turned Adobe's 300M-Install Extension Into a Full WhatsApp Takeover (Guardio)

ARTICLES COVERED:

1. Really Muddy Waters — Refuting the Seedworm Attribution of Commodity MaaS (digicat)
2. Dear Diary, Today I found a Ghost in the Network (Intrusion Truth)
3. Puppeteers: Chinese hackers still trick Claude into dirty work. (NetAskari)
4. Project-Orbital: Operational Relay Box Intelligence, Tracking, & Analysis Lexicon (ORBITAL) (BushidoUK)
5. Inside the growing residential proxy botnet threat (Lumen Technologies)
6. Random Windows Things Part 2: Unexpected Clipboard Data Behaviour (Winsider Seminars & Solutions Inc.)
7. An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Report (Cornell University)
8. Technical Details: Const Evaluation and Data Layout - Rust on CHERI (CHERIoT Platform)
9. The SID that wasn’t there: bypassing KB5014754 to Domain Admin on a fully patched AD CS (Mohamed Alzhrani)

ARTICLES COVERED:

1. APT42: AI-Assisted Rapport Phishing and a More Resilient TAMECAT (Darkatlas Squad)
2. DNS Poisoning Tactics Expand to Hospitality Wi-Fi (ReliaQuest)
3. Russian Global Webmail Espionage (Palo Alto Networks)
4. Windows Persistence Forensics: Services, Scheduled Tasks, and Autoruns (Seth Enoka)
5. Hunt for Certighost (CVE-2026-54121) exploitation (f-bader)
6. KernelCallbackTable Process Injection (S12)
7. beignet: MacOS Shared Library to Shellcode Loader (sliverarmory)
8. What Does Windows HyperGuard (SKPG) Protect in ntoskrnl? (0xflux)
9. Reconstructing cloud identity intrusions from O365 and CloudTrail logs (Doby Baxter)
10. NaX: Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins (Maor Sabag)
11. Virtualization Internals Part 5 - KVM Internals: From VM Creation to Guest Execution (Ayoub Faouzi)
12. SliverC2-Evasion-Suite: Four-kit defense evasion suite for Sliver C2: Crystal Palace loader, sleep masking, in-memory PE execution, and remote process injection with PPID spoofing. (panwnvda)

ARTICLES COVERED:

1. CheckPoint Security Advisory - Action Required - July 2026 Security Update - , we identified one of those in the wild, affecting a handful of customers. (Check Point Software Technologies)
2. Cl0p Exploitation of PTC Windchill & FlexPLM (CVE-2026-12569) (Ransom-ISAC)
3. Its AI agent spent days hacking a company, but sources say OpenAI did not notice for a week (Reuters)
4. Patchmageddon (J.P. Morgan Asset Management)
5. Inside a DPRK BlueNoroff ClickFix Kit (JUMPSEC)
6. Updated Cyber Threat Actor Naming System | Google Cloud Blog (Google)
7. AgentBaiting: How Fake AI Skills Deliver Malware at Scale (Island)
8. SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor - StepSecurity (StepSecurity)
9. @copilot-mcp/apex: A macOS Infostealer Re-Published on npm After Takedown (SafeDep)
10. The Week of Sandbox Escapes (Pillar Security)
11. Silent Replacement of Trusted macOS App Executables (Talal Haj Bakry and Tommy Mysk)
12. SiemQueryBuilder: This repository is for the Threat Intelligence Analyst and The Threat Hunter for performing IOC sweeping on multiple SIEM Platform. (Hashir14k)
13. data-diode: A Data Diode with 2 Raspberry Pi and OpenBSD (Sven Seeberg)
14. Cisco's Transition to a Risk-Based Vulnerability Disclosure Model (Cisco)
15. Next chapter: Restructuring GitHub's bug bounty program (GitHub)
16. raptor-loop-hunt: RAPTOR autonomous looping multi-altitude security vulnerability hunt — Claude Code skill (dinosn)
17. An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports (Cornell University)
18. Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis (Adel ElZemity, Shujun Li, and Budi Arief)
19. The-Jinn-Guard: Kernel-aware agent governance daemon. Tamper-evident hash-chained audit ledger, BPF-LSM enforcement, Z3-backed policy checks. Research prototype. (AlphaReasoning)

ARTICLES COVERED:

1. Analysis of the Latest Tactical and Technical Upgrades of the APT-C-00 (Ocean Lotus) Organization (腾讯 (Tencent))
2. Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged (Hunt.io and Bob Diachenko)
3. Look What You Made Us Patch: 2025 Zero-Days in Review (Google)
4. Security Vulnerability Patterns in AI-Generated Code: A Cross-Model Comparative Study (Shanna M. Kahn and John D. Hastings)
5. Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343) (blog.calif.io)
6. STAR: Semantic-Traffic Alignment and Retrieval for Zero-Shot HTTPS Website Fingerprinting (Institute of Information Engineering, Chinese Academy of Sciences; School of Cyber Security, University of Chinese Academy of Sciences; Institute for Network Sciences and Cyberspace, Tsinghua University)
7. Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR (Bitdefender)
8. BlinkLinkSentiennel: A user-mode detection sensor prototype for bind-link abuse on Windows, the EDR-evasion class documented by Bitdefender (Alloy Secure Group)
9. Using WebDav to Outsmart Smartscreen, MOTW, and that OTHER Alert (R.B.C (g3tsyst3m))
10. CVE-2026-54121: Certighost POC (aniqfakhrul)
11. Shellph: Shellph is a portable command-line utility designed to automate encryption and obfuscation of arbitrary shellcode. Named after my cat (Belph) (xirtam2669)
12. Mohabi: Disaggregating and Sandboxing the Firefox JavaScript Engine (USENIX Association)
13. Procurement guidelines for the cybersecurity of hospitals and healthcare providers (European Union Agency for Cybersecurity (ENISA))
14. Security Guidelines for Storage Infrastructure: Draft SP 800-209r1 Available for Public Comment (National Institute of Standards and Technology)
15. open-connector: Open-source auth gateway connecting 1000+ SaaS providers to AI agents through SDK, CLI, MCP, HTTP, and OpenAPI. (OOMOL Lab)
16. We argue that the bottleneck in LLM vulnerability discovery is not model capability, but codebase decomposition. Along the research, we've discovered .diff are more interesting than we've presumed. (Pwno.io Inc.)
17. Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? (SentinelOne)
18. llm-observer-proxy-go: Run-scoped LLM observation proxy with an embedded Bifrost data plane (xxyyue)
19. Pixels to Payload: Dissecting a Four-Stage Bitmap-Steganography Dropper Delivering AsyncRAT (Rhys Downing)
20. Remus-Stealer-Fileless-Payload-Extraction-C2-Exfiltration-Analysis: "Reverse engineering analysis of Remus Stealer, uses fileless execution, clipboard theft, screen capture, and C2 communication. (kaandemir993)
21. Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel (Cisco Talos)
22. GCSA洞察：Fastjson 1.2.83 “Gadget-Free” 漏洞（0day）深度分析与防御指南 - In-depth Analysis and Defense Guide for the Fastjson 1.2.83 “Gadget-Free” Vulnerability (0day) (The information regarding the organization or individual that controls the content at the provided URL could not be retrieved.)

ARTICLES COVERED:

1. Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days from TA458 (Proofpoint)
2. JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake (Group-IB)
3. Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant (ENKI)
4. TAG-195 Upgrades MaaS Ecosystem with Modular Tools (Recorded Future)
5. New BitLocker extortion activity: RDP, MSSQL, RMM Abuse (AO Kaspersky Lab)
6. Large-Scale GitHub Actions Abuse Powers a Distributed cPanel... (Socket)
7. Oracle Critical Patch Update Advisory - July 2026 - "This Critical Patch Update contains 1449 new security patches across the product families" (Oracle Corporation)
8. Releases now reject new files after 14 days - The Python Package Index Blog (Python Software Foundation)
9. U.S. GAO - Cybersecurity Regulations: Multiple Sectors Are Subject to Potentially Duplicative Reporting Requirements (U.S. Government Accountability Office)
10. UK and partners expose Russian state-supported actors for new ‘zero-click’ phishing campaign targeting Western organisations (National Cyber Security Centre (NCSC))

ARTICLES COVERED:

1. Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (Cybersecurity and Infrastructure Security Agency)

ARTICLES COVERED:

1. MuddyWater: ClickFix to Telegram & PatchAgent Backdoor (Ransom-ISAC)
2. [QuickNote] SolidPDFCreator – Mustang Panda Stage-1 Backdoor (Target India) (kienmanowar)
3. [QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysis (Kienmanowar)
4. Inside Pegasus: The evolution of the world's most notorious spyware system - Amnesty International Security Lab (Amnesty International's Security Lab)
5. OpenAI and Hugging Face partner to address security incident during model evaluation (OpenAI)
6. Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25 (Searchlight Cyber)
7. CVE-2026-50502 : RCE via le service Windows Event Log (Login Sécurité)
8. Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries (Hunt Intelligence, Inc.)
9. Introducing Antares: Highly Efficient Open Weight AI Models for Vulnerability Localization (Cisco)
10. Grand Idea Studio: Reverse Engineering a Ledger Nano X Hardware Implant (Grand Idea Studio)
11. Furtex: Post-exploitation and evasion research toolkit for Linux. (MatheuZSecurity)
12. DPRK’s Famous Chollima Deploys RATs Through ClickFake Job Interviews (SOCRadar® Cyber Intelligence Inc.)
13. ChainVeil and ViteVenom are DPRK’s PolinRider Campaign (OpenSourceMalware)
14. Chinese police repatriate key suspect in phishing and Trojan virus case from Vietnam (China Daily)
15. Unpacking “Cruciferra”: An Analysis of a Sophisticated Crypter Service | Proofpoint US (Proofpoint)

ARTICLES COVERED:

1. The Morris Worm: The Internet's First Major Wake-Up Call (Historical Archive)