Marius Avram @securityshell

man, the silence from google is making me go crazy. the new chrome release has 429 security fixes, mostly found by google itself. why don’t they want to tell the world how cool their latest AI/security work is? at this point, it is absurd to not explain what is going on with this sudden spike.

❗️🚨 An Israeli company has backdoored hundreds of millions of households through countless Smart TV apps, and they're quietly turning Samsung and LG TVs into exit nodes for AI web-scraping. Your TV is relaying strangers' web traffic from your home IP, your bandwidth, your address attached to whatever those scraping jobs touch. Roku, Fire TV and Google TV banned the practice. Samsung and LG didn't. The culprit is Bright Data's proxy SDK, which rides inside Tizen and webOS apps, 200+ on webOS alone. Datacenter IPs get blocked, home IPs don't. Include Security reverse-engineered the SDK and found its relay protocol has no message signing, authentication, or device attestation. Their words: less secure than typical malware command-and-control. To make things worse, they found that in iOS the relay tunnel binds straight to the physical network interface, so it routes around any VPN the user is running. Bright Data's config also ships per-country tiers. Devices in Uzbekistan and Oman are cleared to relay down to 1% battery, with data caps up to 60x the worldwide default. Before the BaCkDoOrEd replies land: technically you agreed. In practice you were enrolled into a global proxy network you were never given the information to refuse. And these exit nodes drag down your IP's reputation, potentially leaving you with blocks from providers.

keyboard_arrow_left Previous keyboard_arrow_right Next

‼️🚨 A new npm supply-chain attack compromised 57 packages across over 286 malicious versions in under 2 hours. The attackers used self-replicating malware, a new version of the Miasma worm, which also used evasion techniques to stay under the radar. The payload targets CI/CD and developer credentials, including GitHub Actions secrets, cloud credentials, Vault tokens, SSH keys, npm and GitHub tokens, and password-manager stores. This variant also injects AI coding assistant config files at `.claude`, `.cursor`, `.gemini`, and `.vscode` paths, a separate persistence and repo-poisoning angle.

keyboard_arrow_left Previous keyboard_arrow_right Next

So we going back to the milw0rm days with str0ke I see..

International Cyber Digest @IntCyberDigest

4 days ago

‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs." The bug: just clicking a

keyboard_arrow_left Previous keyboard_arrow_right Next

56 340 2K 273K 586

Nearly 4 years after the $120M Elrond exploit, Romanian prosecutors say the attackers were former Elrond employees. According to court documents cited by Romanian media: • 1.65 million EGLD were allegedly extracted by exploiting a known smart contract vulnerability before a security fix was deployed. • The exploit reportedly destabilized the WEGLD/EGLD peg and forced the exchange offline due to liquidity issues. • Prosecutors claim the individuals had prior knowledge of the vulnerability through internal discussions. • Two defendants admitted their involvement and received suspended sentences. • A third former employee is currently standing trial. If confirmed through the courts, this would make one of the most significant insider-related incidents in crypto history. elrond-erd-2:native @MultiversXfndn @MultiversX

Introducing Claude Opus 4.8: it builds on Opus 4.7 with sharper judgment, more honesty about its own progress, and the ability to work independently for longer than its predecessors. Available today at the same price.

I sent MSRC multiple 0-click attack vectors, resulting in arbitrary file/directory creation & heap overflow. They said "WONTFIX" as legacy technology (NT4-2025). I sent them a LPE attack vector that broadly weakened the OS and they marked it as "MODERATE" microsoft.com/en-us/msrc/blo…

scworld.com/brief/zero-cli…

Follow every Mythos discovery through our coordinated vulnerability disclosure dashboard. red.anthropic.com/2026/cvd/

Microsoft has banned Nightmare Eclipse from GitHub: github.com/Nightmare-Ecli… This is the researcher who disclosed several zero-days after Microsoft also deleted their MSRC account. They have now moved on to GitLab: deadeclipse666.blogspot.com (h/t to: @[email protected])

🚨 Anthropic just dropped the first Project Glasswing update Claude Mythos found 10,000+ critical vulnerabilities in ONE month: > Cloudflare: 2,000 bugs, 400 high/critical severity > Mozilla: 271 vulnerabilities in Firefox 150 — 10x more vulnerabilities found in Firefox 148 > UK AI Security Institute: first model to solve BOTH their cyber attack simulations end to end > at one partner bank, Mythos prevented a fraudulent $1.5M wire transfer in real time > wolfSSL: found a way to forge certificates on a crypto library used by billions of devices > scanned 1,000+ open source projects > 90.6% true positive rate after human review > maintainers are asking Anthropic to SLOW DOWN because they can’t patch fast enough > Microsoft says patch volume will “continue trending larger for some time” The bottleneck in cybersecurity is no longer finding bugs. It’s fixing them. “Progress on software security used to be limited by how quickly we could find vulnerabilities. Now it’s limited by how quickly we can patch them.”

keyboard_arrow_left Previous keyboard_arrow_right Next

Anthropic @AnthropicAI

2 weeks ago

Last month we launched Project Glasswing, our collaborative AI cybersecurity initiative. Since then, we and our partners have found more than ten thousand high- or critical-severity vulnerabilities in essential software.

518 658 9K 2.7M 1K

WPScan 4.0.0: We're Back wpscan.com/blog/wpscan-4-…

We regret to inform you that the source code for Ente has been leaked. Most likely, it's being auctioned on the dark web. 🧵 Whoever purchases it will regret it for the reasons in this thread.

GitHub @github

3 weeks ago

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version,

584 4K 12K 7.5M 4K

Drupal SA-CORE-2026-004 (PostgreSQL Entity Query SQLi via JSON:API filter array keys) github.com/dinosn/drupal-…

Introducing nginx-poolslip, a fresh RCE for the the latest nginx release 1.31.0. nginx-rift has been patched, but our security agent Vega has found a new 0 day. We will release the full technical writeup with ASLR bypass 30 days after the patch on nebusec.ai.

LAPSUS$ leak site is live with a TeamPCP x LAPSUS$ GitHub auction at $95,000. ~4,000 private repos, framed as 'no extortion, single buyer or free leak'. The supply-chain story making headlines this week ties directly to LAPSUS$ now. If TeamPCP confirms as a LAPSUS$ affiliate, the GitHub-extension breach attribution shifts overnight.

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

Here's the PoC for Nginx CVE-2026-42945 which works against vanilla Ubuntu (and any other distro?) + Nginx with ASLR enabled. I have included all iterations of the PoC the LLM was kicked to improve. TL;DR: We can use an LFI/file-read primitive to leak enough details from /proc//mem to bypass ASLR and achieve reliable RCE, in most cases at first shot. There are still other ways to make it work, with even less subtle primitives. If you ask Geppetto nicely, he will help you ;) github.com/Hamid-K/nginx-…

darkreading.com/vulnerabilitie…

UPDATE: So far we've identified 639 compromised npm package versions across 323 unique packages in tonight’s Mini Shai-Hulud wave. That includes 558 versions across 279 unique @​antv packages. Most were detected within ~6 minutes of publication. socket.dev/blog/antv-pack…