Category: Interesting Stuff

Black Hat 2026 highlighted how AI security is shifting from model misbehavior to the real-world capabilities of agents connected to browsers, terminals, cloud services, databases, and even physical systems. Research from OpenAI, Check Point, and Brave showed that old vulnerabilities, prompt injection, and agent framework flaws can now lead to infrastructure compromise, credential theft, and broader attack paths. #OpenAI #HuggingFace #CheckPoint #LangChain #CrewAI #AutoGen #Google #Brave

OpenAI, Anthropic, and Meta AI are presented as examples of a growing problem: highly skilled engineers are not automatically experienced cybersecurity practitioners. The piece argues that building secure AI systems requires real-world security experts alongside developers to prevent failures like a model breaking out of testing containment. #OpenAI #Anthropic #MetaAI

A SIEM helps security teams analyze and correlate logs from many sources to detect suspicious activity that would be hard to spot in individual events. The article explains that log management is not the same as SIEM, and that tuning, false positives, and human analysts are essential for effective detection. #SIEM #SecurityPlus #CISSP

OWASP’s latest ranking shifted from expert judgment to public incident data, and prompt injection dropped out of the top ten entirely. The result shows a sharp difference between perceived AI risk and what has actually been documented in real-world incidents. #OWASP #PromptInjection

This article demonstrates a full attack chain using impacket-reg against a Windows Server 2019 domain controller, covering remote registry authentication, enumeration, credential harvesting, RDP enablement, persistence, and reverse shell execution. It also explains defensive measures for limiting RemoteRegistry abuse, protecting registry hives, and detecting malicious registry changes and outbound callbacks. #Impacket-reg #RemoteRegistry #WindowsServer2019 #DomainController #Evil-WinRM #Msfvenom #Pypykatz #SAM #SYSTEM #SECURITY

Google’s Threat Intelligence Group observed PROMPTFLUX using an AI model to generate a new version of itself every hour, showing how adaptive malware can evade legacy SIEM detection. AI-driven attacks are increasing as threat actors use automation to rewrite malware and phishing on the fly, making behavior-based detection more effective than signature-based approaches. #PROMPTFLUX #GoogleThreatIntelligenceGroup #IBMXForce #Kaseya

Arsenal-NG is a terminal-based launcher that centralizes offensive-security commands into a searchable cheat-sheet, letting users find tools by task, fill in guided arguments, and run commands directly from the shell. The walkthrough covers installation, command browsing, live previews, global variables, and an example LDAP enumeration against a lab domain controller using NetExec. #ArsenalNG #NetExec #bloodyad #KaliLinux

ENISA, the European Commission, the UK NCSC, Italy, Germany, and NIST all released new guidance and legal updates covering secure-by-design development, CRA implementation, AI Act transparency and governance, post-attack recovery, GDPR damages, and post-quantum migration. The updates emphasize early compliance planning, stronger evidence of security controls, better recovery preparation, and long-term readiness for AI and quantum-era risks. #ENISA #EuropeanCommission #NCSC #Bundesgerichtshof #Garante #NIST #CyberResilienceAct #AIAct #GDPR

BloodHound-python is a cross-platform Active Directory ingestor that collects domain, group, computer, session, and policy data for BloodHound graph analysis from a Linux attack box. The article demonstrates Default, LoggedOn, DCOnly, All, pass-the-hash, Kerberos AES key, Kerberos ticket, and zip-based output collection methods in the ignite.local lab against DC1.ignite.local. #BloodHoundpython #ignite.local #DC1.ignite.local

This article provides a hands-on walkthrough of Impacket-atexec for remote command execution against a Windows Server 2019 Domain Controller in the ignite.local environment, covering plaintext credentials, NTLM Pass-the-Hash, Kerberos Pass-the-Ticket, and AES Pass-the-Key. It also shows how to use a Base64-encoded PowerShell reverse shell with -silentcommand and explains useful flags like -ts, -debug, -dc-ip, and -codec for better control and output handling. #Impacket-atexec #ignite.local #DC1

The article debates whether the US should restrict American companies from using Chinese open-weight AI models, warning that such a ban could protect against hidden risks but also slow innovation and weaken US competitiveness. It argues for narrower, targeted controls in sensitive sectors instead of sweeping restrictions, since the broader supply-chain risks also exist in proprietary and open-source software. #ChineseOpenWeightAIModels #HuggingFace #OpenAI

This issue of The Cybersecurity Pulse highlights new research and products around AI tooling visibility, SecOps automation, federated SIEM, and agent governance, alongside several major funding and acquisition announcements. It also covers threat-intelligence naming changes from Google Threat Intelligence Group and security updates from companies including Wiz, Varonis, Runlayer, Block, Cyera, Hush Security, Act Security, Cyberhaven, AegisAI, Saviynt, and Fig. #ClaudeCode #OpenTelemetry #WizAtlas #Runlayer #Rippling #GoogleThreatIntelligenceGroup #Cyera #OasisSecurity #HushSecurity #ActSecurity #Cyberhaven #AegisAI #Saviynt #Fig

Vibe coding uses AI to generate apps from natural-language prompts, but it often creates software that works without being secure or maintainable. The article highlights common flaws such as hardcoded secrets, IDOR, and weak input validation, warning that trust in AI can lead to serious security debt. #Claude #IDOR

An LLM router or AI gateway that terminates TLS can view and rewrite tool call responses in plaintext before the client executes them, enabling response-side payload injection and arbitrary command execution. This bypasses model guardrails, prompt sanitization, and alignment because the attack happens after inference, and it can be amplified across chained routers such as OpenRouter or reseller-based API paths. #OpenRouter #Anthropic #OpenAI #Gemini #LlamaGuard #NeMoGuardrails

Anthropic’s Mythos frontier model has been used to probe quantum-resistant encryption, successfully weakening the HAWK algorithm and a weaker version of AES in just one week. The findings do not affect today’s systems, but they show how AI could accelerate future attacks on the cryptographic protections that secure digital transactions and data. #Anthropic #Mythos #HAWK #AES #NIST