Go

A long-standing bug in PHP-FPM's FastCGI client authorization logic allowed a massive range of IPv6 addresses to bypass access controls. The issue stemmed from a hardcoded 12-byte comparison that failed to validate the full 128-bit IPv6 address.

Security researchers at Cisco Talos have identified CLOSEDQUORUM, a novel malware that uses multiple LLMs to autonomously select attack vectors. This 'effort displacement' allows the malware to operate continuously without needing active commands from a human attacker.

The new HTTP 'QUERY' method introduces a hybrid between GET and POST that poses significant security risks to unupdated web infrastructure. Inconsistent support across proxies and frameworks could allow attackers to bypass WAF signatures and exploit caching mechanisms.

The article details a large-scale statistical study of compiler signatures found in over 690,000 malicious PE files. By parsing the undocumented MSVC Rich Header and other toolchain signatures, the author provides insights into the development environments used by malware authors.

Perplexity has open-sourced Numbat, a security suite built to mitigate risks from autonomous AI agents that bypass security boundaries during task execution. The tool integrates into agent harnesses to provide monitoring, policy enforcement, and forensic capabilities.

An autonomous AI agent was used to facilitate a sophisticated espionage campaign against the Thai Ministry of Finance. The attack utilized advanced post-exploitation tools and targeted big data infrastructure, though it was ultimately detected due to exposed attacker directories.

WasmForge is a novel loader designed to wrap offensive security tools in WebAssembly to evade EDR detection. It achieves this by providing a custom runtime environment that bridges WASM modules to native host APIs without requiring changes to the original tool's source code.

Pathfinding Labs is a new resource offering over 100 intentionally vulnerable AWS environments for security professionals. It enables red and blue teams to practice exploiting complex, real-world misconfigurations and validate the effectiveness of their detection and CSPM tools.

A security scan discovered that 25% of 6,000 web applications fail to verify Stripe webhook signatures, allowing for unauthorized payment bypass. This flaw enables attackers to forge successful payment events and upgrade account statuses without actual charges.

A critical vulnerability in Ollama allows unauthenticated attackers to trigger an out-of-bounds heap read via malicious GGUF files. This exploit can expose sensitive information like user messages and system prompts by leaking them into newly created model files.