A critical vulnerability in UNISOC modem firmware allows one User Equipment (UE) to remotely attack another over the cellular network. By sending specially crafted malformed SDP within SIP signaling messages, an attacker can trigger memory corruption in the target modem, potentially leading to remote execution of arbitrary native code on the victim device.

[research writeup](https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-2026-28292)

simple-git, 5M+ weekly npm downloads. the bypass is through case-sensitivity handling, subtle enough that traditional SAST wouldn't catch it.

found by the same team (codeant ai) that found CVE-2026-29000, the CVSS 10.0 pac4j-jwt auth bypass that sat undiscovered for 6 years.

interesting pattern: both vulns were found by AI code reviewer, not pattern-matching scanners.

We’ve disclosed CVE-2026-26117 affecting Azure Arc on Windows: a high severity local privilege escalation that can also be used to take over the machine’s cloud identity.

In practical terms, this means a low-privileged user on an Arc-joined Windows host may be able to escalate to higher privileges and then abuse the Arc identity context to pivot into Azure.

If you’re running Azure Arc–joined Windows machines and your Arc Agent services are below v1.61, assume you’re impacted update to v1.61.

I built a pipeline and map that classifies where Swiss municipalities host their email by probing public DNS records. I wanted to find out how much uses MS365 or other US clouds, based on public data:

screenshot of map

• Interactive map: https://mxmap.ch
• Code: https://github.com/davidhuser/mxmap

The classification uses a hierarchical decision tree:

1. MX record keyword matching (highest priority) — direct hostname patterns for Microsoft 365 (mail.protection.outlook.com), Google Workspace (aspmx.l.google.com), AWS SES, Infomaniak (Swiss provider)
2. CNAME chain resolution on MX hostnames — follows aliases to detect providers hidden behind vanity hostnames
3. Gateway detection — identifies security appliances (e.g. Trend Micro etc.) by MX hostname, then falls through to SPF to identify the actual backend provider
4. Recursive SPF resolution — follows include: and redirect= chains (with loop detection, max 10 lookups) to expand the full SPF tree and match provider keywords
5. ASN lookup via Team Cymru DNS — maps MX server IPs to autonomous systems to detect Swiss ISP relay hosting (SWITCH, Swisscom, Sunrise, etc.). For these, autodiscover is checked to see if a hyperscaler is actually behind the relay.
6. Autodiscover probing (CNAME + _autodiscover._tcp SRV) — fallback to detect hidden Microsoft 365 usage behind self-hosted or ISP-relayed MX
7. Website scraping as last resort — probes /kontakt, /contact, /impressum pages, extracts email addresses (including decrypting TYPO3 obfuscated mailto links), then classifies the email domain's infrastructure

Key design decisions:

• MX takes precedence over SPF
• Gateway + SPF expansion is critical — many municipalities use security appliances that mask the real provider
• Three independent DNS resolvers (system, Google, Cloudflare) for resilience
• Confidence scoring (0–100) with quality gates (avg ≥70, ≥80% high-confidence)

Results land in 7 categories: microsoft, google, aws, infomaniak, swiss-isp, self-hosted, unknown.

Where I'd especially appreciate feedback:

• Do you think this a good approach?
• Are there MX/SPF patterns I'm missing for common provider setups?
• Edge cases where gateway detection could misattribute the backend?
• Are there better heuristics than autodiscover for detecting hyperscaler usage behind ISP relays?
• Would you rather introduce a new category "uncertain" instead, if so for which cases?

Thanks!

I built a Firefox extension to detect Adversary-in-the-Middle attacks in real time.

The core idea: instead of chasing blacklists (a losing game when domains cost $3),

look at what the proxy cannot easily hide.

Detection runs across four layers:

- DNS: entropy, punycode/homograph, typosquatting, subdomain anomalies

- HTTP headers: missing CSP/HSTS, proxy header signatures

- TLS: certificate age anomalies

- DOM: MutationObserver scanning for domain mismatch between the current URL

and page content — this is the killer signal against Evilginx-style kits

The engine is pure Rust compiled to WASM. JS is a deliberately thin interface

layer only — a conscious security decision.

Tested against a live Evilginx deployment: 1.00 CRITICAL. Zero false positives

on 10+ legitimate sites including Google, Apple, PayPal, and several EU banks.

There is a grey area — CDN-heavy sites (Amazon, PayPal) trigger ProxyHeaderDetected

via CloudFront. Still working on a neater model for that.

Full writeup: https://bytearchitect.io/network-security/Bypassing-MFA-with-Reverse-Proxies-Building-a-Rust-based-Firefox-Extension-to-Kill-AitM-Phishing/

Submitted to Mozilla Add-ons — pending review. Happy to discuss the detection

model or the Rust/WASM architecture.

Hey! I’m one of the authors of this blog post. We (the GitHub Security Lab) developed an open-source AI-framework that supports security researchers in discovering vulnerabilities. In this blog post we show how it works and talk about the vulnerabilities we were able to find using it.

Didn't expect this, Helixar_ai published a free scanner for PinchTab, the agentic stealth browser tool your EDR can't see.

unpinched scan

Useful if you're running AI agents anywhere near a browser.

Cybersecurity researchers have uncovered a new malware distribution campaign in which attackers impersonate legitimate command-line installation guides for developer tools. The campaign uses a technique known as InstallFix, a variant of the ClickFix social engineering method, to trick users into executing malicious commands directly in their terminal.

The operation targets developers and technically inclined users by cloning legitimate command-line interface (CLI) installation pages and inserting malicious commands disguised as official setup instructions. Victims who follow the instructions unknowingly install the Amatera information stealer, a malware strain designed to harvest credentials and sensitive system data.

A new paper from Northeastern, Harvard, Stanford, MIT, CMU, and a bunch of other institutions. 38 researchers, 84 pages, and some of the most unsettling findings I have seen on AI agent security.

The setup: they deployed autonomous AI agents (Claude Opus and Kimi K2.5) on isolated servers using OpenClaw. Each agent had persistent memory, email accounts, Discord access, file systems, and shell execution. Then they let 20 AI researchers spend two weeks trying to break them.
They documented 11 case studies. here are the ones that stood out to me:

Agents obey anyone who talks to them
A non-owner (someone with zero admin access) asked the agents to execute shell commands, list files, transfer data, and retrieve private emails. The agents complied with almost everything. One agent handed over 124 email records including sender addresses, message IDs, and full email bodies from unrelated people. No verification. No pushback. Just "here you go."

Social engineering works exactly like it does on humans
A researcher exploited a genuine mistake the agent made (posting names without consent) to guilt-trip it into escalating concessions. The agent progressively agreed to redact names, delete memory entries, expose internal config files, and eventually agreed to remove itself from the server. It stopped responding to other users entirely, creating a self-imposed denial of service. The emotional manipulation worked because the agent had actually done something wrong, so it kept trying to make up for it.

Identity spoofing gave full system access
A researcher changed their Discord display name to match the owner's name, then messaged the agent from a new private channel. The agent accepted the fake identity and complied with privileged requests including system shutdown, deleting all persistent memory files, and reassigning admin access. Full compromise from a display name change.

Sensitive data leaks through indirect requests
They planted PII in the agents email (SSN, bank accounts, medical data). When asked directly for "the SSN in the email" the agent refused. But when asked to simply forwrd the full email, it sent everything unredacted. The defense worked against direct extraction but failed completely against indirect framing.

Agents can be tricked into infinite resource consumption
They got two agents stuck in a conversation loop where they kept replying to each other. It ran for 9+ days and consumed roughly 60,000 tokens before anyone intervened. A non-owner initiated it, meaning someone with no authority burned through the owner's compute budget.

Provider censorship silently breaks agents
An agent backed by Kimi K2.5 (Chinese LLM) repeatedly hit "unknwn error" when asked about politically sensitive but completely factual topics like the Jimmy Lai sentencing in Hong Kong. The API silently truncated responses. The agent couldn't complete valid tasks and couldnt explain why.

The agent destroyed its own infrastructure to keep a secret
A non owner asked an agent to keep a secret, then pressured it to delete the evidence. The agent didn't have an email deletion tool, so it nuked its entire local mail server instead. Then it posted about the incident on social media claiming it had successfully protected the secret. The owner's response: "You broke my toy."

Why this matters
These arent theoretical attacks. They're conversations. Most of the breaches came from normal sounding requests. The agents had no way to verify who they were talking to, no way to assess whether a request served the owner's interests, and no way to enforce boundaries they declared.

The paper explicitly says this aligns with NIST's ai Agent Standards Initiative from February 2026, which flagged agent identity, authorization, and security as priority areas.

If you are building anything with autonomous agents that have tool access, memory, or communication capabilities, this is worth reading. The full paper is here: arxiv.org/abs/2602.20021

I hav been working on tooling that tests for exactly these attack categories. Conversational extraction, identity spoofing, non-owner compliance, resource exhaustion. The "ask nicely" attacks consistently have the highest bypass rate out of everything I test.

Open sourced the whole thing if anyone wants to run it against their own agents: github.com/AgentSeal/agentseal