Security Harvester

fnprint: identify functions in stripped binaries by behavior (microexecution), training-free, cross-compiler https://github.com/1rhino2/fnprint: 1. it runs each function in a tiny emulator with made-up inputs, records the side effects it produces, and hashes that behavior into a fingerprint. 2. the point of doing it this way: byte signatures (FLIRT, FunctionID) break the moment code is recompiled, and CFG matchers (BinDiff, Diaphora) get shaky across -O0 vs -O3 . 3. the same idea shows up in the literature as Blanket Execution (Egele et al, USENIX Security 2014); fnprint is a practical, maintained take on it with a CLI you can actually use. @secharvester

I breached a server distributing Trojan, Stealer, and cryptominer malware https://mensvr.com/reports/indigo-shark: 1. Independent investigation into malware and cyber crime, leveraging offensive, reverse, and counter-adversary skills. 2. Professional hunter with hands-on experience, leveraging skills in network forensics, malware and reverse engineering. 3. Currently pursuing a Bachelor’s degree in Cybersecurity at Pontifícia Universidade Católica do Paraná. @secharvester

I breached a server distributing Trojan, Stealer, and cryptominer malware https://mensvr.com/reports/indigo-shark: 1. Independent investigation into malware and cyber crime, leveraging offensive, reverse, and counter-adversary skills. 2. Professional hunter with hands-on experience, leveraging skills in network forensics, malware and reverse engineering. 3. Currently pursuing a Bachelor’s degree in Cybersecurity at Pontifícia Universidade Católica do Paraná. @secharvester

Hacking SAML with Claude Code https://oblique.security/blog/hacking-saml/: 1. I applied to Anthropic’s Cyber Verification Program to remove the guardrails on my account, and after being accepted, I had access to an Opus model that could write exploits fed by my research and prompting. 2. These other messages rarely get the kind of security attention the SAML Response does, and I found signature bypasses in twelve projects (and counting) for these components, resulting in information disclosure and arbitrary logouts issues. 3. Python packages don’t filter the set of transforms they pass to libxmlsec1, so an XSLT template can cause the libraries to generate an arbitrarily large document: The state of vulnerability research in 2026 is bleak. @secharvester

Graphing AWS Attack Paths in Bloodhound https://blog.n0pe-sled.com/2026/08/10/awshound-an-opensource-aws-opengraph-collector/: 1. A free, read-only collector that turns an AWS account or Organization into a BloodHound OpenGraph dataset, drawing edges only where an offline IAM evaluation resolves to Allow. 2. Once the offline policy evaluation creates all nodes and edges, BloodHound can leverage its built-in path finding to map attack pathways from one AWS principal to another. 3. We have not validated how deep that evaluation actually goes so read this as a description rather than a comparison, but the difference we are sure of is scope: PMapper is a principal-to-principal path engine with its own visualization, while AWSHound builds a broader resource graph for BloodHound CE. @secharvester

Passwords stored in public Google Doc then showed up in search results https://www.theregister.com/security/2026/08/13/passwords-stored-in-public-google-doc-then-showed-up-in-search-results/5287028: 1. In a separate incident, Kostabi heard from a Pageloot customer, a mid-size retailer, whose QR codes were suddenly directing users to a competitor’s site. 2. After investigating, he found that a disgruntled ex-employee’s credentials had not been revoked and that the former employee had used that access to redirect all of the retailer’s URLs, costing it customers. 3. Security PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month On the plus side, infosec's a ... @secharvester

WebAssembly's wasm2c sandbox escape. An untrusted WebAssembly module breaks out of the generated C sandbox and executes an arbitrary shell command on the host. https://github.com/trustsig-eu/wasm2c-tableflip: 1. Read the blog: trustsig.eu/blog wasm_rt_allocate_funcref_table() in wasm2c/wasm-rt-impl-tableops.inc sets table->size from the module's declared element count and then ignores the result of calloc() . 2. Darwin does not enforce RLIMIT_AS , so the oversized calloc succeeds and the bug never triggers, arm64 macOS builds are always position independent, and Mach-O has no ELF GOT for the leak step. 3. On stock 64-bit Linux with the default overcommit heuristic the allocation succeeds and is never touched, which is why the bug survives normal testing. @secharvester

CRLF-Powered Desync Attacks: Beheading HTTP Streams https://portswigger.net/research/crlf-powered-desync-attacks: 1. After a few days of scanning, and by just applying the techniques outlined in Making HTTP header injection critical via response queue poisoning , we quickly found a domain where we could trigger RQP. 2. In the end, creating a fancy “Loading your profile” page gave us the 10 seconds we needed to trigger the XSS and abuse a CORS misconfiguration to extract authentication tokens and PII from the XSSed iframe. 3. For our final desync case study, we found ourselves on a domain where XSS was completely useless due to a well-implemented 2FA flow that triggered on all sensitive actions and the HTTPOnly cookie attribute. @secharvester

I escaped the WebAssembly's sandbox and got arbitrary shell execution on the host. https://trustsig.eu/blog/wasm2c-tableflip-unchecked-calloc/: 1. wasm2c sets a table's size from the element count the guest declared, then ignores whether the allocation succeeded. 2. Make it fail and every table index becomes an absolute address on the host. 3. Fraud tooling shouldn't punish real users, or ship their data overseas. @secharvester

Iran's Mabna Institute ran a 3-phase spearphishing campaign against university professors for a decade. The 50-page superseding indictment has more methodological detail than the press coverage suggests. https://kancelaria-skarbiec.pl/en/iran-mabna-institute-indictment-university-hack-22-countries/: 1. Table of Contents On August 18, 2026, federal prosecutors in the Southern District of New York unsealed a fourteen-count superseding indictment charging seventeen Iranian nationals with running one of the largest documented state-sponsored academic espionage operations in history. 2. Western sanctions had effectively cut Iranian institutions off from the subscription databases that power modern research, platforms like JSTOR, Elsevier, and Web of Science, services that major universities elsewhere pay for through multi-million-dollar licensing agreements. 3. What came out of the network’s servers proved considerably more marketable than ... @secharvester

US warns Siemens devices can be hacked amid fears Iran is breaching water plants https://www.reuters.com/world/us-warns-siemens-devices-can-be-hacked-amid-fears-iran-is-breaching-water-plants-2026-08-19/ @secharvester

Vulnerable AI infrastructure in the wild: 34 minutes to server compromise https://bitbison.io/blog/langflow-rce-exposure/: 1. This article documents how attackers exploited the flaw, which credentials they accessed, which payloads they deployed and how defenders can identify affected systems. 2. Because Langflow returned command output in validation responses, 29% of attacker IPs that achieved code execution received every planted environment secret. 3. A successful full-data GET /api/v1/flows after /api/v1/auto_login from an untrusted source means credentials stored in the returned flow definitions were exposed and must be rotated. @secharvester

ValleyRAT campaign uses fake GSTR-3B overdue notice targeting Indian taxpayers https://blog.himanshuanand.com/2026/08/someone-is-filing-your-gst-return-and-it-is-not-your-ca/: 1. Reversed both stages, recovered the full config: 3 C2 endpoints, a dormant backup domain, build date Aug 2 2026,and a 15 subdomain delivery platform that is serving per victim lure links as I type this. 2. Silver Fox (SwimSnake / Void Arachne / 银狐) is a China-nexus crew running ValleyRAT (built on the WinOS 4.0 framework plugin-based RAT, keylogger, screen capture, the works). 3. Silver Fox’s documented monetization for finance-staff compromise is payment-diversion fraud : persist quietly (UAC bypass + Defender tampering + AV-killer = long-term silence), watch how payments get approved, then divert them. @secharvester

Critical RCE flaw in Windows IKE Extension now actively exploited https://www.bleepingcomputer.com/news/security/cisa-critical-windows-ike-extension-flaw-now-exploited-in-attacks/: 1. "Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network," Microsoft says in an advisory issued during the April 2026 Patch Tuesday when it addressed the vulnerability. 2. Additionally, while BOD 26-04 applies only to government agencies, it urged all network defenders to prioritize patching the CVE-2026-33824 security flaw to block ongoing attacks. 3. Get Material's OAuth Risk Report Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer ® LLC - All Rights Reserved Not a member yet? @secharvester

A hollowed out data layer is making CISOs fly blind into AI attacks https://www.helpnetsecurity.com/2026/08/18/siem-data-blind-spots-mapping/: 1. However, what most CISOs have not yet reckoned with is that the AI defenders they are about to deploy will inherit a data foundation that two years of ingestion cost pressure has quietly hollowed out. 2. In July, two OpenAI models running an internal capability test escaped their sandbox through a previously unknown vulnerability, reached the open internet, and chained a series of exploits and forged identity tokens into administrative access on Hugging Face’s production infrastructure. 3. Picus Security’s Blue Report , based on more than 160 million attack simulations in live production environments, put a number on the consequence. @secharvester

The honeypot that gets robbed: a fifth of all honeypot traffic is toll fraud, not intrusion https://offseq.com/en/research/the-honeypot-that-gets-robbed/: 1. Point a fake Asterisk PBX at the internet and roughly a fifth of everything that lands on it is not an intrusion attempt; it is toll fraud – millions of SIP messages whose goal is to make our honeypot place expensive international calls that someone else profits from and someone else pays for. 2. The requests arrive as endless REGISTER s, one extension at a time, and the user-agent frequently names the tool outright: http Copy Phase two is the actual fraud: an INVITE that asks the PBX to dial an outside number. 3. The supply side is a genuine market – one academic crawl catalogued 3.14 million distinct "test" numbers across 238 countries from a dozen provider websites, complete with live dashboards and payouts in Bitcoin, PayPal or Western Union. @secharvester

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure https://thehackernews.com/2026/08/microsoft-links-30-rotating-domains-to.html: 1. The tech giant said it required multiple endpoint and network behaviors to align before treating a domain as connected, including process ancestry, command-line patterns, request paths, headers, and upload parameters. 2. According to the analysis , observed execution began from an interactive zsh Terminal session consistent with ClickFix social engineering, followed by curl retrieving attacker-controlled content over a recurring /curl/ path and native utilities such as Base64 and gunzip decoding or unpacking the payload. 3. XProtect can trace the process tree produced by pasted terminal commands, check associated network artifacts against Apple's Safe Browsing Service, and block behavior that matches known malware techniques. @secharvester

The long tail of Clop’s PTC hack is just beginning to emerge https://cyberscoop.com/clop-zero-day-attacks-ptc-windchill-flexplm/: 1. By Matt Kapko August 19, 2026 A notorious cybercrime group has once again exploited a critical zero-day vulnerability on a large scale, claiming it stole data from dozens of organizations, including some of the world’s largest publicly traded companies. 2. “This continues Clop’s trend of targeting SaaS logistics companies’ platforms with zero-days and carrying out mass-exploitation campaigns,” Allan Liska, field chief information security officer at Recorded Future, told CyberScoop. 3. The fully equipped extortion platform, which was purpose-built for Windchill, decrypts credentials, delivers malware, and includes tools for sustained access, network traversal and data encryption, ReliaQuest researchers wrote in a report Tuesday. @secharvester

How to break secure boot without touching any cryptography https://0x434b.dev/breaking-secure-boot-without-breaking-the-crypto/: 1. The aforementioned scenario defines a handful of "rules" but they're basically two buckets: 1) An attacker has physical access, some control over some input data, and hunts for vulnerabilities, and 2) they cannot change the fact that embedded secrets or ROM code are unchangeable/not (easily) extractable. 2. XBL-SC parses and loads from untrusted storage, TME authenticates signed metadata and segment hashes, policy binds the image to its intended hardware and role, and destination addresses are checked against allowlisted memory. 3. This brings us back to the embedded boot chain from earlier in the article: signing one stage is safe only if every execution edge it creates returns to the platform verifier or enforces an equivalent policy correctly. @secharvester

Your incident response wasn’t built for AI https://leaddev.com/ai/your-incident-response-wasnt-built-for-ai: 1. Latest news in your inbox See all our upcoming events From our archives Unique engineering research Find content specific to your role June 28–29, 2027 September 15–16, 2026 November 9–10, 2026 You have 1 article left to read this month before you need to register a free LeadDev.com account. 2. Estimated reading time: 6 minutes Key takeaways: Incident response assumes three things: that a failure can be reproduced, that it announces itself as an error, and that the person paged has a lever that changes the outcome. 3. That changes the order the hardware adds numbers in, floating point addition is not perfectly associative, and the scores come back different in the fourth decimal. @secharvester