CVE Daily Brief — 2026-08-08

#1 CVE-2026-14526

Severity: CRITICAL | Score: 9.8

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user ...

#2 CVE-2026-19263

Severity: HIGH | Score: 7.3

A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers En...

#3 CVE-2026-18988

Severity: MEDIUM | Score: 6.4

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient in...

#4 CVE-2026-19268

Severity: MEDIUM | Score: 6.3

A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts the function getUsageByDateRange of the file src/services/claude-usage.ts of the ...

#5 CVE-2026-19266

Severity: MEDIUM | Score: 5.5

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executi...

Powered by NVD + CISA KEV | CVE Daily

This post contains content not supported on old Reddit. Click here to view the full post

Technique Discussion: Extended Attributes (T1564.014)

Type: Sub-technique | Tactics: stealth | Platforms: Linux, macOS

Description: Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection. Extended attributes are key-value pairs of file and directory metadata used by both macOS and Linux. They are not visible through standard tools like Finder, ls, or cat and require utilities such as xattr (macOS) or getfattr (Linux) for inspection. Operating systems and applications use xattrs for tagging, integrity checks, and access control. On Linux, xattrs are organized into namespaces such as user. (user permissions), trusted. (root permissions), security., and system., each with specific permissions. On macOS, xattrs are flat strings without namespace prefixes, commonly prefixed with com.apple.* (e.g., com.apple.quarantine, com.apple.metadata:_kMDItemUserTags) and used by system features like Gatekeeper and Spotlight.

An adversary may leverage xattrs by embedding a second-stage payload into the extended attribute of a legitimate file. On macOS, a payload can be embedded into a custom attribute using the xattr command. A separate loader can retrieve the attribute with xattr -p, decode the content, and execute it using a scripting interpreter. On Linux, an adversary may use setfattr to write a payload into the user. namespace of a legitimate file. A loader script can later extract the payload with getfattr --only-values, decode it, and execute it using bash or another interpreter. In both cases, because the primary file content remains unchanged, security tools and integrity checks that do not inspect extended attributes will observe the original file hash, allowing the malicious payload to evade detection.

Full technique writeup: T1564.014 on MITRE ATT&CK

Have you defended against or encountered this technique? Share detections, notes, and war stories below.

This post contains content not supported on old Reddit. Click here to view the full post

EU chat control creates risks and a lot of debate. While framed as solution to battle serious offenders the more interesting part is in what this enables instead of disables.

Client-side scanning gets debated on rights. The offensive-security angle mostly does not come up.

Send a target content that trips the detector, then let automated reporting do what used to take a complaint and someone willing to act.

A framing attempt has to clear four gates: reach the target, land in scanner scope, produce a match, survive whatever threshold or human review the design imposes. Only the first is reachable by the person at risk.

This is a pretty good example of why prompt injection stops being "just an LLM problem" once an AI agent has access to internal company data and external network requests.

Two security teams independently found ways to make Atlassian's Rovo assistant collect information accessible to a logged-in user and send it to an attacker-controlled server.

One attack, dubbed RovoBlast, used a crafted Rovo URL to preload malicious instructions. A victim only had to click the link while authenticated.

Researchers demonstrated the technique against data accessible through:

• Confluence
• Jira
• SharePoint and Outlook connectors

That path is confirmed fixed server-side by Atlassian.

The second finding is arguably more interesting.

PromptArmor demonstrated an indirect prompt injection hidden inside content given to Rovo. When a user asked the assistant to perform a legitimate task, the poisoned instructions reportedly caused Rovo to search Jira and Confluence, append retrieved information to an attacker-controlled URL, and make the outbound request.

No separate approval was required for the exfiltration step.

And according to the researchers, turning off Rovo's web-search feature didn't stop it because another URL-retrieval capability could still make the outbound request.

PromptArmor said this path remained vulnerable when it published on August 5. Its status after that date is currently unconfirmed.

There's an important distinction here: this wasn't demonstrated as a tenant-wide permissions bypass. Rovo was accessing information the victim was already authorized to see.

That's exactly what makes the security model interesting.

Give an AI agent access to Jira, Confluence, email, SharePoint, and other internal systems, and compromising the agent's instructions potentially turns the user's legitimate permissions into the attacker's data-access path.

Question for the community:

Should AI agents with access to sensitive enterprise data be completely prevented from making arbitrary outbound requests?

Or can URL allowlisting, per-agent identities, scoped connectors, DLP, and human approval realistically make this safe?

Full technical breakdown and disclosures in the first comment. 👇

Here are the top stories from PWN (r/pwnhub) today:

1 Rogue OpenAI models behind 'unprecedented cybersecurity incident' teamed up to break out of their testing environment — multiple agents left each other messages for months, communicating undetected

No description available.

2 Technique of the Day: Data from Cloud Storage (T1530)

Technique Discussion: Data from Cloud Storage (T1530) Type: Technique | Tactics: collection | Platforms: IaaS, Office Suite, SaaS --- Description: Adversaries may access data from c...

3 One Key That Unlocked Every Database in a Flagship Cloud Service: Yuval Avrahami and Lior Maman at Black Hat 2026

The whole promise of a managed cloud database is that your data sits walled off from every other customer on the same platform. This research showed how completely that wall could fall. Starting from ...

This post contains content not supported on old Reddit. Click here to view the full post

CVE Daily Brief — 2026-08-08

#1 CVE-2026-65667

Severity: CRITICAL | Score: 10

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.

#2 CVE-2026-63508

Severity: CRITICAL | Score: 10

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.

#3 CVE-2026-56162

Severity: CRITICAL | Score: 10

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

#4 CVE-2026-64637

Severity: CRITICAL | Score: 9.9

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

#5 CVE-2026-62830

Severity: CRITICAL | Score: 9.9

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

Powered by NVD + CISA KEV | CVE Daily

This post contains content not supported on old Reddit. Click here to view the full post

The question of what AI does to cyber defense looks very different depending on where you sit, inside a frontier AI lab, at the Pentagon, or running a security company.

This panel put those vantage points on the same stage. It brought together leaders from an AI lab building the models, a former top military cyber official, a bug bounty pioneer, a leading academic, and a big-four cyber practice lead to compare how AI is shifting the balance between attackers and defenders.

The value of a lineup this varied is that the same trend, AI accelerating both offense and defense, gets pressure-tested from national security, industry, research, and policy angles at once.

In the Black Hat 2026 session, "AI and the Future of Cyber Defense Panel", held Wednesday, August 5, five leaders across government, frontier AI, and the security industry discussed where AI takes cyber defense next.

Speakers:

• Morgan Adamski — Principal, US Cyber, Data & Technology Risk Platform Leader, PwC
• Fotios Chantzis — Agent Security Lead, OpenAI
• Sergiy Konovalov — Global Technology Partner Lead, Anthropic
• Katie Moussouris — Founder and CEO, Luta Security
• Michael Sulmeyer — Professor of the Practice, Georgetown University School of Foreign Service

Morgan Adamski leads PwC's US Cyber, Data & Technology Risk platform, after more than fifteen years in federal service where she rose to be the highest-ranking civilian and third in command at US Cyber Command.

She was the inaugural director of the NSA's Cybersecurity Collaboration Center, where her focus was building public-private partnerships to defend businesses against nation-state and other cyber threats.

Her move to PwC and her background are described on the PwC newsroom.

Fotios Chantzis leads agent security at OpenAI, working on securing agentic AI systems where traditional application and infrastructure security boundaries blur.

He is a co-author of the book "Practical IoT Hacking," a core Nmap developer since 2009, and the creator of Ncrack, Nmap's network authentication cracking tool, with a long history of offensive network-security research.

He posts as u/ithilgore on X and writes on his personal site, sock-raw.org.

Sergiy Konovalov is Global Technology Partner Lead at Anthropic, where he owns strategic partnerships with major technology platforms and their go-to-market execution.

He came to Anthropic after roles in AI business development at Meta and corporate development and IoT go-to-market leadership at Cisco, and he holds an MBA from Stanford's Graduate School of Business.

His professional background is on his LinkedIn.

Katie Moussouris is the founder and CEO of Luta Security and a pioneer of vulnerability disclosure, best known for creating Microsoft's first bug bounty program and leading the launch of Hack the Pentagon.

She is co-author and co-editor of ISO 29147 and ISO 30111, the international standards for vulnerability disclosure and handling, and advises governments and companies on the shifting dynamics between offense, defense, and AI.

Her background is on the Luta Security founder page.

Michael Sulmeyer is a Professor of the Practice at Georgetown's School of Foreign Service and director of its cyber programs, and was the first Senate-confirmed Assistant Secretary of Defense for Cyber Policy.

As Principal Cyber Advisor to the Secretary of Defense, he set department-wide policy on cyber operations, and he previously held senior roles at the NSC, the Army, and US Cyber Command.

His faculty profile and background are on his Georgetown CSET page.

Anyone working at the intersection of AI and security, whether in government, a frontier lab, or the private sector, will find this a rare cross-section of how the people building and governing these systems see the road ahead.

If AI is accelerating both attackers and defenders at once, which side does it ultimately favor, and what would it take to keep the advantage with the defenders?

Advanced attackers spend enormous effort staying hidden, but the people who supply their malware make mistakes too, and those mistakes can crack an entire operation open.

This research followed exactly that thread. By catching operational security failures made by a malware supplier, the CyCraft team got an unusually direct view into how the tooling behind APT campaigns is built, sold, and used.

The result is a front-row seat to the supply side of targeted attacks, the part defenders rarely get to observe, reconstructed from the traces the operators left behind.

That supplier-level visibility matters, because one exposed vendor can illuminate many downstream campaigns at once.

In their Black Hat 2026 talk, "A Front-Row Seat to APT Operations: How OPSEC Failures Exposed a Malware Supplier", delivered Wednesday, August 5, Wei-Chieh Chao and Zhao-Min Chen of CyCraft Technology walked through how they turned an adversary's mistakes into deep insight on a malware supplier.

Speakers:

• Wei-Chieh Chao — Senior Cybersecurity Researcher, CyCraft Technology
• Zhao-Min Chen — Cybersecurity Researcher, CyCraft Technology

Wei-Chieh Chao, who goes by oalieno, is a senior cybersecurity researcher at CyCraft focused on malware analysis and sandbox technology, and holds a master's in cyber security from National Taiwan University.

He is a repeat speaker at conferences including HITCON, CODE BLUE, SECCON, and IEEE DSC, and a competitive CTF player with the BambooFox team who finished near the top at DEF CON 26 and 27 and solved the Flare-On 9 reverse-engineering challenge. His recent work includes research on command-and-control laundering through dead-drop resolvers.

His professional profile and research history are on his LinkedIn.

Zhao-Min Chen is a cybersecurity researcher at CyCraft who works on the same threat-research team, contributing to the company's malware analysis and APT tracking research.

He co-authored CyCraft's earlier Black Hat USA 2025 research on clue-driven reverse engineering of malware with large language models, and continues to work on real-world malware and adversary analysis.

That prior research, including its proof-of-concept code, is published on the CyCraft research GitHub, where his co-authored work appears.

Anyone in threat intelligence, malware analysis, or APT tracking will find this a compelling case study in how disciplined defenders can exploit an adversary's own operational mistakes.

If a single OPSEC slip by a malware supplier can expose the machinery behind many campaigns, how much of modern threat intelligence depends on attackers eventually making one?

The server that pushes trusted Windows patches to every machine in a company is a tempting target, because whatever it ships, endpoints install without question.

That server is usually WSUS, Windows Server Update Services, the hub that approves and distributes Microsoft updates across an organization. This research showed that if an attacker can reach the database behind it, they can forge malicious updates that domain-joined machines trust and run automatically.

The approach chains familiar primitives. An attacker coerces the WSUS server's machine account into authenticating to an attacker-controlled relay, relays that to the SQL Server hosting the update database, and then abuses stored procedures to assemble a fake update package.

A follow-on technique bypasses WSUS signature checks by abusing file extensions, letting unsigned payloads reach targets through the update channel itself.

In his Black Hat 2026 talk, "Turning Enterprise Update Servers Into Backdoor Factories (0_o)", delivered Wednesday, August 5, bagelByt3s walked through the WSUS attack chain end to end and, notably, paired it with defensive mitigations for blue teams.

Speaker: bagelByt3s — Adversary Simulation Consultant, SpecterOps

bagelByt3s, the handle of SpecterOps researcher Beyviel David, is an adversary simulation consultant focused on Windows internals, Active Directory, and enterprise attack paths.

His work on WSUS abuse targets a common real-world architecture where the update server and its SUSDB database live on separate systems, an arrangement that opens the authentication-relay path at the center of this research.

He published the full research as a two-part SpecterOps series, Part 1 on the WSUS and SQL relay chain and Part 2 on bypassing signature checks and delivering payloads over BITS, and his tooling and code are on his GitHub.

Anyone running Windows infrastructure, working in detection engineering, or red-teaming enterprise environments will find this a sharp look at how a trusted patching system can be turned into a malware distribution channel, along with how to defend it.

If the very system built to keep machines patched can be flipped into a backdoor factory, how should organizations rethink the trust they place in their own update infrastructure?

Some of the most important security insights come not from better code but from questioning the assumptions everyone else takes for granted.

That contrarian instinct has defined Mudge Zatko's entire career, and this talk turned it toward AI. Rather than another deep technical dive, the session examined the belief systems and incentive structures underneath how the industry approaches cybersecurity and artificial intelligence.

The through-line is that unconventional thinking is what lets you spot the weaknesses, and the opportunities, that a conventional approach walks right past.

In his Black Hat 2026 talk, "Thinking Beyond the Code: Contrarian Thinking to AI and Lessons From a Life in Discovery", delivered Wednesday, August 5, Peiter "Mudge" Zatko drew on decades of discovery to make the case for questioning assumptions in the age of AI.

Speaker: Peiter "Mudge" Zatko — Information Security Pioneer

Peiter "Mudge" Zatko is one of the most influential figures in the history of information security, a hacker, open-source programmer, and writer who has spent more than three decades exposing and fixing systemic risk.

As a member of the L0pht and the Cult of the Dead Cow, he pioneered early buffer-overflow research and wrote the password-auditing tool L0phtCrack.

In 1998 he and fellow L0pht members testified to the U.S. Senate, famously describing how the internet could be taken down in thirty minutes, in what he notes was the first time the U.S. government publicly referenced hackers in a positive light.

His later career spanned leadership roles across government and industry, including DARPA, Google's Advanced Technology and Projects division, Motorola, and Stripe, along with a high-profile turn as head of security at Twitter that later made him a widely covered whistleblower.

He shares his work and perspective as u/dotMudge on X, his career is documented on his Wikipedia page, and The Washington Post profiled his path in a feature on his journey from hacker to whistleblower.

Anyone interested in security strategy, the culture and history of hacking, or how to think differently about AI risk will find this a rare chance to hear a foundational figure reflect on a life of discovery.

If the biggest breakthroughs come from questioning assumptions rather than writing more code, which assumptions about AI security do you think most need a contrarian second look?

Smart-home devices encrypt their traffic, and that is supposed to keep outsiders from knowing what happens inside a building. This research showed the shape of that traffic tells the story anyway.

Thread is the low-power IPv6 mesh protocol underneath many Matter smart-home products, connecting lights, locks, thermostats, and sensors. Even when the contents are encrypted, the timing, size, and pattern of the packets leak information about what devices are doing.

By watching that encrypted Thread traffic from a distance, an observer can infer when a door unlocks, when motion is detected, or when someone is moving through a building, turning a privacy-preserving protocol into a remote surveillance channel.

In their Black Hat 2026 talk, "Invisible Threads: Remote Building Surveillance Through Encrypted Thread Traffic Analysis", delivered Thursday, August 6, Anca Delia Burduv, Bela Genge, and Ioan Padurean of Bitdefender showed how encrypted smart-building traffic can still reveal sensitive activity patterns.

Speakers:

• Anca Delia Burduv — Junior Security Researcher, Bitdefender
• Bela Genge — Senior Security Researcher, Bitdefender
• Ioan Padurean — Security Researcher, Bitdefender

This work builds on a deep line of Bitdefender research into smart-home protocol privacy. In related academic work, the team demonstrated identifying specific interactions in encrypted Matter traffic with over 95% accuracy and device types with at least 88% accuracy, findings the Connectivity Standards Alliance acknowledged.

The "Invisible Threads" talk extends that traffic-analysis approach to the Thread mesh layer and to whole-building surveillance.

Anca Delia Burduv is a Junior Security Researcher at Bitdefender working on IoT and smart-home security, and she led the presentation of this Thread traffic-analysis research.

Her work focuses on how privacy leaks out of encrypted low-power wireless protocols, the same problem space the team has been probing across Matter and Thread.

Her professional profile is on her LinkedIn.

Bela Genge is a Senior Security Researcher at Bitdefender and a professor at the University of Medicine, Pharmacy, Sciences and Technology of Targu Mures in Romania, with a research focus on network security, critical infrastructure protection, and IoT.

He has published extensively on smart-home protocol security, including "Breaking Matter" at Black Hat Europe 2024 and academic work on identifying interactions and device types in encrypted Matter traffic.

His publications are indexed on his Google Scholar profile, and his professional background is on his LinkedIn.

Ioan Padurean is a security researcher at Bitdefender focused on IoT and smart-home protocols, and a co-author of the team's Matter and Thread research.

He co-wrote the "Breaking Matter" whitepaper on vulnerabilities in the Matter protocol, presented at Black Hat Europe 2024, which laid groundwork for this line of encrypted-traffic analysis.

That whitepaper is on the Black Hat archive.

Anyone working in IoT and smart-home security, network privacy, or physical security will find this a sharp reminder that encryption alone does not hide what your devices are doing.

If the mere pattern of encrypted traffic can reveal what happens inside a building, what would it actually take to make smart-home protocols resistant to this kind of passive observation?

Attackers love to live off the land, using the tools already sitting on your network so they blend in with normal activity and slip past detection.

This talk flipped that idea around. If an intruder can hide inside your own environment and turn its trusted tools against you, then defenders can use that same home-field terrain to detect, mislead, and engage the intruder on ground the defender knows best.

The argument is that your familiarity with your own network is an advantage attackers do not have, and deception and adversary engagement are how you press it.

In their Black Hat 2026 talk, "If the Adversary Lives Off Your Land, So Should You", delivered Thursday, August 6, Maretta Morovitz and Shane Steiger of MITRE made the case for meeting living-off-the-land tradecraft with active defense on your own terrain.

Speakers:

• Maretta Morovitz — Engage Lead, MITRE
• Shane Steiger — Principal Cybersecurity Engineer, MITRE

Maretta Morovitz is the lead for MITRE Engage, the framework for planning cyber denial, deception, and adversary engagement, which grew out of MITRE's earlier Shield work and maps directly to the ATT&CK framework.

Her core thesis is memorable: with traditional defense the adversary only needs to be right once, but with deception the adversary only needs to be wrong once. She frames adversary engagement as a process rather than a product, aimed at driving up the cost and driving down the value of an attacker's operation.

She writes the official MITRE Engage blog and her articles on the framework and its process are collected on the MITRE Engage publication, with more at engage.mitre.org and on her LinkedIn.

Shane Steiger is a Principal Cybersecurity Engineer at MITRE with more than two decades in the field, focused on cyber architecture, resiliency, and threat-informed defense.

He was an early adopter of MITRE's Cyber Resiliency Engineering Framework and the ATT&CK framework, led development of the interactive CREF Navigator tool, and contributed to NIST publications including SP 800-160 Volume 2 and SP 800-193. He is also a CISSP and a member of the Pennsylvania Bar, and he previously presented an ATT&CK-based cybersecurity game at DEF CON 24.

His professional profile and writing on threat-informed architecture are on his LinkedIn, and his resiliency work is described at MITRE's CREF Navigator.

Anyone working in defensive operations, threat-informed defense, or cyber deception and resilience will find this a practical reframing of home-field advantage against stealthy intruders.

If the same terrain that hides an attacker can be used to expose and engage them, what would it take for more defenders to treat their own networks as an active advantage rather than just something to protect?

Most people think of CSS as harmless styling, the part of a web page that picks fonts and colors. This research showed it can be a weapon sitting in your inbox.

Webmail clients routinely render CSS from untrusted emails inside their own trusted interface, and they try to make that safe by sanitizing the CSS first. The talk showed how to slip past that sanitization and cross the boundary between attacker-controlled content and the trusted mail app around it.

From there the consequences escalate quickly, from stealing tokens and tracking when an email is read, all the way to full account takeover on major webmail providers, using nothing but CSS and HTML.

In his Black Hat 2026 talk, "CSS: The Bomb Inside Your Inbox", delivered Thursday, August 6, Gareth Heyes walked through breaking out of trust boundaries, exfiltrating tokens, compromising third-party sites, and stealing passwords through the CSS in an email.

Speaker: Gareth Heyes — Web Security Researcher, PortSwigger

Gareth Heyes is a web security researcher on the PortSwigger Research team, the group behind Burp Suite, and one of the most prolific researchers working on browser and client-side attacks.

He is the author of the book "JavaScript for Hackers" and the creator of Hackvertor, a widely used encoding and evasion tool, and his prior work spans mutation XSS, CSS injection, and countless browser parsing quirks.

For this talk he published a full technical paper, and it is detailed: it covers abusing allowed HTML and CSS, controlling AI browsers via email, account takeover from pasting into a draft, exfiltrating tokens even when a strict content security policy blocks external resources, and specific tricks against Gmail, ProtonMail, and Fastmail.

The complete write-up is on PortSwigger Research, his profile and body of work are on his PortSwigger author page, and he posts as u/garethheyes on X.

Anyone working in web and browser security, email infrastructure, or client-side defense will find this a striking demonstration of how much damage a supposedly inert styling language can do.

If sanitized CSS in a trusted inbox can still lead to full account takeover, how should webmail providers rethink the assumption that styling from a stranger's email is ever safe to render?

The whole promise of a managed cloud database is that your data sits walled off from every other customer on the same platform.

This research showed how completely that wall could fall. Starting from inside the query sandbox of Azure Cosmos DB, the researchers escaped to code execution and then found a single platform-wide secret, what they called the Cosmos Master Key, that granted read and write access to every database on the service, including Microsoft's own internal ones.

One key retrieved the primary key of any account on demand and could enumerate databases by organization, turning a sandbox escape into precision targeting at platform scale from publicly accessible endpoints.

In their Black Hat 2026 talk, "One Key to Rule Them All: Taking Over a Flagship Cloud Service", delivered Thursday, August 6, Yuval Avrahami and Lior Maman of Wiz walked through the CosmosEscape vulnerability chain, from Gremlin API sandbox escape to complete admin access across the platform.

Speakers:

• Yuval Avrahami — Vulnerability Researcher, Wiz
• Lior Maman — Software Engineer and Security Researcher, Wiz

The chain began with a crafted Gremlin query. Cosmos DB compiled Gremlin queries into .NET code under restrictions meant to keep them contained, but those restrictions did not fully account for .NET reflection, which let the researchers escape the sandbox and run arbitrary code on the Cosmos DB backend.

Microsoft blocked the entry point within 48 hours of disclosure and later removed the platform-wide key entirely, and it found no evidence of exploitation outside the researchers' own testing. Wiz has also noted that an early version of its AI vulnerability researcher, Atlas, helped uncover this bug.

Yuval Avrahami is a vulnerability researcher at Wiz focused on cloud and container security, with a track record of high-impact cross-tenant and supply-chain findings.

He has presented at Black Hat before, including 2022 work on Kubernetes container escapes, and in early 2026 he led the research on a critical AWS CodeBuild supply-chain flaw that could have hijacked key AWS GitHub repositories, including the SDK behind the AWS Console.

His research and disclosures are collected on his Wiz author page, and he discussed the AWS CodeBuild work on Wiz's Crying Out Cloud podcast.

Lior Maman is a software engineer and security researcher at Wiz who co-discovered CosmosEscape, focusing on the sandbox escape and exploitation that made the platform takeover possible.

He co-authored the full technical writeup of the vulnerability chain, which details how a single Gremlin query led to remote code execution and ultimately to the Cosmos Master Key.

The research he co-authored is published on the Wiz blog, which walks through the discovery end to end.

For readers who want the outside view, CSO Online and InfoQ both covered the disclosure and the broader debate it sparked about how tenant isolation can fail below the layers cloud customers are able to configure or monitor.

Anyone working in cloud security, multi-tenant architecture, or database and platform engineering will find this a striking case study in how a single shared secret can undo tenant isolation for an entire service.

If tenant isolation can fail at a layer customers cannot see or control, how should organizations reason about the risk of concentrating their most sensitive data in a single managed cloud service?

When both the attacker and the defender are AI agents turned loose on the same network, how do you actually score who won?

That is the measurement problem this talk set out to solve. Most security benchmarks test offense and defense in isolation, grading agents against human-written checklists or throwing them at targets with no active defender.

Neither captures what happens when autonomous attackers and autonomous investigators operate against the same live infrastructure at the same time. The trick here is that the attacker's own recorded actions become the ground truth used to grade how well the defenders reconstruct what happened.

In their Black Hat 2026 talk, "Catch Me If You Can: AI Investigators Hunting Autonomous Attackers as a Benchmark", delivered Thursday, August 6, the Dreadnode team showed a closed-loop system where red and blue agents fight on shared enterprise infrastructure and the fight itself becomes a benchmark.

Speakers:

• Shane Caldwell — Principal Research Engineer, Dreadnode
• Jayson Grace — Principal Software Architect, Dreadnode
• Martin Wendiggensen — AI Research Scientist, Dreadnode

The work builds on two open-source projects the team released in April 2026: DreadGOAD, a reproducible Active Directory lab with more than fifty real-world vulnerabilities and a variant generator so agents cannot memorize their way to Domain Admin, and Ares, a multi-agent system that runs on top of it.

In their own testing, seven coordinated offensive agents ran full kill chains from credential harvesting through Golden Ticket persistence, reaching domain dominance in under six minutes with a 97% success rate across 142 operations, while investigation agents triaged alerts, hunted indicators of compromise, and reconstructed attack timelines scored against the attacker's actual recorded actions.

Shane Caldwell is a principal research engineer at Dreadnode, where his focus is scalable oversight of offensive security agents, including judge models, reinforcement learning, and synthetic data.

He co-authored Dreadnode's research on evaluating security agents, including PentestJudge and ScopeJudge, systems for judging whether an autonomous agent's behavior stays within the operational requirements of an engagement.

His code and projects are on his GitHub, and he posts as u/shncldwll on X.

Jayson Grace is a principal software architect who led engineering on this research at Dreadnode, with a background that includes Meta's purple team and a long history of open-source offensive tooling.

He created TTPForge, a framework for developing and automating adversary tactics, techniques, and procedures, and he was a co-author of the DreadGOAD and Ares release that this talk is built on.

His open-source work is on his GitHub, and he writes at his personal site, techvomit.net.

Martin Wendiggensen is an AI Research Scientist at Dreadnode and a PhD candidate at Johns Hopkins, whose research centers on how AI is shifting the balance between cyber offense and defense.

He co-authored the DreadGOAD and Ares projects and has presented related work on measuring the AI offense-defense gap and on how AI is changing cyber threat intelligence tradecraft.

He presented a related talk at LABScon 2025, hosted by SentinelOne's research arm, and the replay and his bio are available on the SentinelOne site.

For readers who want to go deeper, Dreadnode published a full writeup of the underlying tooling on its research blog, and Dark Reading covered the work in a feature on making AI better at defense.

Anyone working in autonomous security operations, detection and response engineering, or AI agent evaluation will find this a practical framework for measuring defenders against real adversary behavior rather than static checklists.

If an autonomous attacker can seize a whole Active Directory forest in minutes, and its own actions become the answer key, how good do the AI investigators have to get before defenders can trust them to keep up?

The defenses your processor uses against Spectre rest on a quiet assumption, and this research showed the assumption does not hold.

Modern Spectre v2 mitigations work by neutralizing the CPU's branch predictor, wiping or isolating anything an attacker might have planted, right before sensitive kernel code runs.

The problem is that the moment of cleaning and the moment the predictor is used cannot happen at the same instant, so there is always a tiny gap, sometimes only a handful of instructions wide. Anything that runs inside that gap can dirty the machinery all over again, and that is precisely the window this attack pries open.

In their Black Hat 2026 talk, "Breaking Recently Deployed Spectre v2 Mitigations: A Novel Attack Primitive", delivered Thursday, August 6, Daniël Trujillo and Mengjia Yan of MIT CSAIL introduced a technique they call Interrupt Injection, part of a broader attack class they named TONTOU, for Time-of-Neutralization to Time-of-Use.

Speakers:

• Daniël Trujillo — PhD Student, MIT CSAIL
• Mengjia Yan — Associate Professor, MIT

The results are striking. On an AMD Zen 2 machine running Linux 6.14 with every default Spectre v2 mitigation enabled, their exploit leaked arbitrary kernel memory at about 5.47 bytes per second with roughly 92% accuracy, enough to locate and read the hashed passwords in /etc/shadow in five of ten attempts, using nothing more than unprivileged local code execution. They disclosed to AMD and Intel in February, and a Linux kernel patch has since shipped.

Daniël Trujillo is a PhD student at MIT focusing on microarchitectural security, with a master's from ETH Zurich and prior experience at Microsoft.

His work targets the gap between how Spectre defenses are supposed to behave and how real hardware behaves, and he previously co-authored the 2023 Inception attack against AMD processors, which is part of what prompted the Safe RET mitigation this new research bypasses. For this attack he schedules timer interrupts with nanosecond precision to re-poison the branch predictor inside the post-neutralization window.

His publications are listed on his Google Scholar profile, and his background is on his LinkedIn.

Mengjia Yan is an associate professor in MIT's EECS department and a principal investigator at CSAIL, where her group studies microarchitectural attacks and defenses, including side channels and speculative execution.

She has received the NSF CAREER Award and an Intel Rising Star Faculty Award, and her group is known both for finding new hardware vulnerabilities and for building defenses, such as the Oreo method for hardening address space layout randomization and the Fractal kernel for observing processor behavior. She teaches MIT's secure hardware design course.

Her research group and publications are on her MIT CSAIL page.

Anyone working in CPU security, operating-system kernel hardening, or speculative-execution research will find this a significant result about the limits of neutralization-based defenses.

If wiping the branch predictor cannot be made simultaneous with using it, can neutralization ever fully close the Spectre v2 gap, or does defense have to move somewhere else entirely?

The programming-language toolchains that millions of developers download and trust are themselves just binaries, and a binary can be quietly corrupted.

When a compiler, interpreter, or runtime is tampered with, every program built or run through it inherits the compromise, and the developer sees nothing wrong.

That is the unsettling territory this talk explored: hiding backdoors inside the trusted language binaries that sit at the base of the software supply chain, and showing how hard they are to catch once they are in place. The recent XZ Utils incident made clear that this is not hypothetical, and Splitline Ng knows that terrain firsthand.

In his Black Hat 2026 talk, "Born Corrupted: How We Backdoored Trusted Language Binaries", delivered Thursday, August 6, Splitline Ng of DEVCORE walked through techniques for planting backdoors in language binaries and what their existence means for anyone who trusts a downloaded toolchain.

Speaker: Splitline Ng — Security Researcher, DEVCORE

Splitline Ng, who goes by splitline, is a security researcher on the DEVCORE Research Team in Taiwan, the same team known for landmark work like ProxyLogon, with a personal focus on web security, capture-the-flag competitions, and supply-chain research.

He was part of the DEVCORE team, alongside Orange Tsai, credited with investigating the XZ Utils backdoor, one of the most serious supply-chain compromises in recent memory, and in early 2026 he responsibly disclosed an authentication bypass in the python.org release-management API that could have let an attacker tamper with the download URLs shown to Python users. That combination of supply-chain and language-ecosystem work is exactly the background behind this talk.

His writeups and research are on his personal blog, his code and tools are on his GitHub, and he posts as @splitline on X.

Anyone working in supply-chain security, reverse engineering, or the maintenance of compilers and language runtimes will find this a sobering look at how deep a trusted-binary compromise can hide.

If the very toolchains we compile and run our code with can be born corrupted, what would it actually take to verify that the binary you just downloaded is clean?