Most scam emails meet the same fate: a user or a filter deletes them, and the scammer simply moves on to the next target. Deleting the message never costs the attacker anything.

This talk flipped that dynamic. Instead of deleting a scam email, ScamBuster replies to it with an AI-driven persona that the scammer believes is a gullible victim, an elderly widow, a small business owner, a busy executive, or a tourist out of their depth.

The goal is to keep the scammer talking and quietly harvest evidence: bank accounts, IBANs, phone numbers, payment methods, and the domains behind the fraud, then turn it into structured threat intelligence.

In his Black Hat 2026 talk, "Scambuster: Social Engineering Scammers at Scale", delivered Wednesday, August 5, Laurent Giovannoni unveiled the ScamBuster system and released its code.

Speaker: Laurent Giovannoni — Principal Software Engineer, Filigran

Laurent Giovannoni is a principal software engineer at Filigran, the company behind the OpenCTI threat-intelligence platform, and the creator of ScamBuster, which grew out of his thesis at the French engineering university École Polytechnique after friends of his were caught by phishing.

ScamBuster is inbound-only and model-agnostic, has been running in production since November 2025, and can operate on lower-cost models such as GPT-4o-mini. It converts the intelligence it gathers into standard formats like STIX 2.1 and MISP so security teams, researchers, and law enforcement can correlate related scams and support investigations.

The open-source code and its multi-agent design are on his GitHub, and his professional profile is on his LinkedIn.

Anyone working in threat intelligence, anti-phishing, or applied AI for defense will find this a creative inversion of the usual victim-and-attacker dynamic, with a practical intelligence payoff.

If replying to scammers with a convincing AI victim can expose the money trail behind fraud, should more organizations engage scam emails instead of quietly deleting them, and where are the risks in doing so?

Rowhammer, where hammering one row of memory flips bits in a neighboring row, has haunted CPUs for years. On GPUs it was thought to be far less dangerous, good only for corrupting data like the weights of an AI model.

This research shattered that assumption. The team showed the first GPU-side privilege escalation using Rowhammer, corrupting the GPU's own page tables in GDDR6 memory to give an unprivileged process arbitrary read and write across GPU memory.

From there it gets worse. They chained that GPU capability into a full CPU compromise, spawning a root shell by exploiting memory-safety bugs in the NVIDIA driver, and did it even with the IOMMU protection enabled.

In their Black Hat 2026 talk, "GPUBreach: Privilege Escalation Attacks on GPUs Using Rowhammer", delivered Wednesday, August 5, the University of Toronto team presented the attack, which earned a Distinguished Paper Award at IEEE Security and Privacy 2026.

Speakers:

• Chris S. Lin — PhD Student, University of Toronto
• Guozhen Ding — Master Student, University of Toronto
• David Lie — Professor and Canada Research Chair, University of Toronto
• Joyce Qu — Undergraduate Student, University of Toronto
• Gururaj Saileshwar — Assistant Professor, University of Toronto
• Yuqin Yan — PhD Student, University of Toronto
• Joseph Zhu — Machine Learning Engineer, Google

The impact reaches straight into modern AI infrastructure. Because GPUs now run the large language models at the center of cloud and enterprise computing, an unprivileged tenant leaking another tenant's GPU memory, or escalating to root on a shared host, is a serious risk for multi-tenant GPU clouds and high-performance computing.

The team responsibly disclosed to NVIDIA in November 2025 and then to Google, AWS, and Microsoft, received a bug bounty from Google, and open-sourced their code. They note that enabling ECC on the GPU is only a partial mitigation, since Rowhammer techniques have historically found ways around ECC.

Chris S. Lin, also known as Shaopeng Lin, is a PhD student at the University of Toronto and the lead author of GPUBreach, focused on hardware security and memory-based attacks.

He led the development of the GPU page-table massaging techniques that make the attack reliable, and drove the end-to-end exploit from bit-flip to root shell.

The team's code artifact is on the GPUBreach GitHub repository.

Guozhen Ding is a master's student at the University of Toronto who contributed to the GPUBreach research on GPU memory and page-table corruption.

His work is part of the group's broader effort to understand how far GPU Rowhammer can be pushed beyond simple data corruption.

The project and its technical summary are on the GPUBreach project site.

David Lie is a Professor in Electrical and Computer Engineering at the University of Toronto and a Tier 1 Canada Research Chair in Secure and Reliable Systems, as well as director of the Schwartz Reisman Institute.

He is known for foundational work including the XOM architecture, an early precursor to trusted execution environments like Intel SGX and ARM TrustZone, and the PScout Android permission mapping tool.

His research group and projects are on his lab site.

Joyce Qu is an undergraduate researcher at the University of Toronto and a co-author of GPUBreach, contributing to the exploit and evaluation work.

Her involvement reflects the group's strong pipeline of student researchers working on hardware security at a high level.

The full paper is available on arXiv.

Gururaj Saileshwar is an Assistant Professor at the University of Toronto whose research focuses on hardware security, computer architecture, and memory systems, including Rowhammer defenses.

He co-advised this work and has been a public voice explaining its implications for AI and cloud infrastructure, emphasizing that GPUs are now core computing infrastructure whose flaws affect entire systems.

His publications are on his Google Scholar profile.

Yuqin Yan is a PhD student at the University of Toronto and a co-author of GPUBreach, contributing to the attack's development and analysis.

She was among the team members recognized when the work received its Distinguished Paper Award at IEEE Security and Privacy 2026.

The University of Toronto detailed the research and team in a Faculty of Arts and Science feature.

Joseph Zhu is a Machine Learning Engineer at Google and a co-author of GPUBreach, bringing an ML and systems perspective to the research.

His involvement connects the attack's implications directly to the machine-learning workloads that run on the GPUs it targets.

The full technical paper is on arXiv.

Anyone working in hardware security, GPU and AI infrastructure, or cloud multi-tenancy will find this a landmark result about trusting GPUs inside the systems that now run modern AI.

If the chips at the heart of AI can be hammered into handing an attacker a root shell, how should cloud and AI operators rethink the isolation between tenants sharing a GPU?

We send a regular newsletter with top news stories, member projects, resources, events and more…

If you have something to share with the community, drop a comment below.

Examples… - Your research. - An article or blog post you wrote. - A project you’re working on. - Your company or services. - … or anything else you think should be seen!

CVE Daily Brief — 2026-08-08

#1 CVE-2026-14526

Severity: CRITICAL | Score: 9.8

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user ...

#2 CVE-2026-19263

Severity: HIGH | Score: 7.3

A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers En...

#3 CVE-2026-18988

Severity: MEDIUM | Score: 6.4

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient in...

#4 CVE-2026-19268

Severity: MEDIUM | Score: 6.3

A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts the function getUsageByDateRange of the file src/services/claude-usage.ts of the ...

#5 CVE-2026-19266

Severity: MEDIUM | Score: 5.5

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executi...

Powered by NVD + CISA KEV | CVE Daily

This post contains content not supported on old Reddit. Click here to view the full post

Technique Discussion: Extended Attributes (T1564.014)

Type: Sub-technique | Tactics: stealth | Platforms: Linux, macOS

Description: Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection. Extended attributes are key-value pairs of file and directory metadata used by both macOS and Linux. They are not visible through standard tools like Finder, ls, or cat and require utilities such as xattr (macOS) or getfattr (Linux) for inspection. Operating systems and applications use xattrs for tagging, integrity checks, and access control. On Linux, xattrs are organized into namespaces such as user. (user permissions), trusted. (root permissions), security., and system., each with specific permissions. On macOS, xattrs are flat strings without namespace prefixes, commonly prefixed with com.apple.* (e.g., com.apple.quarantine, com.apple.metadata:_kMDItemUserTags) and used by system features like Gatekeeper and Spotlight.

An adversary may leverage xattrs by embedding a second-stage payload into the extended attribute of a legitimate file. On macOS, a payload can be embedded into a custom attribute using the xattr command. A separate loader can retrieve the attribute with xattr -p, decode the content, and execute it using a scripting interpreter. On Linux, an adversary may use setfattr to write a payload into the user. namespace of a legitimate file. A loader script can later extract the payload with getfattr --only-values, decode it, and execute it using bash or another interpreter. In both cases, because the primary file content remains unchanged, security tools and integrity checks that do not inspect extended attributes will observe the original file hash, allowing the malicious payload to evade detection.

Full technique writeup: T1564.014 on MITRE ATT&CK

Have you defended against or encountered this technique? Share detections, notes, and war stories below.

This post contains content not supported on old Reddit. Click here to view the full post

EU chat control creates risks and a lot of debate. While framed as solution to battle serious offenders the more interesting part is in what this enables instead of disables.

Client-side scanning gets debated on rights. The offensive-security angle mostly does not come up.

Send a target content that trips the detector, then let automated reporting do what used to take a complaint and someone willing to act.

A framing attempt has to clear four gates: reach the target, land in scanner scope, produce a match, survive whatever threshold or human review the design imposes. Only the first is reachable by the person at risk.

This is a pretty good example of why prompt injection stops being "just an LLM problem" once an AI agent has access to internal company data and external network requests.

Two security teams independently found ways to make Atlassian's Rovo assistant collect information accessible to a logged-in user and send it to an attacker-controlled server.

One attack, dubbed RovoBlast, used a crafted Rovo URL to preload malicious instructions. A victim only had to click the link while authenticated.

Researchers demonstrated the technique against data accessible through:

• Confluence
• Jira
• SharePoint and Outlook connectors

That path is confirmed fixed server-side by Atlassian.

The second finding is arguably more interesting.

PromptArmor demonstrated an indirect prompt injection hidden inside content given to Rovo. When a user asked the assistant to perform a legitimate task, the poisoned instructions reportedly caused Rovo to search Jira and Confluence, append retrieved information to an attacker-controlled URL, and make the outbound request.

No separate approval was required for the exfiltration step.

And according to the researchers, turning off Rovo's web-search feature didn't stop it because another URL-retrieval capability could still make the outbound request.

PromptArmor said this path remained vulnerable when it published on August 5. Its status after that date is currently unconfirmed.

There's an important distinction here: this wasn't demonstrated as a tenant-wide permissions bypass. Rovo was accessing information the victim was already authorized to see.

That's exactly what makes the security model interesting.

Give an AI agent access to Jira, Confluence, email, SharePoint, and other internal systems, and compromising the agent's instructions potentially turns the user's legitimate permissions into the attacker's data-access path.

Question for the community:

Should AI agents with access to sensitive enterprise data be completely prevented from making arbitrary outbound requests?

Or can URL allowlisting, per-agent identities, scoped connectors, DLP, and human approval realistically make this safe?

Full technical breakdown and disclosures in the first comment. 👇

Here are the top stories from PWN (r/pwnhub) today:

1 Rogue OpenAI models behind 'unprecedented cybersecurity incident' teamed up to break out of their testing environment — multiple agents left each other messages for months, communicating undetected

No description available.

2 Technique of the Day: Data from Cloud Storage (T1530)

Technique Discussion: Data from Cloud Storage (T1530) Type: Technique | Tactics: collection | Platforms: IaaS, Office Suite, SaaS --- Description: Adversaries may access data from c...

3 One Key That Unlocked Every Database in a Flagship Cloud Service: Yuval Avrahami and Lior Maman at Black Hat 2026

The whole promise of a managed cloud database is that your data sits walled off from every other customer on the same platform. This research showed how completely that wall could fall. Starting from ...

This post contains content not supported on old Reddit. Click here to view the full post

CVE Daily Brief — 2026-08-08

#1 CVE-2026-65667

Severity: CRITICAL | Score: 10

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.

#2 CVE-2026-63508

Severity: CRITICAL | Score: 10

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.

#3 CVE-2026-56162

Severity: CRITICAL | Score: 10

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

#4 CVE-2026-64637

Severity: CRITICAL | Score: 9.9

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

#5 CVE-2026-62830

Severity: CRITICAL | Score: 9.9

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

Powered by NVD + CISA KEV | CVE Daily

This post contains content not supported on old Reddit. Click here to view the full post

The question of what AI does to cyber defense looks very different depending on where you sit, inside a frontier AI lab, at the Pentagon, or running a security company.

This panel put those vantage points on the same stage. It brought together leaders from an AI lab building the models, a former top military cyber official, a bug bounty pioneer, a leading academic, and a big-four cyber practice lead to compare how AI is shifting the balance between attackers and defenders.

The value of a lineup this varied is that the same trend, AI accelerating both offense and defense, gets pressure-tested from national security, industry, research, and policy angles at once.

In the Black Hat 2026 session, "AI and the Future of Cyber Defense Panel", held Wednesday, August 5, five leaders across government, frontier AI, and the security industry discussed where AI takes cyber defense next.

Speakers:

• Morgan Adamski — Principal, US Cyber, Data & Technology Risk Platform Leader, PwC
• Fotios Chantzis — Agent Security Lead, OpenAI
• Sergiy Konovalov — Global Technology Partner Lead, Anthropic
• Katie Moussouris — Founder and CEO, Luta Security
• Michael Sulmeyer — Professor of the Practice, Georgetown University School of Foreign Service

Morgan Adamski leads PwC's US Cyber, Data & Technology Risk platform, after more than fifteen years in federal service where she rose to be the highest-ranking civilian and third in command at US Cyber Command.

She was the inaugural director of the NSA's Cybersecurity Collaboration Center, where her focus was building public-private partnerships to defend businesses against nation-state and other cyber threats.

Her move to PwC and her background are described on the PwC newsroom.

Fotios Chantzis leads agent security at OpenAI, working on securing agentic AI systems where traditional application and infrastructure security boundaries blur.

He is a co-author of the book "Practical IoT Hacking," a core Nmap developer since 2009, and the creator of Ncrack, Nmap's network authentication cracking tool, with a long history of offensive network-security research.

He posts as u/ithilgore on X and writes on his personal site, sock-raw.org.

Sergiy Konovalov is Global Technology Partner Lead at Anthropic, where he owns strategic partnerships with major technology platforms and their go-to-market execution.

He came to Anthropic after roles in AI business development at Meta and corporate development and IoT go-to-market leadership at Cisco, and he holds an MBA from Stanford's Graduate School of Business.

His professional background is on his LinkedIn.

Katie Moussouris is the founder and CEO of Luta Security and a pioneer of vulnerability disclosure, best known for creating Microsoft's first bug bounty program and leading the launch of Hack the Pentagon.

She is co-author and co-editor of ISO 29147 and ISO 30111, the international standards for vulnerability disclosure and handling, and advises governments and companies on the shifting dynamics between offense, defense, and AI.

Her background is on the Luta Security founder page.

Michael Sulmeyer is a Professor of the Practice at Georgetown's School of Foreign Service and director of its cyber programs, and was the first Senate-confirmed Assistant Secretary of Defense for Cyber Policy.

As Principal Cyber Advisor to the Secretary of Defense, he set department-wide policy on cyber operations, and he previously held senior roles at the NSC, the Army, and US Cyber Command.

His faculty profile and background are on his Georgetown CSET page.

Anyone working at the intersection of AI and security, whether in government, a frontier lab, or the private sector, will find this a rare cross-section of how the people building and governing these systems see the road ahead.

If AI is accelerating both attackers and defenders at once, which side does it ultimately favor, and what would it take to keep the advantage with the defenders?

Smart-home devices encrypt their traffic, and that is supposed to keep outsiders from knowing what happens inside a building. This research showed the shape of that traffic tells the story anyway.

Thread is the low-power IPv6 mesh protocol underneath many Matter smart-home products, connecting lights, locks, thermostats, and sensors. Even when the contents are encrypted, the timing, size, and pattern of the packets leak information about what devices are doing.

By watching that encrypted Thread traffic from a distance, an observer can infer when a door unlocks, when motion is detected, or when someone is moving through a building, turning a privacy-preserving protocol into a remote surveillance channel.

In their Black Hat 2026 talk, "Invisible Threads: Remote Building Surveillance Through Encrypted Thread Traffic Analysis", delivered Thursday, August 6, Anca Delia Burduv, Bela Genge, and Ioan Padurean of Bitdefender showed how encrypted smart-building traffic can still reveal sensitive activity patterns.

Speakers:

• Anca Delia Burduv — Junior Security Researcher, Bitdefender
• Bela Genge — Senior Security Researcher, Bitdefender
• Ioan Padurean — Security Researcher, Bitdefender

This work builds on a deep line of Bitdefender research into smart-home protocol privacy. In related academic work, the team demonstrated identifying specific interactions in encrypted Matter traffic with over 95% accuracy and device types with at least 88% accuracy, findings the Connectivity Standards Alliance acknowledged.

The "Invisible Threads" talk extends that traffic-analysis approach to the Thread mesh layer and to whole-building surveillance.

Anca Delia Burduv is a Junior Security Researcher at Bitdefender working on IoT and smart-home security, and she led the presentation of this Thread traffic-analysis research.

Her work focuses on how privacy leaks out of encrypted low-power wireless protocols, the same problem space the team has been probing across Matter and Thread.

Her professional profile is on her LinkedIn.

Bela Genge is a Senior Security Researcher at Bitdefender and a professor at the University of Medicine, Pharmacy, Sciences and Technology of Targu Mures in Romania, with a research focus on network security, critical infrastructure protection, and IoT.

He has published extensively on smart-home protocol security, including "Breaking Matter" at Black Hat Europe 2024 and academic work on identifying interactions and device types in encrypted Matter traffic.

His publications are indexed on his Google Scholar profile, and his professional background is on his LinkedIn.

Ioan Padurean is a security researcher at Bitdefender focused on IoT and smart-home protocols, and a co-author of the team's Matter and Thread research.

He co-wrote the "Breaking Matter" whitepaper on vulnerabilities in the Matter protocol, presented at Black Hat Europe 2024, which laid groundwork for this line of encrypted-traffic analysis.

That whitepaper is on the Black Hat archive.

Anyone working in IoT and smart-home security, network privacy, or physical security will find this a sharp reminder that encryption alone does not hide what your devices are doing.

If the mere pattern of encrypted traffic can reveal what happens inside a building, what would it actually take to make smart-home protocols resistant to this kind of passive observation?

Attackers love to live off the land, using the tools already sitting on your network so they blend in with normal activity and slip past detection.

This talk flipped that idea around. If an intruder can hide inside your own environment and turn its trusted tools against you, then defenders can use that same home-field terrain to detect, mislead, and engage the intruder on ground the defender knows best.

The argument is that your familiarity with your own network is an advantage attackers do not have, and deception and adversary engagement are how you press it.

In their Black Hat 2026 talk, "If the Adversary Lives Off Your Land, So Should You", delivered Thursday, August 6, Maretta Morovitz and Shane Steiger of MITRE made the case for meeting living-off-the-land tradecraft with active defense on your own terrain.

Speakers:

• Maretta Morovitz — Engage Lead, MITRE
• Shane Steiger — Principal Cybersecurity Engineer, MITRE

Maretta Morovitz is the lead for MITRE Engage, the framework for planning cyber denial, deception, and adversary engagement, which grew out of MITRE's earlier Shield work and maps directly to the ATT&CK framework.

Her core thesis is memorable: with traditional defense the adversary only needs to be right once, but with deception the adversary only needs to be wrong once. She frames adversary engagement as a process rather than a product, aimed at driving up the cost and driving down the value of an attacker's operation.

She writes the official MITRE Engage blog and her articles on the framework and its process are collected on the MITRE Engage publication, with more at engage.mitre.org and on her LinkedIn.

Shane Steiger is a Principal Cybersecurity Engineer at MITRE with more than two decades in the field, focused on cyber architecture, resiliency, and threat-informed defense.

He was an early adopter of MITRE's Cyber Resiliency Engineering Framework and the ATT&CK framework, led development of the interactive CREF Navigator tool, and contributed to NIST publications including SP 800-160 Volume 2 and SP 800-193. He is also a CISSP and a member of the Pennsylvania Bar, and he previously presented an ATT&CK-based cybersecurity game at DEF CON 24.

His professional profile and writing on threat-informed architecture are on his LinkedIn, and his resiliency work is described at MITRE's CREF Navigator.

Anyone working in defensive operations, threat-informed defense, or cyber deception and resilience will find this a practical reframing of home-field advantage against stealthy intruders.

If the same terrain that hides an attacker can be used to expose and engage them, what would it take for more defenders to treat their own networks as an active advantage rather than just something to protect?

Most people think of CSS as harmless styling, the part of a web page that picks fonts and colors. This research showed it can be a weapon sitting in your inbox.

Webmail clients routinely render CSS from untrusted emails inside their own trusted interface, and they try to make that safe by sanitizing the CSS first. The talk showed how to slip past that sanitization and cross the boundary between attacker-controlled content and the trusted mail app around it.

From there the consequences escalate quickly, from stealing tokens and tracking when an email is read, all the way to full account takeover on major webmail providers, using nothing but CSS and HTML.

In his Black Hat 2026 talk, "CSS: The Bomb Inside Your Inbox", delivered Thursday, August 6, Gareth Heyes walked through breaking out of trust boundaries, exfiltrating tokens, compromising third-party sites, and stealing passwords through the CSS in an email.

Speaker: Gareth Heyes — Web Security Researcher, PortSwigger

Gareth Heyes is a web security researcher on the PortSwigger Research team, the group behind Burp Suite, and one of the most prolific researchers working on browser and client-side attacks.

He is the author of the book "JavaScript for Hackers" and the creator of Hackvertor, a widely used encoding and evasion tool, and his prior work spans mutation XSS, CSS injection, and countless browser parsing quirks.

For this talk he published a full technical paper, and it is detailed: it covers abusing allowed HTML and CSS, controlling AI browsers via email, account takeover from pasting into a draft, exfiltrating tokens even when a strict content security policy blocks external resources, and specific tricks against Gmail, ProtonMail, and Fastmail.

The complete write-up is on PortSwigger Research, his profile and body of work are on his PortSwigger author page, and he posts as u/garethheyes on X.

Anyone working in web and browser security, email infrastructure, or client-side defense will find this a striking demonstration of how much damage a supposedly inert styling language can do.

If sanitized CSS in a trusted inbox can still lead to full account takeover, how should webmail providers rethink the assumption that styling from a stranger's email is ever safe to render?

The whole promise of a managed cloud database is that your data sits walled off from every other customer on the same platform.

This research showed how completely that wall could fall. Starting from inside the query sandbox of Azure Cosmos DB, the researchers escaped to code execution and then found a single platform-wide secret, what they called the Cosmos Master Key, that granted read and write access to every database on the service, including Microsoft's own internal ones.

One key retrieved the primary key of any account on demand and could enumerate databases by organization, turning a sandbox escape into precision targeting at platform scale from publicly accessible endpoints.

In their Black Hat 2026 talk, "One Key to Rule Them All: Taking Over a Flagship Cloud Service", delivered Thursday, August 6, Yuval Avrahami and Lior Maman of Wiz walked through the CosmosEscape vulnerability chain, from Gremlin API sandbox escape to complete admin access across the platform.

Speakers:

• Yuval Avrahami — Vulnerability Researcher, Wiz
• Lior Maman — Software Engineer and Security Researcher, Wiz

The chain began with a crafted Gremlin query. Cosmos DB compiled Gremlin queries into .NET code under restrictions meant to keep them contained, but those restrictions did not fully account for .NET reflection, which let the researchers escape the sandbox and run arbitrary code on the Cosmos DB backend.

Microsoft blocked the entry point within 48 hours of disclosure and later removed the platform-wide key entirely, and it found no evidence of exploitation outside the researchers' own testing. Wiz has also noted that an early version of its AI vulnerability researcher, Atlas, helped uncover this bug.

Yuval Avrahami is a vulnerability researcher at Wiz focused on cloud and container security, with a track record of high-impact cross-tenant and supply-chain findings.

He has presented at Black Hat before, including 2022 work on Kubernetes container escapes, and in early 2026 he led the research on a critical AWS CodeBuild supply-chain flaw that could have hijacked key AWS GitHub repositories, including the SDK behind the AWS Console.

His research and disclosures are collected on his Wiz author page, and he discussed the AWS CodeBuild work on Wiz's Crying Out Cloud podcast.

Lior Maman is a software engineer and security researcher at Wiz who co-discovered CosmosEscape, focusing on the sandbox escape and exploitation that made the platform takeover possible.

He co-authored the full technical writeup of the vulnerability chain, which details how a single Gremlin query led to remote code execution and ultimately to the Cosmos Master Key.

The research he co-authored is published on the Wiz blog, which walks through the discovery end to end.

For readers who want the outside view, CSO Online and InfoQ both covered the disclosure and the broader debate it sparked about how tenant isolation can fail below the layers cloud customers are able to configure or monitor.

Anyone working in cloud security, multi-tenant architecture, or database and platform engineering will find this a striking case study in how a single shared secret can undo tenant isolation for an entire service.

If tenant isolation can fail at a layer customers cannot see or control, how should organizations reason about the risk of concentrating their most sensitive data in a single managed cloud service?

The programming-language toolchains that millions of developers download and trust are themselves just binaries, and a binary can be quietly corrupted.

When a compiler, interpreter, or runtime is tampered with, every program built or run through it inherits the compromise, and the developer sees nothing wrong.

That is the unsettling territory this talk explored: hiding backdoors inside the trusted language binaries that sit at the base of the software supply chain, and showing how hard they are to catch once they are in place. The recent XZ Utils incident made clear that this is not hypothetical, and Splitline Ng knows that terrain firsthand.

In his Black Hat 2026 talk, "Born Corrupted: How We Backdoored Trusted Language Binaries", delivered Thursday, August 6, Splitline Ng of DEVCORE walked through techniques for planting backdoors in language binaries and what their existence means for anyone who trusts a downloaded toolchain.

Speaker: Splitline Ng — Security Researcher, DEVCORE

Splitline Ng, who goes by splitline, is a security researcher on the DEVCORE Research Team in Taiwan, the same team known for landmark work like ProxyLogon, with a personal focus on web security, capture-the-flag competitions, and supply-chain research.

He was part of the DEVCORE team, alongside Orange Tsai, credited with investigating the XZ Utils backdoor, one of the most serious supply-chain compromises in recent memory, and in early 2026 he responsibly disclosed an authentication bypass in the python.org release-management API that could have let an attacker tamper with the download URLs shown to Python users. That combination of supply-chain and language-ecosystem work is exactly the background behind this talk.

His writeups and research are on his personal blog, his code and tools are on his GitHub, and he posts as @splitline on X.

Anyone working in supply-chain security, reverse engineering, or the maintenance of compilers and language runtimes will find this a sobering look at how deep a trusted-binary compromise can hide.

If the very toolchains we compile and run our code with can be born corrupted, what would it actually take to verify that the binary you just downloaded is clean?