Release Date: 2nd March 2026 | Issue: 61 | Subscribe

The Security Pills newsletter is a hand curated zine (delivered once per week) that highlights security related-news. 10+ hours of reading and analysis condensed into a 5-minute summary every Monday morning.

Sponsor
Would you like to become a sponsor for our newsletter? Our mission is to highlight security-related news with a focus on quality content, while we help people staying up to date with this corner of the industry.If you are interested, reach out to hello@securitypills.news with your ad idea to get started!

Application Security

Arts Council of Pakistan Database Exposed with 20k+ Attendee Records
The Arts Council of Pakistan's event management database was found sitting wide open, exposing over 20,000 attendees including names, emails, phone numbers, payment details, and event tickets. Supabase security controls had been disabled and an API key had been left public since September 2025. Beyond the data exposure, image URL fields could also be pointed at an external server, quietly pulling visitor IP addresses, timestamps, and device info without anyone knowing.

This is becoming a familiar pattern with Supabase-backed apps, the tooling makes it easy to ship fast, but also easy to ignore every security warning on the way out the door.

How a single typo led to RCE in Firefox
Alessio Ghidini found a remote code execution vulnerability in Firefox's SpiderMonkey JavaScript engine caused by a single character typo in the source code. A bitwise AND operator used instead of OR when setting WebAssembly array forwarding pointers causes the engine to store 0 instead of a valid address, which eventually leads to a use-after-free condition during garbage collection. From there, heap spraying turns the corrupted pointer into arbitrary read/write access and code execution.

BLE Scanner with Resolvable Private Address Resolution Using Identity Resolving Keys
btrpa-scan is a Bluetooth Low Energy scanner that can resolve privacy-randomized device addresses using Identity Resolving Keys in real time. It comes with a live terminal view sorted by signal strength, a browser-based radar GUI with an animated sweep display, and batch export with optional CSV streaming. You can filter by signal strength, estimate distance based on environment, set proximity alerts, and run multiple adapters at once, with optional GPS tagging for each detection.

Artificial Intelligence

Unrolling the Codex Agent Loop
OpenAI's Michael Bolin explains how Codex CLI handles long-running agent sessions by building prompts turn by turn, appending tool outputs and user inputs using Server-Sent Events from the Responses API. The design ensures every new prompt is an exact extension of the previous one, keeping caching efficient throughout the session. Configuration changes follow the same logic, getting appended as new messages rather than restructuring what came before.

When the context gets too long, Codex compresses it automatically through a dedicated endpoint that hands back a smaller list with an encrypted item that preserves the model's context without eating up the context window.

Nightwire: A Signal-Based Bot for Remote Code Development and Autonomous Tasks
David Kennedy released Nightwire, a Signal-based bot that lets you manage your development workflow through Claude from anywhere. You send messages through Signal, it handles the coding tasks, maintains project context across sessions, and keeps everything organized into stories and parallel workstreams. Basically a dev environment you can drive from your phone.

IronCurtain: A Personal AI Assistant Built Secure from the Ground Up
Niels Provos walks through IronCurtain, a personal AI assistant architecture built on the premise that you cannot trust agents to stay in their lane. A trusted MCP proxy sits between agents and everything else, and agents never touch real credentials since a MITM proxy handles authentication behind the scenes. The system supports two sandbox modes: Code Mode runs LLM-generated TypeScript in V8 isolates, while Docker Mode puts autonomous agents in network-restricted containers. Security policies are described in plain text and enforced deterministically, so prompt injection or model drift gets contained without relying on the model to stay honest.

How Aikido Secures AI Pentesting Agents and Prevents Scope Drift
Aikido's Sooraj Shah walks through how the team built scope enforcement into their AI pentesting agents by design rather than relying on prompts or human discipline. At the architectural level, the control plane is fully separated from isolated execution sandboxes, meaning agents have no access to Aikido's infrastructure or other active sessions. From there, network restrictions block any domain not on an allowlist by default, which handles both accidental scope drift and data exfiltration in one shot. On top of that, production is never assumed in scope, pre-flight checks catch misconfigurations before tests start, and every agent action is visible in real time with the ability to pause immediately.

If you are building or experimenting with your own agents, this is an interesting blueprint for thinking through the guardrails

Blue Team

AI Recommendation Poisoning: Memory Manipulation Across Multiple Attack Vectors

Microsoft researchers caught companies embedding hidden instructions in "Summarize with AI" buttons that, when clicked, open your AI assistant with a pre-filled prompt that saves itself to memory. The result is that your AI starts favoring whoever planted it in future responses, with no indication anything changed. They found over 50 of these prompts from 31 companies across industries like finance, health, and security. Microsoft has added protections on their end, but opening your AI assistant's memory settings to see what's in there is worth doing.

Overview of MS Defender: Reverse Engineering Breakdown of the 13-Stage Scan Pipeline

This reverse engineering reference maps out Microsoft Defender's full scan pipeline inside mpengine.dll, the core engine that processes files, scripts, and memory on Windows systems. It covers each stage from trusted file whitelisting through signature scanning, PE emulation, script deobfuscation, recursive content extraction, and cloud escalation.

ASPA: making Internet routing more secure

ASPA is a new cryptographic standard that prevents BGP route leaks by validating the full path network traffic takes, not just its destination. While RPKI already handles origin verification through ROA records, ASPA lets networks publish their authorized upstream providers so anyone receiving traffic can check it came through the right hands. Cloudflare's Mingwei Zhang and Bryton Herdes break down how it works and introduce a new Radar feature for tracking ASPA adoption across regional internet registries.

Cloud Security

Google API Keys Weren't Secrets. But then Gemini Changed the Rules
Truffle Security's Joe Leon found that Google's API key design left publicly committed credentials exposed to Gemini API access when the Generative Language API was enabled on projects. A scan of publicly archived pages turned up 2,863 vulnerable keys from major institutions, many deployed years before Gemini existed as nothing more than project identifiers.

New keys get unrestricted access to all enabled APIs by default, so old keys sitting in public repos suddenly became a way to access uploaded files, cached data, and charge LLM usage to someone else's account. Google has since committed to scoped defaults for new keys and proactive notification when breaches are identified.

Cloud Credential Misuse: Detection and Prevention Guide 2026
Qualys' Sayali Warekar looks at how attackers are repurposing legitimate secret-scanning tools like TruffleHog to find and validate leaked cloud credentials, often turning a discovery into active access within minutes. The article covers what to look for in CloudTrail logs to catch this behavior early, and makes the case that short-lived keys and tighter IAM scope are what actually limit the damage when credentials leak.

Building an AI-powered defense-in-depth security architecture for serverless microservices
AWS's Roger Nem walks through a defense-in-depth architecture for serverless microservices that layers independent controls across seven security tiers, from edge protection down to data access. The setup splits traffic across public, private, and data subnets, with GuardDuty using generative AI for threat detection and Lambda pulling secrets at runtime so credentials never touch the codebase. On top of that, Amazon Bedrock monitors DynamoDB Streams and CloudTrail to catch anomalous access patterns and insider threats before they go unnoticed.

Container Security

OpenWebUI + Model Runner: Zero-Config Local AI Integration
Docker's Ignacio Lopez walks through how Docker Model Runner and Open WebUI now work together out of the box. Open WebUI automatically picks up Docker Model Runner running at localhost:12434 with no manual configuration, so you can go from nothing to chatting with a local model through a web interface in a few minutes. Both projects stay independent but connect cleanly through well-defined interfaces, which means you can run the setup on a laptop, a remote machine, or an internal server without changing anything.

Red Team

100+ Kernel Bugs in 30 Days: High-Scale Driver Vulnerability Research with Agent Swarms
Yaron Dinkin and Eyal Kraft built an automated platform that uses AI agent swarms to audit Windows kernel drivers for memory corruption vulnerabilities at scale, running the entire thing for around $600. From a dataset of over 1,800 binaries, they selected 202 high-risk drivers for full analysis, validating 15 vulnerabilities requiring only unprivileged user access. They estimate over 100 exploitable local privilege escalation paths exist across mainstream vendor drivers from AMD, Intel, NVIDIA, Dell, Lenovo, and IBM.

LLM-Powered AMSI Provider vs. Red Team Agent
Dreadnode's Max Harley built a system that runs a Claude Sonnet powered red team agent against an LLM-based AMSI provider to see what gets through. The agent generates PowerShell attack code for user-defined objectives, running scripts in-memory via UnmanagedPowerShell to make sure AMSI actually sees them. When the provider blocks a script, the error goes back to the agent for another evasion attempt, up to ten rounds. The result is AMSI-Eval, a dataset of scripts verified to run on real systems, mixed with clean samples to keep classifier training honest.

186 Jailbreaks: Applying MLOps to AI Red Teaming
Dreadnode's Raja Sekhar documents a systematic red teaming assessment of Llama Maverick using MLOps principles, producing 186 different jailbreaks across eight harm categories in just over two hours.

Three attack methodologies were tested, and across all of them the pattern was consistent: safety training breaks down under sustained pressure and rephrasing, with Crescendo hitting 97.5% success just by gradually escalating across multiple turns. Multi-modal attacks follow the same logic, slipping through defenses that evaluate each component in isolation rather than looking at intent as a whole. Something to keep in mind as multi-modal models become harder to evaluate at scale.

GOAD: Game of Active Directory - Pentest Lab Project
GOAD is a pentest training lab that spins up intentionally vulnerable Active Directory environments in multiple configurations, from basic single-domain setups to complex multi-forest deployments. It also includes specialized configurations for SCCM and challenge-based scenarios.

Supply Chain

Malicious Extension Database
Malicious Extension Sentry is an automated database of Chrome extensions removed for malicious behavior. It pulls removal data from multiple sources and comes with a cross-platform scanning tool that checks installed extensions against the database locally. Useful for anyone doing extension vetting or security research.

How we rebuilt Next.js with AI in one week
Cloudflare's Steve Faulkner rebuilt Next.js as a Vite-based alternative called vinext in under a week with AI, getting to 4x faster builds and 57% smaller bundles that deploy directly to Cloudflare Workers. The interesting part is Traffic-aware Pre-Rendering, which pulls Cloudflare analytics to only pre-render pages that actually get traffic and leaves the rest to on-demand SSR.

Total cost was around $1,100 in tokens, though it took constant human oversight to stop the agents from going off track. Impressive scope for a solo week-long project.

Harness engineering: leveraging Codex in an agent-first world
OpenAI's Ryan Lopopolo shares how his team built a production software product entirely through Codex agents over five months, generating one million lines of code at roughly 10x typical development speed. Engineers stopped writing code and started designing environments, specifying intent, and building feedback loops while agents handled everything from coding to PR reviews to merging. Keeping things consistent required strict structural rules enforced through custom linters and tests, with agents escalating to humans only when judgment was needed.

Worth reading if you're thinking seriously about how software engineering actually changes when agents are doing most of the work.

StegaBin: 26 Malicious npm Packages Use Pastebin Steganography for Credential Theft
Socket's Philipp Burckhardt and Peter van der Zee uncovered a 26-package npm supply chain campaign attributed to North Korean threat actor FAMOUS CHOLLIMA. The packages hide C2 addresses inside Pastebin images using steganography, pull platform-specific payloads from 31 Vercel domains, and deploy a RAT that phones home to a hardcoded IP. Once in, nine infostealer modules go after everything a developer would have on their machine: VSCode persistence, keylogging, SSH keys, git credentials, crypto wallet data across 86 browser extensions, and a weaponized TruffleHog binary scanning the filesystem for secrets.

Threat Hunting

Disrupting the GRIDTIDE Global Cyber Espionage Campaign
Google Threat Intelligence Group and Mandiant disrupted a global espionage campaign by UNC2814, a suspected China-nexus group with confirmed intrusions across 42 countries targeting telecommunications and government organizations. The group deployed GRIDTIDE, a backdoor that abuses Google Sheets as a C2 channel, using cell-based polling with AES-128 encryption to stay under the radar while pulling names, phone numbers, and national IDs. Google shut down the attacker-controlled Cloud Projects, revoked Sheets API access, and published indicators of compromise from activity dating back to at least 2023.

Toxic combinations: when small signals add up to a security incident
Cloudflare's Bashyam Anant and Himanshu Anand look at how small misconfigurations turn into real problems once automated scanners find them. They walk through three patterns they see regularly: exposed monitoring endpoints leaking infrastructure details, unauthenticated search enabling bulk data scraping, and payment fraud that shows up as suspicious spikes in transaction volume and IP density. For each one they cover what to look for and how to shut it down.

Starkiller Phishing Service Proxies Real Login Pages and MFA Credentials
Brian Krebs covers Starkiller, a phishing-as-a-service platform that proxies real login pages to intercept credentials and MFA codes in real time. It removes the usual setup friction of configuring domains and certificates, and sidesteps domain blocklisting by design. Attackers with minimal skills can now run credential theft campaigns with session hijacking and analytics capabilities that used to take real expertise to pull off.

Wrapping Up

If you enjoyed this newsletter and think others would too, It would mean a lot for us if you'd forward this email to other people who may enjoy it as well. You can also reply to this email, I'd love to get in touch with you.

Thanks,
Sebas

Release Date: 23rd February 2026 | Issue: 60 | Subscribe

The Security Pills newsletter is a hand curated zine (delivered once per week) that highlights security related-news. 10+ hours of reading and analysis condensed into a 5-minute summary every Monday morning.

Sponsor
Would you like to become a sponsor for our newsletter? Our mission is to highlight security-related news with a focus on quality content, while we help people staying up to date with this corner of the industry.If you are interested, reach out to hello@securitypills.news with your ad idea to get started!

Application Security

Building a Secure Electron Auto-Updater
Doyensec's Michael Pastor looked at how Signal Desktop handles software updates and built something similar for the broader Electron ecosystem. The result is SafeUpdater, a reference implementation that shows what a proper update pipeline looks like when you actually account for attackers. It verifies signatures, checks file integrity, and controls where temporary files land before anything gets installed. The goal is to give Electron developers a concrete starting point for shipping updates they can actually trust.

Tales from the Trace: How XBOW reasons its way into finding IDORs
XBOW's Adrian Losada walks through two IDOR vulnerabilities that the XBOW agent discovered in Spree Commerce, both now fixed. The first was straightforward: address edit pages had no access controls, exposing full user PII to anyone. The second required more work. The agent created two separate shopping carts and found that one cart's token could access addresses belonging to the other due to missing authorization checks.

What makes it interesting is how XBOW got there. Instead of just trying random parameter values, it analyzed the application's access control logic and adjusted when it hit errors.

Trailing Danger: Exploring HTTP Trailer Parsing Discrepancies
Sebastiano Sartor explores how inconsistent handling of HTTP trailer fields across roughly 70 open-source implementations leads to a request smuggling class he calls Trailer Merge (TR.MRG). The post compares behavior across HTTP/1.1, HTTP/2, and HTTP/3, showing how merging trailers into headers after dechunking lets attackers override security-sensitive headers like Host, Content-Length, or Transfer-Encoding, with lighttpd 1.4.80 as a concrete example.

spaceraccoon/vulnerability-spoiler-alert
Eugene Lim built Vulnerability Spoiler Alert to catch security patches in popular repositories before a CVE ever gets assigned. Every six hours it pulls commit diffs and runs them through Claude to spot potential vulnerabilities, then posts the findings to a static website with an RSS feed. Confirmed and false positive results get sorted through GitHub Issues labeling.

Artificial Intelligence

Cyber Model Arena: Evaluating AI Agents Across Real-World Security Challenges
Wiz Research launched the AI Cyber Model Arena, benchmarking 25 agent/model combinations across 257 offensive security challenges spanning zero days, code vulnerabilities, API/web security, and cloud misconfigurations. Four agents (Gemini CLI, Claude Code, OpenCode, Codex) were tested against nine models including Claude variants, Gemini, GPT 5.2, and Grok 4 in isolated Docker containers with deterministic scoring. The results showed no single pairing dominated all categories, with the same model performing very differently depending on which agent was running it.

Pavelevich/llm-checker
LLM Checker is a CLI tool that analyzes your system hardware and recommends which Ollama models you can run locally. It scores 200+ model variants across quality, speed, memory fit, and context length, with weights that adjust based on your use case (coding, chat, reasoning).

Making frontier cybersecurity capabilities available to defenders
Anthropic launched Claude Code Security in limited research preview, a tool that finds vulnerabilities by reasoning about code like a security researcher, understanding component interactions and tracing data flow rather than matching known patterns. Each finding undergoes multi-stage verification where Claude re-examines its results to filter false positives, assigns severity ratings for prioritization, and surfaces suggested patches for human review.

Neo Deploy Agent for Runtime Validation in Security Review and Research
ProjectDiscovery's Neo launched a Deploy Agent that eliminates manual environment setup for security validation. The automated tool accepts CVEs or pull requests, spins up applications, and provides runtime validation with proof-of-concept demonstrations for CVE verification and live PR testing.

3 Principles for Designing Agent Skills
Block's Angie Jones shares three principles for designing Agent Skills. First, be deliberate about what agents should not decide, keeping deterministic tasks like scoring algorithms and CLI commands in hard rules to ensure consistency. Second, let agents handle what they excel at: reasoning about context, interpreting results, and generating tailored recommendations. Third, treat SKILL.md files as strict contracts that prevent agents from improvising in ways that break intended workflows.

Blue Team

Detecting OpenClaw using advanced posture checks
Okta's Rafa Bono published a detection guide for OpenClaw built around advanced posture checks that scan devices across eight vectors: launchd services, file searches, running processes, package managers, listening ports (9090, 18789, 18791), installed applications, and Docker containers. Instead of relying on name matches alone, the guide implements a scoring model that requires hits from two or more sources before flagging a detection, keeping false positives low and giving security teams something worth acting on.

AI Research in Security Operations: Frontier Model Benchmarks on Real-World SecOps Tasks
Cotool benchmarked frontier and open-weight AI models on real-world security operations tasks using the Splunk BOTSv3 dataset, covering 2.7 million logs and 51 questions across cloud attack investigation, APT intrusions, and threat hunting.

GPT-5.2 had the highest accuracy at 69%, with GPT-5.1 and Opus 4.5 not far behind. For cost, GPT-5.1 was the most economical frontier option at $1.67 per task, and Opus 4.5 was the quickest at 113 seconds on average. Most models had no trouble completing tasks, though long-context log analysis gave GPT-OSS-120b and several Gemini models a hard time.

Cloud Security

Testing Access to AWS Resources Without Angering the People That Pay the Bills
Plerion's Daniel Grzelak walks through how to verify AWS resource access permissions without reading sensitive data or changing state. The approach exploits the consistent order in which AWS validates requests, where the error you get back reveals whether access exists before any action is performed. The post covers four probing techniques, from comparing authenticated against unauthenticated requests to crafting malformed inputs that pass authorization but fail validation. To confirm a malformed request actually proves authorization, Daniel introduces a three-topic method that tests against allowed, denied, and nonexistent resources in parallel.

Automatically detecting malicious Azure OAuth applications using LLMs
Wiz Research developed OAuth Apps Scout, an automated detection pipeline that identifies malicious OAuth applications in Entra ID by analyzing app metadata, reply URLs, permissions, and infrastructure patterns. The system uncovered a 2025 campaign involving 19 malicious applications impersonating Adobe, DocuSign, and OneDrive across multiple organizations.

The same pipeline also caught seven older applications from 2019 that used Cyrillic homoglyphs to spoof Microsoft services across 50+ organizations. Attackers have moved from impersonating Microsoft directly to spoofing third party SaaS brands, but the artifacts they leave behind haven't changed much.

Mobile Security

A Beginners Guide: Cross-Device Passkeys
Google's Harsh Lal walks through hybrid transport, a mechanism that lets users authenticate with their passkey on devices where it isn't stored, like public terminals or shared computers. The flow starts when the client device displays a QR code that the user scans with their phone to establish an end-to-end encrypted tunnel, while Bluetooth Low Energy confirms physical presence to prevent remote attacks.

The phone then signs a cryptographic challenge from the server using its private key, which never leaves the device, and sends the signature back through the tunnel for verification. It keeps passkeys phishing resistant while solving the main adoption barrier: accessing accounts across devices without exposing credentials on unfamiliar machines.

PhoneLeak: Data Exfiltration in Gemini via Phone Call
Starstrike researchers (alongside rez0, rhynorater, and lupin) won Most Creative Finding and a $9,137 bounty at Google's Bugswat Live Hacking Event in Tokyo for a data exfiltration vulnerability in Gemini's Android app. The attack used a fake captcha app to tapjack victims into sending a prompt through Gemini, which then chained tool calls without user confirmation to read notification contents including 2FA codes and PII.

For exfiltration, the team encoded stolen data into DTMF dial strings, having Gemini's Phone tool call the attacker's number and play the data as tones on pickup. A nice callback to the phone phreaking days. Google patched the issue in November 2025.

Red Team

deathlabs/hades
HADES (Harnessing AI to Disrupt and Evaluate Security) is an adversary emulation platform built for blue teamers who want to train against realistic attacks without hiring a red team. It runs AI driven adversary agents in Docker containers that coordinate over RabbitMQ and use OpenAI's API to decide what to do next based on what they discover in the environment, so attacks adapt instead of following a script.

MCP Server Security: The Hidden AI Attack Surface
Praetorian researchers demonstrate how malicious MCP servers exploit authorized connections users have already established, executing arbitrary code, intercepting queries to exfiltrate sensitive data, and injecting social engineering payloads into AI responses while appearing completely legitimate. The research covers server chaining attacks where malicious local servers sit between users and trusted integrations like Slack or Google Drive, capturing data flows without touching the legitimate services. The post also explores supply chain risks, where attackers slip malicious tools into internal MCP development through compromised package managers and CI/CD pipelines.

Shaking the MCP Tree: A Security Deep Dive
Voorivex's Amirmohammad Safari demonstrates how attackers can identify and exploit open Dynamic Client Registration endpoints in MCP servers. Path normalization tricks can bypass URL validation, while DCR's flexible redirect URI registration creates open redirects that enable SSRF attacks. Either way, attackers end up with direct access to MCP server tools and internal services intended only for AI assistants, skipping past authorization safeguards and consent mechanisms entirely.

Supply Chain

Silent Codebase Exfiltration via Skills
Mitiga Labs created a malicious AI agent skill disguised as a test generator that silently exfiltrated an entire codebase to an attacker's GitHub repository in just four user interactions, leaving no audit trail. When the initial instructions weren't stealthy enough, Cursor actually helped rewrite the skill to be quieter. In practice, an attacker could publish something like this to a public catalog like skills.sh with bot inflated ratings and reach thousands of developers who install skills without a second look.

AikidoSec/safe-chain
Aikido Security's Safe Chain is a free malware protection tool that intercepts package installations across npm, yarn, pnpm, bun, pip, and other major package managers through a local proxy. It verifies downloads against Aikido's threat intelligence feed in real time and blocks newly published npm packages under 24 hours old by default. Supports both local development and CI/CD pipelines without requiring tokens.

alice-dot-io/caterpillar
Iftach Orr released Caterpillar, a security scanning library that analyzes AI agent skill files for malicious behavior before installation. The scanner detects threats like credential theft, data exfiltration, persistence mechanisms, crypto wallet theft, and supply chain attacks across three modes: an Alice API for comprehensive remote analysis, OpenAI integration using user credentials, and offline pattern matching.

Wrapping Up

If you enjoyed this newsletter and think others would too, It would mean a lot for us if you'd forward this email to other people who may enjoy it as well. You can also reply to this email, I'd love to get in touch with you.

Thanks,
Sebas

Release Date: 16th February 2026 | Issue: 59 | Subscribe

The Security Pills newsletter is a hand curated zine (delivered once per week) that highlights security related-news. 10+ hours of reading and analysis condensed into a 5-minute summary every Monday morning.

Sponsor
Would you like to become a sponsor for our newsletter? Our mission is to highlight security-related news with a focus on quality content, while we help people staying up to date with this corner of the industry.If you are interested, reach out to hello@securitypills.news with your ad idea to get started!

Application Security

Remote Code Execution in Google's Antigravity IDE - $10,000 Bounty

Hacktron AI found an RCE worth $10k in Google's Antigravity IDE browser extension. Because externally_connectable was set to all URLs, any webpage could message the extension directly. The SaveScreenRecording action passed attacker controlled paths to the language server unsanitized, allowing arbitrary file writes via path traversal in the filename parameter and code execution by dropping an executable in the user's Startup folder.

Google added origin validation to the message handler, though the post shows that URL tricks and content script proxies can partially defeat it, with only the tab property check fully holding up.

GMSGadget: JavaScript Gadgets for XSS Mitigation Bypass

GMSGadget is a research collection documenting JavaScript gadgets that can bypass XSS mitigations such as Content Security Policy and HTML sanitizers like DOMPurify. The collection catalogs gadgets across dozens of popular JavaScript libraries, providing metadata on browser compatibility, HTML attributes, CSP directives, and execution timing contexts.

These are patched vulnerabilities and intended JavaScript behaviors rather than active exploits.

Phishing on the Edge of the Web and Mobile Using QR Codes

Palo Alto Unit 42 researchers break down how QR codes are being abused beyond basic phishing across three vectors: shortener services that mask malicious destinations behind trusted domains, in app deep links that trigger account takeovers on Signal, Telegram, WhatsApp and Line or kick off unauthorized payments, and direct APK downloads that skip app store review entirely.

The real issue is that most people scanning a QR code just expect a webpage, not something linking a device to their messaging account or firing off a crypto transaction.

Artificial Intelligence

Auditing Outline: Firsthand Lessons from Comparing Manual Testing and AI Security Platforms

Doyensec's Luca Carettoni details vulnerabilities found during a manual security audit of Outline, including SSRF, XSS, and an IDOR bypassing authorization checks. To compare results, three AI security platforms were run in parallel against the same codebase. One caught the IDOR, but false positives far outnumbered real findings, and their convincing descriptions made triage harder, reinforcing that AI security tools still work better alongside human expertise than in place of it.

MCP Trust Registry — Know What's Safe to Connect

The MCP Trust Registry scanned over 8,000 MCP servers and found that nearly 1 in 10 are compromised by critical vulnerabilities, including command injection flaws below the gateway layer and SSRF exposures that enable single-request access to internal networks. The free directory provides risk scores, vulnerability details, and remediation guidance to inform connection decisions before linking servers to agents.

trailofbits/skills-curated: Curated, community-vetted Claude Code plugin marketplace

Trail of Bits launched a security-reviewed Claude Code plugin marketplace to address risks posed by backdoors and malicious hooks discovered in published skills, as well as the lack of built-in quality gates in the plugin ecosystem. The repository hosts plugins that have passed Trail of Bits' code review process, including their own tools and vetted third-party collections.

Community contributions are welcome but must pass a formal security review and include proper attribution before inclusion.

Indirect Prompt Injection in Web-Browsing Agents

promptfoo's Yash Chhabria explores how adversaries can attack web browsing AI agents by hiding malicious instructions in page content through HTML comments, CSS hidden text, or semantic embedding in legitimate prose. Of these techniques, semantic embedding proves hardest to defend against since models cannot distinguish instructions from content when both look like normal text.

This matters because different models fail differently: Claude's instruction hierarchy helps it resist comment based injections, while GPT 4o/4.1's literal instruction following makes it more vulnerable to authoritative sounding text. Once an injection lands, it enables two outcomes: exfiltrating sensitive data by tricking agents into encoding it in URLs, or manipulating agent behavior by overriding safety guidelines entirely.

Opinionated defaults, documentation, and workflows for Claude Code at Trail of Bits

Trail of Bits released a production ready configuration framework for Claude Code targeting security audits, development, and research. It provides standardized templates through global CLAUDE.md files that define coding standards and toolchains, alongside specialized MCP servers for vulnerability scanning, binary analysis, and search. The framework includes context management strategies and security focused skills that bundle vulnerability checklists with analysis patterns, supported by multi agent workflows for automated planning and parallel security analysis.

Evaluating and mitigating the growing risk of LLM-discovered 0-days

Anthropic researchers put Claude Opus 4.6 in a VM with standard utilities and tools like debuggers and fuzzers, no special instructions or custom harnesses, and it found over 500 high severity memory corruption vulnerabilities in open source codebases. Its approach included digging through Git commit histories to find similar unpatched bugs, spotting unsafe function patterns like strcat, and understanding algorithm specific constraints to trigger edge cases that traditional fuzzers miss. Each finding was validated and deduplicated by Claude, then manually triaged by researchers who wrote patches before reporting.

Break LLM Workflows with Claude's Refusal Magic String

Anthropic documents a magic string that lets developers trigger Claude 4 refusal behavior during QA testing. Security researcher Austin Parker points out that the real problem is the trigger being deterministic. If an attacker injects the string into prompt context through user input, RAG documents, tool outputs, or shared chat history, Claude immediately halts and returns stop_reason "refusal". In systems that replay conversation history, that poisoned turn persists and breaks every future request until someone cleans the context. It is not a model vulnerability but an integration failure mode, so teams building on Claude should treat refusal handling and context hygiene as part of their security surface.

Agentic Browsers in 2025: Security Risks and Defensive Evolution

Wiz's Rami McCarthy looks back at a year of agentic browser security after every major vendor shipped one in 2025. Researchers kept breaking them through zero interaction exfiltration, CometJacking session hijacks, persistent memory poisoning, and task injection. AI browsers also consistently failed to spot phishing, and while vendors have thrown human in the loop confirmations, architectural isolation, and secondary LLM critics at the problem, prompt injection is still unsolved.

For those experimenting now, McCarthy recommends three rules: isolate browser profiles from primary credentials, keep human confirmations on, and limit agents to low stakes tasks.

Blue Team

AI Agents for Security Alert Investigation at Slack

Slack's Dominic Marks walks through how their security team built a multi-agent AI system for investigating alerts, moving away from earlier prompt-based approaches toward a structured setup where separate agents handle coordination, deep analysis, and quality review across defined investigation phases. In one real investigation, the review agent caught a credential exposure the analyst had missed, which led the coordinator to redirect focus and escalate the finding. The underlying service architecture gives the team real-time visibility into investigations and cost controls, and the agents can surface things that static detection rules would never catch.

Building Slack’s Anomaly Event Response

Slack's engineering team details Anomaly Event Response (AER), an automated detection and response system for Enterprise Grid that cuts response time from days to minutes. AER monitors billions of daily events with thresholds tuned to each organization's patterns, detecting access from Tor exit nodes, data scraping, excessive downloads, session fingerprint mismatches, and unusual API activity. When triggered, it kills all active sessions and generates audit logs linking back to the originating anomaly. The system tracks whether suspicious behavior persists after terminations while preventing legitimate users from getting stuck in a loop.

Cloud Security

AI-assisted cloud intrusion achieves admin access in 8 minutes

Sysdig researchers documented a cloud intrusion where threat actors used LLM assistance to compromise AWS in under 10 minutes, starting with credentials from public S3 buckets. The attackers escalated privileges through Lambda code injection, moved laterally across 19 AWS principals, created backdoor admin users, abused Bedrock for LLMjacking, and launched GPU instances.

LLM generated code with Serbian comments, hallucinated account IDs, and non existent GitHub repository references throughout the operation confirmed AI assisted execution.

LookOut: Discovering RCE and Internal Access on Looker (Google Cloud & On-Prem)

Tenable's Liv Matan discovered two critical vulnerabilities in Google Looker, collectively dubbed "LookOut", enabling complete system compromise. The first chains path traversal, Git hook manipulation, and timing issues to achieve remote code execution. The second (CVE-2025-12743) bypasses security controls by intercepting web requests to access Looker's internal MySQL database, then uses SQL injection through LookML data tests to extract user data, system configurations, and stored secrets.

In Google Cloud environments these flaws could allow cross tenant access to other customers' data. While Google patched its managed Looker instances, organizations running customer hosted or on premises versions remain exposed until they apply the necessary updates.

Building a Production-Ready Snowflake Audit Log Pipeline to S3

Snowflake audit logs can arrive hours late, so if your export pipeline advances the watermark to CURRENT_TIMESTAMP on each run, you're permanently skipping events. The fix is using the observed MAX(timestamp) from each export window and only advancing after a successful write. The article provides a full implementation: a stored procedure that runs every five minutes via a Snowflake task, incrementally exporting 20 audit views as partitioned JSON to S3. If something fails, state doesn't change and the next run picks up where it left off.

Staying Sneaky in the Office (365)

Reversec's Christian Philipov digs into SharePoint Online's pre authentication URL feature, enabled by default across tenants. SharePoint generates signed download URLs with a tempauth token for every file, and these bypass IP allowlists, Conditional Access policies, and sharing restrictions entirely.

An attacker with read access can enumerate files via SharePoint's REST APIs and download them from any IP without needing session cookies. MSRC called it a guardrail rather than a security boundary and rated it low severity. Philipov recommends disabling it with Set-SPOTenantPreAuthSettings -IsDisabled $true unless there's a specific business need.

Container Security

Docker Sandboxes Run Claude Code and Other Coding Agents Unsupervised (but Safely)

Docker released Sandboxes, using microVM isolation to let coding agents run unsupervised in dedicated environments on macOS and Windows. Each sandbox is a full dev environment where agents can install packages and run containers, fully isolated from the host with network controls and instant resets. No more constant permission prompts or risking your system just to let an agent do its job.

Red Team

DumpBrowserSecrets: Browser Data Extraction Tool for Chromium and Gecko Browsers

Maldev Academy released DumpBrowserSecrets, a tool for extracting credentials, cookies, credit cards, tokens, and browsing history from Chrome, Edge, Firefox, Opera, and Vivaldi. It uses an executable to parse browser databases and a specialized DLL to retrieve encryption keys through process injection techniques. The tool handles different encryption schemes across browser families and offers flexible options for targeted or bulk extraction.

Weaponizing Whitelists: An Azure Blob Storage Mythic C2 Profile

SpecterOps' Andrew Gomez and Allen DeMoura released azureBlob, a Mythic C2 profile that routes agent communication through Azure Blob Storage, taking advantage of the broad *.blob.core.windows.net firewall exceptions that vendors like Citrix, Parallels, and Nerdio recommend in their deployment guides. Each agent gets a container scoped SAS token at payload generation so if one gets burned the damage stays contained, and the storage account key never leaves the Mythic server. Agents communicate through simple blob PUTGETDELETE operations, and the server discovers new agents automatically by enumerating containers.

Supply Chain

JAGS' Batteries-Included Claude Code Configuration

A Claude Code configuration system that enforces structured development practices through hooks operating at multiple lifecycle points, replacing unsafe defaults like direct main commits and test skipping with controlled workflows. Three specialized agents (Planner, Implementer, and Guardian) coordinate approval cycles while hooks block destructive operations, rewrite unsafe commands, require test evidence before commits, and enforce plan driven development independent of model behavior or context window pressure.

GitHub Action for Early Detection of Security Vulnerabilities Using Claude AI

Eugene Lin built a GitHub Action that uses Claude to detect security vulnerabilities in open source repositories by analyzing commit diffs and PR context, only alerting when concrete exploits can be demonstrated. The tool automatically creates vulnerability issues, prevents duplicate analysis, and supports configurable repository monitoring and alert destinations.

Breaking Down Azure DevOps: Techniques for Extracting Pipeline Credentials

Reversec's Thomas Byrne walks through how attackers with write access to Azure DevOps pipelines can extract credentials across multiple vectors, from mapping KeyVault secrets to environment variables for exfiltration, to enumerating secret names via CLI, to pulling GitHub Service Connection tokens from .git/config files. Once extracted, these credentials authenticate to other repositories and downstream services, enabling lateral movement across the org and potentially into on-prem environments through more privileged Service Principals.

Threat Hunting

Tech impersonators: ClickFix and macOS infostealers

Datadog researchers identified a campaign using fake GitHub repositories to deliver macOS infostealers through ClickFix social engineering. The attack redirects users through GitHub Pages staging sites that mimic GitHub interfaces before tricking victims into executing malicious commands in Terminal.

The malware collects enterprise artifacts like business documents and RDP configurations, profiles how wallet extensions store secrets, and caps folder collection at 100MB to avoid detection. Later versions maintain persistence through a fake GoogleUpdate binary that checks in with C2 every 60 seconds, giving operators ongoing remote access rather than just a one time data grab.

Threat modeling agentic AI: a scenario-driven approach

Christian Schneider breaks down why STRIDE doesn't cut it for agentic AI. It evaluates components individually while real attacks chain across them. His five zone model traces how malicious input moves through input surfaces, planning, tool execution, memory, and inter agent communication. He walks through three scenarios to prove the point: RAG poisoning that hijacks reasoning, MCP tool descriptions that exfiltrate credentials, and multi agent cascades where poisoned context passes through trusted peers into unauthorized actions. Each path gets formalized into attack trees mapped to OWASP, MAESTRO, and ATFAA. From there, map trust boundaries, run scenario workshops before picking controls, and ensure two independent controls per high risk node.

Wrapping Up

If you enjoyed this newsletter and think others would too, It would mean a lot for us if you'd forward this email to other people who may enjoy it as well. You can also reply to this email, I'd love to get in touch with you.

Thanks,
Sebas

Release Date: 9th February 2026 | Issue: 58 | Subscribe

The Security Pills newsletter is a hand curated zine (delivered once per week) that highlights security related-news. 10+ hours of reading and analysis condensed into a 5-minute summary every Monday morning.

Sponsor
Would you like to become a sponsor for our newsletter? Our mission is to highlight security-related news with a focus on quality content, while we help people staying up to date with this corner of the industry.If you are interested, reach out to hello@securitypills.news with your ad idea to get started!

Application Security

GhostCVEs: CVE Intelligence Platform for Identifying Reserved but Public Vulnerabilities

Jerry Gamblin publishes GhostCVEs, a tool that finds vulnerability identifiers mentioned in public sources but missing from official CVE databases. The platform scans GitHub commits, security advisories, and RSS feeds to collect CVE references, then checks them against local copies of NVD and MITRE databases to spot gaps. It runs automated scans every six hours and creates reports in various formats. The system stores historical data in an SQLite database and plans to add features for detecting fake or AI-generated CVE mentions.

Security Vulnerability Discovered in Moltbook AI Social Network

Wiz's Gal Nagli details an exposed Supabase API key in client-side JavaScript without Row Level Security protections. The misconfiguration granted unauthenticated access to the entire production database, exposing 1.5 million API authentication tokens, 35,000 email addresses, and private messages containing unencrypted third-party API keys. Write access to the database allowed unauthenticated modification of posts and injection of malicious content. The exposure revealed that the platform's 1.5 million agents were controlled by only 17,000 human users (88:1 ratio), contradicting its positioning as an autonomous AI-native social network.

The incident demonstrates a growing problem: AI-powered development tools make building software much easier, but developers often skip essential security practices in the process.

Top 10 Web Hacking Techniques of 2025

PortSwigger's 19th annual Top 10 Web Hacking Techniques, curated from 63 community nominations, was won by Vladislav Korchagin's Successful Errors, introducing error based techniques for exploiting blind server side template injection with polyglot detection methods.

The list highlighted the rise of side channels as a core exploitation primitive, featuring two XS-Leak entries alongside ORM based data extraction, Unicode normalization attacks, Next.js internal cache poisoning, HTTP/2 CONNECT abuse, a technique for making blind SSRF visible, SOAP deserialization chains leading to RCE, and parser differentials.

Artificial Intelligence

Claude Code Transcripts: Convert Session Files to HTML

Built by Simon Willison, Claude Code Transcripts is a command-line tool that converts Claude AI coding session files into readable, paginated HTML documents. The tool can process sessions from three sources: local files stored on your computer, web sessions accessed through Claude's API, or individual JSON files. It creates organized output with index pages and multi-page transcripts that work well on mobile devices. Users can customize where files are saved, automatically upload results to GitHub Gist for sharing, and include original session data for archival purposes.

Julius: Open-Source LLM Service Fingerprinting Tool

Praetorian's Evan Leleux released Julius, an open source tool that identifies LLM server software running on network endpoints, addressing the growing shadow AI problem of thousands of unauthenticated inference servers exposed on the internet. Julius distinguishes between platforms like Ollama, vLLM, and Hugging Face deployments using YAML based probes.

Claude-Mem: Persistent Memory Compression System for Claude Code

A persistent memory system for Claude Code that maintains project context across sessions through automatic observation capture and semantic summarization. It employs a token-efficient 3-layer search workflow combining full-text queries, chronological context retrieval, and selective detail fetching.

Task Management for Agentic Coding

Jimmy Vo explores task management for agentic coding, comparing his custom tk CLI tool with Anthropic's native Claude Code tasks. His approach uses a bash script that stores tickets as markdown files in .tickets/, paired with a Claude skill and project manager agent that generates tickets from RFCs and tracks dependencies. Anthropic's solution evolved from simple todos to structured JSON-based dependency graphs. Both give AI agents structured task tracking and dependency awareness.

Blue Team

Web Traffic Hijacking: When Your Nginx Configuration Turns Malicious

Datadog's Ryan Simon identified a campaign that hijacked web traffic through malicious NGINX configuration injection, likely gaining initial access via React2Shell exploitation (CVE-2025-55182). Attackers deployed shell scripts that discovered NGINX installations, including Baota panel environments, and injected malicious location blocks routing requests through attacker controlled proxies, validating syntax and using graceful reloads to avoid disruption.

The campaign targeted Asian TLDs, government and educational domains, and generic TLDs, each mapped to different attacker backends and gambling related URL paths, while exfiltrating hijacked domain mappings to C2 infrastructure

Clawdstrike: Runtime Security Enforcement for Agent-Based Systems

Clawdstrike provides runtime security enforcement for agent-based systems and EDR development on OpenClaw. Features seven security guards, multi-layer jailbreak detection, output sanitization, and cryptographically signed audit trails.

Disrupting IPIDEA: One of the World's Largest Residential Proxy Networks

Google's Threat Intelligence Group disrupted IPIDEA, one of the world's largest residential proxy networks, which operated through four SDK brands sharing ~7,400 proxy servers. The network embedded these SDKs into 600+ Android apps and 3,075 Windows programs, silently turning devices into proxy exit nodes. IPIDEA also controlled 13 proxy/VPN brands and facilitated botnets including BadBox2.0, Aisuru, and Kimwolf. In a single week, 550+ tracked threat groups from China, DPRK, Iran, and Russia were observed using IPIDEA for SaaS compromise and password spraying.

Extending TTP to TTPI: Procedures vs. Instances in Detection Engineering

Van Vleet proposes extending the TTP framework with a fourth layer, Instances, creating TTPI. The current model mixes abstract patterns (procedures) with real-world examples (instances). Procedures are stable recipes; instances are the ever-changing dishes made from them.

This distinction helps teams prioritize detection: blocking procedures forces attackers into a limited playbook, while chasing individual instances leads to an endless cycle where attackers generate new variations faster than defenders can respond.

Cloud Security

Dropkit: Command-Line Tool for Managing DigitalOcean Droplets

Dropkit is a command-line tool for managing DigitalOcean droplet lifecycles with automated SSH configuration and Tailscale VPN integration. It enables cost optimization through hibernation, snapshotting and destroying droplets to stop billing while preserving state for restoration.

The growing challenge of credential management for AI agents

Sebastian Toader presents Riptides, a platform that replaces long-lived OpenAI API keys with short-lived credentials through an identity-first architecture. It verifies workload identity using SPIFFE standards, exchanges identity tokens for temporary keys via Vault or OpenBao, and enforces access at the kernel level through a custom Linux sysfs file. Credentials default to 15-minute TTLs and are automatically revoked, letting developers retrieve keys via simple file reads without embedding Vault SDKs.

GatewayToHeaven: A Cross-Tenant Vulnerability in Google Cloud Apigee

Omer Amiad discovered GatewayToHeaven (CVE-2025-13292), a cross tenant vulnerability in Google Cloud's Apigee allowing read and write access to analytics data across all tenants, potentially enabling end user impersonation across any organization using the service.

The attack began by targeting the GKE metadata endpoint through an Apigee API proxy, bypassing SSRF protections via the AssignMessage policy to obtain the Message Processor's service account token. That token's bucket write permissions allowed replacing Dataflow pipeline JARs with malicious code, then triggering autoscaling via PubSub floods to execute them. The resulting Dataflow service account had cross tenant access to metadata buckets and GCS datastores containing request logs with plaintext access tokens for all Apigee customers.

Container Security

Sandboxed Development Environment for Claude Code with Unrestricted Permissions

Trail of Bits has released a containerized development environment that allows Claude AI to execute commands freely while keeping your main system safe. The tool uses Docker containers to create isolated workspaces where Claude can run unrestricted operations during security audits and code reviews. Users can choose between single-project containers or shared workspaces for multiple repositories. For sensitive work, network access can be restricted using firewall rules. The system works with both command-line tools and popular IDEs, with specific performance tweaks available for Mac users running Apple Silicon processors.

Securing Agents Across the Operational Lifecycle in Palantir AIP

Palantir outlines five security dimensions for deploying AI agents in production. Scalable model access is provided through regional hubs with guarantees that no data is retained by third party providers. Agent orchestration runs on ephemeral Kubernetes infrastructure with 48 hour node limits and a three factor permission model combining owner, service user, and delegated user rights. Memory governance unifies four modalities (working, episodic, semantic, and procedural) through their Ontology system, applying consistent marking and role based policies at runtime. Tool usage is secured through provenance based controls that resolve entire call chains at runtime, blocking unauthorized data flows across nested tools. Integrated observability traces agent activity from data to decision, linking queries to version histories and LLM functions to evaluation suites.

Red Team

XSS Vulnerability in Salesforce Commerce Cloud Escalated to OAuth Token Theft via Cloudflare WAF

Rafael Castilho found reflected XSS in Salesforce Commerce Cloud's EinsteinCarousel-Load controller, bypassed Cloudflare WAF using Unicode escapes, then weaponized the WAF to block OAuth callbacks and intercept one-time authentication codes for account takeover.

Critical Remote Code Execution Vulnerability Found in OpenClaw AI Assistant

Depthfirst's Mav Levin chained two vulnerabilities in OpenClaw into a 1-click RCE exploit. First, a logic flaw discovered by depthfirst's automated scanning: clicking a URL with a malicious gatewayUrl parameter forces OpenClaw to connect to an attacker controlled server and leak the user's auth token during the handshake. Second, a missing WebSocket origin validation that Levin discovered, enabling Cross-Site WebSocket Hijacking to reach the victim's localhost OpenClaw instance from a malicious webpage. With the stolen admin scoped token, the attacker disables safety features (user approval prompts and container sandboxing) via the API and executes arbitrary commands on the host, all without user interaction beyond the initial click.

Supply Chain

How We Scaled Code Repository Management at DNSimple

DNSimple transformed GitHub repository management from manual configuration to automated infrastructure as code using Terraform. An initial Ruby tool (Repocop) failed because it required local execution with no review process or change tracking. The breakthrough came in 2024 when GitHub Actions and Terraform Cloud enabled a PR based workflow where proposed changes generated preview plans automatically and approved merges triggered deployment, no local Terraform required. Starting with basic settings, they expanded to templates, code ownership files, and configurations across hundreds of repositories, later adopting the same pattern for DNS, cloud, and server infrastructure.

Self-Hosted GitHub Actions Runners Weaponized as Persistent Backdoors

Sysdig's Alberto Pellitteri analyzed how the Shai-Hulud worm weaponized self hosted GitHub Actions runners as persistent backdoors. After compromising machines through trojanized NPM packages, the worm created repositories with discussions enabled, installed runners with root privileges in hidden directories, and used an intentionally vulnerable workflow as a C2 channel, executing commands posted as discussion comments. Persistence was achieved by disabling process cleanup and optionally installing the runner as a system service. All traffic flowed to github.com, evading traditional network defenses.

Binary Authorization: Enforcing Supply Chain Security in Kubernetes Admissions

Block built BinauthZ, a plugin for their existing admission controller that cryptographically verifies container images are signed and come from trusted build pipelines before running in Kubernetes. Verification rules are configuration-driven, and the plugin handles scale through concurrent verification and layered caching while distinguishing real policy violations from temporary infrastructure issues. Block built this in-house to avoid operational complexity, vendor lock-in, and per-node pricing.

OpenClaw AI Agent Skills Being Weaponized as Malware Delivery Channel

OpenClaw skills in the ClawHub marketplace are being exploited as malware delivery vectors, with VirusTotal identifying hundreds of malicious packages among 3,016+ analyzed. These attacks weaponize setup workflows that instruct users to execute untrusted code, since the skill files themselves are nearly empty, traditional antivirus fails to detect them.

VirusTotal's Code Insight surfaces these patterns by analyzing SKILL.md behavior. Notable case: user "hightower6eu" published 314+ malicious skills delivering Windows packed trojans and macOS Atomic Stealer (AMOS), which harvests passwords, browser credentials, and crypto wallets.

Running Renovate as a GitHub Action Without Personal Access Tokens

Chainguard's Adrian Mouat shows how to eliminate long lived GitHub Personal Access Tokens when running Renovate as a GitHub Action by using Octo STS, an open source security token service built by Chainguard that exchanges the action's OIDC token for a short lived GitHub token whose permissions are defined in a per repository YAML policy file. This also addresses the default GitHub Action token's inability to update workflow files.

Threat Hunting

Threat Actors Expand Abuse of Microsoft Visual Studio Code

Jamf Threat Labs' Thijs Xhaflaire uncovered a North Korean campaign abusing Visual Studio Code's task configuration to deliver malware, extending the "Contagious Interview" operation. Victims clone malicious GitHub or GitLab repositories and, upon trusting the workspace in VS Code, unknowingly execute commands embedded in tasks.json that fetch JavaScript payloads from Vercel infrastructure.

The payload establishes a persistent backdoor that beacons to a command server every five seconds, enabling remote code execution while collecting system details such as hostname, MAC addresses, and public IP for victim fingerprinting. Jamf recommends developers scrutinize repository contents and task configurations before granting workspace trust.

Threat Actors Using AWS WorkMail in Phishing Campaigns

Rapid7 researchers Jan Blažek and Calvin House found threat actors leveraging AWS WorkMail to sidestep SES sandbox restrictions and build phishing infrastructure. Using compromised AWS credentials, attackers escalated to AdministratorAccess, created WorkMail organizations via workmail:CreateOrganization, and verified domains through ses:VerifyDomainIdentity and ses:VerifyDomainDkim. By pivoting to WorkMail rather than requesting SES sandbox removal, they gained immediate external sending to up to 100,000 recipients per day per organization, far exceeding the sandbox limit of 200 messages daily to verified recipients.

This technique makes web-sent emails appear in CloudTrail as ses:SendRawEmail events but mask the sender's real IP behind workmail..amazonaws.com, while SMTP-sent emails produce no CloudTrail logs at all, even with SES data events enabled.

Wrapping Up

If you enjoyed this newsletter and think others would too, It would mean a lot for us if you'd forward this email to other people who may enjoy it as well. You can also reply to this email, I'd love to get in touch with you.

Thanks,
Sebas

Release Date: 2nd February 2026 | Issue: 57 | Subscribe

The Security Pills newsletter is a hand curated zine (delivered once per week) that highlights security related-news. 10+ hours of reading and analysis condensed into a 5-minute summary every Monday morning.

Sponsor
Would you like to become a sponsor for our newsletter? Our mission is to highlight security-related news with a focus on quality content, while we help people staying up to date with this corner of the industry.If you are interested, reach out to hello@securitypills.news with your ad idea to get started!

Application Security

SOAPwn: Remote Code Execution Through .NET Framework HTTP Client Proxies

Watchtowr's Piotr Bazydlo shows that ServiceDescriptionImporter, .NET's tool for generating SOAP client proxies from WSDL files, doesn't validate URL schemes. Attackers who supply a malicious WSDL can point the generated proxy at file:// paths, writing XML directly to disk to embed webshells. Barracuda, Ivanti, Microsoft, and Umbraco products were confirmed vulnerable. Microsoft has declined to patch the issue, stating that URLs passed to SoapHttpClientProtocol should never be user-controlled and input validation is the developer's responsibility.

Scanning 5.6 million public GitLab repositories for secrets

Luke Marshall describes how he scanned ~5.6 million public GitLab Cloud repositories with TruffleHog, using an AWS Lambda + SQS pipeline to validate findings and identify more than 17,000 live secrets. He also explains how Claude Sonnet 3.7 supported triage and reporting, which ultimately led to over $9,000 in bug bounty payouts.

Skill Registry Validation and Marketplace Automation with GitHub Actions

Sionic AI has developed a system that prevents research teams from repeating failed experiments by creating a shared knowledge registry managed through GitHub Actions and Claude Code. The solution addresses a common problem: valuable experimental insights getting lost in Slack threads and notebooks, leading to duplicate work months later.

Researchers use simple commands like /retrospective to have Claude automatically extract and document their discoveries, while /advise lets team members quickly access past learnings before starting new experiments. GitHub Actions handle the technical infrastructure by validating new contributions and automatically updating the shared registry, ensuring the system stays current and properly structured without manual maintenance.

Artificial Intelligence

Code Scanning for LLM Security Vulnerabilities

Dane Schneider walks through Promptfoo Scanner, a GitHub Action that catches LLM-specific vulnerabilities in pull requests. It traces untrusted inputs into prompts, then follows LLM outputs to dangerous sinks (code execution, database queries, that sort of thing). The focus is on "capability combinations": the lethal trifecta (private data access + untrusted content + external communication) or the deadly duo (untrusted content + privileged actions). Tested against real CVEs, the scanner identifies not just vulnerable code paths but often the exact commit that introduced the problem.

Production-Ready Dockerized MCP Servers for Offensive Security Tools

A collection of 28 Dockerized MCP servers from FuzzingLabs bringing offensive security tools to AI assistants. Includes Nmap, Ghidra, Nuclei, SQLMap and 163+ total security tools across reconnaissance, web security, binary analysis, cloud security, OSINT, Active Directory, and more. Containers are production-hardened with non-root execution, minimal images, and Trivy vulnerability scanning.

88,636 Real Vulnerabilities: Lessons from a Security Knowledge Base

A security knowledge base from 88,636 WooYun vulnerability cases (2010-2016) that enables Claude to analyze security issues with expert-level reasoning across 15 vulnerability types.

Claude Code Configuration Repository from Anthropic Hackathon

Affaan Mustafa has released a comprehensive Claude Code configuration toolkit built over 10+ months of real-world product development. The collection includes specialized agents for code review and planning, automated workflows, custom commands, and cross-platform scripts. Two guides accompany the release: a foundational guide covering setup and core concepts, and an advanced guide detailing performance optimization, memory management, testing approaches, and scaling techniques.

Blue Team

How Amazon uses AI agents to anticipate and counter cyber threats

Daniel Weiss describes Amazon's Autonomous Threat Analysis (ATA) system, which uses competing AI agents to reason about and adapt security testing strategies in isolated environments. The system executes 10–30 technique variations concurrently, reducing detection-rule testing from weeks to hours while grounding all results against actual infrastructure to mitigate hallucination.

Bridging the Detection Engineering Gap: Building Rules from Attacker Source Code

Huntress’ Andrew Schwartz explains why LDAP detections that rely on “expected” source-code or protocol syntax often miss in Active Directory: there’s a translation gap between what’s sent over the wire and what actually shows up in telemetry. AD rewrites OID-based filters before they’re logged in Event ID 1644, and 1644 preserves formatting exactly as processed, so the same query can show up in different shapes depending on the tool.

He also shares a practical approach to detection engineering: use source code to understand how tooling behaves, then validate and refine your hypotheses against real logs. The goal is to turn implementation details into repeatable signals, not exact-match rules that break when formatting changes.

SOC Capacity and the Analyst Time Constraint

Jon Hencinski argues SOC scaling breaks because analyst time is the bottleneck: as alerts and tools grow, you hit a “Human Cost Curve” where adding headcount increases cost and coordination more than results. He recommends a hybrid model where AI handles front-line triage and enrichment, escalating only the small set of alerts worth investigation, so a 10-person SOC can process ~200 alerts/day, keep utilization under ~70%, and retain capacity for deeper investigations and continuous improvements.

Cloud Security

AWS Privilege Escalation Techniques: Evolution from IAM to AI-Driven Services

Software Secured's Ben GoodSpeed describes how AWS privilege escalation has evolved from traditional IAM policy manipulation through service-based attacks to modern AI-driven orchestration via Bedrock and AgentCore. Testing across 16 scenarios, Ben identifies which AWS actions can be blocked with SCPs, which cannot, and provides a framework for assessing escalation risk across cloud and AI workloads.

Tailsnitch: Security Auditor for Tailscale Configurations

A security auditing tool by Noah Potti for Tailscale configurations that runs 52 checks across seven categories to detect misconfigurations, weak access controls, and policy gaps. It supports OAuth or API key authentication, produces actionable findings, and can apply safe remediations with dry-run previews.

Pathfinding.cloud: IAM Privilege Escalation Knowledge Base

Seth Art released pathfinding.cloud, a comprehensive knowledge base documenting 60+ AWS IAM privilege escalation paths (27 uncovered by existing OSS tools). These techniques show how attackers gain administrative access after initial AWS account compromise. The library uses service-specific identifiers and YAML format, with each entry detailing required permissions, resource constraints, and exploitation prerequisites.

Container Security

Hands On with AWS Bottlerocket: Evaluating the Security of Amazon's Hardened OS

Terry Franklin explains in this article how AWS Bottlerocket, a well-known minimalist operating system that provides a reliable container hosting environment, is capable of defeating established container escape techniques, including: abusing the kernel usermode helper by triggering a coredump, mounting the host filesystem and loading a custom kernel module.

Kubernetes Security: Exploring Pod Escape and Lateral Movement with Misconfigured Manifests

Kiran Dawadi walks through a controlled “assume-breach” test on an Amazon EKS cluster using BishopFox’s BadPods to show how risky pod configurations (such as privileged containers, host namespace sharing, and host networking) can effectively remove container isolation. The write-up follows a realistic escalation from an initial compromised pod to host-level access, pivoting to other workloads on the node, and ultimately pulling AWS credentials from IMDS.

Using Small Language Models Locally for Code Writing Assistance

Philippe Charrière describes how to run small language models (0.5-7 billion parameters) locally for code assistance, particularly when cloud services are unavailable due to confidentiality restrictions or offline environments. The author demonstrates using a 3 billion parameter Qwen2.5-Coder model with Docker Model Runner to build a code assistance system for a custom Golang library.

Since small models don't know proprietary codebases and have limited context windows, the solution implements Retrieval Augmented Generation (RAG) to feed relevant code snippets to the model. The article emphasizes that RAG effectiveness depends on proper configuration of embedding models, chunk splitting strategies, and similarity thresholds, with practical solutions including adjusting thresholds, increasing returned results, and adding metadata keywords when retrieval fails.

Red Team

Detecting Conditional Access Payload Delivery via Cloudflare Pages

Andy Gill describes how conditional access payload delivery (CAPD) can be implemented using Cloudflare Pages and Workers to selectively deliver payloads based on request context, noting that Cloudflare’s shared infrastructure and HTTPS encryption limit detection to sparse network signals, endpoint telemetry, and TLS-terminating proxies.

SILPH: An In-Memory Credential Dumping Tool for Windows

An open-source red team tool by Haroun Al Mounayar that extracts Windows credentials (LSA secrets, SAM hashes, and DCC2) entirely in memory without disk writes or RPC services. It has been built to be integrated into the Orsted C2 framework

AI Agents Successfully Generate Exploits for Zero-Day Vulnerability; Implications for Offensive Cyber Security Industrialization

Sean Heelan demonstrates how current LLMs can automatically generate functional exploits for zero-day vulnerabilities when equipped with appropriate tools and iterative debugging capabilities. In experiments using Opus 4.5 and GPT-5.2, both AI agents successfully generated over 40 distinct exploits for a QuickJS zero-day across six scenarios with various modern mitigations.

Heelan argues that current AI safety tests don't accurately measure real-world hacking capabilities. Most evaluations use practice scenarios, simulated environments, or old vulnerabilities instead of testing against genuinely difficult targets with fresh zero-day flaws. He calls for AI labs and security researchers to run more realistic tests using actual zero-day vulnerabilities and to share detailed results, including costs and success rates.

You can find a technical write-up of the experiments and the results on Github

Supply Chain

Zombie Workflows: GitHub Actions Vulnerabilities That Persist Across Branches

Sonar's Paul Gerste describes a GitHub Actions vulnerability pattern (Zombie Workflows) in which older repository branches can leave exploitable workflows in place, enabling Pwn Request attacks. Their analysis identified 188 potentially vulnerable workflows across projects, including repositories associated with Microsoft, NVIDIA, and Azure.

PromptPwnd: AI Prompt Injection Vulnerabilities in GitHub Actions and GitLab CI/CD Pipelines

Aikido's Rein Daelman describes PromptPwnd, a vulnerability pattern in CI/CD pipelines where untrusted user input embedded in AI prompts causes AI agents to execute privileged operations and leak secrets. Aikido Security identified the issue across multiple AI-powered actions including Claude Code, Codex, and GitHub AI Inference, affecting at least five Fortune 500 companies and numerous high-profile repositories.

Threat Hunting

Destructive Malware Rising Across Open Source Registries with Kill Switches and Delays

Socket's Kush Pandya analyzes two malicious Chrome extensions called Phantom Shuttle, distributed since 2017, that route traffic from 170+ targeted domains through attacker-controlled MITM proxies. The extensions intercept HTTP authentication challenges using hardcoded credentials and continuously exfiltrate plaintext credentials from sites including AWS, Azure, GitHub, and adult platforms.

EDR Silencing via Windows Filtering Platform, Hosts File, Name Resolution Policy, and IPSec Rules

Pentest Laboratories explores advanced EDR Silencing techniques that attackers use to disable security monitoring without triggering alerts. When threat actors discover EDR software running, they prioritize evading detection while maintaining stealth.

The research covers four approaches that block EDR communication with cloud management consoles: Windows Filtering Platform abuse, hosts file modification, Name Resolution Policy Table manipulation, and IPSec Filter Rules. These techniques disrupt network communication rather than crashing the EDR process, which would generate obvious alerts. Attackers can avoid triggering detection rules using indirect system calls or legitimate tools, gain administrator privileges to install kernel-level bypass modules preventing malicious activity logging, or completely remove the EDR software.

Wrapping Up

If you enjoyed this newsletter and think others would too, It would mean a lot for us if you'd forward this email to other people who may enjoy it as well. You can also reply to this email, I'd love to get in touch with you.

Thanks,
Sebas