Another week with articles. Thanks to the high temperatures I wasn’t motivated to do anything else but read, which lead to some more links this week.

---

Quarkslab took a closer look at Xiaomi’s proprietary security chip as used in cameras. Methods used included, among others, I2C sniffing, flash dumping, and firmware analysis.

• https://blog.quarkslab.com/black-box-probing-a-security-analysis-of-xiaomis-mja1-secure-chip.html

---

Praetorian’s setup for automated vulnerability analysis with AI was recently introduced. In the first part, the target was FreeBSD and the approach is explained in detail.

…

Another week, nother round

---

A VirtualBox escape through a use-after-free vulnerability, compiled by Luca Ginex.

• https://blog.exodusintel.com/2026/06/15/zombie-cotables-resurrecting-freed-memory-to-escape-virtualbox/

---

FIFA apparently was busy awarding peace prizes and didn’t have time to test their central systems. For many football fans, probably a happy outcome.

• https://bobdahacker.com/blog/fifa-hack

---

Niels Provos versus frontier models.

• https://www.provos.org/p/case-for-open-weight-models/

---

I have to agree with Justin Bollinger here. I’ve always taken a detour around jq and maybe used Python’s json.tool or awk and cut to prepare and filter data.

…

Another week with new articles.

---

Zoltan Madarassy and Alex Brown wrote another article for Elttam on what to watch out for in Go reviews.

• https://www.elttam.com/blog/golang-code-review-notes-ii

---

Matthew Green looked at the reasoning blocks in LLMs and was able to derive secrets from the systems (with a bit of luck). Additionally, neither Claude nor GPT5x seem to use system prompts in API mode.

• https://blog.cryptographyengineering.com/2026/05/29/fooling-around-with-encrypted-reasoning-blobs/

---

A comprehensive write-up of CVE-2026-23111. This is a use-after-free vulnerability caused by incorrect use of the exclamation mark.

…

Another week and another round of articles.

---

LevelBlue investigated a malware campaign in Brazil where Havoc was being used. Nine different stager variants were observed and they were distributed via .zip files. But that seems quite common, especially in May to receive invoices as ZIP archives. So good preparation.

• https://www.levelblue.com/blogs/spiderlabs-blog/the-demon-arrives-later-a-havoc-stager-hides-behind-microsoft-defender-dlp

---

Ruby Gems can now also be installed with a cooldown to reduce supply chain attacks. You can define the number of days a gem must exist before it’s listed for update.

…

Again a lot of interesting articles, at least in my opinion.

---

Interesting approach to bridge the air-gap using audio signals to get malware onto a target system when USB ports and the like are disabled. cocomelonc kicks off in the first blog post [1] with the transmitter side and some basics. The second part [2] then deals with the receiver under Linux.

1. https://cocomelonc.github.io/malware/2026/05/24/malware-tricks-56.html
2. https://cocomelonc.github.io/malware/2026/05/26/malware-tricks-57.html

---

Something a bit different for a change. nand2mario from Small Things Retro has set about pouring the 80386 (for those old enough to remember) into an FPGA based on the original microcode. Cool project.

…

Another week and a new round of links

---

Mathieu Farrell describes for Quarkslab which vulnerabilities he found in Optical Line Terminals in great detail. Including an explanation of what the whole thing actually is.

• https://blog.quarkslab.com/how-olts-may-have-exposed-entire-isp-networks.html

---

Massive attack on GitHub repositories. I couldn’t figure out which ones are directly affected. On 2026/05/21 it have been 5000 repositories and rising.

• https://www.ox.security/blog/megalodon-cicd-malware-github/

---

Elliot Belt/Felix Billières has extensively worked with AI in security research and provides his research along with recommendations on how to reproduce.

…

Another week, another round.

---

Datadog has looked at malicious agent skills and lists indicators to watch out for.

• https://securitylabs.datadoghq.com/articles/malicious-skills-supply-chain-risks-in-coding-agents-with-dynamic-context/

---

Synacktiv looked at the Tesla Wall Connector in 2025 and has now published a second part to the first article.

• https://www.synacktiv.com/en/publications/exploiting-the-tesla-wall-connector-from-its-charge-port-connector-part-2-bypassing.html

---

Trail of Bits introduces a new Go fuzzer.

• https://blog.trailofbits.com/2026/05/12/go-fuzzing-was-missing-half-the-toolkit.-we-forked-the-toolchain-to-fix-it./

---

Hacktron found an RCE in Github Copilot.

• https://www.hacktron.ai/blog/rce-in-vscode-copilot/

---

Daniel Stenberg explains “named globbing” in curl. Very practical and I just wasn’t aware that curl can do that.

…

Another Week, another round of interesting news. This time with different views on the Claude Mythos results from Mozilla and Curl

---

Citizenlab has compiled studies on telco network surveillance. Very comprehensive, but also very interesting.

• https://citizenlab.ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/

---

Talos has identified a previously unknown attacker using the CloudZ RAT with a plugin “Pheno” that’s used to check if the Phone Link application is being used under Windows. The goal is probably to obtain credentials and possibly also OTP codes.

…

Another week, another round of interesting news.

---

Lazarus comes around the corner with a new malware variant for Macs and has ported a known variant from Go to Python using AI. The entry point is Telegram messages containing fake Teams, Meets, or Zoom invitations.

• https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/

---

Talos sees strong growth in the adoption of Macs in the enterprise world. So far, Living off the Land tools seem to be less documented. They want to address this in their post. Certainly doesn’t hurt to be broadly positioned.

…

Another week another round.

---

Level Blue addresses a phishing vector that only became interesting thanks to the wider adoption of MFA. Attackers try to get the victim or helpdesk to deactivate or reset the second factor.

• https://www.levelblue.com/blogs/spiderlabs-blog/why-attackers-are-bypassing-phishing-emails-and-targeting-identity-instead

---

Calif unleashed Codex on a TV with a compromised browser to see how Codex performs in such scenarios and can turn an existing shell into a root shell. I think it’s a good insight into the current state of things and it aligns with what I’ve seen so far.

…

Another week another round

---

itm4n took a closer look at Windows’ implementation for collecting Bitlocker information. Maybe a pretty interesting topic if you want to dive into the depths of disk encryption.

• https://itm4n.github.io/bitlocker-little-secrets-the-undocumented-fve-api/

---

Something a bit different. Unlocking features in an Audi.

• https://blog.zsec.uk/audi-carplay-2026/

---

Something else again. A Mastodon discussion around the latest Windows zero-day Bluehammer. The discussion goes into the functionality a bit. Plus the repo.

• https://infosec.exchange/@wdormann/116358064691025711
• https://github.com/Nightmare-Eclipse/BlueHammer/tree/main

---

Talos analyzes LucidRook, a Lua-based stager that provides stripped Rust elements.

…

Another busy week:

---

Claude found an RCE in vim and emacs relatively easily.

• https://blog.calif.io/p/mad-bugs-vim-vs-emacs-vs-claude

---

Another week and another supply chain attack.

• https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
• https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/

---

And right along with that, TeamPCP uses audio steganography in WAV files to bypass EDR and other analysis tools.

• https://pwn.guide/free/cryptography/audio-steganography

---

I’m an avowed RSS fan, but I didn’t know about XSLT. Too bad I only find out about it when it’s being discontinued.

• https://justinjackson.ca/xslt

---

MDSec shows a way in the article to disable pre-boot DMA without triggering the Bitlocker Recovery Key by reading out the UEFI, modifying it, and writing it back.

…

Looks like there was a lot going on last week, which resulted in quite a few links.

---

TrustedSec has started a blog series around detection. In my view, very much worth reading.

• https://trustedsec.com/blog/building-a-detection-foundation-part-1-the-single-source-problem
• https://trustedsec.com/blog/building-a-detection-foundation-part-2-windows-security-events
• https://trustedsec.com/blog/building-a-detection-foundation-part-3-powershell-and-script-logging
• https://trustedsec.com/blog/building-a-detection-foundation-part-4-sysmon

---

Corelan is back after 7 years without an article and starts with a very comprehensive session around WinDBG and WinDBGX.

• https://www.corelan.be/index.php/2026/03/23/debugging-windbg-windbgx-fundamentals/

---

Level Blue Security wrote in their blog how the Azure ServiceBus can be used for C2 communication via WebSockets.

…

Another week another round of interesting articles I came across during the week. Even though it’s again without a specific theme, Talos made it into the list twice.

---

An approach to add agents to a C2 through indirect prompt injections. The whole thing builds on prompting and further reduces the technical requirements for attackers, which in turn could increase the number of attacks.

• https://embracethered.com/blog/posts/2026/agent-commander-your-agent-works-for-me-now/

---

Various threat actors are now apparently relying on an iOS exploit chain called DarkSword. The Google Threat Intelligence Team has a very interesting write up on that chain.

…

Another week another round. For week 12 we have a colourful mix of articles with no particular theme.

---

Praetorian shows in their blog how different interpretation of headers can lead to gaps in system security. They use two CVEs in Fabio and OAuth to explain header injection.

• https://www.praetorian.com/blog/reverse-proxy-header-attacks/

---

An OSINT newsletter that’s just starting. The person previously worked in Dutch law enforcement and already ran an OSINT newsletter for colleagues there. Now the tips are being shared with everyone. I definitely think it’s worth adding to your RSS feed if you’re interested in OSINT.

…

Another week another round of articles i deemed interesting

---

I wasn’t aware until now that nuclei also has an OSINT tag and can check user accounts on platforms.

• https://publication.osintambition.org/using-nuclei-for-osint-5-minute-basic-guide-f8764424902b

---

Jean-Francois Maes outlines a system that could make it possible to use commercial LLMs with a private upstream system for pentests. Strictly speaking, there would be two upstream systems. The first one anonymizes confidential information on the way in and deanonymizes it on the way back. The second upstream system then checks whether the first one was successful before it goes into the commercial LLM.

…

Another week with multiple very interesting articles.

---

Graham Helton presents an RCE in Kubernetes on his blog. It requires GET permission and WebSocket communication. The report was closed as Won't fix (Intended behavior), so it’s worth keeping this in the back of your mind.

• https://grahamhelton.com/blog/nodes-proxy-rce

---

Patrick Binder introduces his tool apimspray, which uses Azure API Management (APIM) to conduct EntraID password spraying via Microsoft’s own IP addresses. The whole thing is difficult to detect, but he also explains that EntraID Identity Protection can help with detection through its alerts. Besides the usual MFA everywhere, he also gives additional recommendations to better secure accounts against this attack and tool.

…

Welcome to the next week of articles I deemed interesting.

---

A pretty interesting phishing approach.

• https://www.levelblue.com/blogs/spiderlabs-blog/phishing-with-oauth-redirect

---

Talos looked into how to bypass Code Read-out Protection (RDP) by emulating a single thread to find vulnerabilities in the ModBus TCP implementation of the devices.

• https://blog.talosintelligence.com/good-enough-emulation/

---

Usually it’s more articles around security and red teaming topics, but containerization also plays a significant role in modern environments. Even though dependencies that are installed separately from the OS package manager need to be checked independently since many security scanners struggle with that (at least that’s my last understanding, it might have changed), higher speed when building containers is also important in many places. Andrew Nesbitt shows in his article that most package managers (Cargo, Go, and Co.) for software development allow downloading dependencies separately.

…

Another week, another round.

---

Credential exfiltration through an Outlook add-in. They’re leveraging an “abandoned” project to infiltrate 4,000 systems.

• https://www.koi.ai/blog/agreetosteal-the-first-malicious-outlook-add-in-leads-to-4-000-stolen-credentials

---

I find SpecterOps’ article about their new tool V8-forensics pretty interesting. It can help debug exploits by extracting JavaScript artifacts from Chrome’s memory after it crashes.

• https://specterops.io/blog/2026/02/11/v8-heap-archaeology-finding-exploitation-artifacts-in-chromes-memory/

---

Apparently more and more providers are already filtering Telnet in their networks. But the sheer volume of Telnet connections running over the internet alone is pretty alarming to me.

…

Back again with some interesting articles that came across my way during the last few days.

---

Stan Ghouls relies on spear phishing to land their targets. The writeup on initial access is very detailed. They’re also recycling Mirai here. https://securelist.com/stan-ghouls-in-uzbekistan/118738/

---

I’m not exactly sure when this article was written (or if that’s just the modification date), but the author exploits a race condition to bypass protections against credential dumping. https://otter.gitbook.io/red-teaming/articles/windows-of-opportunity-exploiting-race-conditions-in-seclogon-to-dump-lsass

---

Yarix introduces their tool Doppelganger in this article, which they use to disable PPL by leveraging a vulnerable driver and clone the lsass process to save the dump obfuscated. https://labs.yarix.com/2025/06/doppelganger-an-advanced-lsass-dumper-with-process-cloning/

…