Newsletter 2026-07-07
Another week, another round.
Socket looks at Polinrider’s approach, where Git history is deliberately manipulated and rewritten to the “main” branch via force push. This allows malicious commits to disappear among legitimate ones and the entire repo to appear OK.
Stepsecurity maintains some GitHub actions. These were initially only available for paying customers, but are now also available for open source projects. It might be worth taking a look at their overview if you need a specific action.
Ryan Miceli took a closer look at a Western Digital hard drive’s firmware and documented the process of accessing, modifying, and flashing the firmware. Definitely worth reading.
Not too long ago, Trail of Bits started the Patch the Planet initiative, where they work with OpenAI to examine open source projects for vulnerabilities and provide patches. A Trail of Bits engineer is assigned to help the maintainers. Here’s the first report.
Recently in Italy there was a phishing campaign where attackers managed to break out of Chrome.
- https://www.d3lab.net/breaking-out-of-chromes-sandbox-a-native-messaging-backdoor-observed-in-italy/
Veeam has an RCE and SecureLayer7 has written it up. So if a backup server appears in the network during the next test, it might be worth taking a very close look.
Three longer articles dealing with the use of LLMs in the security field. TrustedSec goes into using LLMs to extract Yara rules, signatures, etc. and presents this as a statement for layered defenses. The two SpecterOps articles are more offense-oriented. One on the development of Mythic agents and the other on analyzing EDR solutions through reverse engineering with the help of MCP servers. Particularly insightful when combined.
- https://specterops.io/blog/2026/06/24/disposable-tooling-building-llm-generated-mythic-agents-from-prompt-to-deployment/#h-first-attempts-with-just-vibes
- https://trustedsec.com/blog/the-defensive-stack-is-exposed
- https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis/#h-the-balance-of-disclosure
The article goes a bit less in-depth than most articles here, but the setup looks interesting and might be worth trying out. Also, I didn’t know Joern before.
Read you next week.