Newsletter 2026-09-08
Another week, another round.
Lukas Maar from Calif describes, in a four-part series, what a portable path from untrusted_app to root on bootloader-locked Android devices can look like, with the goal of requiring as few adjustments as possible per OEM, kernel, chipset, or device. This is the first article in the series.
SpecterOps has released a whole batch of skills for agents, with some interesting ones in there.
TrustedSec has written down how to investigate AWS WAF logs, and a new tool came out of it in the process.
Konstantin sent me this article by Chaz Schlarp, where he had a whole range of devices checked by an AI. Very interesting results.
Elastic published two articles on how they improved the costs of their agentic systems, specifically by focusing on targeted agents with narrow tasks.
- https://www.elastic.co/security-labs/agentic-soc-token-budget-architecture
- https://www.elastic.co/security-labs/ai-agent-optimization-production-scale
Gendigital observed a pretext-building phishing attack and traced it back in considerable detail.
JFrog took a look at some of the recently published CVEs, which came out in a flood (91 in a single day), focusing particularly on the gap between Spring’s severity ratings and those from CISA. This again highlights that the sheer volume of CVEs has now reached a point where nobody can really keep up properly.
Already from July, but still a worthwhile introduction to hardware analysis.
Andy Gill writes in his blog about how to use older models in Claude Code to sidestep the guardrails of newer models.
The DFIR Report has once again published a very comprehensive writeup, covering an SEO poisoning campaign that was used to distribute malware and carry out IT support scamming attacks.
The Web Scraping Club took a look at the new Chrome API for performance measurement. It certainly has its uses, but I mostly see it as yet another tool for device fingerprinting.
Read you next week.