Newsletter 2026-09-22

Another week, another round. This time, coincidentally, with two entries each from Quarkslab and Datadog.

Quarkslab introduces a new tool for generating code flow graphs from binary data.

• https://blog.quarkslab.com/from-p-code-to-gnn-extract-binary-code-semantics.html

Searchlight Cyber took a look at the JavaScript engine Goja. Written in Go, as the name might suggest, it is used in tools like Grafana and Nuclei among others. They found an RCE vulnerability that could be reliably exploited across multiple tools.

• https://www.slcyber.io/research/out-of-bounds-out-of-sandbox-rce-goja

Datadog works through MITRE to map out which actions on GitHub can indicate stolen credentials, and also calls out a few pitfalls you might run into along the way.

• https://securitylabs.datadoghq.com/articles/mapping-out-your-unknown-threat-hunters-guide-to-github/

DomainTools has found a new tool called Lemmings, apparently used by Russian threat actors to spread disinformation. The platform offers a full package covering lifecycle and verification management, along with the ability to hand off credentials and other artifacts to other operators.

• https://dti.domaintools.com/research/lemmings-russian-persona-provisioning

Microsoft has presented a first working version of the Windows Endpoint Security Platform, giving security vendors more room to implement features outside the kernel to avoid further incidents like the big CrowdStrike debacle. Jonny Johnson took a closer look and wrote it up.

• https://jonny-jhnson.dev/blog/a-first-look-inside-the-windows-endpoint-security-platform/

Intruder presents an interesting approach to getting Claude to find vulnerabilities in software.

• https://www.intruder.io/research/finding-plesk-rce-by-lying-to-ai

Datadog examined two platforms used to manage stolen credentials, verify them, and launch further attacks directly from the interface.

• https://securitylabs.datadoghq.com/articles/attacker-infrastructure-but-vibe-coded/

Unit42 used a prompt injection in AWS AgentCore Harness to exfiltrate credentials in cleartext and wrote the whole thing up in detail. Amazon rated it as informational.

• https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/

Quarkslab put together an interesting primer on passive optical networks, covering potential threat models and security measures for those kinds of networks. If you want to pick up some of the terminology and look beyond the usual pentest scope there might be something interesting in here.

• http://blog.quarkslab.com/overview-of-passive-optical-networks-pons-security.html

Andy Gill has published a few topics around red team preparation on his blog.

• https://blog.zsec.uk/below-the-waterline-stage-1-red-team-planning/

Read you next week.