https://appsec.fyi Curated application security resources — XSS, SQLi, SSRF, IDOR, RCE, and more. en-us Sun, 12 Jul 2026 16:04:24 +0000 carl@chs.us (Carl Sampson) carl@chs.us (Carl Sampson) https://www.tipranks.com/news/private-companies/software-supply-chain-attack-highlights-growing-demand-for-preemptive-package-security https://www.tipranks.com/news/private-companies/software-supply-chain-attack-highlights-growing-demand-for-preemptive-package-security A recent software supply chain attack has underscored the increasing need for preemptive security in package management. These attacks target the dependencies that software relies on, introducing malicious code into legitimate applications. This incident highlights the vulnerabilities inherent in interconnected development environments and emphasizes the growing demand for robust solutions that can identify and mitigate risks *before* they impact end-users. Organizations are realizing the critical importance of securing their software supply chains to prevent widespread compromise. Supply Chain Security news Sun, 12 Jul 2026 12:35:39 +0000 Supply Chain Security — appsec.fyi https://www.rescana.com/post/critical-cve-2026-2699-and-cve-2026-2701-vulnerabilities-force-immediate-shutdown-of-progress-sharefile-storage-zone-con https://www.rescana.com/post/critical-cve-2026-2699-and-cve-2026-2701-vulnerabilities-force-immediate-shutdown-of-progress-sharefile-storage-zone-con Progress ShareFile Storage Zone Controller v5.x has been forced into an immediate shutdown due to critical vulnerabilities, CVE-2026-2699 and CVE-2026-2701. These security flaws necessitate this urgent action to protect affected systems. Further details are available via the provided link. RCE news Sun, 12 Jul 2026 11:34:28 +0000 RCE — appsec.fyi https://www.rescana.com/post/ghostcommit-multimodal-prompt-injection-attack-exposes-ai-code-review-tools-to-supply-chain-risks https://www.rescana.com/post/ghostcommit-multimodal-prompt-injection-attack-exposes-ai-code-review-tools-to-supply-chain-risks A new multimodal prompt injection attack, dubbed "Ghostcommit," targets AI code review tools, posing significant supply chain risks. This attack leverages the AI's ability to process both text and image inputs. By embedding malicious prompts within images, attackers can trick AI code reviewers into accepting vulnerable code or even executing arbitrary commands. This bypasses traditional security checks and injects compromised code into development pipelines, potentially leading to widespread system compromise. The research highlights a critical vulnerability in how AI models handle mixed-media inputs, demanding urgent attention from developers of AI-powered security solutions. Supply Chain Security advanced Sun, 12 Jul 2026 11:30:37 +0000 Supply Chain Security — appsec.fyi https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html The jscrambler npm package version 8.14.0 was found to be compromised. During installation, it secretly executed a platform-specific binary. This binary's purpose and potential impact are currently unclear. Users who have installed this version are advised to uninstall it immediately and review their systems for any suspicious activity. Further investigation is ongoing to determine the full extent of the compromise and its implications. Supply Chain Security news Sun, 12 Jul 2026 10:25:29 +0000 Supply Chain Security — appsec.fyi https://discounttimu.substack.com/p/scanning-malicious-websites-with-cfe https://discounttimu.substack.com/p/scanning-malicious-websites-with-cfe This document, Part 2 of "Scanning malicious websites with arbitrary number of VPN tunnels," likely details advanced techniques for identifying malicious websites by leveraging multiple VPN tunnels. It probably explores methods to bypass security measures and gather intelligence on threats, potentially by obfuscating the origin of scanning activity. The focus is on a technical approach to enhance the detection and analysis of harmful online content through sophisticated network routing. Recon advanced Sun, 12 Jul 2026 06:15:20 +0000 Recon — appsec.fyi https://www.igorslab.de/en/global-cms-attack-wave-webshells-known-vulnerabilities/ https://www.igorslab.de/en/global-cms-attack-wave-webshells-known-vulnerabilities/ Attackers are exploiting known vulnerabilities in WordPress, Joomla, and Craft CMS to distribute web shells globally. This widespread attack wave targets these popular content management systems, indicating a coordinated effort to gain unauthorized access to websites. The specific vulnerabilities being leveraged allow attackers to upload and execute malicious code, potentially leading to data breaches, website defacement, and further compromise of server resources. Users of these CMS platforms are strongly advised to update their software immediately and ensure all plugins and themes are also current to mitigate the risk of infection. RCE news Sun, 12 Jul 2026 04:04:04 +0000 RCE — appsec.fyi https://www.securityweek.com/ghost-accounts-abuse-github-api-in-mass-recon-campaign/ https://www.securityweek.com/ghost-accounts-abuse-github-api-in-mass-recon-campaign/ Analysis of ghost account abuse of the GitHub API reveals mass reconnaissance campaigns leveraging dormant accounts and leaked credentials. Threat actors exploit unauthenticated API endpoints, including REST and GraphQL, to enumerate organizations, repositories, and users. While primarily focused on reconnaissance, some campaigns escalated to cloning repositories and exfiltrating data, sometimes using inadvertently exposed tokens. Detection strategies involve monitoring for data exfiltration from private repositories, anomalous user agent behavior, and establishing baselines for normal GitHub activity. GraphQL news Sun, 12 Jul 2026 01:19:28 +0000 GraphQL — appsec.fyi https://www.securityweek.com/hallusquatting-turns-ai-hallucinations-into-botnet-delivery-mechanism/ https://www.securityweek.com/hallusquatting-turns-ai-hallucinations-into-botnet-delivery-mechanism/ Technique detailing HalluSquatting, an attack that leverages AI hallucinations to deliver botnets at scale. This untargeted promptware method exploits AI applications by pre-registering fake repository or package names that LLMs commonly invent. When users ask AI tools like Cursor, GitHub Copilot, or Gemini CLI to fetch resources, the AI may hallucinate a squatted name, download malicious instructions, and execute them via the built-in terminal, leading to the deployment of malware and the creation of agentic botnets. AI Security news Sat, 11 Jul 2026 18:45:28 +0000 AI Security — appsec.fyi https://www.digitaltrends.com/cool-tech/researchers-hid-a-prompt-injection-inside-a-png-and-ai-fell-for-it/ https://www.digitaltrends.com/cool-tech/researchers-hid-a-prompt-injection-inside-a-png-and-ai-fell-for-it/ Technique for prompt injection via image files that targets AI coding assistants like Claude. Researchers demonstrated hiding malicious instructions within a PNG image, which AI review tools often overlook. These hidden commands can later trigger AI assistants to access sensitive project files and exfiltrate data, disguised as legitimate code. The vulnerability's manifestation varies depending on the specific coding assistant used, emphasizing the need for multimodal AI review that scrutinizes all asset types. AI Security news Sat, 11 Jul 2026 18:10:19 +0000 AI Security — appsec.fyi https://www.bleepingcomputer.com/news/security/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets/ https://www.bleepingcomputer.com/news/security/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets/ Writeup on Ghostcommit, an attack technique that hides prompt injection within PNG images to bypass AI code reviewers and steal repository secrets. Researchers demonstrated how a malicious instruction embedded in an image file referenced by an AGENTS.md document could trick AI agents like Cursor with Claude Sonnet into exfiltrating sensitive data from .env files. This exploit leverages the current blind spot where AI code reviewers often skip image analysis, unlike proposed multimodal defenders. AI Security news Sat, 11 Jul 2026 18:10:18 +0000 AI Security — appsec.fyi https://www.infosecurity-magazine.com/opinions/shadow-ai-is-your-new-attack/ https://www.infosecurity-magazine.com/opinions/shadow-ai-is-your-new-attack/ Analysis of "Shadow AI" highlights how unmanaged AI systems, adopted by employees for efficiency, create significant security risks. These "Shadow AI" deployments bypass traditional security controls and introduce new attack vectors such as data poisoning, prompt injection, third-party AI supply chain risk, and credential exposure, exemplified by the Samsung incident in March 2024. Addressing this emergent threat requires integrating AI governance and cybersecurity functions, focusing on visibility, accountability, AI-specific controls, and expertise investment. AI Security beginner Sat, 11 Jul 2026 18:10:17 +0000 AI Security — appsec.fyi https://lifehacker.com/tech/how-to-use-ai-browsers-without-getting-hacked https://lifehacker.com/tech/how-to-use-ai-browsers-without-getting-hacked Guide to using AI browsers like Perplexity Comet, ChatGPT Atlas, and Dia securely, highlighting risks such as prompt injection, unauthorized account access, and data leakage. It details vulnerabilities including CometJacking and Cross-Site Request Forgery (CSRF) affecting Atlas, and advises disabling data sharing for model training, restricting agent access to logged-in sessions, and utilizing incognito mode for sensitive tasks to mitigate these threats. AI Security beginner Sat, 11 Jul 2026 18:10:16 +0000 AI Security — appsec.fyi https://www.tomshardware.com/tech-industry/cyber-security/hallusquatting-is-the-latest-agentic-ai-exploit-where-models-dream-up-potentially-malicious-urls-in-tool-calls-attack-exploits-a-fundamental-weakness-in-every-available-model https://www.tomshardware.com/tech-industry/cyber-security/hallusquatting-is-the-latest-agentic-ai-exploit-where-models-dream-up-potentially-malicious-urls-in-tool-calls-attack-exploits-a-fundamental-weakness-in-every-available-model Writeup of the HalluSquatting attack, an exploit leveraging AI hallucinations to trick agentic AI models like Claude into executing malicious code from fake GitHub repositories. This technique exploits the non-deterministic nature of LLMs, causing them to generate plausible but nonexistent repository names, which attackers then register. Successful exploitation can lead to reverse shells, data exfiltration, and further system compromise, affecting models such as Claude Opus 4.5 and applications like Cursor and Copilot. AI Security news Sat, 11 Jul 2026 18:10:15 +0000 AI Security — appsec.fyi https://aws.amazon.com/blogs/security/designing-for-the-inevitable-system-prompt-leakage-and-mitigations-in-generative-ai-applications/ https://aws.amazon.com/blogs/security/designing-for-the-inevitable-system-prompt-leakage-and-mitigations-in-generative-ai-applications/ Library for defending against system prompt leakage in generative AI applications. This resource addresses LLM07, a top vulnerability where attackers use prompt injection to extract an application's system prompt, potentially revealing proprietary information and tool definitions. It emphasizes that full remediation is not currently possible, advocating for design principles that assume leaks will occur and implementing mitigation controls like Amazon Bedrock Guardrails' prompt attack filters to reduce exposure and increase extraction difficulty. AI Security intermediate Sat, 11 Jul 2026 18:10:14 +0000 AI Security — appsec.fyi https://www.infoworld.com/article/4193403/ai-agents-fall-for-indirect-prompt-injection-traps-2.html https://www.infoworld.com/article/4193403/ai-agents-fall-for-indirect-prompt-injection-traps-2.html Analysis of indirect prompt injection (IPI) traps reveals vulnerabilities in AI agents, with specific models like Llama3-3-70b-instruct, Llama3-2-90b-instruct, Gemini-3-flash, and Gemini-2.5-pro exhibiting susceptibility. This research highlights how hidden instructions embedded in websites can manipulate AI behavior, leading to scams that human users would typically avoid. The attack surface is expanding as AI agents interact more with the web, necessitating architectural rather than purely behavioral defenses, as traditional enterprise security models struggle to address these novel threats. AI Security intermediate Sat, 11 Jul 2026 18:10:13 +0000 AI Security — appsec.fyi https://carnegieendowment.org/europe/research/2026/07/when-ai-agents-attack-autonomous-cyber-operations-and-europes-governance-gap https://carnegieendowment.org/europe/research/2026/07/when-ai-agents-attack-autonomous-cyber-operations-and-europes-governance-gap Analysis of autonomous AI agent operations reveals evolving cybersecurity threats and governance gaps. The emergence of platforms like Moltbook, where millions of AI agents interact, highlights risks from data leaks (API authentication tokens) and the difficulty of tracing accountability. Major AI models like Anthropic's Claude, capable of identifying and exploiting zero-day vulnerabilities across operating systems and browsers, demonstrate the blurring line between AI-assisted operations and autonomous cyber capabilities. The EU faces challenges adapting its governance frameworks to address these rapidly evolving, agentic AI risks, particularly given its dependence on U.S. AI infrastructure. AI Security advanced Sat, 11 Jul 2026 18:10:13 +0000 AI Security — appsec.fyi https://x.com/ZOWEHZEE/status/2075936951429923278 https://x.com/ZOWEHZEE/status/2075936951429923278 This content details the successful exploitation of an XML External Entity (XXE) vulnerability to perform a Server-Side Request Forgery (SSRF) attack. The objective was to access the AWS metadata endpoint. The method involved utilizing an external entity to achieve this. The provided link points to further information on this XXE and SSRF exploit. No bug bounty payout amount is mentioned. SSRF intermediate Sat, 11 Jul 2026 13:48:22 +0000 SSRF — appsec.fyi https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html Library update addressing stored XSS in Zimbra Classic Web Client. Exploitation of this vulnerability allows attackers to inject and execute malicious JavaScript within user sessions via crafted emails, potentially leading to mailbox access, session data compromise, and account setting manipulation. This flaw, though unassigned a CVE, follows a history of XSS vulnerabilities in Zimbra, including CVE-2025-27915, CVE-2023-37580, and CVE-2024-27443. Users are advised to update to Zimbra Collaboration Suite version 10.1.19. XSS news Sat, 11 Jul 2026 12:56:34 +0000 XSS — appsec.fyi https://cyberpress.org/zimbra-10-1-19-fixes-stored-xss-flaw/ https://cyberpress.org/zimbra-10-1-19-fixes-stored-xss-flaw/ Zimbra 10.1.19 addresses a stored cross-site scripting (XSS) vulnerability that could be exploited by sending specially crafted emails. This flaw allowed attackers to inject malicious scripts into the Zimbra web client, potentially leading to unauthorized actions or data theft by users who viewed the compromised email. The update rectifies this security weakness, enhancing the platform's safety. XSS news Sat, 11 Jul 2026 07:41:19 +0000 XSS — appsec.fyi https://arxiv.org/pdf/2606.07158 https://arxiv.org/pdf/2606.07158 This research explores whether AI-generated adversaries can evade TTP-based attribution methods. The study, "Can AI-generated adversaries break TTP-based attribution? (arXiv 2026)," investigates the effectiveness of current attribution techniques against sophisticated, AI-driven attackers. It analyzes how advanced AI might mimic or alter Tactics, Techniques, and Procedures (TTPs) to mislead security systems and prevent the identification of the true attacker. The paper aims to understand the potential vulnerabilities in attribution models when faced with AI-powered threats and suggests future directions for developing more robust attribution systems. AI Security advanced Sat, 11 Jul 2026 06:15:40 +0000 AI Security — appsec.fyi https://github.com/bikini/exploitarium https://github.com/bikini/exploitarium Archive of public proof-of-concept and vulnerability research writeups, including specific findings for c-ares-tcp-uaf-calc-poc, curl-smtp-expn-recipient-crlf-injection, discourse-scoped-api-key-preauth-bypass, and rustdesk-session-permission-pocs. The repository preserves original READMEs and tracked files from former standalone repositories, ensuring byte-for-byte identical content as verified by Git tree data. This collection aims to foster interest in cybersecurity vulnerability research and encourage ethical disclosure. Bug Bounty news Sat, 11 Jul 2026 06:15:34 +0000 Bug Bounty — appsec.fyi https://search.cerast-intelligence.com/ https://search.cerast-intelligence.com/ This "Show HN" post introduces an OSINT tool designed to discover exposed files on various domains. The tool aids in identifying potentially sensitive information that might be unintentionally accessible via websites. No bug bounty payout amount is mentioned in the provided content. OSINT beginner Sat, 11 Jul 2026 06:15:34 +0000 OSINT — appsec.fyi https://github.com/flythenimbus/bramble https://github.com/flythenimbus/bramble Library for local-first password management, Bramble offers Chromium browser extensions, and iOS/Android apps that sync vaults peer-to-peer. It uses a Rust crypto core for Argon2id key derivation and AES-256-GCM encryption, with secrets wiped from memory post-use. Bramble supports passkeys, smart autofill, TOTP codes, and encrypted backups to local files or future cloud storage providers. It contrasts with cloud-based managers by ensuring vaults remain on user devices, eliminating a central breach target. Unlock options include master password, hardware keys, biometrics, or a recovery code. Secrets & Credential Leaks beginner Sat, 11 Jul 2026 06:15:33 +0000 Secrets & Credential Leaks — appsec.fyi https://github.com/openai/codex/issues/2847 https://github.com/openai/codex/issues/2847 Library of proposed features for OpenAI Codex, addressing the exclusion of sensitive files and paths from model analysis. This includes a mechanism for both repository-local and global ignore files, akin to `.codexignore`, to prevent the exposure of sensitive data such as `.env` files, `.pem` certificates, and `.ssh` directories, while still allowing analysis of others like `node_modules/`. The goal is deterministic and shareable configurations for team-wide consistency, building on prior discussions and aiming to rectify a gap in the current `codex-rs` implementation. AI Security news Sat, 11 Jul 2026 06:15:33 +0000 AI Security — appsec.fyi https://snyk.io/blog/how-to-keep-http-connection-alive-9-hours https://snyk.io/blog/how-to-keep-http-connection-alive-9-hours Tool for managing CTF user accounts and notifications, built with Spring Boot, Spring Security, and WebFlux. It integrates with the CTFd API to create users, assign unique aliases, and manage email notifications, including handling API rate limits with robust retry mechanisms and supporting long-running bulk email processes using Server-Sent Events (SSE) for status updates. API Security intermediate Sat, 11 Jul 2026 06:00:35 +0000 API Security — appsec.fyi https://yeswehack.com/en/blog/puma-live-hacking-event https://yeswehack.com/en/blog/puma-live-hacking-event leHACK's biggest Bug Bounty event, focused on PUMA, saw participants uncover numerous vulnerabilities. The event, which brought together ethical hackers and security researchers, aimed to identify and fix security flaws within PUMA's digital systems. The detailed analysis of the event highlights the significant findings and contributions made by the hacking community to enhance PUMA's cybersecurity posture. Bug Bounty news Sat, 11 Jul 2026 06:00:29 +0000 Bug Bounty — appsec.fyi https://cyberpress.org/trojan-visual-studio-supply-chain-attack/ https://cyberpress.org/trojan-visual-studio-supply-chain-attack/ A new Trojan has been discovered that exploits Visual Studio projects, turning them into a potent software supply chain attack vector. This malicious code can infiltrate development environments, allowing attackers to compromise legitimate software builds. The ultimate impact is the potential for widespread distribution of malware through trusted software updates. Supply Chain Security news Sat, 11 Jul 2026 05:55:45 +0000 Supply Chain Security — appsec.fyi https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys Writeup detailing CVE-2026-47291, a kernel-mode remote code execution vulnerability in Windows HTTP.sys. Exploitation involves an attacker sending crafted HTTP/1.x requests over TLS, triggering a heap buffer overflow during header parsing due to insufficient bounds checking when growing a buffer reference array. This can lead to denial-of-service or code execution with kernel privileges. The vulnerability is mitigated by configuring `MaxRequestBytes` to 65,535 or lower, and detection requires monitoring TLS-encrypted traffic for an unusually high number of HTTP header lines per request. RCE news Fri, 10 Jul 2026 23:34:17 +0000 RCE — appsec.fyi https://gbhackers.com/roundcube-webmail-security-update-patches-critical-zero-click-xss/ https://gbhackers.com/roundcube-webmail-security-update-patches-critical-zero-click-xss/ Roundcube Webmail has released a security update addressing critical zero-click vulnerabilities. These flaws allowed for Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF) bypasses, potentially enabling attackers to execute malicious code or access internal resources without user interaction. Users are strongly advised to update their Roundcube installations immediately to mitigate these risks. The update is crucial for protecting against potential exploitation of these severe security weaknesses. XSS news Fri, 10 Jul 2026 22:16:32 +0000 XSS — appsec.fyi https://www.scworld.com/brief/injective-labs-sdk-npm-package-compromised-to-steal-cryptocurrency-keys https://www.scworld.com/brief/injective-labs-sdk-npm-package-compromised-to-steal-cryptocurrency-keys Library for detecting supply-chain attacks like the compromise of the @injectivelabs/sdk-ts npm package. Hackers injected malicious code into version 1.20.21 of the package, which was downloaded 310 times, to steal cryptocurrency private keys and mnemonic seed phrases. The malware targeted functions for generating or importing wallet keys, exfiltrating captured data via HTTP POST requests. This incident highlights the risk to applications built with cryptocurrency wallets, trading bots, decentralized exchanges, and DeFi applications. Supply Chain Security news Fri, 10 Jul 2026 21:25:43 +0000 Supply Chain Security — appsec.fyi https://x.com/Sudarshana_io/status/2075682976583602648 https://x.com/Sudarshana_io/status/2075682976583602648 A security researcher, Sudarshana, discovered a Server-Side Request Forgery (SSRF) vulnerability in a headless PDF export. By directing the export to a specific AWS IMDSv2 endpoint (169.254.169.254/latest/meta-data/iam/security-credentials/), they successfully retrieved temporary AWS credentials. The researcher notes that IMDSv2's default configuration, which requires a PUT token, prevents this exploitation. They recommend using host allowlists rather than denylists to mitigate such vulnerabilities, as denylists may miss specific IPs. SSRF intermediate Fri, 10 Jul 2026 21:03:37 +0000 SSRF — appsec.fyi https://cyberpress.org/openclaw-remote-access-tool/ https://cyberpress.org/openclaw-remote-access-tool/ Researchers have discovered critical vulnerabilities in OpenClaw, a messaging application. These flaws could allow attackers to execute arbitrary code on a user's host system simply by sending a specially crafted WhatsApp message. This means a malicious message could potentially compromise a user's entire device, going beyond just the messaging application itself. Further details are available at the provided link. RCE news Fri, 10 Jul 2026 20:49:20 +0000 RCE — appsec.fyi https://www.developer-tech.com/news/developers-face-rce-via-claude-code-auto-mode-exploit/ https://www.developer-tech.com/news/developers-face-rce-via-claude-code-auto-mode-exploit/ A vulnerability in Claude Code's "auto-mode" allows for Remote Code Execution (RCE), posing a significant security risk to developers. This exploit enables malicious actors to potentially run arbitrary code on a developer's system through the AI assistant. Further details are available via the provided link. The summary does not include a payout amount as none was stated in the content. RCE news Fri, 10 Jul 2026 20:09:18 +0000 RCE — appsec.fyi https://arstechnica.com/security/2026/07/hackers-can-use-9-of-the-most-popular-ai-tools-to-assemble-massive-botnets/ https://arstechnica.com/security/2026/07/hackers-can-use-9-of-the-most-popular-ai-tools-to-assemble-massive-botnets/ Library for mitigating prompt injection vulnerabilities in AI assistants. HalluSquatting, a novel pull-based attack, exploits LLMs' tendency to hallucinate resource identifiers, enabling the assembly of massive botnets and large-scale device infections. This technique targets AI coding assistants like Cursor, Gemini CLI, GitHub Copilot, and others by registering predicted hallucinated identifiers and seeding them with malicious payloads. AI Security news Fri, 10 Jul 2026 18:45:37 +0000 AI Security — appsec.fyi https://cryptonews.net/news/security/33128062/ https://cryptonews.net/news/security/33128062/ Malicious actors attempted to compromise the Injective npm package, a crucial component for developers building on the Injective blockchain. The attackers aimed to inject malicious code into the package to steal users' private wallet keys. This incident highlights the ongoing threats to the cryptocurrency ecosystem and the importance of robust security measures for open-source software. Further details on the specifics of the attack and its prevention are likely to be found in the linked article. Supply Chain Security news Fri, 10 Jul 2026 18:45:34 +0000 Supply Chain Security — appsec.fyi https://www.csoonline.com/article/4195670/crowdstrike-identifies-five-new-prompt-injection-threats-to-ai.html https://www.csoonline.com/article/4195670/crowdstrike-identifies-five-new-prompt-injection-threats-to-ai.html Analysis of five new prompt injection threats identified by CrowdStrike against AI systems. These techniques include Trigger-Activated Rule Addition, Cognitive Token Suppression, Algorithmic Payload Decomposition, Special Token Injection, and Unwitting User Context-Data Injection, which exploit LLMs by tricking them into accepting dubious instructions disguised as benign input. Security teams can counter these attacks through threat modeling, expanded testing, and detection engineering for composite attacks. AI Security news Fri, 10 Jul 2026 16:05:33 +0000 AI Security — appsec.fyi https://ambcrypto.com/injective-software-package-hit-by-malicious-supply-chain-attack-details/ https://ambcrypto.com/injective-software-package-hit-by-malicious-supply-chain-attack-details/ Library for building Injective applications, compromised via a malicious supply chain attack on the `@injectivelabs/sdk-ts` package (v1.20.21) published to npm. Attackers gained access to a contributor's GitHub account to push malicious commits and, under the guise of telemetry, uploaded a backdoor that stole developers' private keys and mnemonic seed phrases when using `fromMnemonic` or `fromHex` wallet generation functions. The attack spread through transitive dependencies in 17 additional Injective packages. Supply Chain Security news Fri, 10 Jul 2026 15:35:39 +0000 Supply Chain Security — appsec.fyi https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html Writeup detailing a WhatsApp-to-host attack chain leveraging three OpenClaw vulnerabilities: GHSA-hjr6-g723-hmfm and GHSA-9969-8g9h-rxwm, both involving OS command injection and incomplete input validation in the host execution environment filtering; and GHSA-575v-8hfq-m3mc, a path traversal flaw enabling sandbox bind mount bypass. These flaws allow for credential theft, privilege escalation, and arbitrary code execution without prior host compromise, as demonstrated by accessing sensitive user files or the Docker socket. RCE advanced Fri, 10 Jul 2026 14:34:29 +0000 RCE — appsec.fyi https://x.com/Daily_CyberSec/status/2075581115335614844 https://x.com/Daily_CyberSec/status/2075581115335614844 Four critical vulnerabilities have been discovered in Apache Camel, affecting versions prior to 4.21.0. These vulnerabilities enable header injection, server-side request forgery (SSRF), secret disclosure, and authentication bypass. Users are strongly advised to update to version 4.21.0 immediately to patch these security flaws and protect their systems. SSRF news Fri, 10 Jul 2026 14:08:23 +0000 SSRF — appsec.fyi https://www.cio.com/article/4195152/your-next-insider-threat-doesnt-have-a-badge-it-has-an-api-token.html https://www.cio.com/article/4195152/your-next-insider-threat-doesnt-have-a-badge-it-has-an-api-token.html Library for securing AI agents, this resource addresses the evolving threat landscape where authorized AI agents, acting within their granted permissions, can cause breaches through sequences of seemingly benign actions. It details failure modes like tool-chain abuse, delegation-chain exploitation, and approval evasion, arguing that traditional security models focused on "who is allowed in" and "what data is allowed out" are insufficient for agentic systems. The library advocates for a runtime policy engine to govern agent actions at the moment they occur, ensuring authority shrinks during delegation and that audit logs serve as immutable evidence. API Security beginner Fri, 10 Jul 2026 10:11:08 +0000 API Security — appsec.fyi https://cybersecuritynews.com/django-sql-injection-vulnerability-exploited/ https://cybersecuritynews.com/django-sql-injection-vulnerability-exploited/ A critical SQL injection vulnerability in Django is currently being exploited in the wild. This vulnerability affects Django versions 3.2.x prior to 3.2.18, 4.0.x prior to 4.0.7, and 4.1.x prior to 4.1.1. The exploit targets specific database queries that can be manipulated to gain unauthorized access or execute malicious commands. Users are strongly advised to update to the patched versions immediately to mitigate this risk. No specific bounty payout amount was mentioned in the provided content. SQLi news Fri, 10 Jul 2026 09:06:31 +0000 SQLi — appsec.fyi https://www.helpnetsecurity.com/2026/07/10/software-supply-chain-security-video/ https://www.helpnetsecurity.com/2026/07/10/software-supply-chain-security-video/ Guide on operationalizing software supply chain risk, arguing for daily use of SBOMs beyond compliance for vulnerability triage, vendor access reviews, identity monitoring, and incident response. It draws on Group-IB’s High-Tech Crime Trend Report 2026 to illustrate how supply chain attacks link phishing, ransomware, and data breaches through inherited trust. The guide details prioritizing exposed systems, defining compromise windows, containing stolen credentials, and vendor risk scoring, highlighting AI's acceleration of attack timelines. Supply Chain Security beginner Fri, 10 Jul 2026 06:45:25 +0000 Supply Chain Security — appsec.fyi https://cyberpress.org/roundcube-webmail-1-7-2-fixes-zero-click-xss-dos/ https://cyberpress.org/roundcube-webmail-1-7-2-fixes-zero-click-xss-dos/ Roundcube Webmail 1.7.2 addresses critical security vulnerabilities, including a zero-click Cross-Site Scripting (XSS) flaw, a Server-Side Request Forgery (SSRF) bypass, and Denial of Service (DoS) issues. The update provides essential patches to protect users from these threats. SSRF news Fri, 10 Jul 2026 06:16:31 +0000 SSRF — appsec.fyi https://eaton-works.com/2026/07/08/coal-india-camera-hack https://eaton-works.com/2026/07/08/coal-india-camera-hack Writeup of plaintext password vulnerability in Coal India's AI security camera network, exposing the "RPI Dashboard" developed by DeepSight AI Labs. The analysis details how an unauthenticated API call to `get_users` revealed an entire user list with weak, duplicated passwords, and how local storage manipulation could bypass authentication to access the alert dashboard across seven coal mines, a flaw later confirmed fixed by CERT-IN. Secrets & Credential Leaks intermediate Fri, 10 Jul 2026 06:15:37 +0000 Secrets & Credential Leaks — appsec.fyi https://thereallo.dev/blog/claude-code-prompt-steganography https://thereallo.dev/blog/claude-code-prompt-steganography Analysis of Claude Code reveals prompt steganography used to mark requests. The application locally alters the system prompt by subtly changing date separators or apostrophes, embedding classification data about API base URLs and system timezones. This technique, triggered by the `ANTHROPIC_BASE_URL` environment variable and specific geographical timezones, aims to detect API resellers and unauthorized gateways. While not malicious, the hidden implementation of this classification mechanism undermines trust in a tool with extensive filesystem and shell access. AI Security advanced Fri, 10 Jul 2026 06:15:31 +0000 AI Security — appsec.fyi https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9 https://lwn.net/SubscriberLink/1079385/3d7a57da58b41aa9 Writeup detailing the "protestware" controversy surrounding the Xsnow application in Debian. The entry discusses how Xsnow's maintainer included a feature that displayed Ukrainian flags when the application's language was set to Russian. This triggered a debate on the Debian development list regarding potential violations of the Debian Free Software Guidelines (DFSG), specifically concerning discrimination. While Xsnow itself was deemed DFSG-compliant, the discussion highlighted concerns about software exhibiting deceptive behavior based on user settings. Supply Chain Security news Fri, 10 Jul 2026 06:15:30 +0000 Supply Chain Security — appsec.fyi https://snyk.io/blog/symlinks-are-still-scary https://snyk.io/blog/symlinks-are-still-scary Library detailing symlink attacks, a decades-old vulnerability vector enabling arbitrary file access and RCE. These attacks leverage symbolic links, small files containing paths that, when opened by a program, redirect to another location. Git's support for committing symlinks allows attackers to ship them in repositories, posing risks to build scripts, editors, and AI agents that process files without proper path resolution. The library highlights historical examples like CVE-2021-32803, Zip Slip, CVE-2024-21626, and CVE-2024-32002, alongside modern instances in Incus, emphasizing the need to resolve paths atomically before operation. AI Security intermediate Fri, 10 Jul 2026 06:00:41 +0000 AI Security — appsec.fyi https://yeswehack.com/en/blog/offensive-security-exposure-management-siloed https://yeswehack.com/en/blog/offensive-security-exposure-management-siloed In the AI era, offensive security and exposure management must integrate. Traditional silos hinder proactive threat identification and mitigation. AI-powered tools can enhance both, offering deeper insights into vulnerabilities and potential attack vectors. Integrating these disciplines allows organizations to move beyond reactive security measures and build a more resilient defense against evolving cyber threats. This unified approach is crucial for effective risk management in a rapidly changing landscape. Bug Bounty beginner Fri, 10 Jul 2026 06:00:32 +0000 Bug Bounty — appsec.fyi