👋 I’m back!

Last week was the first time in 6 years, out of over 340 issues, I’ve delayed a tl;dr sec issue to the following week.

That’s because it was a pretty crazy week between the GPT-6 Astra launch, and a Cyber Summit event we held for a number of CISOs and other security leaders.

It was a bit surreal to be invited to deliver a small section of the livestreamed keynote (recording), along with Greg Brockman and other colleagues (shout-out Eric, Vanessa, and Johannes). I managed to fit in a joke that made it through editorial review 🤘 

I thought the process was interesting, so I wanted to share some behind-the-scenes:

About a month ago, the marketing team organizers offered to schedule me a virtual consultation with a fashion consultant for my outfit. Of course, I accepted. During the call I held up various options from my closet, she provided feedback, and afterwards she emailed me some links to other items I could buy.

Each speaker did a number of individual run-throughs in the preceding days, where a number of marketing, comms, and events people gave feedback, as well as an external speaking coach. Apparently I say “um” more than I’d expected, and I have a habit of using “so…” in transitions.

We did some full run throughs the day before and the morning of the event. I also received a calendar invite for “hair and makeup” since the keynote was being livestreamed and recorded 😂 

As we say in security, “Teams who get their makeup done together, stay together.”

P.S. If you appreciate tl;dr sec, please check out this issue’s sponsors 🙏 

Sponsor

📣 A $320/month subscription service is hijacking Microsoft 365 sessions — MFA included

Building and maintaining a live adversary-in-the-middle relay takes specialist skill. Island Security Research discovered that NovaCookies rents one out. This hands buyers a maintained Microsoft 365 sign-in flow, rotating infrastructure, and an operator dashboard, turning real-time session theft into an off-the-shelf product. Delivery chains hide behind genuine Docusign envelopes and Microsoft/Google redirect endpoints to look legitimate. Island detailed the attack and published 755 domains as IOCs.

🍪 See inside the phishing kit 🍪

AppSec

Rolling with the Punches: Why Cybersecurity is Backgammon, Not Chess
Phil Venables compares cybersecurity to backgammon, a game of managing risk under uncertainty rather than chess with perfect information and fixed moves. Backgammon concepts map to security practices, blots are exposed vulnerabilities that should be secured into anchors (defense-in-depth like IAM and MFA), primes are layered controls (network segmentation, EDR, DLP) that create impassable barriers, and blitz attacks mirror automated ransomware campaigns that overwhelm defenses.

The same logic extends to the doubling cube, the piece that lets a backgammon player raise the stakes mid-game, which Phil uses for the risk decisions executives face during incidents like whether to pay a ransomware demand or trigger disaster recovery. Phil recommends security be built to absorb hits and recover rather than to prevent every attack.

Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
Palo Alto Networks's Arie Olshtein describes three attacks on Google's synced passkey implementation that let an attacker take over accounts from a compromised endpoint without escalating privileges. The attacks exploit gaps in device trust workflows, inconsistent UV flag validation by relying parties, and the exposure of master key material to client devices, demonstrating that hardware-backed protections and cloud isolation don't fully eliminate endpoint compromise risks.

The Pass-ta-key attack extracts Chrome's TPM-wrapped identity key and signs cloud authenticator requests without user interaction. The Silver Pass-ta-key variant forces device re-registration by invalidating the existing UV key, then abuses the uv_key_pending state to register an attacker-controlled UV key without attestation, giving the attacker persistent access without ever touching the victim's device. The Golden Pass-ta-key attack extracts the security domain secret (SDS) from Chrome's process memory during cloud authenticator re-registration, so the attacker can decrypt every synced passkey and forge authentication responses, with no way to rotate or revoke the key.

“A distribution with rapid updates is now a requirement. I love older, stable software, but the cycle of backporting patches is simply too long. An older distribution that isn’t getting immediate upstream updates should be assumed vulnerable. A competent agent will discover these bugs quickly and synthesize target-specific exploits.”

Sponsor

📣 87% of orgs are running a known exploitable vulnerability right now

Datadog analyzed production telemetry from thousands of organizations rather than surveying them. 87% were running at least one known, exploitable vulnerability in a deployed service. But when runtime context is applied, whether the library is actually loaded, whether the service is publicly exposed, whether the code is reachable, only 18% of findings labeled critical remain critical.

The State of DevSecOps 2026 report covers the methodology, the full dataset, and where the gap between scanner severity and real exploitability is widest.

👉 Read the report 👈

Phew, 87% is a lot. Love to see how the runtime context can filter to just when a vulnerability dependency is actually loaded and the code is reachable, that’s quite useful for prioritization.

Cloud Security

Password spraying campaign targets AWS root user accounts across 150+ organizations
Datadog's Martin McCloskey writes about a password spraying campaign targeting AWS root user accounts across 150+ organizations between July 24 and August 23, 2026, identified by two specific user agents (Chrome 85 and Firefox 120) and traffic routed through residential proxies. No one got in, but even attempting a root login requires knowing the account's email address, which means attackers already had root emails for 150+ organizations, either from a pre-compiled list or by brute-forcing valid ones.

Martin recommends using AWS Organizations service control policies to block direct root activity, enabling centralized root access for short-lived AssumeRoot sessions, and alerting on all root activity through CloudTrail.

Threat hunt AI: How we built an AI security analyst on AWS for under $500/month
Grow Therapy's Pablo Vidal describes a $500/month AI threat hunting system that runs 20 daily hunts across 15 log sources (CloudTrail, Okta, GitHub, CrowdStrike, and others) using ECS Fargate, Lambda, and Claude. Each hunt runs through five phases, Sonnet handles data gathering with up to 100 tool calls, then Opus with extended thinking compares findings against 1-day and 7-day baselines, pulls in additional context, and scores confidence. After scoring, the model argues against its own findings using false positive history and actor history, and can only reject a finding with specific counter-evidence.

This adversarial review step cut the findings from about 40% noise to mostly stuff worth reviewing. To keep noise down further, both SQL detections and AI hunts write to the same Snowflake ALERTS table via CDC (change data capture) streams, with SHA-256 fingerprints that suppress repeat alerts for the same finding within 48 hours. Great tip: use a cheaper model (Sonnet) for the data gathering, which doesn’t need Opus-level reasoning (cut costs by ~60%).

Lessons learned:

• Data pipeline > AI - Get your logs in a queryable store like Snowflake or BigQuery.

• Existing observability spend is a cheat code - Use the tools your engineers already use for debugging (e.g. Datadog already has searchable logs).

• Build the feedback loop before deploying anything - The system that lets analysts mark false positives, stores those resolutions, and feeds them back into future hunts.

• Do signal-to-noise tuning in staging mode - Every new hunt should run against production data but write to a staging table.

• Start narrow on tools - They started hunts with only Datadog and Snowflake tools. Other tools got added as specific hunts needed them. A large set of tools might bloat up the LLM’s context window and lower the signal to noise ratio.

• Cost tracking - Have every hunt logs its token counts and computed cost.

Supply Chain

MCP Configuration Poisoning: Owning Your Machine With Just A Text File
Checkmarx's Bruno Dias demonstrates MCP Configuration Poisoning, where attackers embed malicious commands in mcp.json files that AI tools and agents automatically execute when processing repositories. Many tools including IDEs, security scanners, and CI/CD pipelines read and execute these files without prompting or sandboxing. As proof of concept, Dias exploits Snyk's Agent Scan (now fixed in v0.5.0) by creating a malicious mcp.json with a bash command that runs when the scanner processes the file.

Even "Human in the Loop" prompts aren't fully protected, since attackers can bypass them using "HITL Dialog Forging" (also called "Lies in the Loop"). Bruno recommends sandboxing execution environments, detecting suspicious patterns like shell invocations or URL piping, and treating configuration files from untrusted repositories as potential threats.

💡 Security vendor demonstrates attack technique by demoing it on another security vendor’s product 🍿🌶️ 

GitHub Actions SHA Pinning, Org-Wide
Semgrep's Leif Dreizler writes about how he rolled out GitHub Actions SHA pinning across ~350 repositories after the tj-actions/changed-files incident, where attackers rewrote every tagged release to point to malicious commits. He used pinact for tag → SHA conversion, Renovate for branch references, and Semgrep Agentic Workflows to run detection and remediation in parallel. Even with those tools, pinned actions calling other unpinned actions kept breaking the rollout, and Reusable Workflows added the same problem since the actions they call still need pinning.

Leif auto-enrolled new repos via a cron-based GitHub Action that checks for new repos every 15 minutes and enables the repo-level pinning requirement, pinned the ~80% of repos that had never run an action, and worked through representative repos first before flipping the org-wide switch.

💡 Great write-up of rolling out and enforcing a new security control, and the edge cases and nuances in GitHub Actions pinning, a few of which to me are non-obvious (e.g. transitive pinning).

Blue Team

gendigitalinc/sage
By Gen: An open-source Agent Detection & Response (ADR) framework that intercepts and validates tool calls from AI coding agents like Claude Code, Cursor, OpenClaw, and OpenCode before execution. It performs URL reputation checks via cloud APIs, evaluates commands against YAML-based threat heuristics, validates npm/PyPI packages through supply-chain analysis (registry existence, file reputation, age), and scans installed plugins for threats at session start.

The tool sends only URL and package hashes to Gen Digital reputation APIs while keeping file content, commands, and source code local, with an option to disable cloud services for fully offline operation.

A Cautionary Tale About Data Breach Claims, Verification and Carhartt
Troy Hunt used his OpenClaw tool to analyze the ShinyHunters Carhartt breach and found that nearly half of the 24.8M email addresses were synthetic TPC-DS benchmark data sitting in Carhartt's Databricks instance alongside real customer records. That test data had 97.6% of domains appearing only once, birth years uniform from 1924 to 1992, and domains pairing real names with gibberish strings. After stripping the test data and other duplicates, the actual victim count dropped to 12.9M, roughly half the number other analysts had already published without checking.

💡 Neat example of using AI to sanity check and comb through large amounts of data.

Red Team

DecBench
An experimental benchmark by researchers from the Noelo Lab at the University of Georgia, led by Zion Basque, for comparing decompilers and modern LLMs on the task of recovering exact source code. This benchmark uses new and previously known metrics (perfect match percentage) and datasets that represent the various directions of exactness for decompilers: control flow structure, types, and precise recompilability. This benchmark is also living: as new decompiler/LLMs are released, their scores will be added to the leaderboard.

Kuna: Decompiler Development in the Age of Coding Agents
Zion Basque releases Kuna, an experimental decompiler where an LLM wrote nearly every line of code, achieving 44.4% perfect control flow structuring on C functions compared to IDA Pro's 45.7%. The decompiler improves autonomously by studying examples where it underperforms against IDA Pro, Ghidra, and angr on fundamental metrics, successfully reimplementing more than 20 core angr features that took years of scientific research to develop. Kuna is a Rust port of Ghidra reworked to match angr's pipeline, demonstrating what high-level scientific feedback alone can achieve, though it still requires human-led research to guide refinement and, while structuring works well, types, optimizations, recompilability, and variable identification still need real work.

💡 Super cool work! One thing that’s become fairly clear with LLMs is that if you have an “oracle” when you’re implementing or porting something, whether it’s an extensive test suite or existing implementation, LLMs are very good at rebuilding it from scratch. We saw this in Anthropic’s port of bun from Zig to Rust, Cloudflare reimplementing Next.js, and more.

AI + Security

alibaba/open-code-review
Alibaba’s internal code review CLI, now open-sourced after two years of use across tens of thousands of developers, with a built-in multi-language ruleset (NPE, thread-safety, XSS, SQL injection), OpenAI & Anthropic compatible. They claim 9x fewer tokens and higher precision than Claude Code on a 200-PR benchmark across 10 languages. The tool uses a hybrid architecture where deterministic steps handle file selection, bundling, and rule matching while an agent handles the dynamic decisions, and supports workspace diffs, branch ranges, full-file scans, and a delegation mode where your existing coding agent (Claude Code, Codex, or Cursor) runs the review using the tool's file selection and rules.

Don't Let Abliteration Abliterate Your Bug Hunting: Discovering Verdict Bias in Uncensored Models
John McIntosh tested abliterated (uncensored) LLM builds against their base models for vulnerability research and found what they call "verdict bias," with abliterated models confirming findings 3-4x more often whether the evidence supported it or not. Using nano-analyzer to scan FreeBSD kernel source for a known CVE, base Gemma models correctly identified the real bug while the most aggressive abliterated build graduated 96% of candidates to VALID (versus 65% for base), produced 138 false positives, and never found the actual vulnerability. Those false positives aren't from lack of understanding, the model identifies exactly why a finding is invalid in its chain of thought, then confirms it anyway, because abliteration's weight editing strips out not just refusals but the model's willingness to say "no" under uncertainty.

Misc

Misc

• Alex Hormozi - It took me 37 years to realize what I'll tell you in 18 minutes.

• Alex Hormozi - "How Do You Know How Wealthy Someone Really Is?"

• Mark Manson - Why the Person You Feel for Will Change - “Loving someone is not loving them when they stay the same, it is choosing them even as they become someone new.”

• 5 essential rope knots everyone should learn

• Are you an unc? (childhood nostalgia)

• Sesame Street - Kermit and Joey sing the alphabet, but she keeps sneaking in “cookie monster.”

• John Steinbeck’s diary entry - “My work is no good, I am appalled at how bad it is. I am so lazy and the thing is so hard.”

• Nathan Fielder's Elizabeth Holmes Doc Met With Shock and Awe at Secret Screening

Humor

• POV: All the benches are taken

• Banger meme from Denny’s about how they’re similar to NVIDIA

• Kyle Gordon - We Will Never Die

• Weird Al - The Brain Song

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋