🤗 Family Movie Time

I have some fun Halloween anecdotes but I haven’t had time to write them up yet so I’ll save them for next week.

Instead, I’ll quickly reflect on this wholesome meme I saw recently:

It reminds me of a very fond memory I have of when I was a wee lad, say 6 or under, about how my parents and I would watch movies together.

My dad would sit on one side of the couch and extend his legs down the rest of the couch, then my mom would sit on top of him and do the same, and then I’d sit on her and do the same, like we were a bunch of matryoshka Russian nesting dolls. It was very comforting.

There’s something nice about that closeness and familiarity. A part of me is wistful that this isn’t as much a thing when you’re older. I guess you get to live it again for a time, when you have kids.

Feel free to share a sweet memory you had with your parents as a kid, or that you have with your kid(s) now 🙂 

Sponsor

🚨65% of threat intel teams say noise is their #1 problem (Sponsor)

Alert noise and false positives were the most common challenge (65%) among surveyed enterprise intel leaders in Flashpoint’s 2026 Enterprise Threat Intelligence Report, followed by analyst bandwidth (55%). As one healthcare leader put it, “we can’t hire our way out of that problem.”

Flashpoint Ignite force-multiplies the team you already have, turning noisy alerts into actionable defenses. Tour the platform to discover how Ignite supports faster investigation and decision-making through advanced search, customized alerts, finished intelligence, dashboards, analyst support, and integrated AI.

👉 Tour the Flashpoint platform 👈

AppSec

The Vulnpocalypse - Good News and Bad News
Phil Venables examines the "vulnapocalypse" challenge where AI-driven vulnerability discovery is creating massive triage workloads, but argues the real bottleneck isn't finding or fixing vulnerabilities in code, it's deploying those fixes across diverse, complex infrastructures including edge devices, medical equipment, and industrial systems. He breaks down vulnerability remediation into four stages (discovery, fix development, testing/staging, deployment) and notes that while AI accelerates stages 1-2, stage 4 deployment often consumes 60% of effort due to certification requirements, infrastructure complexity, and reliability risks.

Phil proposes solutions including policy intent systems that auto-enforce configurations, AI-driven compensating controls that adjust WAFs/firewalls based on vulnerability context, patch intelligence to predict breaking changes, and faster rollback capabilities with incremental deployment percentages (5% → 20% → … 100%) to catch issues earlier.

💡 Fantastic blog as always from Phil. I like the style of the intro bullets, alternating “the good news is” and “the bad news is.” I’ve also been finding that the vulnerability fix deployment is a big percent of the effort and problem. Great discussion of the challenges and opportunity at each vulnerability remediation stage.

Backporting security fixes to stable releases
Trail of Bits’ Artem Dinaburg calls attention to the challenge of actually getting fixes to users, as stable releases (e.g. Ubuntu Long Term Support) often contain thousands of known, unfixed CVEs that AI agents can easily exploit. Using Codex with GPT-5.6, Trail of Bits identified and backported security fixes to stable Linux kernel branches and distributions, successfully getting 142 fixes representing 90 CVEs applied to stable kernel trees. (Linux CVE backport tracker)

Artem’s analysis shows significant vulnerability debt: Ubuntu 26.04 has 770 unfixed CVEs across 1,028 packages (43.5% high/critical), Debian 13 has 4,562 unfixed CVEs across 1,128 packages (39.9% high/critical), and stable kernel branches like 5.10.y contain over 2,000 unfixed CVEs. Trail of Bits is now offering free backporting assistance to open source projects and Linux distributions through Patch the Planet.

💡 I appreciate how this post highlights the importance difference between “this vulnerability has been patched in main" and “(most) users are actually protected.” The data around how many known, non backported CVEs there are is 😅 given how easy it is for current models to create exploits from a vuln write-up and/or a patch.

Backporting fixes seems like a great example of messy, grindy work that meaningfully improves security, and is well-suited for LLMs. Would love to see more details on how their process works.

Sponsor

📣 CodeAF: open-source software factory with vulnerability hunting built in

CodeAF is a new open-source software factory built for open models like DeepSeek and Qwen, with vulnerability hunting built in. Every candidate must survive a challenge before you see it: a source-to-sink trace, a sanitization check, a concrete exploit path. Findings land as SARIF with CWE IDs and a suggested patch. On one open model it tops DeepSource's published OpenSSF CVE Benchmark. On DeepSWE, same model, it solved nearly 4× as many real GitHub issues as Claude Code, at 3.4× less per solved issue.

👉 Try CodeAF on GitHub 👈

Hm those are some pretty impressive performance gains, curious to look into how they make that happen 👀 

Cloud Security

Things LLMs get wrong about AWS IAM
Alex Smolen critiques three common IAM anti-patterns frequently generated by coding agents: using explicit Deny statements in identity policies (which add unnecessary complexity when implicit deny already works), misapplying permissions boundaries outside their intended use case of constraining delegated IAM authority, and unnecessarily including sts:GetCallerIdentity in Allow statements when it's always permitted by default.

Athena's Trojan Horse: Cross-Tenant Data Poisoning and Exfiltration via AWS Athena
Upwind’s Dan Gansel discovered that aws-sdk-pandas (AWS's official pandas extension) creates a predictable default S3 bucket for Athena query results and treats attacker-owned buckets as legitimate by catching both BucketAlreadyExists and BucketAlreadyOwnedByYou exceptions identically. While AWS previously patched the Athena service for this bucket squatting vulnerability, the fix never propagated to the SDK.

Training on Enemy Ground: Cross-Tenant RCE in Amazon SageMaker
Upwind’s Dan Gansel discovered a cross-tenant RCE vulnerability in Amazon SageMaker's Python SDK stemming from predictable S3 bucket naming that allowed attackers to pre-register buckets and intercept ML workflows. The vulnerability exploited a logic bug in AWS's 2023 ExpectedBucketOwner fix that only validated ownership when buckets were already in the victim's account listing.

The attack produced zero errors or CloudTrail events in victim accounts, and affected 200+ official AWS example notebooks using default_bucket(). Beyond RCE, the squatted bucket enabled training data exfiltration, model poisoning, and intellectual property theft across the victim's entire ML pipeline.

💡 These bucket squatting / shadow resource attacks seem to be the gift that keeps giving for cloud provider vulns.

Blue Team

On the hunt for ARTEX: understanding agentic attacks in AWS environments
Datadog’s Julie Agnes Sparks observed ARTEX, an AI-native penetration testing framework, conducting real-world attacks against AWS environments in October 2026, using compromised long-term IAM access keys to search CloudWatch logs for financial data, file paths, and secrets like AKIA keys. Julie identified hundreds of internet-exposed ARTEX consoles (often in Mandarin, hosted in Singapore/Hong Kong), and observed unauthenticated abuse of public Amazon Cognito user pools, including anonymous sign-ups, token collection, and follow-up AWS account enumeration attempts.

The post describes ARTEX's multi-LLM architecture, how it uses an agent planner directing worker agents that record activity on a "blackboard" graph, two examples of real ARTEX activity in the wild, and detection opportunities, including characteristic user agents, placeholder S3 object requests (zzz_nonexistent_abc.txt), consistent FilterLogEvents limits of 1000 events, and noisy permission-denied errors during enumeration.

See also Wiz’s coverage of ARTEX here.

ARTEX and Friends: Enter Agentic Offensive Frameworks
Google Threat Intelligence Group and Mandiant observed multiple threat actors (financially motivated and suspected PRC-nexus operators) weaponizing open-source agentic pentesting frameworks like ARTEX, PentAGI, and Hexstrike to conduct highly-automated intrusions across the attack lifecycle, with some operations progressing from initial access to deep system access in as little as 15 minutes. ARTEX demonstrated capabilities including automated Active Directory reconnaissance, privilege escalation via Kerberoasting and DCSync, cloud infrastructure profiling to harvest Azure storage keys, and rapid iterative trial-and-error execution, though this speed came at the cost of being forensically noisy.

To counter these autonomous frameworks, Mandiant recommends five defensive layers: restricting control-plane access to trusted networks, migrating to short-lived workload credentials, continuous vulnerability scanning, hardening applications against feature abuse, and implementing behavioral detection to identify identity velocity anomalies and API bursts that indicate automated tooling.

💡 I found the “Evolution of Autonomous Offensive Frameworks” section especially interesting, as it describes the stages they’ve observed of how LLM-augmentation in cyber operations have evolved over the last year and how they expect it to continue:

• Stage 6: Multi-agent-driven, unsophisticated attacks with little to no human interaction - 1-3 months

• Stage 7: Sophisticated, fully autonomous/agentic attacks - 3 - 6 months

AI + Security

Quicklinks

• Kowntaewook/MCPTrace - A Volatility 3 plugin for extracting MCP/JSON-RPC message candidates from Windows and Linux memory dumps.

• Shadow AI agents are multiplying. Here’s how to find them - Employees are spinning up AI agents faster than security teams can track them, and no single discovery method gives complete coverage. Nudge Security’s guide breaks down eight discovery methods, what each detects and misses, and questions to ask vendors.*

• heterodoxin/AbliteratedOutTheBox - A fork of llama.cpp that bypasses LLM safety refusals at inference time without modifying model weights or requiring additional training. It works by forcing the model to generate both compliant and refusal responses to each prompt, computing the activation difference between them, then using a look-ahead gate to detect refusal attempts and projecting activations away from the refusal direction during generation.

^*Sponsored

The Patchless Window
Second Security's Elad Erez, Daniel Drizin, and Or Elias describe "The Patchless Window," the gap between when an open source vulnerability fix becomes public and when its CVE is published, finding it grew from 5.1 days in January 2026 to 39.2 days in August across 18,594 CVEs. They find that public exploits appeared within hours of fixes (fastest examples: 4-16 hours), while the fastest tenth of all public exploits arrived in just 1.8 days.

By analyzing commit histories, vulnerability flows, and matching exploits from VulnCheck's XDB database, they show that AI-accelerated attackers can weaponize vulnerabilities from public source diffs while defenders remain unaware, as vulnerability management tools and scanners only trigger on CVE publication. Ultimately the research argues that the real security gap extends from when vulnerable code is introduced until protection is deployed, and both ends must shrink as AI makes exploit generation from public fixes increasingly trivial.

💡 I’ve been thinking about this gap for a while, and I think this study really nails framing the problem and making it visually intuitive with some nice diagrams. Great work, highly recommend reading!

Abliterated Models in Appsec Pentesting
Include Security's Laurence Tennant tested abliterated GLM-5.3 (a model with safety guardrails surgically removed using the Heretic tool) against base GLM-5.3 for webapp pentesting using the OpenCode agent harness. He found the abliterated model produced 26% fewer vulnerability findings in source code analysis and wasn't significantly better at exploit development, though it did push further into post-exploitation without prompting, resulting in more robust proof-of-concepts in 4 of 5 cases versus 2 of 5 for the base model.

The abliterated model excelled at black-box pentesting by immediately starting vulnerability searches without careful prompting, but introduced risks including destructive actions, scope breaches, and supply chain concerns from untrusted hosting providers.

💡 It’s interesting to see performance and subtle behavior/risk differences in abliterated models. Originally based on this post, previously included in tl;dr sec, I thought abliterated models inherently had some trade-offs (e.g. intelligence, false positive rate), but now I’m not as sure, it might be possible to have an abliterated model with close to the same intelligence as the base model 🤔 

Misc

• Microsoft Paint RCE - We are in the lulzy-est timeline 😂 What about popping calc via calc? 🤔 

• Never gonna print you up! - Yannick Dixken discovered 14 vulnerabilities in Prusa 3D printers, culminating in a full RCE chain exploitable over the network.

• sshhole - OpenSSH on musl Linux has a bug such that it will… take any password >256 characters 😂 🫠  Absolutely insane.

• 93% of Paint Splatters are Valid Perl Programs

• Nvidia Is Preparing to Oust CEO Jensen Huang

• A Timeline of Nvidia CEO Jensen Huang’s Suspected Spy Drama - ‘When asked if Huang should remain CEO, Trump says, “I think so, oh yeah, sure,” adding, “he’s an honorable guy. I think he probably has an excuse for it.”’ I actually lol’d reading this 😂 

• Arian Teo - This guy creating anime versions of things is so fun - rom com, late for my flight

• Bryan Johnson - The Longevity Effects Of Psilocybin - Very fun storytelling style and animation at the beginning

• Tim Ferriss - The 4-Hour Workweek in a World of AI

• Todd Achilles campaign ad - How to Not Start Foreign Wars - Pretty 🔥 honestly

• Roald Dahl, Writer, Wartime Fighter Ace, and Honeypot - Whoa if this is true that’s crazy 🤯 

• HealthyGamerGG - Solving your problems doesn’t solve your problems

• Crazy Ex-Girlfriend - A Boy Band Made Up Of Four Joshes - Honestly this hits hard.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋