Preliminary collection

2026 AI

189 web security research leads collected for 2026 — preliminary, unranked and not community-vetted.

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

189 records · open this year in the interactive archive

Collected research

• $15k - CSPT to full account takeover, then 2FA bypass via the prototype chain whoareme

  Client-side path traversal reroutes an authenticated invite request to change an account email, enabling password reset. The author then reports a 2FA bypass using __proto__ as the code and explains a possible…

• $170k in Bypasses: The Vercel React2Shell Challenge ginoah and s1r1us

  Reconstructs React2Shell WAF challenge bypasses arising from differences between filtering and application parsing. The May writeup follows a March conference presentation of the same bypasses and describes local…

• 8 Out of 10 Banks in Belgium HATE This One Weird eID RCE James Arnott

  Follows browser messages into native Belgian eID software and its library-loading interface. Replayable activation data, exposed PIN-token key material and loose DLL checks combine with download and path-resolution…

• A First Measurement Study on Authentication Security in Real-World Remote MCP Servers Huijun Zhou, Xiaohan Zhang, Haozhe Zhang, Haoyang Zhang, Mi Zhang and Min Yang

  First measurement of authentication in remote Model Context Protocol servers. Of 7,973 live servers found, 40.55% expose their tools with no authentication at all. Among the rest OAuth dominates, but MCP deployments…

• A Formal Analysis of Agent Payment Protocols Ke Jiang, Mohan Yu, Yuan Chang, Mohit Kumar Jangid, Jianyu Niu, Cong Wang and Yinqian Zhang

  A matched Tamarin analysis compares authorization, payment and fulfillment properties across four agent payment protocols. The paper reports counterexamples and repairs, extending earlier payment-security analyses; its…

• AgentForger: ChatGPT Cross-Site Agent Forgery Mike Takahashi
• Agentic Browsers and the Same-Origin Policy Franziska Roesner and David Kohlbrenner

  Across seven agentic browsers, the embedded agent can read page content that the same-origin policy would deny to script, including cross-origin iframes and masked password fields. A malicious page that frames a…

• Alias Equals Zone? Large-Scale and Stealthy Takeover of Domain Hosting Service via CNAME-Following Cross-Domain Verification Ruixuan Li, Xingyu Zhao, Yunyi Zhang, Baojun Liu and Jun Shao

  Domain hosting providers misread CNAME semantics during ownership verification: a challenge token found after following a CNAME is accepted as proof of control over the aliasing domain, which itself configures no token…

• Almost Impossible: Java Deserialization Through Broken Crypto in OpenText Directory Services Dylan Pindur and Adam Kues
• Analyzing the WebRTC Ecosystem and Breaking Authentication in DTLS-SRTP Martin Bach, Vukašin Karadžić, Lukas Knittel, Robert Merget and Jean Paul Degabriele

  DTLS-SRTP secures media in Zoom, Teams and Google Meet and underpins WebRTC, whose stack spans HTTP, TLS, SDP, ICE, STUN, TURN, DTLS, SRTP and SCTP - too much to audit systematically by hand, so deployments went…

• Angular compromise through dev infra: GitHub Actions cache poisoning as a vulnerability class Adnan Khan and adnanthekhan

  A pull_request_target workflow in angular/dev-infra interpolated github.head_ref into a run step, so a branch name executed commands even though the token was read-only and no secrets were present. The payload flooded…

• API Keys Leaking in PNG Metadata of AI Images Luke Marshall

  Examines API keys serialized into PNG metadata by AI image workflows. A worked example contrasts executed prompt nodes with the entire saved canvas, including inactive nodes, and a public-image study measures exposure…

• Are your Sites Truly Isolated? Automatically Detecting Logic Bugs in Site Isolation Implementations Jan Drescher, David Klein and Martin Johns

  Site Isolation confines each site to its own renderer process, leaving the browser process to track which process may act for which site; errors in that bookkeeping are Site Isolation bypasses. This work presents the…

• Astro full-read SSRF: Host validation and prerendered error-page fetching Jorian Woltjer

  Traces a full-read SSRF through Astro’s server-side fetching of prerendered custom error pages. Host-derived URLs and uneven validation of Host and forwarded-host headers expose internal responses in a particular hybrid…

• AutoFail: Breaking Web Boundaries using Android's Autofill Framework Riccardo Lamarca, Philipp Beer and Marco Squarcina

  ADAPT traces Android autofill across five browsers and nine password managers, finding lost frame context and inconsistent matching that can leak credentials across sites. A separate UI-size oracle exposes saved-account…

• Avoiding the paradox: A native full-read SSRF and one-shot DoS in SvelteKit Rachid Allam (zhero) and Yasser Allam (inzo_)
• Before the first prompt: Code execution paths in trusted coding-agent projects Nick Frichette

  Examines code execution during startup of trusted coding-agent projects. A configured stdio MCP server can start before hook review, while a project-controlled PATH substitutes a git wrapper during automatic context…

• Beyond Normalization: The Expanding Unicode Attack Surface Ryan Barnett and Isabella Barnett

  Maps Unicode processing across byte decoding, regex options, URL conversion, Java hexadecimal parsing and cookie or database comparison. Pipeline diagrams and contrasting configurations show how inspection and later use…

• Beyond the Ceremony: The 2026 Passkey Attack Surface Matteo Giordano

  Organizes passkey testing across authenticators, hybrid transport, clients, relying parties, synchronization and recovery. Burp profiles and field-editing examples show how controlled key substitution preserves valid…

• Blind enumeration of unreadable records via a sort oracle in Trello BobAshEf

  Uses an unreadable Trello mirror card as a hidden participant in sorting. Renaming a readable probe card reveals relative ordering against the private title, turning permitted sorting into a comparison oracle; GraphQL…

• BodySnatcher: agentic hijacking in ServiceNow Aaron Costello

  Traces a shipped provider credential and email auto-linking into ServiceNow’s internal agent execution channel. Recovered constants identify active agents, while blind asynchronous requests resolve newly created records…

• Borrowing Windows Hello Keys for Authentication and Persistence Dirk-jan Mollema

  The WHFB private key lives in the TPM, yet the Passport KSP via NCryptOpenKey signs arbitrary data for a low-privilege user with no PIN or biometric prompt, a side effect of RDP needing the key usable under another…

• Breaking the Boundaries: Analyzing QUIC Frame-Packet Interactions With QUIC-Attacker Nurullah Erinola, Marcel Maehren, Marcus Brinkmann and Jörg Schwenk
• BUIzz: Finding Policy Enforcement Bugs via Interaction Simulation on the Browser User Interface Mingi Jung, Donggyu Kim, Mijung Kim and Seongil Wi

  Browsers enforce CSP, SameSite and similar headers, so a browser bug in enforcement silently removes the defence a site configured. BUIzz is the first framework to hunt those bugs through browser-user-interface…

• Burp Suite Professional: browser-powered crawl writes attacker-controlled files Masahiro Kawada (kawakatz)

  Traces attacker-controlled file-input metadata through a browser-powered crawler into local file creation. An unchecked extension/path allows a generated upload file to escape its temporary directory, with a Windows…

• Cache key injection: Smuggling poison through the door Alex Brumen

  Nginx case studies show how ambiguous cache-key boundaries can map distinct requests to the same cached response. The article examines conditional cache poisoning and disclosure risks and distinguishes upstream host…

• Cache Me, Catch You: Exploiting LLM Caching Layers in vLLM, GPTCache & Friends Xiangfan Wu, Lingyun Ying, Haipeng Qu, Guoqiang Chen and Yacong Gu

  Research on LLM serving caches (vLLM, GPTCache and peers) where the layer deciding whether two requests are 'the same' is fooled. All three cache types rest on serialize-key-reuse, so an attacker crafts colliding…

• Can AI do novel security research? Meet the HTTP Terminator James Kettle

  Feeding 1-3 sentence RFC fragments to an LLM generated 30,000 desync vectors, each validated on live sites by sending a plain request over a separate connection and watching for a changed response. It found triggers…

• CargoWise WebTracker — The Keys Were in the Cargo Patrik Grobshäuser, Shubham Shah, Adam Kues and Dylan Pindur

  Follows hardcoded encryption keys into CargoWise auto-login tokens and a fallback identity. Handler endpoints bypass page-level session teardown, enabling contact enumeration and persistent sessions that expose shipment…

• Casse-Spip - From an Unauthenticated SQL Injection to Remote Command Execution Franck Chevalier

  SPIP vulnerabilities combine an unauthenticated SQL injection, missing action authorization and mass assignment. The article explains how these flaws enable administrator account takeover or command execution through…

• Cast Attack: A New Threat Posed by Ghost Bits in Java Xinyu Bai and Zhihui Chen

  The Cast Attack exploits Java narrowing a 16-bit char to a byte (via (byte) ch and ch & 0xFF), dropping the high 8 bits ('ghost bits'). An attacker submits a Unicode character whose low byte equals a forbidden ASCII…

• Caught in the Octopus Trap: Unauthenticated RCE in Argo CD Hugo Vincent
• CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks Ziyu Lin, Tianlong Su, Yingjie Lin, Prosanta Gope, Yinzhi Cao, Ximeng Liu and Biplab Sikdar

  Measures CDN-to-origin amplification when compact HTTP/3 headers expand into HTTP/1.1 and slow request bodies retain backend connections. Experiments across six providers compare QPACK tables, stream limits, fan-out and…

• Charting your way in: Helm template injection Paul Barbé

  Follows attacker-controlled Helm values into YAML rendered by a privileged ArgoCD deployment. Multiline values, quoting and document separators create extra resources; comparing Helm versions shows that an invalid later…

• Chat-template backdoors: systematic evaluation and agentic impact Ariel Fogel, Omer Hofman, Eilon Cohen and Roman Vainshtein

  Poisoned chat templates insert privileged instructions without changing model weights. This 2026 study extends a July 2025 disclosure with comparative model and runtime evaluation; its May revision adds agent…

• ChatMate: Remote Prompt Execution on AI Assistants through Sandbox Escaping Ori Lahav

  A malicious document tells Microsoft Copilot to run gzip-packed Python in its analysis sandbox, which then reaches an unauthenticated internal service on the host network; its /config endpoint takes a name that…

• Claude in Chrome: from alert(1) to full account takeover Raul Klugman-Onitza and João Donato
• Cline Kanban WebSocket Hijack Sagi Layani

  Examines an unauthenticated local WebSocket control channel in Cline Kanban. Runtime messages expose task and workspace identifiers that can be used to attach terminal input, submit prompts and terminate sessions. The…

• Codex Discovered a Hidden HTTP/2 Bomb Calif

  HPACK lets a client seed the dynamic table once and then send thousands of one-byte indexed references; the per-entry bookkeeping a server allocates around a nearly empty header (about 70 bytes on nginx and IIS, 4,000…

• Coding-agent trust handoffs: shell validation, output channels and shared workspaces Elad Meged

  Compares coding-agent enforcement across shell tokenization, command classification, environment access, output channels and successive invocations sharing writable files. Chain-by-chain examples show how validation at…

• Compromising Cleo Harmony: A SAML Bypass Chain to Arbitrary Code Execution armadin.com
• Computer-Use and TOCTOU: What You Click Is Not What You Get! Johann Rehberger
• Content-Type Override to Stored XSS on public objects Amirmohammad Safari

  Examines response Content-Type overrides on public object storage. MinIO accepts an anonymous override, while an attacker’s own AWS identity can satisfy S3’s signed-request requirement for a public object; serving…

• CosmosEscape: Taking Over Every Database in Azure Cosmos DB Yuval Avrahami and Lior Maman

  Traces a Gremlin query escape into a shared Cosmos DB gateway, then follows gateway credentials through a signing key to account primary keys. A regional configuration lookup locates target tenants, linking query…

• cPanel file read through SMTP-created paths and CalDAV parser collisions Shubham Shah and Adam Kues

  Uses SMTP plus-address delivery to create a Maildir path required by a CalDAV attachment route. Later decoding and traversal expose another file, while an unretained privilege-reduction object restores elevated access…

• CRLF-Powered Desync Attacks: Beheading HTTP Streams Tom Stacey and Tobia Righi

  When Nginx's proxy_pass includes $uri the path is normalised and URL-decoded, so %0d%0a in it injects headers or whole requests into the upstream request. Injecting Transfer-Encoding beside the real Content-Length gives…

• Cruising for Shells in Flowise Alex Brown, Luke Jahnke and Jia Hao Poh
• CSS: the bomb inside your inbox Gareth Heyes

  Webmail sanitizers and browsers disagree about CSS. Nested href attribute selectors, sped by a clipboard-paste race, leak a Medium login token five characters at a time; when CSP blocks requests, @font-face…

• CVE-2026-21876: bypassing OWASP CRS by overwriting the multipart charset in a later segment daytriftnewgen (some0ne)

  Shows an OWASP CRS multipart rule overwriting one capture variable while iterating header values. A harmless charset in a later part hides an earlier dangerous value from final validation; the research and fix…

• CVE-2026-41238: How Prototype Pollution Turns DOMPurify Into an XSS Gadget Paul Reed

  Explains a DOMPurify custom-element gadget caused by replacing normalized configuration with an ordinary fallback object. The source-level case traces inherited allowlist options and RegExp type requirements…

• Demystifying the (In)Security of OAuth-based Account Linking in Connector Ecosystems Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung and Wing Cheong Lau

  Project page for a systematic study of OAuth connector account linking. It links the paper analyzing cross-user session fixation and connector or tenant confusion, alongside an Android static-analysis screening method…

• Deployment Poisoning: A(nother) Novel Attack Vector for GitHub Actions Boost Security Labs

  A workflow in a fork pull request can name an environment that does not exist; GitHub creates it and emits a deployment_status event that runs the default branch's workflow with secrets. The environment name is…

• DNS Cache Poisoning Like it's 2006 Omer Ben-Simhon and Amit Klein

  Cache poisoning against BIND 9 that predicts BOTH values a spoofed answer must match - the UDP source port and the TXID - where most prior attacks predict only one, and does it entirely from the client side, with no…

• DOMPurify bypass via SMIL animateTransform on Safari mizu.re

  Browsers now escape < and > in attributes during serialization, which broke nearly every DOMPurify mutation-XSS bypass. This one goes at SMIL instead: DOMPurify's default SMIL configuration combined with Safari's…

• DOMPurify XSS via `<selectedcontent>` re-clone KabirAcharya
• ELF in the Pixels: Building Shared Object–Image Polyglots Salvatore Abello (babelo)
• Envade: One Click in VS Code, Full Shell for the Attacker Elad Luz

  Documents the mismatch between displayed and persisted MCP installation fields in VS Code. The report analyzes hidden runtime configuration and HTTP account context, compares the consent boundary with Cursor, and…

• Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25 Adam Kues

  A WordPress REST batch mismatch enables nested validation bypass and read-only SQL injection. Forged post objects poison the request cache; oEmbed updates and hierarchy repair persist them as changesets. Temporary…

• Exploiting AQL Injection Vulnerabilities in ArangoDB Daniel Kachakil

  Explains AQL injection in collection and filter positions, including error-based, reflected, blind and timed extraction. Shows data modification and creation of JavaScript UDFs through system-collection writes, with…

• Exploiting Auth0 Defaults in XSS Attacks Alex Brown

  Uses an XSS lab to trace Auth0 token issuance when implicit grants remain enabled behind a confidential OAuth proxy. Tenant audience defaults and current-user Management API scopes create additional token paths; an…

• FCSC 2026 "Aquarium": escaping the Node.js Permission Model _Worty

  Solves a Node.js challenge by importing a data URL whose fragment defeats an appended filename suffix. From a permission-limited process, readable process metadata and same-user signaling start an unrestricted peer’s…

• FCSC 2026 writeups: Firefox `execCommand` ICU-vs-JS case-folding differential, Gunicorn `HEAd` smuggling, libmagic polyglots kevin_mizu

  Five CTF web writeups, each a parser disagreement. JavaScript's toLowerCase expands U+0130 to two code points so an execCommand blocklist misses it, while Firefox's u_tolower maps it to plain i and runs insertHTML…

• Finding Gadgets Like it's 2026 Atredis Partners

  An LLM agent drives a call graph built with WALA class-hierarchy analysis, pruned to Serializable classes and extended via ASM with reflection and type-confusion edges, querying it over REST and validating each…

• From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX Marcio Almeida

  Examines unauthenticated encryption and inconsistent validation across Telerik upload and postback paths. The case combines established cryptographic and deserialization techniques, explains nondefault deployment…

• Get Set, Exploit! Unveiling Python Class Pollution In-the-Wild Zhengyu Liu, Jiacheng Zhong, Jianjia Yu, Muxi Lyu, Zifeng Kang and Yinzhi Cao

  Python's recursive attribute and item setters let a user-supplied key path walk from an object to its class, module globals, function defaults and closure cells, so one nested update rewrites the runtime. The talk gives…

• Ghosts of Encryption Past: Salesforce Marketing Cloud / ExactTarget Dylan Pindur, Shubham Shah and Adam Kues

  Investigates Salesforce Marketing Cloud email-view encryption by connecting template injection, CBC manipulation and a MicrositeURL encryption oracle. Recovering an accepted legacy XOR format accelerates forging and…

• GitHub RCE Vulnerability: CVE-2026-3854 Sagi Tzadik

  Traces Git push-option delimiters into trusted metadata passed between GitHub services. Following the overwritten fields through their consumers reveals environment and sandbox changes, activation of pre-receive hooks…

• Golang code review notes II Zoltan Madarassy and Alex Brown

  Collects six Go review cases involving length truncation, removed proxy headers, shared URL pointers, C strings, JSON method selection and permissive decoding. Working examples and Semgrep rules connect each…

• Gotta Phish 'Em All! Novel Attack Techniques via Persistent Browser-in-the-Middle Giacomo Lenzini

  Presents a persistent browser-in-the-middle framework with isolated sessions, substituted cursors, synchronized page identity and extension-mediated traffic changes. Suppressing logout requests while clearing visible…

• Grand Theft Atlas Stav Cohen
• H3Act: Automated Measuring Semantic Conversion Anomalies of HTTP/3-to-HTTP/1.1 Translation in CDNs Qihang Peng, Siyuan Tian, Yongxin Qiu, Jinyang Huang, Yaru Yang, Xiang Li, Jia Zhang, Yiming Zhang, Haixin Duan, Yunsenxiao Lin, Shugen Chen and Liqun Yang

  Presents H3Act, which generates structured HTTP/3 probes and analyzes their HTTP/1.1 translation at CDN backends. RFC retrieval, an attack corpus and generator/analyzer feedback guide testing; compressed payload…

• Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird Aleksey Solovev and Nikita Sveshnikov

  Traces Firebird PDO query reconstruction through NUL-terminated string operations. A quoted binary token loses its closing quote while reconstruction resumes at later tokens, making subsequent input become SQL syntax…

• Hack the Source, Of the Source Tsi-Lin Ng

  A talk on hacking package registries by chaining parser differentials with injection. A LuaJIT-vs-Lua integer differential makes server and client resolve different versions; Julia's Registrator falls to command and…

• Hacking AI customer service agents Ayoub and Inti De Ceukelaire

  AI support agents can join a ticket, account and privileged support workflow without preserving the customer's authorization boundary. The article explains how to map tools, influence agent decisions and test…

• Hacking Your Life with AI Can Get You Hacked: How AI Orchestration Platforms Ship RCE by Design Peyton Kennedy

  Seven AI workflow platforms assume that whoever edits a workflow may run code on the host, while the actual caller is an unauthenticated webhook or a member account. Nocobase's SES compartment has lockdown() commented…

• HashDoS in V8's array-index string hash, and a seeded but invertible permutation as the fix sharp_edged

  A HackerOne report for CVE-2026-21717, a HashDoS in V8 affecting Node.js 20/22/24/25. V8's string hashing maps integer-like strings to their numeric value, so hash collisions are trivially predictable. A request that…

• HermeticReader: turning Adobe's 300M-install extension into a WhatsApp takeover Shaked Biner

  Follows messages from a web-accessible Adobe extension frame into feature flags and a dormant DOM bridge. Extra properties let the attacker redirect the bridge to another tab, where DOM manipulation extracts rendered…

• Hidden security risks in Jupyter notebooks Yaniv Nizry

  Examines Jupyter Desktop and JetBrains notebook boundaries. Navigation can retain a privileged preload bridge that reveals a local server token, while widget protocol configuration can load script into a trusted…

• HijackKV: New Threat in Position-Independent KV Cache Reuse Yichi Zhang, Zhiqi Wang, Huan Zhang and Yuchen Yang

  Position-independent KV cache reuse lets a serving system reuse cached key-value state whenever identical text chunks appear, whatever their position. Because a cache entry is retrieved by token match but encodes the…

• iframe sandbox bypass, cross-origin drag-and-drop, unvalidated postMessage origin, cookie bomb to account takeover Renwa

  Walks through user-assisted drag/drop into a code-evaluation field and a popup-based OAuth chain. An oversized-cookie error interrupts callback consumption so the code can be read from a same-origin window and redeemed…

• Invalid Signed HTTP Exchange fallback navigation: SekaiCTF Filtered Reality dimasma0305

  Solves a constrained reflected-content challenge using an invalid Signed HTTP Exchange body as a fallback navigation source. The navigation changes the Accept header and combines with reflected Content-Type and CSP…

• JavaScript Functions Overload Confusion Yashar Shahinzadeh

  An array sent as m.data.origin stringifies to https://example.com, so new URL().hostname passes the allowlist, but being an object it picks postMessage's options overload and the secret is delivered to the attacker's…

• Jupyter Enterprise Gateway - From Notebook to Kubernetes Cluster Admin Ben Cambourne

  Traces Jupyter Enterprise Gateway inputs through three paths: numeric coercion around a UID/GID denylist, explicit Jinja template evaluation and unescaped YAML pod specifications. The walkthrough distinguishes execution…

• Keys to the Kingdom: Anonymous SQL Injection in Drupal Core (CVE-2026-9082) Patrik Grobshäuser, Kevin Gervot and Tomais Williamson

  Traces attacker-controlled array keys through Drupal’s PostgreSQL-specific case-insensitive IN translation, where SQL placeholders are rebuilt outside generic normalization. JSON login and JSON:API examples expose…

• KindaRails2Shell: how a MATLAB file reads your secrets and pops a shell on Rails André Baptista (0xacb), s3np41k1r1t0, castilho and Ethiack Research Team
• KYC age-verification bypass: generative video and browser liveness-integration testing Kevin Tellier and Léo Desmonts

  Tests generative video against a browser-based age-verification and liveness integration. The article separates video creation, camera injection, challenge behavior and acceptance, showing how injected media can enter a…

• L3akCTF 2026 "Squid": racing `/proc/self/fd` symlinks against Flask `send_file` Jorian Woltjer

  Solves a Flask file-disclosure challenge by racing recycled procfs file descriptors between stat and open. A regular file supplies a nonzero length before an environment file replaces it, bypassing response-length…

• LeakyLinks: Measuring the Security and Privacy Risks of URL Scanning Services Ali Mustafa, Jannis Rautenstrauch, Florian Hantke, Shubham Agarwal, Stefano Calzavara and Ben Stock

  URL scanning services publicly index what they are asked to scan, so access tokens and personal data embedded in a submitted URL become searchable by anyone. LeakyLinks pairs URL filtering with LLM-driven semantic…

• LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails Aviv Donenfeld

  OpenSearch guards pull_request_target CI with a step that curls the PR diff into a Claude prompt, failing the build at medium severity or above. The gate sees about three lines of context, cannot open implementation…

• Living Off The Pipeline: Defensive Research, Weaponized (SmokedMeat / Brisket) François Proulx
• LLM Heist: auditing LiteLLM traffic rerouting, provider-key exposure and tool-call injection Johann Rehberger

  Shows how an administrator credential can reroute a trusted LiteLLM gateway to an attacker proxy, causing provider credentials to be presented there. Subsequent forwarding and structured response modification enable…

• Melting the Flesh of PHP's Memory Hardening Yifan Wu, Xiaochuan Yu and Zhiyun Qian

  PHP's heap hardening initiative set out to stop popular heap exploitation techniques. The first security study of it finds the mitigations defeat current-generation exploits but not adapted ones: it names the flaw that…

• MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Georgios Syros, Evan Rose, Brian Grinstead, Christoph Kerschbaumer, William Robertson, Cristina Nita-Rotaru and Alina Oprea

  Web agents drive a real browser, so untrusted page content reaches the model that decides what to click. MUZZLE red-teams them with an agent rather than fixed templates: it reads the target agent's own trajectories to…

• My First RCE by Reverse Engineering an EXE File With the Help of AI Yashar Shahinzadeh

  Investigates a local .NET agent exposed through a WebSocket API. The author recovers encrypted request handling, disproves a shell-injection hypothesis with a controlled executable and finds an alternate RUNDRIVE…

• Navigating Lax Load Balancers: When an Intersection Gets You Inside Francesco Lacerenza and Mohamed Ouad

  Correlates AWS load-balancer listeners, ordered rules, target groups and backend members to find alternate routes around source-IP, authentication or CDN restrictions. The ELBaph tool and Terraform lab turn separate…

• NemoClaw drive-by agent hijacking: bind-dependent defenses and persistent template poisoning Elad Luz and Ofek Itach

  Connects a container integration’s non-loopback Ollama binding to disabled host checks and DNS rebinding. Modifying a model’s rendering template persists injected instructions where an earlier system-message change…

• Nested APP Authentication — Undocumented Risk and Conditional Access Bypass Shang-De Jiang and Jun Sheng Shi

  Conference page for a study of Microsoft Nested App Authentication. The associated presentation varies broker, nested-client and resource identities and compares Conditional Access inclusion and exclusion policies…

• Never Trust the Output: semantic data pollution in AI agents and MCP Slonser

  Shows an AI agent interpreting escaped data in a structured tool result as additional fields or records, including fullwidth quote and comma spellings. Later tool calls inherit the altered semantics, while fake errors…

• No Socket, No Privs, No Problem: Weaponizing OCI Registries for SSRF, Credential Theft, and Container Escapes David Rochester and Nicholas Gould

  Examines malicious OCI registry challenges and blob redirects as privileged fetch operations. Reusing a digest for a layer and configuration changes verification state and retains SSRF response bytes for exfiltration; a…

• No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks Yarden Porat and Shahar Tal

  Prompt injection is the given; the bugs are in the framework underneath. A tool-call argument carrying LangChain's own constructor JSON is revived by its loader into a chat model with an attacker endpoint and a secret…

• NodeBB XSS through translation-template gadgets after HTML escaping Jorian Woltjer

  Examines eight NodeBB findings, including translation performed after HTML escaping. Bracketed translation syntax selects trusted catalog strings as HTML gadgets, with a second template supplying syntax blocked in…

• OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration Rachel Rabin

  Compares OAuth password-grant responses for registered, unregistered, random and malformed client IDs. The error matrix distinguishes user and credential validation from successful token issuance and explains why…

• OffGuard: LiteLLM authentication and proxy-boundary case study Amitai Cohen and Yaara Shriki

  Explains separate LiteLLM failures in MCP authentication, custom guardrails and administrative defaults. The article distinguishes unauthenticated MCP access from guardrail execution that requires administrative access…

• One Chain to Own Them All: Breaking AI Infrastructures Ji'an Zhou

  A hunt across AI serving stacks that ends in PyTorch's model loader: the weights_only whitelist meant to make torch.load safe was bypassed once, then again after the fix, when a whitelisted function reached through…

• One Char to Rule Them All: DNS Silent Vulnerabilities in Domain Name Resolution Fasheng Miao, Xiang Li, Changqing An and Jilong Wang

  The SHAR (special-characters) attack against DNS. RFC 1035 and RFC 2181 disagree on which characters domain labels may contain, and DNS components handle unsupported characters inconsistently, many silently dropping the…

• One trigram at a time: XSLeak via Universal CSS Injection and DoS in Opera (GX) zhero and inzo_

  Opera GX installs GX Mods - CRX packages carrying CSS but no JavaScript and no permissions - automatically when a page links or frames the file, giving attacker-controlled CSS on every site the victim visits; in…

• Out of Bounds, Out of Sandbox: RCE in Go JavaScript Engine Dylan Pindur and Adam Kues

  A TypedArray offset bug in Goja gives JavaScript code access beyond its buffer. The research connects this corruption to Go runtime objects and native calls, developing a script-to-host escape with published exploit…

• Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems Hongyan Chang, Ergute Bao, Xinjian Luo and Ting Yu

  Indirect prompt injection is usually studied without the hardest step: an unoptimised payload is rarely retrieved under natural queries, so its real impact stays unclear. The malicious content is split into a trigger…

• Parse and Parse: MIME Validation Bypass to XSS via Parser Differential Tang Cheuk Hei

  Content-Type is a singleton field, but Chromium and Firefox coalesce it on commas and keep the last syntactically valid type, while MIME libraries split at the first semicolon and keep the first. So…

• Pass the Passkey: A Novel Attack Surface in Passwordless Authentication Arie Olshtein

  Investigates cloud passkey recovery after compromise of device identity. Forced re-onboarding permits an attacker-controlled user-verification key to be registered in a pending state, supporting later remote assertions…

• Pass-the-Passkey Family of Attacks Michael Grafnetter and @MGrafnetter

  An announcement for a Black Hat USA 26 briefing, not the research itself. It previews a family of attacks the authors liken to Pass-the-Hash and NTLM relay: a major cloud service's passkey implementation vulnerable to…

• Path traversal in signed URLs — present even in the official AWS SDKs Matsui and Eui Chul Chung

  S3 keys are flat, so ../ in an object key is only text until something normalises the path while a presigned URL is built. AWS SDK for Go v1 runs path.Clean() after filling /{Bucket}/{Key+}, so a key of…

• Poisoned by the Host: Large-Scale Measurement of Host Name Poisoning in Web Applications Rui Yang, Haoyu Wang, Zhicheng Sun, Zhengyu Liu and Yinzhi Cao

  Presents HALO, a host-name-poisoning analysis that combines server request behavior, framework host-access guards and application flow checks. The paper provides a multi-stack testing matrix, source-to-sink examples and…

• Poisoning Claude Code: One GitHub Issue to Break the Supply Chain RyotaK

  Claude Code's GitHub Action treated any actor ending in [bot] as having write access, and agent mode never checked the actor was human, so an attacker's own GitHub App, able to open issues on any public repo, feeds it…

• Privacy risks of agentic oversharing on the Web (SPILLAGE) Ali Shahin Shamsabadi

  SPILLAGE measures what LLM web agents disclose while shopping on Amazon and eBay, along two axes: explicit versus implicit disclosure, and content versus behaviour. 180 tasks over Browser-Use and AutoGen with GPT-4o, o3…

• Prompt Injection as Role Confusion (CoT Forgery) Charles Ye, Jasmine Cui and Dylan Hadfield-Menell

  Language models receive system, user, tool and reasoning content as one token stream distinguished only by role tags. Using linear probes trained on identical text wrapped in each tag, this work shows models infer role…

• PromptFiction: a one-click flaw that made Claude Desktop act without consent Elad Luz

  Analyzes automatic instruction submission through Claude Desktop deep links. The report separates conversation-data access from filesystem effects requiring configured MCP tools and further permissions, and describes…

• Proto6: The Schema Was Not Supposed to Run Vladimir Tokarev

  Follows schema-derived identifiers into runtime and static JavaScript generation in protobuf tooling. Prototype-inherited lookups admit hostile type names, while identifier escaping, object prototype writes and…

• Pwning Claude Code in 8 Different Ways RyotaK

  Claude Code allowlists read-only commands such as echo, sort and sed, then guards them with a blocklist over their arguments. Eight bypasses of that blocklist reach command execution with no approval prompt: unfiltered…

• Race Against The Patch: Four Exploit Chains in LiteLLM Shi Weiming and Bruce Chen
• RCE in Google's AI code editor Antigravity - $10000 Bounty sudi

  Examines an overbroad browser-extension messaging interface that forwarded web-origin requests with authority to Antigravity’s authenticated local service, enabling a chosen-path file write. Startup-file execution…

• Re:CACHE — Excessive reflection, type confusion, and 0-click SXSS on Next.js Rachid Allam (zhero;) and inzo_

  Combines reflected response headers with external caching in a Next.js deployment. Attacker-selected Content-Type makes an RSC response render as HTML when a cache ignores Vary, while a second cached Refresh response…

• Recovering Encrypted LLM Reasoning Traces Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping and Maksym Andriushchenko

  Providers hide chain-of-thought by returning it to the client as an encrypted blob. Those blobs turn out to be interchangeable across sessions, users and models within one provider, so injecting a strong model's trace…

• Regular Expression Denial of Service Induced by Backreferences Yichen Liu, Berk Çakar, Aman Agrawal, Minseok Seo, James C. Davis and Dongyoon Lee

  ReDoS theory assumes Kleene regexes and the NFAs that model them, which cannot express backreferences - so Python, Perl, PHP, Ruby and Java fall outside it. A Two-Phase Memory Automaton captures backreference semantics…

• Remote Command Execution in Google Cloud with Single Directory Deletion RyotaK

  Looker's delete_dir rejects a path containing .git but not a bare /, so rm_rf is handed the whole checked-out repository. It deletes post-order in readdir order, predictable enough on ext4 that a sprayed directory puts…

• ROP for the Web: Smuggling XSS, SQLi and Web Shells Past Every WAF Using Compression Dictionaries Lenin Alevski

  Conference presentation introducing controlled Compression Dictionary Transport experiments. Companion labs compare visible responses with dictionary-compressed responses under WAF and IDS inspection. The work…

• Roundcube: remote-content and CSS sanitizer bypasses nullcathedral

  Traces Roundcube SVG feImage handling into a policy route intended for ordinary links. Because the browser fetches the image resource while the sanitizer treats its href differently from image sources, email content can…

• Ruby 4.0 Universal RCE Deserialization Gadget Chain Luke Jahnke

  A universal Marshal.load chain for Ruby 4.0.6, built from RubyGems classes that naming Gem::SpecFetcher autoloads. Time._load validates its zone inside rb_rescue, discarding the exception, and calls to_str, which…

• Salesforce Apex Predator: Breaking Salesforce Sites Nitay Bachrach and Cynthia Ardman

  A Salesforce assessment workshop covering Aura and LWR discovery, bundled component analysis, Apex method and parameter tracing, SOQL/SOSL injection and GraphQL/UI-API exposure. Embedded field manuals and lab sequences…

• Sandcastles, Not Sandboxes: auditing Pyodide-to-host trust boundaries Vladimir Tokarev and Saar Pearl

  Traces restricted Python execution through ctypes and Emscripten exports into the runtime embedding Pyodide. Product cases separate interpreter restrictions from host capabilities, data and credentials, providing a…

• Scanning the Scanners: Turning Security Vendors into Supply-Chain Weapons Raphael Karger
• SearchLeak: Parameter-to-Prompt injection in Microsoft Copilot Dolev Taler
• SECCON CTF 14 Finals: Shadow CSS and friends arkark

  Explains SECCON web challenges including a Firefox Link-header stylesheet load that combines response truncation and integrity checks into a secret-prefix oracle. Other solutions examine chunk-boundary UTF-8 loss, HTML…

• Securing the Supply Chain: Cache Vulnerability in RubyGems Luke Marshall

  Explains why a RubyGems API-key endpoint became cacheable only for compressed responses. Gzip changes the response object before ETag middleware, leaving a cache policy that the deployed CDN reuses under a shared…

• Security Considerations on Istio’s CRDs with Namespace-based Multi-Tenancy Lorin Lehawany and Sven Nobis
• SELECT-only PostgreSQL exploitation: Drupal case study N. Maccary

  Develops a SELECT-only Drupal/PostgreSQL injection into large-object file writes, configuration replacement and native module loading in a new backend. The writeup explains database privileges, connection-pool lifecycle…

• Shaking the MCP Tree: A Security Deep Dive Amirmohammad Safari

  Walks through MCP assessment from OAuth dynamic client registration and authorized tool inspection to a constrained-fetch SSRF chain. Path normalization and an attacker-registered OAuth error redirect expose internal…

• Shazzer XSS: blob origins, failed cleanup and sandbox navigation Jorian Woltjer

  Follows a parent-origin blob through a null-origin sandbox. A structured-clone exception prevents cleanup, preserving a leaked object URL for user-mediated navigation; a clean same-origin popup then changes the CSP…

• Site Isolation is Dead: How Site Isolation is Broken in Agentic Browsers and Extensions Suyoung Lee, Seongho Keum, Changoo Lee, Dongwon Shin, Sanghyun Hong, Byoungyoung Lee and Sooel Son

  Site isolation separates renderer processes per origin, but an agentic browser's whole purpose is to act across that boundary. Two open-source agentic browsers and seven agentic extensions share one architecture…

• Site-DOM-XSS using Cookie Injection: The AI Hackers are Coming Faster than You Think Renwa

  Connects a TikTok analytics cookie writer to an OAuth script-host sink using a space-based cookie parser. URL decoding turns a plus into a space inside an unencoded cookie value, allowing a pseudo-cookie to supply…

• Smashing the ServiceNow Sandbox – Pre-Authentication RCE Adam Kues and @searchlightsec

  An unauthenticated remote code execution flaw in ServiceNow (CVE-2026-6875). User input reaching GlideRecord query builders is evaluated as JavaScript when prefixed with javascript:, and although such expressions run…

• Solving an ORB mystery Jorian Woltjer

  Chases down why detecting a cross-origin response's status code through a script tag's load and error events works on one site and not another, and arrives at what amounts to a bypass of Opaque Response Blocking usable…

• Stealing GitHub tokens via VS Code webview keyboard event bubbling Ammar Askar

  VSCode webviews are cross-origin iframes, but to keep shortcuts working they forward their own keydown events to the host over postMessage, and the host cannot tell a synthetic event from a real keypress. Javascript in…

• Sub:jugation — Hijacking Cloud Identities by Recycling Namespaces in Global OIDC Issuers Tal Skverer

  CI/CD platforms mint OIDC tokens from a single global issuer, and the sub claim is built entirely from a repository namespace that GitHub, GitLab and Terraform allow anyone to re-register once deleted. Recreating the…

• SvelteSpill: A Cache Deception Bug in SvelteKit + Vercel Jorian Woltjer

  Explains a SvelteKit/Vercel cache-deception path where the edge treats a request as an immutable asset while an adapter override returns an authenticated dynamic resource. Failed approaches and request/response traces…

• The API Made Me Do It: Do Bad APIs Lead AI to Generate Vulnerable Code? Yariv Tal

  A worked experiment on constraining generated web application code through safer APIs and build gates. The slides show failed restrictions, generated workarounds and revised gate designs, with control and constrained…

• The Click that shouldn't have worked: RCE via clickjacking in Internet Explorer Igor Sak-Sakovskiy and @Psych0tr1a

  Internet Explorer's engine still ships as the WebBrowser control inside .NET and VB applications. A file downloaded through http://localhost arrives with no Mark of the Web, so a dropped HTML page runs as a local file…

• The CoreBreak Attack: Turning AI Agents into Credentials Exfiltration Vectors Aviyam Ivgi and Hedi Ingber

  Managed agent tools keep the cloud instance metadata endpoint reachable from inside them, so JavaScript in AWS Bedrock AgentCore's browser or Python in its code interpreter can fetch the microVM's IAM role credentials…

• The Dot-Dot-Slash That Frameworks Hand You: CSPT Across Every Major Frontend Framework Jonathan Dunn (xssdoctor)
• The Forgotten Bug: How a Node.js Core Design Flaw Enables HTTP Request Splitting Martino Spagnuolo

  Surveys callbacks and events that permit a Node.js request path to change after constructor validation but before header serialization. Library comparisons and a decoded Express proxy route show how unsafe application…

• The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM CVE-2026-41940) Sina Kheirkhah

  Examines inconsistent session representations and error-recovery behavior in cPanel and WHM. The case shows how state reconstructed from one storage format can be trusted differently by another authentication path.

• The Masks We (Think We) Wear: Privacy Threats of Browser-Extension Wallets in the Web3 Ecosystem Weihong Wang, Yana Dimova, Victor Vansteenkiste, Tom Van Goethem and Tom Van Cutsem

  A browser-extension wallet is both a blockchain client and an identity provider, and five privacy threats follow from doing both in a page. Measuring 85 Chrome wallets covering 35.16M users: routine RPC calls link a…

• The Memory Heist Ayush Paul
• The sorry state of skill distribution Samuel Judson and Tjaden Hess
• The State of Passkeys: Studying the Adoption and Security of Passkeys on the Web Louis Jannett, Andreas Mayer, Maximilian Westers, Vladislav Mladenov, Christian Mainka and Jörg Schwenk

  PASSKEYS-RADAR tracks passkey deployment since 2021 from community directories, Tranco 1M, CrUX 18M and archived pages, reaching 872 passkey-enabled relying parties. PASSKEYS-ATTACKER then tests live implementations…

• The Usual Suspect: Type Confusion in Twelve Bytes HamidSj
• This Message Was Sent by Microsoft: Turning Microsoft Apps into our Phishing Platform Keanu Nys
• Three 0-Day Vulnerabilities in Adminer Yashar Shahinzadeh and Amirmohammad Safari
• Three Bugs Walk Into a PDF: Prototype Pollution, Served Cold Shreyas Penkar

  Patch comparisons explain how inherited properties and unvalidated object types crossed privileged scripting boundaries in Acrobat Reader. The analysis clarifies a previously disclosed chain and its repairs, with…

• Time for ACKrobatics: Abusing TCP Timestamps to Improve Remote Timing Attacks Vik Vanderlinden, Tom Van Goethem and Mathy Vanhoef

  Uses the server's own TCP timestamp in its ACK as the clock for a remote timing attack, so client-side jitter drops out; coalescing many pipelined requests into one segment multiplies the measured runtime. Resolution…

• Token Time Bomb: Evaluating JWT Implementations for Vulnerability Discovery Jingcheng Yang, Enze Wang, Jianjun Chen, Qi Wang, Yuheng Zhang, Haixin Duan, Wei Xie and Baosheng Wang

  JSON Web Token libraries expose a flexible surface - algorithm negotiation, nested signing and encryption, compression - that implementations handle inconsistently. JWTeemo models the token grammar in an extended BNF…

• Transformers: Dark Side of the Type — Weaponizing the Conversion Layer Oleksandr Mirosh

  No serializer is needed for object injection: any conversion that resolves a type named in input and builds it is a sink. ResXFileRef's converter takes filename;typename;encoding, opens a UNC path and constructs…

• Trust Transitions in Email: When Sanitizers and CSS Engines Disagree Paul Reed

  Compares email sanitizers at CSS parsing, serialization, style-scope and browser-evaluation boundaries. Worked probes distinguish remote-image blocking, mock attribute extraction and presentation effects. The examples…

• Trusted Publishing, Untrusted Branch: Inside the Red Hat npm Compromise François Proulx

  Reconstructs an npm compromise in which ephemeral branches retained a trusted workflow filename and published through OIDC. Event actors and signed attestations reveal the branch that produced each package…

• Two Bypasses for Chrome's Sanitizer API Adam Kues and @searchlightsec

  Two ways past Chrome's built-in Sanitizer API, including a javascript: URL that survives sanitisation because a U+2028 line separator splits the scheme token the parser checks against the one it later resolves.

• Unauthenticated RCE in Taskcluster via a GraphQL filter reaching sift's `$where` griffinf

  Traces an anonymous Taskcluster GraphQL filter into sift’s JavaScript-evaluating $where operator. The report identifies a scope that guarantees nonempty input and uses propagated error text to observe service-side…

• Unicode-dot normalization bypasses Node.js TLS wildcard depth checks Node.js project

  Normalizes Unicode dot separators before wildcard hostname validation and supplies a regression test for resolver/verifier disagreement. The change prevents a certificate wildcard from matching an apparent single label…

• uXSS on Samsung Browser (CVE-2025-58485 · SVE-2025-1879) Omid Rezaei and Yashar Shahinzadeh

  Reverse-engineers Samsung Internet intent handling to distinguish a guarded Bixby path from another exported activity accepting a javascript: URL in the existing tab. The final route differs from the exploratory Frida…

• We Need to Talk About CSRF Again Amirmohammad Safari

  Two ways a cross-origin POST skips the CORS preflight while the server still parses the body as JSON. Sending it as a Blob with no type leaves no Content-Type header, which FastAPI read as implicit JSON; and Chromium…

• Web Cache Overflow: Exploiting Imprecise Keys for Cache Degradation and Beyond Matteo Golinelli, Kaan Onarlioglu and Bruno Crispo
• What's in a tag name? JavaScript, apparently Gareth Heyes

  JavaScript hidden in an HTML tag name becomes a payload source when an executable handler reads and transforms that name. The article develops a reusable XSS construction from browser parsing and string behavior; its…

• What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness Zichuan Li, Jian Cui, Ashley Chen, Xiaojing Liao and Luyi Xing

  CoRA discovers which files and metadata enter an agent's context, then checks their message roles and persistence. The paper maps sixteen vectors and five attack chains; its contribution is a systematic harness audit…

• When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers Yarden Porat

  Cloudflare Code Mode runs model-written code in workerd, the V8-isolate runtime that also provides tenant isolation for Cloudflare Workers, so untrusted code shares a single process. The research reports five…

• When Authorization Loses Its Meaning: Breaking and Fixing Third-Party Online Payments Yongkang Xiao, Jing Chen, Min Shi, Kun He, Qiyi Deng and Ruiying Du
• When Cache Poisoning Meets LLM Systems: Semantic Cache Poisoning Guanlong Wu, Taojie Wang, Yao Zhang, Zheng Zhang, Jianyu Niu, Ye Wu and Yinqian Zhang

  A semantic cache reuses one user's LLM answer for any later query judged similar enough, which makes a cache entry shared state. The paper crafts a query that embeds close to a target question, takes its cache slot, and…

• When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax Adrian Denkiewicz

  Examines CFITSIO extended filename syntax behind apparently read-only image operations. Input fetching, output copying, raw-byte conversion and a writable network backend compose into local file writes, server-side…

• When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments Qinying Wang, Yong Yang, Yuan Chen, Shouling Ji and Mathias Payer

  x402 extends HTTP 402 with a payment negotiation flow and delegates proof verification and on-chain settlement to third-party facilitators, so one facilitator becomes shared payment infrastructure for many independent…

• When Two Parsers Disagree: Exploiting Query String Differentials for XSS Amirmohammad Safari

  Uses a small Express application to explain mismatches between extended qs parsing and browser URLSearchParams. Bracket interpretation, normalized keys and a parameter-count cutoff let one parser validate a different…

• When Your VPN Opens Your Private Network to the Public rootxharsh

  Analyzes JWT algorithm confusion in PAN-OS GlobalProtect Cloud Authentication Service deployments, including shared signing-certificate and enrollment prerequisites. Explains how an established cryptographic failure…

• Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253) Piotr Bazydlo

  Reviews the trust boundary between Splunk's management interface and its PostgreSQL sidecar. Database authentication and connection parameters are relied on by maintenance operations without equivalent application…

• Wrestling with a Python: Escaping Copilot Studio’s AI-Guarded Sandbox Simon Maxwell-Stewart, Ryan Hausknecht and Phantom Labs®

  Investigates Copilot Studio’s LLM guard and in-process Python restrictions separately. Introspection reveals sandbox code, a legacy execution path carries an encoded payload into worker modules, and output and…

• Write Once, Shell Everywhere: Turning Arbitrary File Writes into RCE André Baptista, Rafael Castilho and Bruno Mendes

  A graded catalogue of arbitrary-file-write to RCE sinks, plus new ones. Path resolution stops at the first failing component, so the errno of a failed write - read through status code, body length or latency…

• XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638) Nigusu Kasahun
• You're Not Supposed To ShareFile With Everyone (CVE-2026-2699 & CVE-2026-2701) Sonny

  Traces a ShareFile StorageZones chain involving continued execution after an authentication redirect and downstream configuration and upload handling. The analysis distinguishes authorization checks from the point at…

• Your House Has an FFmpeg Problem Jia Hao Poh

  Home Assistant's Wyoming announce service passes media_id straight to ffmpeg as -i, and its scheme blocklist covers only http/https, letting concat:, file: and subfile: through. Raw files still fail because the command…

• Your WAF Blocked Us, That Was The Exploit — Remote Agent Takeover via Cloudflare, Sentry and Claude Zero-Day Ron Bobrov, Nevo Poran and Barak Sternberg

  Every source an agent reads is an injection channel: an unauthenticated Sentry event posted with a public DSN, a Datadog log written with a public client token, or a request crafted to trip Cloudflare's managed WAF so…

• Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers Matteo Scarlata, Giovanni Torrisi, Matilda Backendal and Kenneth G. Paterson

  "Zero knowledge encryption" is a vendor term with no technical meaning, conveying that a server holding an encrypted vault learns nothing about it even when fully malicious. Comparing that claim against Bitwarden…

• Zero-Click RCE in Figma Desktop Benjamin Mamoud (DavenSec)
• zkLogin: when ZKP is not enough @brave and Brave Software

  Zero-knowledge authorization proves possession of a signed credential without revealing it, and its security is usually argued from the proof alone. zkLogin, the most widely deployed such system, is shown to depend as…