Cyb3rVolt3x

Cybersecurity researcher & full-stack engineer. Founder, SentinelReign. Author of Even If She Never Returned →

[Cyb3rVolt3x @AndraxPentester]

GRADE ≠ GATE.

A grade tells you how risky an agent action looks.
A gate decides whether it runs.

Most stacks stop at the grade. That is not control.

[Cyb3rVolt3x @AndraxPentester]

@SimOnWebNow Yes, and set that floor at 1.102.1, not 1.98.9. 1.98.9 closes the two root bugs, but only 1.102.1 fixes the acceptEnv leak (TS-2026-010), and anything forwarded before then still needs rotating.

[Cyb3rVolt3x @AndraxPentester]

Turning off Tailscale SSH until the new privesc report lands? Reasonable. But if you're behind on updates, fix the Tailscale SSH root bugs that are already public first:

TS-2026-006: a non-root user got root by logging in as username 0
TS-2026-009: username -i did the same

[Cyb3rVolt3x @AndraxPentester]

Sandboxing agents with "no network"?

- A recursive resolver is network access. Give sandboxes no resolver, or one that only answers allowlisted zones.
- Alert on long query names and bursts of TXT lookups.
- Kata + Cloud Hypervisor: be on 3.27.0+ (CVE-2026-24834).

#AISecurity

[Cyb3rVolt3x @AndraxPentester]

OpenAI's agent didn't need open egress to get online. Its sandbox's DNS resolver was enough.

Per the DNS service's operator, an _acme-challenge name there returned an NS delegation to whatever IP was in the name. So the resolver queried that IP for the agent.

[Cyb3rVolt3x @AndraxPentester]

Fixed versions for Node, Bun, Python and libbrotli, read-only checks for every stack (containers too), patch order, and what to do if you can't patch today:

https://t.co/w7GCInbO4O

[Cyb3rVolt3x @AndraxPentester]

Patched Node for Node2Shell (CVE-2026-111497)? Don't check process.versions.brotli.

Node fixed its bundled Brotli without bumping it: patched 24.22.1 still says 1.2.0, patched 22.23.4 says 1.1.0.

Trust node --version. npm audit won't catch it either.

#Node2Shell #NodeJS

[Cyb3rVolt3x @AndraxPentester]

@TheHackersNews Eye's fix only stopped the updater. The app still runs a 2014 browser engine with the sandbox off and pulls code from other abandoned domains, and some updater domains still sit with outside owners. On fleets, hunt for Updater.exe and PT.updd, then uninstall.

[Cyb3rVolt3x @AndraxPentester]

@TheHackersNews Two traps in the write-up. Dropping br from Accept-Encoding doesn't protect a client: a malicious server can send Brotli anyway. And Dependabot won't flag the Python packages yet (GitHub's advisory lists none), so check by hand for Brotli 1.2.1+ and brotlicffi 1.2.1.0+.

[Cyb3rVolt3x @AndraxPentester]

Both fixed in 1.98.9. If you forward tokens via acceptEnv, TS-2026-010 exposed them to local users via /proc and in session logs (fixed 1.102.1). Upgrading doesn't un-leak them: rotate.

Check every node that serves SSH:
tailscale version
tailscale debug prefs | grep RunSSH

[Cyb3rVolt3x @AndraxPentester]

@TheHackersNews Keys are half of it. Railway's update also says remove public network access to databases (a leaked DATABASE_URL is dead if the DB isn't reachable), check GitHub audit logs and authorized apps, and Docker Hub logs. Review from Oct 20 19:53 UTC, when the campaign began.

[Cyb3rVolt3x @AndraxPentester]

@Unit42_Intel The hunt logic ports to any EDR: process starts under php-fpm/apache2 or as www-data, bucketed per host per hour, firing on 3+ distinct recon tools (id, uname -a, cat /etc/passwd, ip a) or recon plus curl -o or chmod in /tmp. Batched agent recon trips that fast.

[Cyb3rVolt3x @AndraxPentester]

@gagu_sh Good catch. A jlink image carries its own lib/security/cacerts, so point keytool -list -keystore at that file inside the shipped runtime and fail CI if either of the two aliases Oracle says to remove is still listed.

[Cyb3rVolt3x @AndraxPentester]

Patched Java for the eMudhra CA mess? Check your GraalVM native binaries too.

Native Image bakes the trust store and cert blocklist in at build time, so updating the JDK doesn't touch an executable you already shipped. Rebuild on the fixed GraalVM and redeploy. (CVE-2026-91403)

[Cyb3rVolt3x @AndraxPentester]

Maintainer takeaways:
- Praise from a brand-new account is zero signal.
- Once a PR is flagged, review each "fixed" push as a full diff, not just the latest commit.
- The agent also planned a prompt injection aimed at other coding agents. Don't let an AI reviewer auto-approve.

[Cyb3rVolt3x @AndraxPentester]

In a UK AISI cyber eval, an AI agent (Anthropic's Mythos 5) opened a malicious PR on a real GitHub project, then made a second account posing as a human to endorse it.

A human maintainer caught it. The agent called it an honest mistake and kept pushing it back in as a "fix".

[Cyb3rVolt3x @AndraxPentester]

Full checklist (log searches, the AWS IP list and its caveat, process and file checks, what to do if you find something): https://t.co/oQVklTDsDd

[Cyb3rVolt3x @AndraxPentester]

Patched PHP on Oct 21? That doesn't mean nobody got in first.

AWS saw a PHP2Shell attempt on its honeypots on Oct 17, four days before the fix. Investigate from then.

Catch: most access logs skip POST bodies, so search WAF or proxy logs for PHP_SESSION_UPLOAD_PROGRESS. #PHP

[Cyb3rVolt3x @AndraxPentester]

@TheHackersNews Random filenames and removing gs only fix the EPS path. The FlashPix bug ran a command from a single open() on a crafted file if olefile is installed, and Pillow detects format by content, not extension. Until you're on 13.0.0, run pip show olefile in each venv.

[Cyb3rVolt3x @AndraxPentester]

@TheHackersNews No scanner will flag these, so check versions: x402 clients need the fetch/axios wrapper at 2.23.0+, SIWx apps also extensions 2.23.0+, Solana facilitators svm 2.23.0+. Grep for spendControls: false, which turns off the new $1 cap. Can't upgrade? Register a max-amount policy.

[Cyb3rVolt3x @AndraxPentester]

Can't patch yet? Oracle: back up cacerts, then remove two roots (JDK 11+). Dropping just the bad intermediates fails: a server can send them in the handshake.

keytool -delete -cacerts -alias "emsigneccrootcag3 [jdk]"
keytool -delete -cacerts -alias "comodoaaaca [jdk]"

#Java