Ax Sharma

Security Researcher | Tech Journalist | 📰 Bylines + seen on: BBC, BleepingComputer, Channel 5, TechCrunch | ✉️ [email protected]

[Ax Sharma @Ax_Sharma]

Am also on 🦋BlueSky ⏬
https://t.co/5InSF4ShKH

[Ax Sharma @Ax_Sharma]

Worse than reading, the same trick let you *delete* other people's backups, or erase every backup on the server in a single call.

No special access - any logged-in user.

Francisco Rosales (@0xmagic0) of @Manifold_ai_sec found and reported it. Fixed in v2.56.1, upgrade now.

[Ax Sharma @Ax_Sharma]

Disclosing a critical n8n-mcp flaw (120,000+ weekly npm downloads, 21.5K+ GitHub stars) that let one user wipe everyone else's saved workflow backups.

Or read them, API keys and tokens included.

...Just by guessing a number.

CVSS 9.6 🧵

[Ax Sharma @Ax_Sharma]

n8n-mcp saves a backup before every workflow change.

They all sat in one shared table, tagged with a simple counting number and no owner check.

Type someone else's number, get their workflow back. Secrets and all.

🔗👉 https://t.co/9qJ0zvWd9g

[JFrog Security @JFrogSecurity]

🚨 Supply Chain ALERT New Phase of “Miasma: The Spreading Blight” 🚨

A new wave of the npm supply chain campaign, Miasma: The Spreading Blight
Targets include @‌vapi-ai/server-sdk & ai-sdk-ollama. Attackers are using a new autorun install method exploiting node-gyp shell expansion.

We have updated our previous blog:
https://t.co/gFhlSCFzOu

[Rohan Paul @rohanpaul_ai]

New Google paper says LLMs should stop pretending certainty and instead clearly show when they are unsure.

Hallucination is less about machines being wrong than about machines sounding certain when they should hesitate.

That distinction changes the target-problem.

The paper changes the target from making models perfectly factual to making them honest about their own uncertainty.

For years, the obvious goal has been to make language models know more, so they make fewer factual mistakes.

Perfect factuality may be very hard, but a model that clearly separates “I know this” from “I am guessing” can stay useful without quietly damaging trust.

This paper argues that the harder missing skill is not knowledge, but self-knowledge.

A model can be well calibrated in the broad sense, knowing that answers like this are correct about 60% of the time, yet still fail to identify which particular answer is the dangerous one.

That is the trap: to eliminate errors, the system must refuse many answers that would have been right.

The authors call this the utility tax, and it explains why products keep drifting toward confident usefulness rather than cautious truth.

Here's the key point.

A wrong answer wrapped in honest uncertainty is not the same social object as a wrong answer delivered as fact.

It gives the user a different instruction: verify this, treat it as provisional, do not build too much on it.

The proposed fix is “faithful uncertainty,” where the model’s language mirrors its internal confidence instead of smoothing doubt into authority.

For agents, this becomes even more important, because uncertainty is what should decide when to search, when to trust a source, and when to stop.

Tools expand what a model can access, but metacognition governs whether access is used wisely.

----

Paper Link – arxiv. org/abs/2605.01428v1

Paper Title: "Hallucinations Undermine Trust; Metacognition is a Way Forward"

[Ax Sharma @Ax_Sharma]

MCP registries are the new npm.
And we're about to relive the same mistakes.

🎙️Full conversation with Oleksandr Yaremchuk of @Manifold_ai_sec:
https://t.co/oyYYTYy5M1

[Ax Sharma @Ax_Sharma]

5 supply chain attacks in 72 hours. GitHub's own internal repos (~3,800).

Microsoft's official Azure-associated package. And attackers... already stealing your Claude and Cursor config files via this attack vector.

[SafeDep @safedepio]

🚨 The "𝙼𝚎𝚐𝚊𝚕𝚘𝚍𝚘𝚗" Campaign is live...

𝟻,𝟽𝟷𝟾 malicious commits to 𝟻,𝟻𝟼𝟷 GitHub repositories in a six-hour window.

Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected 𝙶𝚒𝚝𝙷𝚞𝚋 𝙰𝚌𝚝𝚒𝚘𝚗𝚜 workflows containing 𝚋𝚊𝚜𝚎𝟼𝟺-𝚎𝚗𝚌𝚘𝚍𝚎𝚍 bash payloads that exfiltrate:

- CI secrets,
- cloud credentials
- SSH keys
- OIDC tokens
- source code secrets

Check your repo / Technical details: https://t.co/tua3jYU1wa

[Windows Latest @WindowsLatest]

After 10 years of running WindowsLatest, I think this is finally the end of an era.

Google comfirmed that Search is becoming an AI box, which means you'll not be encouraged to click "blue links." Yes, the blue linke are still on the page, but they're becoming irrelevant.

For a decade, I watched Google rank Reddit threads, forums, spam, and sites that merely linked to my reporting above the original articles I broke. I complained to Googlers repeatedly. I showed them my original work being outranked by spammers copying it. Nobody at Google cared...

I never sold products with affiliate links. Ive never recommended anything for a commission. I have never ran a sponsored post. Being the "nice guy" earned me nothing

Google had already decimated independent publishers long before this announcement. AI Mode is just the funeral

[Ax Sharma @Ax_Sharma]

A trojanized Bitwarden npm version appeared for 90 minutes last month.

9 days later it got a CVE—after the package was already pulled.
That's an incident response notification, not what CVEs were originally built for.

Agentic AI makes this gap much worse
https://t.co/bHNIqi4K9y

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is investigating a new, emerging Mini Shai-Hulud npm supply chain attack targeting antv packages.

Attackers compromised an antv maintainer account and published malicious versions of multiple widely used packages (for example, antv/g2). As these packages are widely used as dependencies, the compromise propagated into downstream libraries like echarts-for-react, impacting a much broader set of applications and continuous integration (CI) environments.

All compromised packages contain a byte-identical, obfuscated credential-stealing payload delivered via a preinstall hook (Bun). The malware targets high-value secrets including:
- GitHub personal access tokens (PATs) and OpenID Connect (OIDC) tokens
- npm / Amazon Web Service (AWS) credentials and Security Token Service (STS) sessions
- Secure Shell (SSH) keys, kubeconfigs, and .env / .npmrc files
- Software-as-a-service (SaaS) tokens (Slack, Stripe, Vault)

Exfiltration occurs over HTTPS with Transport Layer Security (TLS) validation disabled. The payload also abuses stolen OIDC tokens to forge Supply-chain Levels for Software Artifacts (SLSA) provenance and propagate malicious releases, exhibiting worm-like behavior across repositories.

Malicious files distributed through npm packages are detected by Microsoft Defender as Trojan:AIGen/NPMStealer , "Suspicious Node.js process behavior", or “Credential access attempt”, preventing credential theft and malicious post-install execution.

Mitigation:
- Audit dependencies for affected antv and related packages; pin or downgrade to known-good versions (pre-2025-05-18).
- Revoke and rotate exposed credentials (GitHub, npm, cloud tokens, SSH keys).
- Validate integrity of CI pipelines and recent build artifacts.
- Network IOC: Stolen credentials are exfiltrated over HTTPS to t.m-kosche[.]com:443. Block at egress and review network logs for outbound connections.

[Zack Korman @ZackKorman]

Cloudflare is right about this. You're not going to be able to patch fast enough, but you can build your systems so that the vast majority of vulnerabilities don't matter.

If you've not done that, you're going to have a bad time.

[Ax Sharma @Ax_Sharma]

Francisco Rosales (@0xmagic0) of @Manifold_ai_sec found and reported the vulnerability.

Fixed in v3.6.0.

The filtering logic already existed. It just wasn't being called in both places. Update now.

[Ax Sharma @Ax_Sharma]

The read-only mode in mcp-server-kubernetes (20,000+ weekly npm downloads) ...doesn't actually restrict anything.

Neither do the other two access control modes.

CVE-2026-46519, CVSS 8.8 🧵

[Ax Sharma @Ax_Sharma]

The tool names are in the README.
Set to read-only mode.

'kubectl_delete' is not on the list.
But if you call it anyway, the pod is gone...

[BleepingComputer @BleepinComputer]

Canada Goose investigating as hackers leak 600K customer records - @Ax_Sharma
https://t.co/N0WU9n8pFf

https://t.co/N0WU9n8pFf

[Ax Sharma @Ax_Sharma]

@troyhunt @canadagoose Canada Goose provided a statement:
https://t.co/CbiTLn7qTz

[Hackmanac @H4ckmanac]

🚨Cyber Alert ‼️

WormGPT

A threat actor known as Sythe claimed to have leaked the database of WormGPT, a cybercrime-focused AI platform, exposing data linked to more than 19,000 users.

The leaked data allegedly includes email addresses, user IDs, and subscription and billing metadata.

Sector: ICT
Threat class: Cybercrime
Observed: Feb 10, 2026
Status: Pending verification

—
About this post:
Hackmanac provides early warning and cyber situational awareness through its social channels. This alert is based on publicly available information that our analysts retrieved from clear and dark web sources. No confidential or proprietary data was downloaded, copied, or redistributed, and sensitive details were redacted from the attached screenshot(s).

For more details about this incident, our ESIX impact score, and additional context, visit https://t.co/eB7qgxKFAa.

[Ax Sharma @Ax_Sharma]

Despite #Zendesk suggesting safeguards and tightening up security last month, the massive spam wave has returned flooding inboxes with hundreds of bogus 'Activate account...' emails that bypass #spam filters

https://t.co/gzTtzV2WRl