🪶Chilcano

#Cloud #Security #Cryptography #PKI #DevSecOps #ServiceMesh

[🪶Chilcano @Chilcano]

That's the harsh reality for those of us who work in cybersecurity. 💪

> Assume exposed software is brittle.
> The stuff is broken. Plan accordingly.

👇

[Florian Roth ⚡️ @cyb3rops]

A friend told me something in a beer garden in Germany about 12 years ago:

“Florian, don’t overthink whether this specific service is exploitable. The stuff is broken. Plan accordingly.”

He meant software.

Most software looks stable because it runs under normal conditions. Look closer and you find memory leaks, parser bugs, unhandled input, bad defaults, forgotten modules, weird edge cases.

Now we have better fuzzing, better automation, AI-assisted auditing, variant hunting, more exploit dev, more eyes on everything.

So yes, patching matters.
But in a world where every kind of internet-facing software keeps producing fresh RCEs, you also need the boring stuff:

1. Reduce the attack surface
- expose fewer services
- disable unused modules, plugins and features
- don’t publish admin interfaces unless they really need to be reachable

2. Limit the blast radius
- run services with least privilege
- isolate internet-facing systems
- avoid shared accounts and credentials

3. Build visibility and control
- collect useful logs
- monitor weird errors, crashes and “should never happen” events
- keep enough data to investigate later
- run regular compromise assessments

Assume exposed software is brittle.
The stuff is broken. Plan accordingly.

[Nicolas Krassas @Dinosn]

Microsoft discovered that Anthropic's Claude Code GitHub Action is vulnerable to prompt injection attacks via issues and Pull Requests https://t.co/GELEiI6oWo

[Siddhant Khare @Siddhant_K_code]

I saw the Gemma 4 announcement two days ago, found some time tonight. Built a small CLI around it.

Gemma 4 12B can describe images, and it's just an 8GB model you can self-host, which means you can wire it into small utility tools without paying for a vision API.

I used it to generate alt text & blog outlines from whiteboard photos

Works well enough to be useful :D

[Bilgin Ibryam @bibryam]

🤩How we contain Claude across products🤩
https://t.co/uMbBITD64h

@AnthropicAI just published what may be the best practical security article I've read on securing AI assistants. Covers:
→ Prompt injection
→ User phishing
→ Data exfiltration
→ MCP/tool risks
→ Sandbox escapes
→ VM isolation
→ Agent permissions
→ Multi-agent trust issues

[Abdulkadir | Cybersec @cyber__razz]

Someone hid a self-replicating worm inside 37 npm packages.

Written in Rust.

Hidden behind an eBPF kernel rootkit.

Talking to its operator over Tor.

It steals 86 environment variables.

AWS keys. GCP keys. Vault secrets. Kubernetes tokens.

Your Anthropic API key. Your OpenAI key.

Your Exodus wallet seed phrase.

Then it uses your own npm credentials to republish itself into your packages.

So your code infects the next developer.

Who infects the next one.

The commits were backdated up to 13 years.

The commit author name was “claude.”

The malware named itself after the AI to hide in plain sight.

The attacker also left their own wallet recovery phrase in the debug data.

Nobody is having a good day.

Check your preinstall hooks.

[Vivek | Cybersecurity @VivekIntel]

That’s why the human element is always considered the weakest link in cybersecurity.

[Zack Korman @ZackKorman]

Cybersecurity is a broken industry. We rely on products that were designed to be sold, not used. And the incentives are completely screwed up.

I made this video about all of the ways things are bad, how we accidentally make it worse, and why new technology won't fix it.

[The Hacker News @TheHackersNews]

⚠️ Poisoned #WhatsApp, Slack, or SMS notifications could hijack Google Gemini on Android.

No malicious app needed.

A single alert could make #Gemini fake messages, trigger actions, join Zoom calls, or poison memory.

Read details: https://t.co/I5XjaIiFtI

[Sam Stepanyan @securestep9]

Every time a major company tells users to run "curl url | bash" to install thier tool, it irresponsibly normalizes a dangerous security anti-pattern.

You should be promoting secure behavior by default, not the other way round:

[NextGenRails™ @NextGenRails]

https://t.co/EckhRwdNko just got a major upgrade.
For anyone who doesn't know what Prechained is:
It's a free, open-source cryptographic archive of the software supply chain. Every package version we capture gets SHA-384 fingerprinted and permanently archived to GitHub — before any attack is disclosed, before any takedown, before any security researcher publishes a finding.
The receipt already exists. That's the point.
What's new:
→ Real-time npm monitoring. New packages published to npm are monitored in real time, Not a curated list — the entire feed.
→ Live Threat Feed. Automatic detection of fingerprint mutations, new install hooks, publisher changes, and size spikes. Every finding links to verifiable before/after receipts.
→ Incident Registry. Community-submitted and auto-detected incidents in one place. Submit a package. Get a cryptographic receipt.
→ 8 ecosystems. npm, PyPI, Cargo, RubyGems, NuGet, Maven, Packagist, GitHub.
Free. No login. No account. AGPL-3.0.
https://t.co/uSzJhhvPxM
#SupplyChainSecurity #npm #CyberSecurity #infosec #SoftwareSupplyChain #OpenSource #SBOM #DevSecOps #PackageSecurity #CyberThreats #CMMC #OSS
cc @OpenSSF @socketdotdev @SwiftOnSecurity @Ransom_DB

[Aikido Security @AikidoSecurity]

⚠️ New "IronWorm" supply-chain attack: 30+ npm packages from @ asteroiddao shipped a malicious Rust binary firing on preinstall.

It sweeps 86 env vars + 20 credential files (AWS, GCP, Vault, npm, plus AI keys like Anthropic & OpenAI), hits Exodus wallets, hides behind an eBPF rootkit, and beacons over Tor. Self-propagates via npm Trusted Publishing OIDC, with backdated commits faked as claude/dependabot/renovate.

[Dr. Anton Chuvakin @anton_chuvakin]

This is fun: "nano is a lightweight SIEM in Rust on ClickHouse, with a piped query language, a real detection lifecycle, and AI that does actual investigation work." https://t.co/tTEbVxPGwt

[Lenny Zeltser @lennyzeltser]

A decoy fires only when someone accesses a resource no legitimate user would touch. Plant tripwires across network, identity, data, and AI agent configs to create asymmetry in your security architecture.

https://t.co/mqWcwtOVzG

[Trail of Bits @trailofbits]

We built four malicious skills to test whether skill scanners actually work. Three took less than an hour to conceive and implement. ClawHub, Cisco, and Vercel's https://t.co/nUlnRcQWyG marked them as safe. 🧵

[Vivek | Cybersecurity @VivekIntel]

OSV-Scanner — Open Source Vulnerability Scanner by Google 💀🔥

Find known vulnerabilities across:
✅ npm, Maven, PyPI, Go, Rust, PHP, Ruby, Java & more
✅ Linux OS packages
✅ Container images
✅ License compliance issues

Key features:
• Recursive source code scanning
• Container vulnerability scanning
• Offline vulnerability database support
• License auditing
• Guided dependency remediation
• Call analysis to reduce false positives

🔗 https://t.co/tgvoDyFp1x

For developers and AppSec teams, it's one of the most practical tools for identifying vulnerable dependencies using the OSV[.]dev database.

#CyberSecurity #AppSec #DevSecOps #OpenSource #VulnerabilityManagement #OSVScanner

[JFrog Security @JFrogSecurity]

The software supply chain has a new predator. 🐛

Meet Iron Worm, the "rustier cousin" of the infamous Shai-Hulud worm. Just like its predecessor, it burrows into dev environments, steals credentials, and self-propagates through trusted GitHub and npm workflows.
Except this one is built in heavy, async Rust, hides behind an eBPF kernel rootkit, and talks over Tor.

Full teardown of the beast:
https://t.co/9Tn4G8tluW

[Calif @calif_io]

Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex.

Blog post: https://t.co/WO9MeExoun

PoCs: https://t.co/NpVgEHBHPl

[Zack Korman @ZackKorman]

Do you think Microsoft lets their own employees do this?

[Cyber Security News @The_Cyber_News]

🚨 Claude Code's GitHub Actions Vulnerability Lets Attackers Compromise Any Repository

Source: https://t.co/lb0fzVp2ox

A critical supply chain vulnerability in Claude Code's GitHub Actions that could allow attackers to compromise any repository using Anthropic's official CI/CD workflow, including Anthropic's own infrastructure.

When combined with prompt injection techniques, it could enable a fully unauthenticated external attacker to exfiltrate secrets, steal OIDC tokens, and push malicious code to any downstream repository that depends on the Claude Code GitHub Actions workflow.

Claude Code GitHub Actions restricts workflow execution to users with write or admin access. However, the checkWritePermissions function unconditionally trusted any actor ending in [bot] regardless of actual permissions.

#cybersecuritynews

[Gray Hats @the_yellow_fall]

Apple open-sources its Apple post-quantum cryptographic code and verification tools, revealing a hidden ML-DSA digital signature bug.

#AppleSecurity #PostQuantumCryptography #PQC #OpenSource #CyberSecurity #Cryptography #iMessage
https://t.co/vUCfDv2jiA

[Vivek | Cybersecurity @VivekIntel]

🐳 DockSec — AI-Powered Docker Security Scanner

Container security reports are often filled with hundreds of CVEs, making it difficult to know what actually matters.

DockSec helps developers focus on the risks that affect their specific Docker environment.

• Combines Trivy, Hadolint, and Docker Scout
• AI-powered vulnerability analysis
• Plain-English security explanations
• Dockerfile remediation guidance
• Security scoring (0–100)
• HTML, PDF, JSON, CSV reporting
• GitHub Actions integration
• Supports OpenAI, Claude, Gemini, and Ollama

How it works:

🔍 Scan → Trivy, Hadolint, Docker Scout
🧠 Analyze → Correlates findings and reduces noise
🛠️ Recommend → Suggests actionable fixes
📄 Report → Generates professional security reports

Key use cases:

• Dockerfile reviews
• Container hardening
• CI/CD security checks
• DevSecOps workflows
• Vulnerability prioritization
• Security posture tracking

Instead of reviewing 200+ raw CVEs, DockSec highlights what is actually relevant and provides practical remediation guidance.

🔗 https://t.co/LLXWcAxUjN

#Docker #ContainerSecurity #DevSecOps #OWASP #CyberSecurity #CloudSecurity #Kubernetes #AppSec #AI #InfoSec