Enclave

AI-powered code security that understands your environment and surfaces only the vulnerabilities that can actually be exploited

[Enclave @EnclaveAI]

99K+ repos depend on numexpr. GDAL is the default stack for geospatial. That’s not “some Python libs.” That’s infrastructure. And we turned both into RCE.

https://t.co/IYtG806AEw

[Yanir Tsarimi @Yanir_]

We found a debug flag enabled in 6 Microsoft Android apps that turned into a vulnerability

Any app on the device could access the Microsoft account

Affecting: Word, OneNote, PowerPoint, Excel, 365 Copilot, Loop.

Here's the full story of "FlagLeft": 🧵

[Enclave @EnclaveAI]

👏 @Yanir_ & @ofekdavidlevin on the finding

[Enclave @EnclaveAI]

We found setIsDebugMode(true) shipped in production across M365 on Android, hitting Word, Excel, PowerPoint, OneNote, Copilot, Loop.
Any app on device could just access account tokens undetected.
How? a shared SDK.

[Enclave @EnclaveAI]

Full details: https://t.co/ClDGdTTEmY

[The Cyber Security Hub™ @TheCyberSecHub]

Exclusive: How One Line of Code Put Billions of Microsoft Android App Downloads at Risk https://t.co/WQ0dHuM6na

[Enclave @EnclaveAI]

Enclave now checks the packages your PRs pull in, not just your code.
It flags risky deps (install scripts, brand‑new releases, known CVEs) as inline PR concerns.
It only runs when the PR changes a manifest or lockfile (e.g., package.json, yarn.lock, pyproject.toml, poetry.lock).
For those files, it computes a normalized dependency diff (PackageChange[]) to see which packages were added, upgraded, downgraded, or newly appear as transitives.

[Enclave @EnclaveAI]

99K+ repos depend on numexpr. GDAL is the default stack for geospatial. That’s not “some Python libs.” That’s infrastructure. And we turned both into RCE.

https://t.co/IYtG806AEw

[Enclave @EnclaveAI]

@trippyz123 @grok please?

[Enclave @EnclaveAI]

99K+ repos depend on numexpr. GDAL is the default stack for geospatial. That’s not “some Python libs.” That’s infrastructure. And we turned both into RCE.

https://t.co/IYtG806AEw

[Yanir Tsarimi @Yanir_]

What happens when your math and map processing libs become RCE vectors?

We've exploited OSS libraries to pop 2 shells on Microsoft's cloud infra, got assessed "low" severity, and found 2 bypasses again to defend our case, almost losing out on 6 digits in bounties

The current impact is over 120,000 repos just on GitHub. AI agents, LangChain, TiTiler, pandas.

Everybody wants the researchers to be responsible.
Here's how responsible disclosure looks like from the other side:

[Enclave @EnclaveAI]

Cloud-Based Criticality is live. Enclave now ranks every finding by what your AWS setup actually allows. Reasoning is attached and severity is in context, not in theory. Go to Settings → Connections → AWS on https://t.co/16eUNzPPz8

[Enclave @EnclaveAI]

Software has entered a supply and demand crisis.

AI-driven velocity means more code hits your repositories than your team can peer review. For a CISO, the problem isn't a lack of tools. It's a lack of signal. Traditional scanners create thousands of alerts and send them into a backlog no one has time to clear. Leaving your team guessing at which issues actually matter to the business.

Security cannot be the bottleneck. It also cannot be a liability. One overlooked trust boundary is all it takes to exfiltrate AI tokens or rack up massive API costs.

Enclave provides the independent oversight required for this scale of development. We don't just scan for patterns. We follow system logic across files and services to find the architectural risks that matter. When Enclave flags an issue, it shows the context and the fix. Your team reviews the fix, approves it, and keeps shipping.

Stop managing noise. Ship with confidence.

[Enclave @EnclaveAI]

Enclave now has a native desktop app (macOS, Windows, Linux).

If you’re doing security research and need to go local, run scripts, use your editor, and work on real files/repos without losing Enclave’s code security context, go to setting on Enclave and get started.

[Enclave @EnclaveAI]

Link: https://t.co/b7W4w8J82s

[Enclave @EnclaveAI]

NGINX Rift is the new 18-year-old nginx RCE. Every version since 2008 in scope.

We scanned 1,465 configs from 528 popular GitHub repos to see how bad it really is.

What we found, and where the real attack surface actually lives 👇

[Enclave @EnclaveAI]

WATCH: Enclave's Independent Reviewer in action.

Analyze every PR for security risks by following logic across files and services. Catch the architectural vulnerabilities traditional scanners miss. No separate backlogs. Get high-confidence findings and suggested fixes commented directly on your GitHub PRs.

Start scanning now: https://t.co/9XPfK68hcC

[Yanir Tsarimi @Yanir_]

To exploit this to RCE you need:

1. ASLR disabled (or some way to leak info)
2. The nginx server configuration to have a "set" + "rewrite" directives. The rewrite has to have '?' in its replacement rule (second arg)

So the attack surface is probably much less than what it seems.

Nice finding and the part about the exploitation is also great, I recommend reading the blog.

[Enclave @EnclaveAI]

75% of Google’s new code is AI-generated and that number will keep increasing.

The role of engineers has shifted, The challenge is no longer writing the code, it’s verifying the architecture.

When software is built at this scale, the risk isn’t in simple syntax errors. The real vulnerabilities are in the data flows between services and where trust boundaries are.

Security has to move as fast as the tools generating code. That requires an independent perspective that can hold the context of an entire system at once. That’s where Enclave comes into play.

https://t.co/u1vEZNLZyE

[Tal Hoffman @talhof8]

Amazing find!

No patch exists for any distribution right now and the full weaponized PoC is already on @GitHub. Only mitigation is blacklisting three kernel modules.

Put simply: splice() lets the kernel move file data without copying it. An attacker uses this to get page cache pages of files they can only read (like /usr/bin/su) into network buffers. Two kernel crypto paths (ESP and RxRPC) then do in-place operations on those buffers without realizing the pages belong to a protected file. The kernel writes directly into the cached copy, and now every process that reads that file sees the attacker’s version.​​​​​​​​​​​​​​​​

Neither bug works on every major distro alone but chained together they cover all of them. Fully deterministic, no race condition, compiles and runs in one line.

If you patched for Copy Fail it doesn’t help here.