CredShields

Engineering Security for the AI Era | AI Pen Testing + Smart Contract Audits | OWASP Smart Contract Security Pioneers | SOC2 Type ll Audited

[CredShields @CredShields]

CredShields and @SolidityScan are proud to contribute to the release of the @owasp Smart Contract Top 10 2026.

OWASP Smart Contract Top 10 defines the primary contract-level failure patterns that repeatedly lead to loss in blockchain systems.

Sincere gratitude to @ethereumfndn Ecosystem Support Program for supporting the OWASP Smart Contract Security initiative.

https://t.co/inlrIp9gMh

[CredShields @CredShields]

Your AI agent can send emails, book meetings for you, even execute code.

So can your attacker. The attacker just needs to control one input.

[CredShields @CredShields]

https://t.co/7lmA38eHuR

[CredShields @CredShields]

Has your security team tested your LLM features for prompt injection?

[CredShields @CredShields]

We just found and disclosed CVE-2026-10753 in Google's Site Kit, the official Google plugin running on 5M+ WordPress sites.

Our team caught a broken access control flaw that slipped past everyone else.

One REST API write endpoint checked for view level access when it should have required admin. That single line let an Editor with dashboard sharing flip a sitewide setting they were never meant to touch. Every sibling endpoint in the same controller already required admin capability. One route drifted out of step.

Running Site Kit? Update to 1.176.0 or later.

Read for a deeper understanding:
https://t.co/35js3wGHTE

[CredShields @CredShields]

Immediate Remediation Steps:

1️⃣ Pin & Proxy: Lock exact dependency versions. Use enterprise-governed package proxies.

2️⃣ Audit eBPF: Monitor build infrastructure for unauthorized eBPF programs.

3️⃣ Hard Reset: Infected runners/workstations must be completely wiped and reimaged.

[CredShields @CredShields]

The Impact: Once active, it bypasses standard barriers to harvest developer IDE credentials, cloud environment access keys (AWS/GCP/Azure), CI/CD secrets, and local storage data.

Standard file deletion will not work against a Ring 0 rootkit.

[CredShields @CredShields]

Vector: Supply chain infiltration via compromised npm packages, triggering silently during npm install via hidden postinstall script hooks.

Stealth: Attaches kprobes to kernel system calls like sys_getdents64 for full process cloaking. It hides its footprint from ps or top.

[CredShields @CredShields]

A highly sophisticated, heavy Rust-built infostealer named IronWorm is actively targeting modern software development pipelines.

Because it deploys a Ring 0 / kernel-level eBPF rootkit, standard user-space EDR agents will fail to detect it.

👇 Quick breakdown and defense steps:

[CredShields @CredShields]

Lock yours down tonight:

1/ Audit your account recovery contact info

2/ Move from SMS to app based MFA

3/ Review logged in devices weekly

#CyberSecurity #InfoSec #MetaAI #AccountSecurity #MFA #AIsecurity

[CredShields @CredShields]

Hackers hijacked high profile Instagram accounts, including the old Obama White House handle without malware, phishing, or stolen passwords.

How did they do it?

[CredShields @CredShields]

The takeaways 👇

→ AI support tools create security blind spots that human agents wouldn't

→ Automated convenience routinely outpaces verification

→ Strong MFA was the layer that held the line for protected accounts

[CredShields @CredShields]

What's one security habit your team actually sticks to? 👇

[CredShields @CredShields]

Your app passed the pentest.

Your LLM wasn't tested.

Here are the 5 attack vectors living in every AI feature right now and why none of them show up in a standard report. 👇