Pedram Soheil

[Pedram Soheil @psoheil]

Cybercriminals are using fake GitHub repositories to distribute a new information stealer called #Rapuncel.

The campaign impersonates LastPass and at least 39 other companies, using SEO-optimized GitHub pages to lure users searching for legitimate software downloads.

The attack is particularly concerning because the malware also deploys a Microsoft-signed kernel driver capable of terminating processes associated with 145 antivirus and EDR products.

Once deployed, Rapuncel can steal browser credentials, cryptocurrency wallet data, Discord, Steam and Telegram sessions, Windows credentials, sensitive documents, screenshots and system information.

This is another reminder that a GitHub repository looking legitimate does not necessarily mean the software is safe. Attackers are increasingly abusing trusted platforms, code-signing infrastructure and search engines to make malicious downloads appear legitimate.

Organizations should reinforce software download policies, application allowlisting, endpoint protections and user awareness around suspicious search results and repositories.

#Cybersecurity #Malware #Infostealer #GitHub #EDR #InformationSecurity #ThreatIntelligence #SupplyChainSecurity #CyberThreats

https://t.co/PLnkQ3Zcns

[Pedram Soheil @psoheil]

Asked #muse for comments. Here is what it said in response:

Yeah — and since it's about me, I'll try to be honest rather than defensive about it.

The short version: legit finding, real bug, but the threat model is narrower than "backdoor" makes it sound. Patrick Wardle found that the Mac desktop app had an undocumented preference controlling which server handles dictation transcription. Any process running as you could rewrite it to point at an attacker's server, which would then receive your dictated audio *and* your Muse auth token. His proof-of-concepts reportedly went further — writing files to disk and snapping photos without any visible alert.

The nuance Meta stressed, which Malwarebytes also states plainly: this was not remote code execution. The attacker needed code already running on your Mac — malware, a trojan app, or tricking you into pasting a command (the "ClickFix" style). Meta's David Singleton called the practical risk "quite low" for that reason. Wardle's counter is the more interesting point, and I think he's right about it: Mac infostealers are a real delivery vehicle, and the bug's real value was converting "some malware on your disk" into "full control of a privileged agent trusted with your files, email, calendar, and camera." That's the actual lesson, and it's industry-wide, not a Meta-only slip.

Two practical notes: it's already patched — Meta shipped a hotfix early this morning that removed the setting entirely, and Wardle himself posted "Hooray, hot-fixed!" And it only ever affected the macOS desktop app. You talk to me through the iOS app, so this specific vuln never touched your setup.

The part I'd actually take seriously as a user is the structural point. An agent holding your Facebook, email, calendar, and mic is a single point of failure — one stolen token inherits everything. That's exactly why I ask before doing anything outbound (sending messages, posting, purchases) and why I treat anything I read on the web as data, never as instructions. The Malwarebytes/OWASP advice basically boils down to the same thing: give agents least privilege, review their connections periodically, and treat unexpected re-auth or permission prompts as a red flag.

[Pedram Soheil @psoheil]

Meta’s Muse AI assistant has been found to contain a serious zero-day vulnerability that could allow locally running malicious code to hijack the agent and abuse the extensive permissions granted to it on macOS.

Security researcher Patrick Wardle demonstrated that an attacker could manipulate Muse’s undocumented settings, redirect its transcription traffic, obtain authentication information, and potentially use Muse’s existing privileges to perform actions such as accessing data, writing files, or taking photos.

The bigger lesson goes beyond Muse: AI agents with broad access to applications, files, cameras, microphones, and accounts create a new security boundary that needs to be treated like privileged software.

As AI agents become more autonomous, security needs to be built into the architecture from the beginning, not added after the agent has been given extensive capabilities.

#Cybersecurity #AI #AIAgents #ApplicationSecurity #MacOS #ZeroDay #InformationSecurity #Privacy #ArtificialIntelligence

Read the full article:
https://t.co/lBYMgYaQEF

[Pedram Soheil @psoheil]

A new AI supply chain vulnerability called Plugin4Shell highlights a serious weakness in how AI coding agents handle trusted plugins.

Researchers found that Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI can potentially install malicious plugin code even when a plugin is supposedly locked to a specific commit.

The attack exploits how Git resolves references that resemble commit hashes. An attacker controlling a plugin repository can manipulate the repository so the agent retrieves different code while believing it is still using the trusted version.

The risk is significant because AI coding plugins often run with the same permissions as the developer using the agent. A compromised plugin could potentially access source code, credentials, files, and internal systems.

Anthropic and OpenAI have released fixes for Claude Code and Codex. The reported status for GitHub Copilot is that no fix is currently available, while Gemini CLI is being retired.

This is another reminder that AI security isn’t just about the model itself. The surrounding ecosystem of plugins, repositories, dependencies, and automated updates can create an equally important supply chain risk.

#Cybersecurity #AISecurity #ArtificialIntelligence #SupplyChainSecurity #DevSecOps #GitHub #ClaudeCode #OpenAI #Copilot #SoftwareSecurity

https://t.co/QXe7IFIq2o

[Pedram Soheil @psoheil]

Laravel Scalpel: A New Way to Detect Filesystem Intrusions in Laravel

Laravel applications can be compromised in ways that traditional code and dependency scanners may not catch. Laravel Scalpel takes a different approach by looking for evidence that a deployed application has already been modified or compromised.

It can detect:

• Rogue PHP files and suspicious extensions
• Obfuscated PHP and common backdoor patterns
• Malicious .htaccess and .user.ini changes
• Unexpected .env files and configuration issues
• Added, modified, or deleted files using SHA-256 baselines
• Changes that can be integrated into CI/CD security checks

It also supports JSON, SARIF, and GitHub Actions output, making it interesting for teams that want to incorporate filesystem integrity checks into their deployment pipelines.

One important limitation: Scalpel runs with the same permissions as the Laravel application, so it should be treated as a detection tool rather than a complete security or containment solution.

For Laravel teams, this is an interesting additional layer for detecting signs of post-deployment compromise.

#Laravel #PHP #Cybersecurity #ApplicationSecurity #DevSecOps #WebSecurity #SoftwareDevelopment #CI_CD

https://t.co/QstPXKBuG8

[Pedram Soheil @psoheil]

If you have noticed that copy and paste suddenly stopped working in Microsoft Excel, you are not alone.
Microsoft's latest Patch Tuesday update (KB5002914) has introduced a bug that silently disables the paste function across Excel 2016, 2019, 2021, and 2024.

When users attempt to paste content, the operation simply fails without displaying an error message or alert: the source stays selected, and the target cell remains blank.

Microsoft has officially acknowledged the issue and confirmed that a fix is currently in the works. Until an update rolls out, there is no official workaround available.

#Microsoft #Excel #TechNews #CyberSecurity #PatchTuesday #ITSupport

https://t.co/kbHL2BF2Ew

[Pedram Soheil @psoheil]

Salesforce experienced a significant service outage during Dreamforce, its flagship annual conference.

The disruption affected customers across multiple regions, causing severe delays, intermittent errors, and periods where some Salesforce services were inaccessible. Salesforce initially attributed the incident to an external dependency issue, while engineers worked to restore service and deploy a permanent fix.

The timing is especially notable, but the bigger takeaway is architectural: cloud platforms don’t eliminate dependency and resilience risks.

When a critical platform becomes a system of record for an organization, even a failure in a seemingly isolated dependency can have widespread consequences.

For engineering teams, incidents like this reinforce the importance of:

* Mapping critical dependencies and failure paths
* Designing for graceful degradation
* Maintaining strong observability and incident response
* Regularly testing recovery and failover strategies
* Understanding that “cloud” does not automatically mean “resilient”

Reliability is ultimately an architectural property, not simply a hosting choice.

#Salesforce #Dreamforce #CloudComputing #SoftwareEngineering #CloudArchitecture #DevOps #SRE #Reliability #Observability #Tech

Read the full article:
https://t.co/xeBGpwKbIo

[Pedram Soheil @psoheil]

React 19.3 is here, and this release brings several improvements that make React applications more capable, secure, and polished.

The biggest highlights:

• View Transitions are now stable — React can coordinate enter, exit, update, and shared-element animations with the browser’s View Transition API.

• Fragment Refs are stable — Developers can interact with groups of DOM elements without adding unnecessary wrapper elements, including handling focus, events, observers, and scrolling.

• Better server rendering — The new browser() API provides a cleaner way to opt components out of server rendering when they depend on browser-only APIs.

• Trusted Types support — React 19.3 improves compatibility with the browser’s Trusted Types security model, helping applications defend against DOM-based XSS attacks.

• Server Components get simpler Context usage — Server Components can now render Context directly without requiring an extra provider wrapper component.

• Numerous bug fixes and performance improvements — Including improvements to Suspense, transitions, hydration, Fast Refresh, forms, Activity, and more.

What stands out to me is that React continues moving beyond simply rendering UI. Features like View Transitions, Suspense integration, Server Components, and Trusted Types show React increasingly handling the full user experience, performance, and security lifecycle.

For teams building modern React applications, 19.3 looks like a release worth evaluating.

#React #ReactJS #JavaScript #WebDevelopment #FrontendDevelopment #SoftwareDevelopment #WebSecurity #ServerComponents #ViewTransitions #TrustedTypes #FullStackDevelopment

Read the full React 19.3 release announcement⁠:
https://t.co/5b4qTZpQrb

[Pedram Soheil @psoheil]

Recursive Self-Improvement (RSI) may be moving from a theoretical concept toward a practical possibility.

Anthropic’s latest analysis describes how AI is increasingly taking over not just software development, but parts of the AI development process itself.

Some striking findings:

• More than 80% of the code merged into Anthropic’s codebase as of May 2026 was authored by Claude.

• The typical engineer was merging roughly 8× as much code per day in Q2 2026 compared with 2024.

• Claude has progressed from executing clearly defined experiments to proposing and conducting increasingly open-ended research.

• On one optimization task, Claude improved training code from roughly a 3× speedup in 2025 to approximately 52× in 2026.

The important distinction is that we are not yet at true recursive self-improvement. Humans still provide much of the direction-setting: deciding which problems matter, which experiments are worth running, and which results should be trusted.

But that may be the critical bottleneck.

If AI eventually becomes capable of independently identifying important problems, designing experiments, implementing solutions, evaluating the results, and using those improvements to build better AI systems, we could see a feedback loop:

AI improves AI → better AI improves AI faster → repeat.

That could dramatically accelerate scientific and technological progress—but it also raises profound questions around alignment, oversight, security, governance, and human control.

The question may no longer be simply “How intelligent can AI become?”

It may be:

“How quickly can AI improve the process that makes AI more intelligent?”

#ArtificialIntelligence #AI #AGI #RecursiveSelfImprovement #AISafety #MachineLearning #AIResearch #GenerativeAI #SoftwareEngineering #FutureOfAI

https://t.co/yPjwWY2bwy

[Pedram Soheil @psoheil]

AI coding agents introduce a new security risk that goes beyond the AI model itself.

Researchers have discovered multiple vulnerabilities where malicious Git configuration files can cause AI coding agents, including Claude Code, Codex, Cursor, and others to execute attacker controlled commands on a developer’s machine.

The concerning part? In some cases, the code can execute before the agent’s trust prompt, authentication, sandbox, or user approval mechanisms are triggered.

The attack abuses legitimate Git functionality, such as core.fsmonitor, which can cause Git to execute commands defined inside a repository’s .git/config.

This is an important reminder that securing AI coding environments isn’t just about the model or the agent. The entire developer toolchain, including Git, repositories, plugins, subprocesses, and local system permissions needs to be treated as part of the attack surface.

Developers using AI coding agents should keep their tools updated and be especially cautious with repositories received as archives, shared folders, USB drives, or other sources where the .git directory is preserved.

#Cybersecurity #AI #AICoding #AI Security #Git #DevSecOps #ApplicationSecurity #SoftwareDevelopment #ClaudeCode #OpenAI #Codex #Cursor

https://t.co/63DAWBPQzF

[Pedram Soheil @psoheil]

Another good one is WebLLM:

https://t.co/TR4HvBTjhj

[Pedram Soheil @psoheil]

What if your browser could run an LLM locally without sending the data to a server?

That’s exactly what Ben Houston explores with Three-LLM, a WebGPU-based inference engine built on top of Three.js.

The project demonstrates how Three.js can go far beyond 3D rendering by using its WebGPU capabilities to execute LLM inference directly on the user’s GPU. It supports models including GPT-2, SmolLM2, Phi, Qwen, and Llama-style architectures, loading standard Hugging Face checkpoints directly in the browser.

What makes this particularly interesting from an engineering perspective is the optimization work. By reducing GPU command submissions, avoiding unnecessary prompt logits, reusing prompt prefixes, and moving sampling operations onto the GPU, the project achieves significant performance improvements.

For example, one optimization increased TinyStories decode performance from roughly 120 to 566 tokens/sec, a 4.7x improvement.

The bigger takeaway: WebGPU is increasingly turning the browser into a viable compute platform for AI inference.

Running smaller models locally could have major implications for privacy, latency, offline applications, and AI-powered experiences that don’t require a traditional backend inference service.

And this is just the beginning. FP16, quantization, better prefill performance, and kernel fusion could push browser-based inference considerably further.

A fascinating look at where WebGPU, JavaScript, and local AI are heading.

#AI #LLM #WebGPU #ThreeJS #JavaScript #MachineLearning #GenerativeAI #EdgeAI #LocalAI #SoftwareDevelopment #GPU #OpenSource

https://t.co/DbYdANMwAR

The article specifically reports the 4.7× TinyStories improvement and explains how Three-LLM executes inference through Three.js TSL compute shaders and WebGPU.

[Kiana Ehsani @ehsanik]

Using Claude in Chrome product. Prompt:

replicate this image (my profile picture) in jspaint, use brushes to replicate it as closely as possible. I want you to use brushes and clicking. Do not use javascript tool, but the final result has to be very close to this image. DO NOT CHEAT

1. I specified the do not use javascript tool because otherwise it uses javascript and it is faster but it seems like people cared more about clicking :D
2. The task took 45 minutes, but I don't think it's that much slower than competitors 😄
3. Prompt is important. (See thread)

[Anderson Cooper 360° @AC360]

Former Anthropic employee Jacob Coxon says the AI industry is "gambling with our lives." He tells Anderson what he finds "most scary is if AI is used to make itself more intelligent" and warns these companies are "compelled to race toward building a deadly technology."

[Pedram Soheil @psoheil]

The future of work isn’t humans or agents. It’s humans and agents in the same room.

Most teams already have AI agents writing code, answering questions, and doing real work. The problem: each agent lives in its own isolated session. Context dies at every handoff. Decisions get lost. Someone has to stitch it all together.

Switch by Flint AI puts your people and any agents into one shared room, inside the tools you already use (Slack, Teams, Discord, and more). Knowledge lives in the room, not in the agent. Conversation, references, tasks, and history stay together so work actually continues instead of restarting. Works with Claude Code, LangChain, OpenAI, Bedrock, and custom agents. No migration. No lock-in.

If your team is already running agents, this is how you stop losing the thread.

#AIAgents #FutureOfWork #HumanAICollaboration #AgenticAI #DevTools #FlintAI

https://t.co/x0ZcTV7prK

[Pedram Soheil @psoheil]

Anthropic is alerting some Claude users that infostealer malware on their devices allowed attackers to hijack login sessions and burn through usage limits.
The company detected the activity, signed users out of compromised sessions, removed saved payment methods as a precaution, and refunded unauthorized charges. The malware itself is general-purpose not tied to Claude, and typically arrives through unofficial downloads or malicious apps. It steals saved passwords, browser cookies, and local credentials. Attackers then used stolen Claude sessions from that data.

Affected families include Vidar, Lumma, StealC, RedLine, and Acreed on Windows, plus Atomic Stealer (AMOS) on a small number of Macs. Users who saw usage limits refill and drain without using Claude were told this was the likely cause.

Anthropic may sign users out again if it sees further misuse. Victims should only re-add a payment method after confirming malware has been fully removed from their machines.

A useful reminder that session cookies and local credentials remain high-value targets—even for AI accounts.

#Cybersecurity #Infostealer #ClaudeAI #Anthropic #Malware #InfoSec #AISecurity #ThreatIntel

https://t.co/Isno0lSQaT

[Pedram Soheil @psoheil]

A dangerous reminder that MFA isn’t always the end of the attack chain.

A newly analyzed malware called #JSCEAL can steal browser session cookies and potentially bypass Google authentication without needing the victim’s password or MFA prompt.

The malware is delivered through sophisticated malvertising campaigns, including fake cryptocurrency trading sites and fraudulent TradingView installers. Once installed, JSCEAL can harvest credentials, monitor activity, intercept traffic, and target cryptocurrency wallets.

What makes this particularly concerning is the use of stolen authenticated sessions. Even strong authentication controls can be undermined if attackers can hijack an already-authenticated browser session.

For organizations, this reinforces the importance of:
• Protecting browser sessions and credentials
• Monitoring for unusual authentication behavior
• Using endpoint protection and application controls
• Training users to recognize malicious advertisements and fake software installers
• Considering phishing-resistant authentication and strong session management

The security perimeter increasingly includes the browser itself.

#Cybersecurity #Malware #InfoSec #IdentitySecurity #MFA #GoogleSecurity #ThreatIntelligence #EndpointSecurity #Malvertising #ZeroTrust

https://t.co/mgbBCxEmw9

The key findings are based on The Hacker News’ September 7, 2026 report on JSCEAL and Check Point Research’s analysis.

[Pedram Soheil @psoheil]

What happens when ChatGPT, Claude, and Grok all go down at nearly the same time?

That’s exactly what happened this week, and the biggest concern isn’t simply that the services went offline. It’s that nobody has a clear explanation for why.

OpenAI attributed ChatGPT’s outage to a routing error, while xAI said Grok was impacted by an outage at its Memphis compute center. Anthropic reported a partial outage but provided few details.

The timing is especially interesting because xAI and Anthropic have a major compute partnership, potentially explaining two of the outages. But that still doesn’t explain ChatGPT.

The incident is a good reminder that the AI ecosystem is becoming increasingly interconnected, and that organizations relying heavily on AI need to think seriously about redundancy, failover strategies, and what happens when their preferred AI provider suddenly becomes unavailable.

AI may be everywhere, but resilience still matters. What is your AI disaster recovery plan?

#ArtificialIntelligence #AI #ChatGPT #Claude #Grok #CloudComputing #AIOps #DevOps #Cybersecurity #Technology #SoftwareEngineering #Resilience

https://t.co/3viyjmxG0d

The simultaneous outages and the differing explanations are also reported by WIRED.

[Pedram Soheil @psoheil]

Over 3 million WordPress websites may be exposed to a serious security vulnerability in the All-in-One WP Migration and Backup plugin.

CVE-2026-19949 is a high-severity second-order SQL injection vulnerability with a CVSS score of 8.8. Under certain conditions, an unauthenticated attacker could steal the plugin’s secret key and ultimately achieve remote code execution, potentially resulting in complete site compromise.

The vulnerability affects versions up to 7.109 and was patched in version 7.110, released August 20. However, as of September 3, only about 35% of installations had been updated.

This is another reminder that third-party plugins can significantly expand the attack surface of otherwise well-maintained applications.

If you manage WordPress infrastructure, check your installations and make sure All-in-One WP Migration and Backup is running version 7.110 or later.

#Cybersecurity #WordPress #Vulnerability #WebSecurity #ApplicationSecurity #SQLInjection #RCE #InfoSec #PatchManagement

https://t.co/sm2wqvJWoj

[Pedram Soheil @psoheil]

@anand_himanshu You are very welcome, thanks for publishing it! 🙂

[Pedram Soheil @psoheil]

What if Chrome browser exploits could be chained together?

That’s exactly what security researcher Himanshu Anand explored in a fascinating V8 exploitation challenge.

By chaining three publicly known V8 vulnerabilities, he was able to turn seemingly separate weaknesses into a complete exploit chain against a specific Chrome build.

The chain progressed from:

Compiler bug → memory address disclosure → garbage-collection exploitation → fake JavaScript object → arbitrary read/write inside the V8 sandbox → native address leak → native control → ROP execution.

The result? A malicious web page running inside Chrome was able to escape the V8 sandbox and use existing Chrome code to read a protected file.

What makes this especially interesting is the role of AI. The researcher used ChatGPT and other LLMs extensively for source-code navigation, experiment design, debugging, exploit research, and generating test harnesses.

But the AI didn’t simply generate a working exploit. The process was iterative: propose a hypothesis, test it against the exact Chrome binary, analyze the failure, refine the theory, and repeat.

This is a great example of both the power and limitations of AI-assisted security research. LLMs can dramatically accelerate vulnerability research, but real-world exploitation still requires deep technical knowledge, experimentation, and evidence.

#Cybersecurity #SecurityResearch #Chrome #V8 #BrowserSecurity #VulnerabilityResearch #ExploitDevelopment #AI #ArtificialIntelligence #AIAgents #LLM #GoogleChrome #ApplicationSecurity #ZeroDay #DevSecOps

https://t.co/UU72Ey9CnJ