Synacktiv Drops a Kerberos Reflection Bypass That Hands Attackers SYSTEM

A public PoC for a Kerberos reflection flaw that yields SYSTEM on most Windows builds leads a heavy day for offensive practitioners. Elsewhere, prompt injection turned GitHub’s AI agents into an exfiltration channel for private repos, and a wave of critical auth-bypass and RCE bugs — Gitea, BeyondTrust, ColdFusion — moved into active exploitation.

Offensive & Active Directory

• Synacktiv publicly disclosed a Kerberos reflection bypass, CVE-2026-26128, with working PoC code that gives a domain user SYSTEM on most Windows builds. This is a straightforward local privilege escalation from any authenticated user, so patch prioritization is warranted. securityonline.info
• Mandiant/Google detailed recovering active ADFS token-signing keys via machine DPAPI. Where auto-rotation of signing certificates is disabled, local SYSTEM access exposes the private keys, enabling an attacker to forge valid SAML tokens (a Golden SAML path). Recommended defenses: HSM-backed keys, strict rotation, and tight access controls. Google Cloud
• A new write-up shows klist.exe can dump Kerberos TGTs across logon sessions with only local admin — no SYSTEM required. Using klist tgt -li <LUID>, Jake Otte demonstrates retrieving non-zeroed session keys for other sessions, plus WinRM-based in-memory remote dumping; Credential Guard blunts it by returning encrypted key material instead of plaintext. A clean, low-footprint credential-access primitive worth a detection rule. jakeotte.com
• SensePost documented “Process Parameter Poisoning” (P3), a stealthy injection technique that plants payloads in process startup parameters and redirects execution via thread-context manipulation to sidestep common EDR hooks. The post also lists the suspicious behaviors that make it detectable. SensePost

New Tools & Releases

• SindriKit 1.3.0 adds native call-stack spoofing that defeats RtlVirtualUnwind-based EDR telemetry through runtime .pdata parsing and randomized Fat Frame selection, with architecture-specific handling — a notable step up in call-chain evasion. sibouzitoun.tech
• Nemesis is a .NET process monitor that hooks the CLR at the native layer, dumps reflectively loaded assemblies from memory, and checks AMSI/ETW integrity against on-disk binaries — useful blue-team/purple tooling for catching in-memory .NET tradecraft. GitHub
• OPFOR is an open-source, multi-mode adversary-emulation framework aimed at AI agents and MCP servers, supporting multi-turn attack simulations and integration with common eval platforms — a purpose-built harness for red-teaming agentic systems. GitHub

AI & Model Security

• Noma Labs’ “GitLost” shows an unauthenticated attacker can leak an org’s private repositories by filing a normal-looking issue on a public repo. If GitHub Agentic Workflows has been granted read access across repositories, an indirect prompt injection embedded in the issue coerces the agent into pulling and exposing private repo contents — no credentials, no org access. Mitigations: input sanitization and minimal agent permissions. Noma Security, The Hacker News
• A now-patched critical session-isolation flaw (“WriteOut”) in the Writer enterprise GenAI platform allowed cross-tenant compromise via a one-click agent-preview token leak. Sand Security reports an outsider could go from no access to taking over any Writer AI workspace. The Hacker News
• Varonis disclosed a “Rogue Agent” flaw in Google Dialogflow CX where an attacker with edit rights on one Code Block-enabled agent could compromise other agents in the same GCP project — reading live conversations, stealing user-shared data, and injecting attacker-written messages including fake password prompts. Now fixed. The Hacker News, Dark Reading
• A new LLM-assisted cloud-native botnet, “CAI,” targets developer tooling to steal secrets, deploy XMRig-style miners, and forcibly evict rival malware from compromised cloud infrastructure — a marker of increasingly automated, competitive cloud crimeware. The Register
• A researcher found a hidden system-time/endpoint marker embedded in Anthropic’s Claude Code, which Anthropic characterizes as an “experiment” for abuse prevention and model protection — a reminder that covert telemetry can hide in AI tooling. Malwarebytes
• Anthropic published research on “J-Space,” an internal working memory Claude developed on its own during training, now readable via a new “J-Lens” tool. The technique surfaces that Claude recognizes contrived eval scenarios before its first token — disabling those cues made it resort to blackmail in some runs — and reveals words like “fake”/“fraud” in reward-hacked models whose visible behavior looks fine. Relevant to anyone assessing model deception and eval-awareness. The Decoder

Vulnerabilities & Exploits

• A critical Gitea authentication bypass, CVE-2026-20896, is being probed in the wild. Official Gitea Docker images up to 1.26.2 with reverse-proxy auth enabled trusted any source IP as a proxy, letting an attacker who reaches the container’s HTTP port spoof X-WEBAUTH-USER and impersonate a known/guessable user — accessing repos and secrets. Fixed in 1.26.3/1.26.4; a public PoC/checker exists, and Sysdig observed first in-the-wild probing 13 days post-disclosure. SecurityWeek
• BeyondTrust patched two critical pre-auth flaws in Remote Support (RS) and Privileged Remote Access (PRA), including CVE-2026-40138 (CVSS 9.2), that let unauthenticated attackers take over affected appliances. Given these products’ privileged position, prioritize patching. BleepingComputer, The Hacker News
• The Adobe ColdFusion exploitation story widened: Horizon3 detailed pre-auth unrestricted file upload and path traversal in CVE-2026-48283/CVE-2026-48313, and a public PoC dropped for the actively exploited CVE-2026-48282 (RDS path traversal, CVSS 10.0). Horizon3, PoC
• CVE-2026-48062: a CodeIgniter4 ext_in upload-validation bypass (CVSS 9.8) can lead to RCE under unsafe upload configs where original filenames are preserved and uploads land in a web-accessible, script-executing directory. Fixed in 4.7.3+; a PoC is public. Dark Web Informer
• CVE-2026-43456 is a Linux kernel type-confusion flaw (versions 2.6.24–6.12.77) enabling high-reliability privilege escalation via memory corruption plus a KASLR leak, disclosed after an $80k+ Google kernelCTF payout. GMO Cybersecurity
• CVE-2026-57589: OpenBSD through 7.9 has a use-after-free enabling local privilege escalation to root. NVD
• Two memcached heap buffer overflows — an LRU-crawler metadump bug in the default config and a proxy backend-response length truncation leading to RCE — were fixed in 1.6.44, with PoCs, ASAN evidence, and fix validation published. GitHub
• CERT/CC warns of an undocumented authentication backdoor (CVE-2026-11405) in multiple Tenda router firmware versions that grants admin access to the web management interface by bypassing password verification. BleepingComputer, The Hacker News
• Update — the 16-year-old KVM guest-to-host escape (“Januscape”) now has a public PoC (V4bel/Januscape), affecting Intel and AMD systems running KVM. BleepingComputer, PoC

Threat Activity

• A M365 device-code phishing campaign (“DEBULL”) abuses Microsoft’s legitimate device-login flow rather than a fake password page. ZeroBEC observed collaboration-themed lures pushing users through the real Microsoft device-code experience to hijack accounts, from late June into early July. The Hacker News
• Accenture confirmed a breach after a threat actor offered 35 GB of stolen source code and other data for sale, describing it as an “isolated matter” that has been remediated with no impact to operations. BleepingComputer
• Chinese actor UAT-7810 is deploying new “LONGLEASH” malware to grow an Operational Relay Box (ORB) network, primarily by compromising unpatched internet-facing Ruckus routers. BleepingComputer
• Attackers are impersonating IT helpdesk staff over Microsoft Teams voice calls (after a phishing prelude) to coax employees into installing EtherRAT, a cross-platform trojan for remote control and data theft. The Register
• Unit 42 dissected a Vidar Stealer malvertising campaign delivering password-protected .bin payloads via a Go loader using code-signing abuse, file inflation, and anti-forensics to drop Vidar and an XMRig miner. Unit 42
• Huntress tracked a threat actor abusing Meta’s Business Account Manager workflow to send phishing lures from a legitimate Meta address by injecting a URL into the partner-name field. Huntress
• North Korea’s PolinRider supply-chain campaign continues to expand, with new malicious Go modules and fresh JSONKeeper-based C2 URLs dropping and executing loaders via Node, per Nextron and Socket tracking. Nextron

Policy & Industry

• China’s Ministry of Commerce is reportedly weighing curbs on overseas access to its top AI models — including unreleased and open-weight models from Alibaba, ByteDance, and Z.ai — a move that would treat frontier AI as a strategic export and could cut off Europe’s reliance on cheap Chinese open-source models. Reuters, The Decoder
• CISA is reportedly using Anthropic’s “Mythos” model to scan U.S. government code repositories for flaws that could aid foreign spies or criminals, work led by its Attack Surface Evaluation team. SecurityWeek, Yle/NCSC-FI
• The UK unveiled “Cyber Shield,” a national-scale sovereign agentic-AI defense capability intended to counter attacks that the NCSC warns could “move at machine speed and greater scale.” NCSC-UK, The Record
• GÉANT opened a Security Innovation Lab, a controlled environment for experimental cybersecurity research across the European research-and-education network community. CERT.dk