Exploit Chains, Poisoned Packages, and AI Agents Turned Against Their Owners

A public browser-to-kernel exploit chain for Android 17 and fresh supply-chain compromises headline a busy day for offensive practitioners. AI coding agents took a beating too, with new research showing how images and hallucinated package names can quietly hand attackers your secrets — or remote code execution.

Vulnerabilities & Exploits

• A researcher published a full-chain browser-to-kernel RCE PoC targeting Android 17, chaining CVE-2026-10702 (a Firefox JIT RCE) into a kernel exploit for root. It builds on the previously disclosed GhostLock stack-UAF work, moving a complete mobile exploitation chain into the open. blackorbird
• Binarly disclosed six vulnerabilities in U-Boot’s FIT (Flattened Image Tree) signature verification, two allowing arbitrary code execution and four causing DoS. The flaws date back to U-Boot 2013.07 and affect 50+ stable releases plus numerous downstream vendor forks — a root-of-trust bypass across a huge embedded/device fleet. Binarly
• Zimbra is urging urgent patching of a critical stored XSS flaw in the Classic Web Client that lets a specially crafted email execute JavaScript in a victim’s session on open, enabling mailbox theft, session-token hijacking, and arbitrary code execution. No CVE assigned yet; disabling the legacy interface is advised until patched. The Hacker News
• Two new bypasses for Chrome’s Sanitizer API were detailed, defeating client-side HTML sanitization via attribute parsing and URL reprocessing — relevant to anyone relying on the API for XSS defense. SloppyLabs
• “Squidbleed” is a newly disclosed Squid proxy vulnerability that leaks HTTP requests, raising both security and privacy concerns for deployments fronting internal services. Schneier on Security
• Ledger’s Donjon team showed a precisely timed laser pulse can reset the password on a Tangem crypto wallet card to an attacker-chosen value with no old password or backup — an unpatchable hardware fault-injection attack, though it requires physical access. The Hacker News

New Tools & Releases

• CaddySmith generates Caddy redirector configs directly from Cobalt Strike or Sliver C2 profiles, with layered filtering and decoy redirection — a practical infra automation tool for red-team operators. GitHub
• Caeruleus is a Linux single-binary BLE testing tool from Praetorian that consolidates scanning, enumeration, characteristic operations, fuzzing, and security assessment into a JSON-driven workflow, replacing an aging patchwork of deprecated utilities. Praetorian
• Sighthound is an open-source, Rust-based SAST scanner using tree-sitter parsers with pattern matching and taint-flow analysis, pitched as a Semgrep/OpenGrep alternative that runs locally or in CI with all rulesets included and no account required. Corgea
• MalExt Sentry is an open-source, real-time threat-intel feed tracking malicious browser extensions, aggregating Chrome policies, community reports, and threat feeds into machine-readable output. MalExt Sentry
• A CISA-KEV → Sigma orchestrator automates a weekly pipeline that pulls newly weaponized CVEs from the KEV catalog and generates production-ready Sigma detection rules (via Gemini), with audit logging and analyst briefings — useful for detection engineers. GitHub

AI & Model Security

• “Ghostcommit” hides prompt-injection payloads inside PNG images to fool AI coding agents. Researchers showed the technique slipping past AI code reviewers CodeRabbit and Bugbot — which never open image files — then convincing a coding agent to read a repo’s .env and write every secret into code encoded as a list of numbers. BleepingComputer
• “HalluSquatting” weaponizes AI hallucinations for RCE: researchers demonstrated registering the fake package names that popular AI assistants invent, turning hallucinated dependencies into a botnet delivery mechanism against developers who trust the model’s output. SecurityWeek
• Three now-patched flaws in the OpenClaw personal AI assistant chain into a WhatsApp-to-host attack, enabling credential theft, privilege escalation, and arbitrary code execution — including an OS command-injection issue (GHSA-hjr6-g723-hmfm, CVSS 8.8). The Hacker News
• A Cambridge study found terrorist group Boko Haram using ChatGPT, Claude, and Gemini for attack planning, explosives construction, and weapons maintenance, with ISIS operatives coaching commanders on bypassing safety filters since 2023 — the study reports safety guardrails repeatedly failed. The Decoder, CASP report
• Netwrix highlights the widening identity-security gap as AI agents accelerate non-human identity sprawl, arguing organizations lack visibility into what these identities are, who owns them, and what they can access. BleepingComputer
• OpenAI’s GPT-5.6 Sol reportedly produced a proof of the 50-year-old Cycle Double Cover Conjecture in under an hour using 64 parallel subagents. Mathematicians call the proof surprisingly elementary but note missing citations to prior work, reopening the question of whether these systems recombine or genuinely create. The Decoder

Software Supply Chain

• The jscrambler npm package was compromised: simply installing the malicious 8.14.0 release triggers a preinstall hook that drops and runs a native Rust infostealer, with a separate binary for Windows, macOS, and Linux. Socket flagged the release six minutes after publication. The Hacker News
• Researchers linked 222 GitHub repositories to a large-scale fake Go package operation using multi-stage PowerShell loaders to deliver trojans, infostealers, spyware, and cryptominers, with persistent attribution via shared GitHub Actions workflows and a common threat-actor email. Security Affairs
• Multiple campaigns are abusing ghost accounts against the GitHub API to mass-map organizations, their repositories, and members — reconnaissance groundwork for targeted attacks. SecurityWeek

Threat Activity

• Unit 42 profiled The Gentlemen, a high-tempo RaaS operation evolved from Qilin that leans on sophisticated tooling and zero-day exploits; the group’s leak site claimed 18 new victims across construction, finance, pharma, and physical-security sectors worldwide. Unit 42, Dark Web Informer
• China-aligned attackers breached US and Canadian universities, using webshells and backdoors for persistent access and targeting physics and engineering departments — focusing on faculty with national-security ties and astrophysics/particle-physics research. CyberScoop / Proofpoint
• WP-SHELLSTORM exposed itself: an open attacker server left visible for three weeks revealed a WordPress-targeting operation with 27 known plugin exploits, target lists of over 1.4M domains, and thousands of planted backdoors. The Hacker News
• Silver Fox, a China-linked group, is deploying MODBEACON, a new Rust-based modular RAT, expanding its arsenal and infrastructure against key sectors. SC World
• Australia’s ACSC warned of a global exploitation campaign hitting vulnerable CMS platforms and plugins. BleepingComputer
• A former BlackCat/Alphv ransomware negotiator, Angelo Martino, was sentenced to 70 months — the third US security professional imprisoned for aiding the gang. Separately, an Armenian Ryuk affiliate pleaded guilty in the US and faces up to 15 years. SecurityWeek, BleepingComputer

Malware & Detection Research

• A deep reverse-engineering writeup of Vidar Stealer 2.0 covers Task Scheduler tampering (spoofing 1999 timestamps), process hollowing into explorer.exe, obfuscated dynamic API calls, and Microsoft Copilot injection for detection evasion. GitHub
• An EDR tradecraft writeup walks through modern EDR internals, the multi-layer detection pipeline, and user- and kernel-mode evasion — emphasizing residual kernel telemetry as a detection opportunity, valuable for both red and blue teams. 0xdbgman

Policy

• The EU’s Chat Control proposal cleared a key parliamentary hurdle despite 314 MEPs voting against and 276 in favor: because rejection of a Council proposal required an absolute majority of all MEPs (360 votes), the measure survived on the timing of a pre-recess vote when many members were absent — reviving “voluntary” scanning of private messages. Patrick Breyer coverage
• Apple sued OpenAI, alleging a “coordinated campaign” to poach 400+ ex-Apple staff — including former iPhone design chief Tang Tan — and steal trade secrets tied to unreleased hardware, as OpenAI builds out its own hardware division. The Decoder