EPIC FAILS in Application Development Security practice processes, training, implementation, and incident response
Hackers Used AI Support Bot to Seize Accounts
A video released on Telegram by pro-Iran hackers claimed to document a remarkably simple exploit that appears to have involved using a VPN connection with an IP address that is in or near the target’s usual hometown, requesting a password reset for the account, and then choosing to chat with Meta’s AI support assistant. From there, the video shows the attacker told the bot to link the account in question to a new email address, after which the bot dutifully sent that address a one-time code that allowed a password reset.
Their exploit failed to work against any accounts that had MFA enabled.

CI/CD Exploited: Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm
In total, 96 versions across 32 packages have been compromised, cumulatively downloaded 116,991 times per week. The malware appears similar to the Mini Shai-Hulud malware that was recently open-sourced by TeamPCP.
The packages were published via GitHub Actions OIDC, indicating the CI/CD pipeline was compromised rather than an npm token.
If you have installed any affected package versions, treat all CI secrets, cloud credentials, SSH keys, and npm tokens as compromised and rotate them immediately.

How a USB-connected speaker can infect a PC without ever being touched
Creative Transport Protocol (CTP) allows devices connected via Bluetooth or USB to send commands to the speaker, such as changing LED colors and equalizer settings. CTP also allows the connected devices to receive responses from the speaker.
A Bluetooth device was able to connect to the speaker, which was connected to a PC via USB, without any authentication, and didn’t have to be paired first. One of the CTP commands, labeled “upload new firmware to device,” allows replacing the firmware without code signing or other measures to prevent the loading of unofficial code.
Bluetooth is always on for the speaker, even in sleep mode, with no apparent way to disable it.
Sound Blaster Katana V2X doesn’t consider the behavior a vulnerability.

Former IBM cybersecurity exec accuses company of covering up years of Chinese hacking
“You can’t sell cybersecurity to the federal government while allegedly having these security problems within your own company.”
William Barlow served as IBM’s vice president of threat intelligence until August 2019. In a whistleblower lawsuit unsealed this week, he alleged IBM knew about the breaches and deliberately failed to notify US authorities.
Barlow alleged that an internal IBM investigation found more than 56,000 potential APT 10 intrusions between 2013 and 2016. The scale was enormous. According to an internal report cited in the complaint, attackers accessed nearly 400 compromised accounts and almost 200 systems across every IBM business unit.
The breach spanned 18 countries and multiple IBM products. The hackers also infiltrated data IBM maintained in partnership with AT&T, which is also named in the lawsuit.
In March 2017, intelligence officials from the Five Eyes alliance warned IBM about the breach. That prompted an internal investigation. But IBM could not fully assess the damage because it had not kept logs of who accessed its network and when, a basic security practice.

United Airlines flight pulls U-turn over Bluetooth device name
A teenager's speaker was named “bomb”.

What’s Weak This Week:

HACKING
Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack
GitHub disabled 73 repositories across four Microsoft organisations, including Azure, Azure-Samples, Microsoft, and MicrosoftDocs, after the worm planted malicious code that harvests developer credentials.
What makes this campaign particularly dangerous is that the attacker planted a payload runner wired to execute automatically through five developer tools: Claude Code, Gemini CLI, Cursor, VS Code, and the npm test script. A developer only needs to clone an affected repo and open it in an AI coding agent for the malware to run.
Once triggered, the Bun-based worm harvests credentials for AWS, Azure, GCP, Kubernetes, npm, and GitHub. It then uses those stolen tokens to commit itself into any repository the victim can write to, spreading autonomously across the ecosystem.
Among the disabled repositories are critical Azure infrastructure projects: azure-search-openai-demo, durabletask and its .NET, Go, JS, and MSSQL implementations, functions-container-action, llm-fine-tuning, and windows-driver-docs. OpenSourceMalware reported that GitHub contained the attack within 105 seconds, but the scope of affected downstream users remains unclear.

Dashlane explains how attackers managed to download encrypted password vaults
Attackers mounted a coordinated hacking campaign against a large base of its users in an attempt to recover as many encrypted password vaults as possible. The password manager provider said fewer than 20 personal user vaults were downloaded.
The attackers sent requests to register new devices across a large number of accounts. Then they simultaneously entered the one-time codes into each of them. In theory, attacking two accounts this way increased the odds for each try to 1 in 500,000. Attacking 1,000 accounts would increase the odds to 1 in 1,000, and so on. The more accounts that were targeted, the better the chances one of them will fall. The economics of password spraying work similarly. The technique also weakens rate limiting because the large number of attempts is spread out, limiting the number hitting any single account.
Ultimately, the 2FA spraying attack managed to hit the right combination before it was shut down.
For attackers to obtain the decrypted vault contents for those accounts, they would still have to crack the master password. Dashlane makes this process difficult by using an algorithm known as Argon2. It dramatically slows down and intensifies the process of converting the plain-text master password into a cryptographic hash. In turn, entering large numbers of guesses requires a tremendous amount of time and computing resources, even when the cracking is performed using GPUs or special-purpose hardware.

OpenAI's agent chained decade-old DoS attacks to crash web servers in seconds
A home computer on a 100Mbps connection can render a vulnerable server inaccessible within seconds.
An HPACK bomb attack (also known as CVE-2016-6581) exploits the HTTP/2 header compression algorithm (HPACK) by sending thousands of tiny messages to the server, forcing it to rapidly allocate memory and ultimately crash.
Then the Slowloris DoS attack (CVE-2016-8740 and CVE-2016-1546) overwhelms the server by opening legitimate connections and maintaining them as long as possible.
Combining the two exhausts the server’s memory and forces it offline.
What Codex did was read the codebases, recognize that the two compose, and build the combined attack. That combination is obvious once you see it, and yet as far as we can tell no human had put it together against these servers.

Autonomous AI-driven worm can reason its way through corporate networks
Researchers at the University of Toronto, the Vector Institute, and the University of Cambridge have built and tested a proof-of-concept AI-driven worm that does not operate on a fixed list of exploits.
Instead, it analyzes each target it encounters, reasons about how to attack it, and creates a strategy on the fly, all with the help of a small, free large language model (LLM) running directly on machines it has already compromised.
On average it correctly identified vulnerabilities, exploited hosts to elevated access, and propagated to hosts.
The worm also demonstrated an ability to exploit vulnerabilities disclosed after its underlying model’s training cutoff (Copy Fail, Dirty Frag and a Marimo RCE), by reading publicly available security advisories at runtime and using the information to craft working exploits.
Finally, the worm diagnosed unexpected failures and found workarounds using general reasoning. For example, it found the hardcoded IP blocklist in its own source code and rewrote it, unprompted. In another example, when replicas crashed on Alpine Linux and Windows Server 2008 hosts due to a VM-detection check bug, the parent worm found the attestation source file on the target machine, removed the failing check, and retried successfully.

Return-To-Tool (RTT) Exploits: Your AI Agent Is Already Compromised
You isolated the database inside a Docker container. You put the Model Context Protocol (MCP) server on its own network segment. The agent runs in a sandbox. A web application firewall (WAF) and a reverse proxy sit in front of the application tier. Firewall rules are tight, egress is restricted, and the production credentials never leave the vault. The auditor signed off.
Then you connected an AI agent so that support tickets could be triaged automatically, customer documents could be parsed at scale, and engineers could query production data in natural language. The agent works beautifully.
On Saturday morning, a message lands in your inbox: “Take a look at this. Is this supposed to be happening?” Attached is a screenshot. Every authentication token from your production database is sitting in a public customer comment thread, posted by your AI agent on its own service account, through its approved tools, within the privileges you gave it. No alerts were fired and nothing is out of policy.
A widely trusted mcp/postgres Docker image and show an SQL read-only bypass that was publicly disclosed more than a year ago, but the image kept shipping the unpatched code anyway. It was pulled more than 100,000 times from Docker Hub and ended up connected to AI agents across countless production deployments.
An AI agent will happily issue whatever SQL a support ticket describes, including the sequence that trips the read-only bypass. The bug didn’t change. Its reachability did. An attack that was theoretical yesterday is a working exfiltration path today, with the agent as the delivery mechanism.
Such deployments are now one crafted ticket away from compromise, regardless of whether anyone has taken advantage of it yet.
[rG: AI Agent Security: With delegated access to systems and data, non-deterministic agents are susceptible to injection attacks that can become catastrophic when there is no active monitoring and alerting implemented.]

IronWorm malware hits 36 packages in npm supply-chain attack
The malware targets 86 environment variables (key-value pairs) and 20 credential files that may contain OpenAI, AWS, Anthropic, and npm credentials, vault configuration files, SSH keys, and Exodus cryptocurrency wallet files.
Uses GitHub Actions to deliver the stolen secrets. The malware serializes the secrets into a single value and then writes it to a file with a harmless-looking name, as if it were lint or formatting output. The last step of the process is uploading the file as a build artifact, which can be downloaded by anyone with access. This way, the threat actor can avoid the need for an external command-and-control (C2) altogether. 

APPSEC, DEVSECOPS, DEV
NIST National Vulnerability Database Severity Scores Wrong 88% of Time, Inspector General Finds
Severity Scores Accurate Just 12% of Time
In May 2024, NIST awarded a new contract to Maryland-based Analygence and publicly pledged to clear the entire backlog by September 2024, setting a processing target of roughly 6,200 vulnerabilities per month. The IG report found that NIST had never once processed more than 5,000 vulnerabilities in any single month. NIST had no internal plan for how it would reach its own target.
"NIST does not have sustainable processes to manage NVD submissions and will be unable to clear the backlog of unprocessed vulnerabilities or prevent future processing delays without significant changes," the report concluded.
By the end of 2025, the backlog had more than doubled from its June 2024 baseline. NIST had missed its self-imposed September deadline and, as of late 2025, had not publicly announced a new target date. The IG found that NIST's online dashboard also displayed inaccurate backlog statistics for at least four months between March and July 2025.

OWASP State of Agentic AI Security and Governance
A comprehensive view of today’s landscape for securing and governing autonomous AI systems.
Maturity Levels
Level 0: Unaware and ad hoc:
No formal recognition of agentic AI's distinct governance/security risks beyond traditional AI. Shadow IT experiments lack policies, AI-software bills of materials (SBOMs) or guardrails; oversight is informal with minimal logging and generic IT incident handling
Level 1: Experimentation without guardrails:
Pilot projects with single agents/small workflows lack defined autonomy limits, decision scopes or escalation criteria. Generic AI policies and occasional red-teaming provide governance without continuous monitoring or risk-tiering; accountability is diffuse
Level 2: Policy-defined, human-in-the-loop:
Formal policies map use cases to regulations (EU AI Act, GDPR) with mandatory human-in-the-loop for high-impact decisions. Cross-functional governance includes named owner (e.g. CAIO); logging/versioning/AI-SBOM established but monitoring is periodic
Level 3: Integrated, continuous oversight:
Agentic AI treated as critical infrastructure with risk-tiered workflows and autonomy ladders across regulated domains. Real-time dashboards track drift/anomalies; kill switches enable autonomy pauses. Governance-as-code enforces machine-readable policies across AI lifecycle

AI SDLC Framework: A CTO Reference Architecture

AI-Powered Vulnerability Sweep of 19,000 MCP Servers
Complex applications require expert domain knowledge and should not be completely delegated to an LLM multistage verification helps reduce hallucinations, but is not a perfect solution. Based on analysis of more than 19,000 repositories:
·      42.6% of manually classified vulnerable repositories showing signs of AI code generation.
·      3.1% – 8.6% contain exploitable vulnerabilities.
·      8.3% of Model Context Protocol (MCP) server repositories show AI bot activity based on contributor metadata, and source-code analysis suggesting AI involvement in at least 20% of repositories overall.
·      4.1% of AI-identified vulnerabilities in MCP server repositories are genuinely exploitable, with SQL injection, remote code execution, and path traversal accounting for the majority.

Why writing software has become dangerous today
Developers are managing systems, not just writing code
The volume exceeded our ability to inspect it.
Risk moved closer to the developer
Most developers can say exactly what's in the code they wrote this morning.
Far fewer can tell what software entered their machine, what gained access to their data, what systems exchanged information behind the scenes, or what new connections were created while they were writing it.

VENDORS & PLATFORMS
AI costs how much? GitHub Copilot users react to new usage-based pricing system.
Copilot users who rely on “Auto” mode to pick the most appropriate available model for any request should be extremely careful, as some users report it can switch to expensive models for extremely simple queries).
Many Copilot users are sharing personal statistics showing how just a few hours of AI usage can now account for a large chunk of their new monthly subscription caps. For some users, it reportedly took less than a day to use up a month’s usage quota.

Microsoft Introduces MDASH for Large-Scale AI Vulnerability Research
Microsoft has introduced a new AI-driven vulnerability discovery system called MDASH, a multi-model agentic security platform designed to automate large-scale code auditing across Windows and other Microsoft software environments. The system combines more than 100 specialized AI agents that work together to scan, validate, debate, and prove vulnerabilities across complex codebases.

Are designers the new SWEs? Figma Make's new two-way GitHub integration turns designs into live, production code; with built-in governance
Figma Make allows product managers, designers, and non-technical builders to import an existing Git repository directly into the Figma desktop app, visually edit the application's underlying code via the canvas, and push those changes back to engineering through standard GitHub pull requests.

Hermes Agentic AI Overtakes OpenClaw
Where OpenClaw enabled execution, Hermes is built around accumulation, and that single design choice is driving a faster shift than most analysts expected.

What’s Coming Next in Visual Studio

Introducing Microsoft Scout: Your always-on personal agent
Microsoft Scout is integrated across Microsoft 365 apps.
Autopilots are always-on agents that work autonomously, with their own identity, and act on your behalf.
Autopilots stay active in the background, understand how work gets done across your apps and systems, and take action without needing to be prompted each time. Because they operate with their own identity, they can carry out tasks within the permissions and policies you and your organization set.
It can proactively schedule and coordinate meeting times across time zones, flag important meetings, and generate the materials you need to prepare while keeping you in the loop. It identifies upcoming deliverables, then automatically blocks time on your calendar to help you stay on track. It can also spot risks, like stalled decisions, so you can address them before they become blockers.
Over time, Microsoft Scout builds context powered by Work IQ, learning how you work, what you care about, and what needs to happen next.
We are contributing policy conformance directly upstream to OpenClaw.
Organizations running OpenClaw will be able to validate whether their environment is configured within their security and compliance requirements, operating securely, and get a verifiable, audit-ready answer.
[rG: Supervisors are going to love this, along with recording transcriptions, for assignments, status, and performance evaluations.]

Microsoft’s Project Solara: A new platform for devices that run AI agents instead of apps
Based on Android instead of Windows, with two working hardware designs so far, and an initial set of big-name companies lined up to run pilots.
A new platform that spans from chip to cloud with enterprise managed personal interface devices. 

LEGAL & REGULATORY
Duo who sold car crash victims' data must repay £118k
Debbie Okparavero and Maliha Islam were sentenced to six-month prison stints, suspended for 18 months, and 150 hours’ unpaid work in 2024, after being found guilty of offenses under the Computer Misuse Act 1990 and the Data Protection Act 2018.
The pair, who worked for roadside accident biz RAC, were caught selling the personal data of car crash victims – just shy of 30,000 lines of data to an unknown buyer,
Okparavero was ordered to repay £89,277.32 ($119,962.38) within three months. Failure to do so will result in her serving 18 months in prison. 

And Now For Something Completely Different …