🕵️ RESEARCH & DEEP DIVES
Anthropic Warns Attackers Using Infostealers to Hijack Claude Login Sessions
Anthropic is warning Claude users that infostealer malware is being used to hijack their login sessions.- Applies to Claude users, whose accounts Anthropic warns are being targeted via compromised login sessions
- Attackers use infostealer malware to hijack sessions and steal account usage to run their own activities
- The tactic reflects a broader shift by bad actors from stealing credentials to hijacking session tokens and authentication cookies
Risky Bulletin: BGP hijack delivers malicious Virtualizor updates — Risky Business News
Divi through 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via... — CVE ThreatInt
Baserow 2.3.3 - SQL injection in formula index() JSONB array extractionBasero... — CVE ThreatInt
MapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt... — CVE ThreatInt
WP File Download through 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deleti... — CVE ThreatInt
FIPS mode assertion failure via malicious CERT payloadIn FIPS mode, Libreswan... — CVE ThreatInt
Piwigo Image Derivative i.php path traversalA security vulnerability has been... — CVE ThreatInt
OpenCart Autocomplete Workflow edit.php cross site scriptingA vulnerability w... — CVE ThreatInt
Keycloak-services: keycloak-services: cross-session email verification proof ... — CVE ThreatInt
OpenCart Autocomplete Workflow address.php cross site scriptingA vulnerabilit... — CVE ThreatInt
FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Upda... — CVE ThreatInt
APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organiz... — CVE ThreatInt
ION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnvION-DTN versions before... — CVE ThreatInt
AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRe... — CVE ThreatInt
AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes — arXiv cs.CR
A Formal Analysis of Agent Payment Protocols — arXiv cs.CR
Explainable Artificial Intelligence for Industrial Cybersecurity: A Review of Methods, Operational Integration, and Research Challenges — arXiv cs.CR
DUPIN: Attack Learning Is Still Needed! Demonstrating Few-Shot after Unsupervised Pretraining Is A Nimble Forensics Learner — arXiv cs.CR
Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems — arXiv cs.CR
Workload Identification with Physical Side Channels for AI Governance — arXiv cs.CR
OreProof: Verifiable Provenance with Limited Disclosure for Critical-Minerals Supply Chains Using Zero-Knowledge Proofs — arXiv cs.CR
NeuroPriv: Adversarial Representation Learning for Privacy in Wearable EEG Systems — arXiv cs.CR
Federated Trust for Embodied Robot Capability Marketplaces — arXiv cs.CR
Don't Trust the Code, Check Its Effects: Runtime Refinement for Regenerated Systems Code Under an Adversarial Generator — arXiv cs.CR
Capability-Gated Language Models: Security Composes, Utility Does Not — arXiv cs.CR
Does Reasoning Mitigate Backdoor Attacks? A Neuro-Symbolic Perspective — arXiv cs.CR
GlitchLab: A Hardware-in-the-Loop Optimizer for Physical Fault Injection — arXiv cs.CR
The Safeguard Worked. Is the LLM System Safer? — arXiv cs.CR
Transferable End-to-End Optimization for Indirect Long-Term Memory Poisoning in LLM Agents — arXiv cs.CR
SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems — arXiv cs.CR
NeuroGraph: An AI Graph-Driven Neuro-Symbolic Framework for Explainable Threat Reasoning in Advanced Manufacturing — arXiv cs.CR
A Version Space Approach for Digital Circuit Analysis — arXiv cs.CR
Automating Static Code Analysis Through CI/CD Pipeline Integration — arXiv cs.CR
PhantomCall: Evading ML Malware Detectors via Function Call Graph Perturbation — arXiv cs.CR
Anthropic Launches Claude Fable and Mythos 5.1 for Advanced Coding and Research — cryptika.com (discovered)
OWASP Launches OASIS AI Initiative to Fix Open Source Vulnerabilities at Scale — cryptika.com (discovered)