Cache Me If You Can (Sitecore Experience Platform Cache Poisoning to RCE) - watchTowr Labs
Source: https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/
Sliding into your DMs: Abusing Microsoft Teams for Malware Delivery
Source: https://permiso.io/blog/sliding-into-your-dms-abusing-microsoft-teams-for-malware-delivery?hs_preview=VYVYybGX-195188659586
An interesting approach to malware by checking for Claude Code CLI and Gemini CLI in compromised \`nx\` package to explore local filesystem and steal credentials, api keys, wallets, etc.
Safeguarding VS Code against prompt injections
Source: https://github.blog/security/vulnerability-research/safeguarding-vs-code-against-prompt-injections/
I setup a challenge for a new kind of tool there's a private key in plain text in this browser instance. You can copy paste and use it. But you cannot see it or take it. It's basically a mirrored document editor that allows you to control it on any webpage without exposure.
There's a 20$ private bitcoin key directly usable by any user on it. Copy paste and delete it or move it around. If you break the new algorithm it's yours!
Countering EDRs With The Backing Of Protected Process Light (PPL)
Source: https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html
An interactive application that visualizes and demonstrates Google’s CaMeL (Capabilities for Machine Learning) security approach for defending against prompt injections in LLM agents.
Link to original paper: [https://arxiv.org/pdf/2503.18813](https://arxiv.org/pdf/2503.18813)
All credit to the original researchers
title={Defeating Prompt Injections by Design},
author={Edoardo Debenedetti and Ilia Shumailov and Tianqi Fan and Jamie Hayes and Nicholas Carlini and Daniel Fabian and Christoph Kern and Chongyang Shi and Andreas Terzis and Florian Tramèr},
year={2025},
eprint={2503.18813},
archivePrefix={arXiv},
primaryClass={cs.CR},
url={https://arxiv.org/abs/2503.18813},
}
AI can be used to create working exploits for published CVEs in a few minutes and for a few dollars
Source: https://valmarelox.substack.com/p/can-ai-weaponize-new-cves-in-under
We Put Agentic AI Browsers to the Test - They Clicked, They Paid, They Failed
Source: https://guard.io/labs/scamlexity-we-put-agentic-ai-browsers-to-the-test-they-clicked-they-paid-they-failed
