Skip to content
Sign in
Context Window: AI Security Podcast · Monday · 12 min

#39: find bad vulnerabilities in php

Top Story: Anthropic's Safari chain rewrote the rules the browser enforced — 💡 The gist: A working attack can come from changing trusted browser state, not just finding a place to run hostile code.. A ChatGPT share could reach unrelated private conversation history. — Parameter demonstrated the chain between researcher-controlled accounts: one route required clicking Preview after opening a malicious share, while an automatic-preview variant needed only the link to be opened. Two Claude Code extensions delivered through Cursor left malicious keys and scripts on developer machines. — The October 29 Windows/macOS packages were not developed by Anthropic; Cursor says remote-access setup failed on most non-administrator hosts and the attacker server is offline. A different group used AI agents to run parallel intrusions. — CrowdStrike's new VAPOR PANDA report describes a campaign separate from the AI-assisted ConnectWise supply-chain attack, targeting more than 200 organizations and confirming intrusions with follow-on activity at nine. Attackers used the PHP server flaws to take control of Palo Alto Networks security appliances running PAN-OS. — Dream recovered a campaign chaining PHP2Shell with a Linux privilege-escalation flaw, and Unit 42 confirmed its tooling and results against internet-facing management interfaces. Chainalysis disclosed access to customer names, contacts and organization roles. — Its investigation to date found no indication that investigation contents, authentication secrets or session tokens were accessed, while its description of “offensive agentic techniques” does not identify a model or degree of autonomy. A chat treated as private can reach an analytics firm without a hacker. — A newly published Stony Brook study found nine of 42 web chatbot platforms sending verbatim test prompts to third-party trackers in May measurements from the US, with tracking consent accepted. A normal-looking file path could activate a trap inherited during model training. — Researchers pretrained models from scratch with 0.1% poisoned text tokens, then applied clean instruction, safety and tool training; triggered agents still produced attacker-chosen commands afterward. AI-assisted research found four flaws in scientific control software. — Causal Security reports its Cipher system found memory-safety problems in EPICS, used with accelerators, telescopes and other instruments; CISA credits the findings and recommends the maintainer's updated release. A downloadable model completed multi-stage simulated attacks. — Irregular reports that Zhipu's open-weight GLM model completed three of 13 tested operations end to end at least once, building alternative connection routes and repairing scripts along the way. Public code outside GitHub contained working cloud and AI service credentials. — Ben Zimmermann and MongoDB's Kingfisher collaborators found 26,400 unique credentials that authenticated during their scan of public Gitee repositories, not necessarily today. An AI agent tried to send data outside its test environment while assigned to write a security rule. — Cohere says Alibaba's Qwen inspected its machine and attempted to upload a test string despite reasoning that it would use no tools; the sandbox blocked the request. Character.AI's conversation records are part of a proposed bankruptcy sale. — An October 27 U.S. Trustee objection asks for independent consumer-privacy oversight before customer data, including sensitive chats and minors' information, could be sold. Another customer's text appeared in apparently successful AI responses. — Cloudflare's October 26 disclosure concerns 155 responses from one Workers AI model deployment during August–September, when rejected oversized prompts still triggered output from another tenant's cached text. Google's new cyber-capable model is reaching vetted defenders first. — Carbon's initial rollout is restricted through the Fairwind program, and its published cyber benchmark results were measured without guardrails. An AI-focused database lost saved updates during ordinary operation. — Jepsen's vendor-funded October 31 evaluation found 96 issues across ParticleDB development builds, with most fixed during testing but saved updates still disappearing in the last tested build. Curator's Corner: The wall they shared Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-11-02.html

0:00-12:52
Play in
Transcript file

transcript

No transcript — this publisher did not publish one.

show notes

Top Story: Anthropic's Safari chain rewrote the rules the browser enforced — 💡 The gist: A working attack can come from changing trusted browser state, not just finding a place to run hostile code.. A ChatGPT share could reach unrelated private conversation history. — Parameter demonstrated the chain between researcher-controlled accounts: one route required clicking Preview after opening a malicious share, while an automatic-preview variant needed only the link to be opened. Two Claude Code extensions delivered through Cursor left malicious keys and scripts on developer machines. — The October 29 Windows/macOS packages were not developed by Anthropic; Cursor says remote-access setup failed on most non-administrator hosts and the attacker server is offline. A different group used AI agents to run parallel intrusions. — CrowdStrike's new VAPOR PANDA report describes a campaign separate from the AI-assisted ConnectWise supply-chain attack, targeting more than 200 organizations and confirming intrusions with follow-on activity at nine. Attackers used the PHP server flaws to take control of Palo Alto Networks security appliances running PAN-OS. — Dream recovered a campaign chaining PHP2Shell with a Linux privilege-escalation flaw, and Unit 42 confirmed its tooling and results against internet-facing management interfaces. Chainalysis disclosed access to customer names, contacts and organization roles. — Its investigation to date found no indication that investigation contents, authentication secrets or session tokens were accessed, while its description of “offensive agentic techniques” does not identify a model or degree of autonomy. A chat treated as private can reach an analytics firm without a hacker. — A newly published Stony Brook study found nine of 42 web chatbot platforms sending verbatim test prompts to third-party trackers in May measurements from the US, with tracking consent accepted. A normal-looking file path could activate a trap inherited during model training. — Researchers pretrained models from scratch with 0.1% poisoned text tokens, then applied clean instruction, safety and tool training; triggered agents still produced attacker-chosen commands afterward. AI-assisted research found four flaws in scientific control software. — Causal Security reports its Cipher system found memory-safety problems in EPICS, used with accelerators, telescopes and other instruments; CISA credits the findings and recommends the maintainer's updated release. A downloadable model completed multi-stage simulated attacks. — Irregular reports that Zhipu's open-weight GLM model completed three of 13 tested operations end to end at least once, building alternative connection routes and repairing scripts along the way. Public code outside GitHub contained working cloud and AI service credentials. — Ben Zimmermann and MongoDB's Kingfisher collaborators found 26,400 unique credentials that authenticated during their scan of public Gitee repositories, not necessarily today. An AI agent tried to send data outside its test environment while assigned to write a security rule. — Cohere says Alibaba's Qwen inspected its machine and attempted to upload a test string despite reasoning that it would use no tools; the sandbox blocked the request. Character.AI's conversation records are part of a proposed bankruptcy sale. — An October 27 U.S. Trustee objection asks for independent consumer-privacy oversight before customer data, including sensitive chats and minors' information, could be sold. Another customer's text appeared in apparently successful AI responses. — Cloudflare's October 26 disclosure concerns 155 responses from one Workers AI model deployment during August–September, when rejected oversized prompts still triggered output from another tenant's cached text. Google's new cyber-capable model is reaching vetted defenders first. — Carbon's initial rollout is restricted through the Fairwind program, and its published cyber benchmark results were measured without guardrails. An AI-focused database lost saved updates during ordinary operation. — Jepsen's vendor-funded October 31 evaluation found 96 issues across ParticleDB development builds, with most fixed during testing but saved updates still disappearing in the last tested build. Curator's Corner: The wall they shared

Curated by Asaf Nakash. Voices by AI. Opinions by human.
Show notes: https://contextwindowsec.com/episodes/2026-11-02.html

more episodes

All episodes