What Is A Router? (And all things AI) – PSW #920

Paul Asadoorian

1. BIG-IP APM vulnerability CVE-2025-53521

   I've been looking into this one for a few different reasons, here's what I've learned:

   • BIG-IP is really just a Linux box, e.g. one test system I have is CentOS 7 with Linux kernel 3.x (this is an older 15.x version)
   • APM is Access Policy Manager, "zero-trust" feature, and must be enabled (which requires several steps, including adding access policies)
   • The orginal Oct 2025 vulnerabiliy was labeled as a DoS, the updated info upgrades this to unauthenticated RCE!
   • IoCs are here: https://my.f5.com/manage/s/article/K000160486
   • This is one of the vulns dropped by F5 after they were breached, remember at the time they disclosed 40+ vulns and they all required auth
   • Some people saw they all required auth and didn't rush to fix, this is not a good strategy
   • UNC5221 is the primary suspect, but no evidence directly linking this group to active exploitation exists. The IoCs published by F5 are good, but I can't match it to known UNC5221 activity, or Brickstorm malware, perhaps its a different group or F5 isn't giving us the full picture.
   • Like malware samples would be great!
2. How to Install QEMU/KVM and Near-Native VMs on Linux: Ultimate Guide

   This is a really great guide, here are some of my tips as I just build a massive lab using Linux KVM and Libvirt:

   • Use Claude, it was amazing at this task and documented everything as we went (like keeping track of 20+ sets of credentials)
   • Make sure you have virtualization enabled in your CPU
   • Give it plenty if disk space, up front - Don't run out of disk space, like I did, and have to move your images to a new disk later in the process, like I did (Claude walked me through this entire process flawlessly)
   • Have Claude create scripts that give you menus to access systems, health status checks, snapshots, and bring up/down the environment

   I've completely converted from VMWare to KVM on all of my systems, and I'm not looking back.

3. Linux Backbone Fragility Revealed The Bus Factor in Databases

   We live in a fragile world:

   The Core Concept

   • The bus factor is the minimum number of key contributors who would need to suddenly disappear from a project before it stalls or fails due to loss of critical knowledge — the lower the number, the higher the risk. Like if someone were to be hit by a bus...
   • The "bus factor" measures how many key developers must leave before a project becomes unmaintained — a low number means a dangerous single point of failure.
   • MongoDB (7), MariaDB (5), Redis (5) — considered healthy; knowledge is well-distributed.
   • MySQL, PostgreSQL, and SQLite all sit at bus factor 2 — classified as high-risk/siloed.
   • Removing the top 2 contributors from MySQL and SQLite results in 100% loss of functional directories (storage engines, SQL parsers).
4. axios Compromised on npm – Malicious Versions Drop Remote Access Trojan – StepSecurity
   • Attackers compromised the npm account of jasonsaayman, the lead axios maintainer, changing the account email to [email protected] and using a stolen npm access token to publish malicious releases stepsecurity
   • Two poisoned versions were published: [email protected] and [email protected], both since removed from npm aikido
   • Axios has over 100 million weekly downloads, making this a high-impact supply chain attack with a ~2 hour exposure window snyk
   • The attack was pre-staged ~18 hours in advance — the attacker first published the malicious dependency [email protected] from a separate attacker-controlled account ([email protected]) to avoid "new package" alerts from security scanners stepsecurity
   • The malicious versions injected [email protected] as a runtime dependency — a package that masquerades as crypto-js but contains a postinstall hook (node setup.js) that fires a cross-platform RAT dropper on macOS, Windows, and Linux stepsecurity
   • Zero malicious code exists inside axios itself — the attack vector is entirely the injected phantom dependency stepsecurity
   • The dropper contacts a live C2 server (sfrclak.com / 142.11.206.73:8000), fetches platform-specific second-stage payloads, then self-destructs by deleting itself and replacing its package.json with a clean decoy to hinder forensic detection stepsecurity
   • Errors are silently swallowed via a top-level try/catch — npm install exits with code 0 even if the dropper runs successfully, producing no warnings stepsecurity
   • A key forensic signal: all legitimate axios 1.x releases are published via GitHub Actions with npm OIDC Trusted Publisher (cryptographically bound to a verified workflow); [email protected] was published manually with no OIDC binding and no gitHead stepsecurity
   • No CVE has been assigned as of the time of reporting cycognito
   • IOCs to hunt: [email protected] or [email protected] in install logs, presence of plain-crypto-js in node_modules, outbound connections to sfrclak.com or 142.11.206.73 on port 8000 stepsecurity
   • Anyone who installed either malicious version should assume full system compromise, rotate all secrets (cloud keys, API tokens, DB passwords), and audit CI/CD runner environments ox
5. Vulnerability Research Is Cooked — Quarrelsome

   Thomas Ptacek wrote this amazing article. It's funny to see some of the younger folks poke holes at this, not knowing just how experienced and smart Thomas is (if you still don't believe me go listen to Security. Cryptography. Whatever. podcast, and Deidra and other hosts and guest are super intelligent to say the least). Here are the very high-level summary points for discussion:

   • AI vuln research is imminent, not gradual — a step-function change happening in months
   • Bug classes are LLM-friendly — well-documented patterns + binary pass/fail exploitability = perfect agent task
   • "Security by obscurity of effort" ends — unglamorous, under-fuzzed targets are now exposed
   • Full-chain exploits are achievable — layered defenses just become iterated sub-problems for agents
   • Bad regulation is coming — policymakers will conflate offensive research with crime
   • One human edge remains — truly novel, undocumented techniques; everything else is fair game
6. How to turn anything into a router

   Josh made a statement: "TVs are routers" and the Internet lost its mind (Ref: https://youtu.be/WYrJe2WfiNI?si=fsxyzhd7O209tcY-). This is in the context of the FCC regulations on routers that just passed. Here's the FCC definition of "router": "For the purpose of this determination, the term 'Routers' is defined by National Institute of Science and Technology's Internal Report 8425A to include consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer. Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems." - technically, a TV as an example, is a consumer-grade networking device (has Wifi and Ethernet), they are intended for residential use, they can be installed by the consumer, and are capable of of forwarding data packets between network systems (perhaps not out-of-the-box, but could certainly be configured to route network packets as most devices are based on Linux and have more than one network interface, e.g. Wifi and Ethernet). The last part is the one up for debate, as the FCC doesn't state that routing packets has to be the device's intended function...

   • I think an interesting point is this: If a device has two or more network interfaces and runs Linux, it's only one command away from being a router: sudo sysctl -w net.ipv4.ip_forward=1
7. GitHub – hackgnar/gratttool: An enhanced Rust variant of Gatttool

   New BT/BLE tools are popping up all over the place, likely due to Claude, but I'll take it.

8. Streamlining secure boot for 26.10

   People are upset about this, and I get both sides. For security, less features in signed Grub is better as the attack surface is reduced. However, users will lose features they depend on to run many environments:

   • Canonical proposes stripping GRUB's signed build to minimal features for Ubuntu 26.10 to reduce the Secure Boot attack surface discourse.ubuntu
   • Removed features include LUKS encryption, LVM, Btrfs, XFS, ZFS, and JPEG/PNG parsing — keeping only ext4, FAT, and ISO9660 discourse.ubuntu
   • Systems using unsupported features cannot upgrade to 26.10 without manual reconfiguration youtube
   • Breaks common enterprise setups (LUKS + LVM is a standard server deployment pattern) youtube
   • Community views it as forcing users onto Canonical's TPM/systemd-boot path — reducing flexibility and increasing vendor lock-in discourse.ubuntu
   • Critics argue the security tradeoff is weak, given Secure Boot is already undermined by signed vulnerable third-party drivers reddit
   • Btrfs removal is especially controversial as it's a mainstream Linux filesystem discourse.ubuntu
   • Downstream distros (Mint, Zorin, Pop!_OS) may be dragged into the same restrictions forum.zorin
9. Zero Days: Electric Motorcycles are a Security Nightmare

   The information on how to attempt to remove materials that encapsulate PCBs is fascinating: "There are three primary materials that PCBs can be encapsulated with: polyurethane; epoxy; and silicone.". Spoiler: They failed and just reversed the Android app to get the firmware rather than try to deal with the "Depotting" process. Awesome article.

10. Remote Command Execution in Google Cloud with Single Directory Deletion
11. TeamPCP Supply Chain Campaign
12. US regulator bans imports of new foreign-made routers, citing security concerns
13. Subdomain Finder
14. Trivy Under Attack Again: Widespread GitHub Actions Tag Comp…

    I removed Trivy from all of my systems and workflows for now. That's how bad this is. This is tied to the Cisco source code leak, but I am not certain anything important or usful from Cisco was leaked:

    • Trivy's GitHub Actions repo (aquasecurity/trivy-action) was hit by a second supply chain attack on March 19–20, 2026
    • A stolen credential from the first breach (Feb 28) was reused due to non-atomic secret rotation
    • Attacker force-pushed 75 of 76 version tags to malicious commits — no branch/release changes, evading notifications
    • Payload was an infostealer: dumped memory, harvested SSH keys, AWS/GCP/Azure creds, and Kubernetes tokens
    • 10,000+ GitHub Actions workflows referencing the action were potentially exposed
    • Malicious Docker Hub images also published (trivy:0.69.4–0.69.6, latest)
    • ShinyHunters used credentials stolen from Trivy-poisoned CI/CD pipelines to breach Cisco
    • Attackers cloned 300+ private Cisco GitHub repos, including source for Cisco AI Assistant and AI Defense
    • Downstream exposure includes repos from major banks, BPO firms, and U.S. government agency clients
    • Microsoft published dedicated detection/defense guidance tied to this compromise
    • Mitigation: Pin GitHub Actions to full commit SHAs, never mutable version tags
15. Cyberattack on vehicle breathalyzer company leaves drivers stranded across the US
16. A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE)
17. SSH certificates and git signing
18. ZeroPath’s 36 Sudo Bug Fixes Reduce CrackArmor’s Impact – ZeroPath Blog
19. Android devices ship with firmware-level malware
20. FreedomFi Sercomm SCE4255W CBRS Small Cell Security Advisory
21. Modular 18650 Packs, No Spot Welding Required
22. Max severity Ubiquiti UniFi flaw may allow account takeover

Joshua Marpet

1. Ryzen DIY

   This teenager designed and HAND BUILT 2 ryzen SBC's. Insane!! He needs some help with core boot to do this bigger!

2. Attack Lifecycle

   The Value Chain Risk Institute, a nonprofit devoted to Third Party Risk Management and Quantification from an Inside-Out perspective, built the AttackClock to visualize the entire attack chain from vulnerability to post-breach. It's interesting.

Sam Bowne

1. Anthropic Just Leaked Upcoming Model With “Unprecedented Cybersecurity Risks” in the Most Ironic Way Possible

   “Claude Mythos” is so powerful, it's a major cybersecurity risk. The model “presages an upcoming wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders,” Anthropic boasted.

2. AI bug reports went from junk to legit overnight, says Linux kernel czar

   "Something happened a month ago, and the world switched. Now we have real reports." It's not just Linux, he continued. "All open source projects have real reports that are made with AI, but they're good, and they're real."

3. AI agents are ‘gullible’ and easy to turn into your minions

   "AI is just gullible...Even more than that, I can get ChatGPT to manipulate you," Bargury said. "ChatGPT is a trusted advisor. You ask it questions that can be sensitive, you ask it for advice. It can be manipulated to answer whatever I want - and not just in the specific conversation, but long term."

4. Vibe coding could mark the end of the App Store review process as we know it

   Apple reviews each app submission and app update submitted to the App Store with human reviewers. But app review is taking significantly longer, with some people being stuck in review for 3+ days, and some reporting even a week of waiting for review. Traditionally, this process would take less than a day, sometimes a day or two in rare cases.

5. New Torg Grabber infostealer malware targets 728 crypto wallets

   Initial access is obtained through the ClickFix technique by hijacking the clipboard and tricking the user into executing a malicious PowerShell command. Torg Grabber is actively developed, with 334 unique samples compiled in three months (between December 2025 and February 2026) and new command-and-control (C2) servers registered every week. Apart from cryptocurrency wallets, Torg Grabber steals data from 103 password managers and two-factor authentication tools, and 19 note-taking apps.

6. Windows is using your internet to send updates to strangers — here’s the setting to stop it

   Delivery Optimization is meant to make updates faster and smoother for everyone. Instead of pulling updates only from Microsoft’s servers, this feature allows your PC to get parts of those same updates from other computers who already have them. This works for both Windows updates and Microsoft Store app downloads. The disadvantages are background data usage and some consumption of disk space.

7. Anthropic’s Claude gets computer use capabilities in preview

   The feature was launched today as a research preview for Claude Pro and Max subscribers, and it notably pairs with Dispatch, which is a mobile tool that debuted last week. With Dispatch, users can assign tasks to Claude from their smartphone, and have it complete those assignments using their computer. Anthropic explained that when Claude is given a task to complete, it will look to see if it has the right integrations to perform it using tools such as Google Calendar and Slack. But if it doesn’t have the right connector, it will fall back onto controlling the computer like a human does, using the screen to navigate. It can open files and documents, operate a web browser and run development tools autonomously.

8. Claude attacks were ‘Rorschach test’ for infosec community, scaring former NSA boss

   The now-infamous Anthropic report about Chinese cyberspies abusing Claude AI to automate cyberattacks was a Rorschach test for the infosec community. 'It freakin' worked' says Rob Joyce - and shows how relentless AI agents can find holes humans miss.

9. Mark Zuckerberg builds AI CEO to help him run Meta

   Meta’s tools include ‘Second Brain’, designed to search and organise company documents, and ‘My Claw’, which can communicate with other colleagues’ AI agents on their behalf. There's a new trend in Silicon Valley known as ‘Tokenmaxxing’--using AI as much as possible while they work.

10. GitHub adds AI-powered bug detection to expand security coverage

    It offers code scanning for known vulnerabilities, dependency scanning to pinpoint vulnerable open-source libraries, secrets scanning to uncover leaked credentials on public assets, and provides security alerts with Copilot-powered remediation suggestions.

11. The US just pulled the plug on ALL foreign-made Wi-Fi routers

    The FCC has blocked new foreign-made Wi-Fi routers from getting approval, effectively banning them from the US market. Brands must now clear strict national security checks to launch new router models in the US.

12. TryHackMe Built an AI Pentester Using Your Data : Here’s Why I’m Not Deleting My Account (Yet)

    TryHackMe launched NoScope ; an AI-powered penetration tester trained on seven years of user behavior data: every attack box session, every room completed, every technique practiced. When asked directly about AI training on user data prior to the launch, TryHackMe denied it. Then NoScope launched with that marketing copy. You can understand why people felt blindsided.

13. This Company Is Secretly Turning Your Zoom Meetings into AI Podcasts

    WebinarTV, a company that bills itself as “a search engine for the best webinars,” is secretly scanning the internet for Zoom meeting links, recording the calls, and turning them into AI-generated podcasts for profit. In some cases, people only found out that their Zoom calls were recorded once WebinarTV reached out to them directly to say their call was turned into a podcast in an attempt to promote WebinarTV’s services.

14. Security credentials inadvertently leaked on thousands of websites

    The researchers analysed 10 million web pages and found over 10,000 that leaked API credentials. The exposed credentials remained publicly accessible for an average of 12 months, with some online for as long as five years. The majority of those credentials exposed – some 84 per cent of those found – were discovered within JavaScript environments, something the researchers believe may be a consequence of software developers using bundler tools to package their code in a way that can be used online.

15. 8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur

    We discovered ~150 Amazon S3 buckets that had previously been used across commercial and open source software products, governments, and infrastructure deployment/update pipelines - and then abandoned. There were requests coming to them for software updates, binaries, VM images, etc.

16. GrapheneOS refuses to comply with new age verification laws for operating systems — group says it will never require personal information

    It will not comply with emerging laws requiring operating systems to collect user age data at setup. "GrapheneOS will remain usable by anyone around the world without requiring personal information, identification or an account," the project stated. "If GrapheneOS devices can't be sold in a region due to their regulations, so be it." The statement came after Brazil's Digital ECA (Law 15.211) took effect on March 17, imposing fines of up to R$50 million (roughly $9.5 million) per violation on operating system providers that fail to implement age verification. California's Digital Age Assurance Act (AB-1043), signed by Governor Newsom in October 2025, takes effect on January 1, 2027, and requires every OS provider to collect a user's age or date of birth during account setup and pipe that data to app stores and developers through a real-time API. Colorado's SB26-051 passed the state senate on March 3 with similar requirements.

17. Claude Code’s source code appears to have leaked: here’s what we know

    The leaked source reveals a sophisticated, three-layer memory architecture that moves away from traditional "store-everything" retrieval to a "Self-Healing Memory" system. At its core is MEMORY.md, a lightweight index of pointers (~150 characters per line) that is perpetually loaded into the context. This index does not store data; it stores locations. Actual project knowledge is distributed across "topic files" fetched on-demand, while raw transcripts are never fully read back into the context, but merely "grep’d" for specific identifiers. This "Strict Write Discipline"—where the agent must update its index only after a successful file write—prevents the model from polluting its context with failed attempts. For competitors, the "blueprint" is clear: build a skeptical memory. The code confirms that Anthropic’s agents are instructed to treat their own memory as a "hint," requiring the model to verify facts against the actual codebase before proceeding.

18. How we made Trail of Bits AI-native (so far)

    AI works. Most companies are using it wrong. They give people tools without changing the system. That's the gap between AI-assisted and AI-native. AI-native is the structural shift. The org is designed from the ground up assuming AI is a core participant. Not a tool you pick up, but a teammate that's always there. Your knowledge management, your delivery model, your expertise, all designed to be consumed and amplified by agents.