Weekly Wire #16: North Korea’s $6.3 Billion Exit The Binance heist that unfolded this week is remarkable mostly for how unremarkable its mechanics were. North Korea’s TraderTraitor crew moved $6.3 billion in about twenty minutes, not by cracking wallets or cold storage but by walking through a single compromised DevOps laptop. The most exotic state-sponsored tradecraft still tends to end in a forgotten machine and a stolen credential, and that should unsettle everyone who stores value behind a login screen. In brief North Korea’s TraderTraitor group drained about $6.3 billion from Binance, the largest crypto theft on record, through a single compromised DevOps laptop rather than any wallet compromise. The FBI attributed the heist to Pyongyang, while Binance said it had covered roughly 95% of affected assets and resumed withdrawals. CrowdStrike detailed Vapor Panda, a China-backed crew using an agentic AI pentesting tool to compromise 140 sensitive targets in 11 days. Researchers mapped Volt Typhoon’s “Silent Train” framework, a network of rapidly rotating compromised devices infiltrating critical infrastructure. Apple alerted victims in 99 countries to mercenary spyware infections, just as the Pall Mall Process nears its final guidelines on commercial hacking tools. Chainalysis, the firm that tracks crypto crime, disclosed its own breach attributed to “offensive agentic techniques.” Digital forensics & DFIR Tampering with timelines - injecting false leads — A companion to the usual timeline-analysis talk that asks the question most practitioners skip: what if the timeline itself has been edited? Knowing an adversary can inject false leads should change how much weight you place on any single artifact. How to investigate business email compromise (BEC): from fraudulent email to full scope — BEC remains the quiet cash cow of financial crime, and a five-phase workflow that runs from first fraudulent email to full scope is the kind of thing that keeps an investigator from missing the mailbox rules the attacker left behind. Microsoft Defender for Endpoint: Beyond default telemetry with Custom Data Collection Rules — Default MDE telemetry leaves real blind spots, and this walks through extending it without drowning your SIEM. Useful for anyone who has stared at an incident and wondered why the one event they needed was never collected. Threat intelligence & APT Binance links $6.3 billion crypto theft to compromised DevOps laptop — The headline is the number, but the detail that should keep CISOs awake is the entry point: an engineer’s laptop, not the wallets. When a $6.3 billion heist comes down to endpoint hygiene, the “we’re too small to be a target” excuse quietly expires for everyone. Studying Fraudulent North Korean IT Workers — A fake startup built to observe how DPRK IT workers infiltrate remote roles is clever applied research. It is the same revenue machine as the heist, just the slower and quieter version. Researchers uncover Volt Typhoon’s covert, ephemeral network — Volt Typhoon’s “Silent Train” framework treats infrastructure as disposable, rotating through compromised devices to frustrate attribution. The implication for defenders is uncomfortable: a clean asset today can be an attack relay tomorrow. China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days — CrowdStrike’s Vapor Panda reframes AI-assisted offense from a research curiosity into a production capability. The speed is the worrying part, not the novelty. Privacy & surveillance Apple notifications alert victims in 99 countries about mercenary spyware infections — Apple flagging mercenary spyware across 99 countries is a useful reminder that commercial surveillance is a global problem, not an exotic one. The timing, right as the Pall Mall Process nears its guidelines, is not accidental. Samsung TVs without mics may listen through soundbars, researcher says — A TV without a microphone that listens through your soundbar is the kind of finding that makes you reread the fine print on every “smart” device in the house. Adding more always-on hardware does not solve the consent problem. DOJ raises privacy concerns over potential sale of Character.AI chats — When a chat platform goes bankrupt, the question of who buys its users’ conversation history becomes a privacy problem the law was never written for. The DOJ pushing for a privacy ombudsman is a small but telling step. Policy & legislation Registrazione NIS2: il 31 ottobre chiude il canale per i ritardatari — The October 31 deadline for late NIS2 registration quietly passed, and ACN’s new determination now sets the rules for 2027. Anyone still treating this as a one-time form-filling exercise will discover the ongoing obligations the hard way. NIST Publishes Guidance to Meet Federal Post-Quantum Deadlines — NIST’s guidance for hitting the 2031 post-quantum deadline is the kind of long-horizon planning that is easy to postpone and expensive to ignore. Systems with long data lifetimes need to start the migration before the math gets weaponized. Tools & research New Android SMS of Death exploit can remotely crash unpatched phones — A crafted text message that crashes unpatched phones is a neat reminder that the carrier layer still has sharp edges. CVE-2026-58882 is the sort of flaw that patches slowly across an entire ecosystem of OEMs. Millions of security cameras at risk: DoS vulnerability in Intelbras devices — Millions of security cameras sharing a single vulnerability is a reminder that IoT patching remains mostly aspirational. A DoS on a surveillance camera is annoying today, but it points to a supply chain that was never built to be updated. PHP2Shell Was Exploited Before the Patch — The uncomfortable detail here is that PHP2Shell was exploited four days before the patch existed, inverting the usual disclosure timeline. Exploitation is now running ahead of disclosure, and defenders are the ones absorbing the delta. Extra Chainalysis discloses data breach from “offensive agentic techniques” — There is a grim symmetry in the firm that tracks crypto crime being breached through “offensive agentic techniques” the same week Binance lost $6.3 billion. Even the watchers are now in the crosshairs. Cyberattacco alla Camera dei deputati: violate le email di Meloni (che non usa), Delmastro (FdI) e Formentini (Lega) — The breach of the Italian Chamber of Deputies email system reads like political theater but still reveals real gaps in institutional hygiene. That ACN was called in under an existing protocol is a small sign the coordination story is improving. The pick of the week is BleepingComputer’s account of the Binance theft, because it distills the week’s lesson into a single image: a DevOps laptop, not a broken cipher, was the entire attack surface. Next week, watch how Binance’s 95% asset recovery holds up under scrutiny, and whether the DPRK IT worker and heist threads converge into a clearer picture of Pyongyang’s crypto revenue machine. FAQ How did North Korea steal $6.3 billion from Binance? The FBI attributed the theft to TraderTraitor, a North Korean threat group, which drained funds across ten blockchains in about twenty minutes after compromising a DevOps engineer’s laptop to submit unauthorized withdrawal transactions. Binance found no evidence of a wallet private key leak and said it had covered roughly 95% of affected assets. What are the most important cybersecurity events of the week of 2026-10-25? North Korea’s $6.3 billion Binance heist, the largest crypto theft on record; CrowdStrike detailing a China-backed group’s agentic AI pentesting campaign; researchers mapping Volt Typhoon’s covert Silent Train network; Apple alerting mercenary spyware victims in 99 countries; and a data breach at blockchain analytics firm Chainalysis attributed to offensive agentic techniques. How are articles selected for the Weekly Wire? Articles are curated from a fixed set of RSS feeds weighted by source reliability and relevance to DFIR, threat intelligence, privacy, policy, and security research. Vendor marketing and press releases are discarded. https://andreafortuna.org/2026/11/01/weekly-wire-16/ #rss #feeds #linksharing #qwibbit

What Torvalds got right about AI and programmers, and what he left out On 13 October, kernel developer Laurent Pinchart received a new rule for his patches, courtesy of Linus Torvalds: stop using compilers. Write everything in assembler, or don’t bother sending it. While you are at it, give up your text editor for the commit message too, because the backspace key is a tool that hides your mistakes, and a serious engineer should be able to show them. The rule was sarcasm, delivered in the register that made Torvalds famous, and it has been circulating ever since as the most sensible thing anyone has said about programmers and AI. I think it is a very good paragraph. I also think it is a shorter argument than the situation deserves, and the interesting part is what the email leaves out. In brief Torvalds was answering a debate about the kernel’s Assisted-by tag, not proposing a test of whether contributors can code without help. His compiler analogy holds as a principle, because tools are a poor measure of competence, and fails on the mechanics, because compilers are deterministic and language models are not. What replaces a ban on tools is a duty to understand, verify and sign for what you submit, the same duty forensic analysts have always had with their own software. The tag was unenforceable, but the question behind it, how reviewers decide how hard to look, is still open. A reply to a tag, not a verdict on talent The context matters, because several retellings of the exchange compress it into “developers must prove they can code without AI”, which is a different argument from the one in the email. At the start of 2026 the kernel documentation began asking contributors to add an Assisted-by line to any patch written with the help of an AI tool. Jonathan Corbet later added a paragraph to the patch submission guide warning that skipping the tag could get in the way of acceptance. It was never enforced, and by October it looked like a failed experiment: of the 18,533 non-merge commits that went into Linux 7.3 up to its seventh release candidate, only about ten percent carried the tag, even though AI use was believed to be far more widespread. At the Maintainers Summit in Prague on 8 October the maintainers reportedly reached consensus to deprecate it, and Sasha Levin posted a patch removing the documentation the next day. According to The Next Web, critics inside the thread argued that the tag could not be enforced and amounted to free advertising for LLM vendors. Pinchart objected that without it the project loses a way to state what it expects from contributors, and that is the sentence Torvalds jumped on in his reply. His answer has three moves. He rejects the whole idea of rules shaped like “don’t use AI for X”. He then runs that logic through two absurd examples, the compiler and the editor, to show that nobody would accept them for any other tool. And he restates the only expectation he has of contributors, which is that they do their best and understand what they are doing, something that has very little to do with which tools produced the text. He closes with a remark about the people he respects and considers intelligent, who are not the ones who “shy away from using new and interesting tools”. It would be easy to read that as a pose, but he practices it. Speaking at Open Source Summit Europe, also in Prague, he said he used to find AI just not very good and now “I actually really like using AI”, citing real security bugs that these tools now find in the kernel. In the same week he published a patch written with LLM help aimed at a cache contention problem. The man is not defending a principle he avoids using. The compiler analogy deserves its applause Every generation of programmers has been told that the previous generation’s tools were the real thing. Assembler programmers looked at compilers the way a vinyl collector looks at streaming. Compiler people looked at garbage collection, then at frameworks, then at the package manager that downloads half the internet before lunch. In each case the tool moved a layer of detail out of the programmer’s head, and the profession got better at the work that remained. Nobody sensible today asks a web developer to prove they can hand-write machine code before touching a pull request. I started working in 1997, and ai miei tempi the debate over tools was already the wrong debate. The useful question was never whether you had used a debugger, a decompiler or a hex editor, but whether you could explain what had happened. My own field offers the cleanest version of the argument. A forensic examiner who refuses to use Volatility because a real analyst walks kernel structures by hand would not be admired for the purity, they would be excluded from the case for the speed. Competence in DFIR has always meant knowing what the tool does, what it assumes and where it lies to you. There is a second half to the analogy that is less often quoted. Engineers who never read assembler are perfectly competent most of the time, and the good ones can still drop one level down when the abstraction leaks, for instance when a performance problem or a miscompiled corner case refuses to yield to the layer above. That is the real content of “understand what you are doing”: you may delegate, as long as you can descend. Applied to an AI assistant, it is a demanding standard rather than a permissive one. Why the analogy stops at the compiler’s door A compiler is a deterministic translator with a specification. Feed it the same source and the same flags and you get the same binary, which is the whole idea behind reproducible builds, and when it gets something wrong the failure is rare enough to become a conference talk. A language model has no specification, gives different answers to the same prompt, and fails in the most unhelpful way possible, by producing something that looks right. A compiler never invents a function that does not exist and then writes a confident comment about it. The trust you can extend to the two is simply not the same trust. The economics differ as well. A compiler does not change who has to read the result, whereas an assistant makes it nearly free to produce a patch and leaves the cost of reviewing it exactly where it was. Torvalds knows this perfectly well. At the same Prague conference he said AI is improving the code base while also stressing maintainers to the point of being a problem, and that about three quarters of the talks at the Maintainers Summit dealt with making these tools less exhausting to live with. The compiler analogy says nothing about this problem, because compilers never produced it. His own answer, in the way it has been reported, is social rather than technical. One account of the summit has him arguing that blaming the LLM is a mistake, that the real problem is contributors who do not understand how the kernel works, and that maintainers should simply give low priority to their patches. I find that convincing as far as it goes. It turns understanding into an admission ticket, which only works if reviewers can still tell, quickly and cheaply, who has it. Understanding is something you can show Here the DFIR habit is useful, because forensics has been dealing with “trust me, the tool said so” for decades. When I wrote a few days ago about the forensics gap in eBPF-based EDR, I pointed out that the Volatility plugins available for the job are a patchwork, that one of them describes itself as alpha and warns against using it in real investigations, and that anyone relying on them should validate them against known-good memory images first. Nobody calls that hostility to tools. It is the procedure that turns a tool’s output into something you can defend, and an examiner who can only say the software told them so tends to have an unpleasant afternoon under cross-examination. Moving the same habit into code review gives a workable definition of understanding. The author can explain why the change is shaped the way it is. They can say what they tested, including the case that failed the first time. They can name what the assistant proposed and they threw away, and they can trace the path a bad input would take through the new code. None of this depends on whether the first draft came from a keyboard or a model, and all of it is visible to a reviewer within minutes of a conversation. The kernel already has the right anchor for accountability, and it is not the tag. The project’s guidance on coding assistants says AI agents must never add a Signed-off-by line, because only a human can certify the Developer Certificate of Origin, the statement that you have the right to submit this code. The same write-up notes that even the Assisted-by tag was phrased as “should” and not “must”. So the real contract was always the signature: the machine may type, a person answers for it. That arrangement survives the removal of the tag unchanged, which is probably why so few maintainers lost sleep over it. The disclosure question Torvalds left on the table None of this makes Pinchart wrong, and the email does not actually answer him. His point was about setting expectations, and a rule such as “tell us how this was made” is a different thing from a rule such as “don’t use the tool”. Torvalds demolishes the second while never quite touching the first. A tag that one patch in ten carries is useless as a signal, but a reviewer deciding how much scrutiny to spend still benefits from knowing whether the author watched the code being written or approved it from a chat window. The summit seems to feel the same way, since a proposal that emerged there is to describe the process in the cover letter of a series, as a sentence of prose rather than a line of metadata. There is also a respectable case for outright bans, and the analogy does not touch it. NetBSD has refused AI-generated code since 2024, and System76 has kept it out of its COSMIC desktop. NetBSD recently reported donations of around 120,000 dollars against a target of 50,000, a surge that arrived alongside its AI-free stance. Those projects are not arguing that their contributors cannot code. They are arguing about provenance, licensing and the kind of community they want, which are legitimate questions that a joke about compilers does not answer. Security teams should recognize the pattern from their own work. Attackers do not fill in disclosure fields, and they adopted the technology faster than most of us. Check Point’s analysis of the VoidLink framework found it was largely produced through AI-assisted development, by a single developer in under a week. A ban or a tag binds only people who were already behaving, and that is why I have little patience for policies built on avoidance. When I wrote about AI models escaping a test sandbox, the part worth attention was the question of who signed off on the environment and who would answer for it, rather than the metaphysics. So the test I would take away from Torvalds is a practical one, and it works well outside software. Can you explain the thing you are about to ship? Can you reproduce the result without the tool in the room, at least well enough to check it? Can you break it on purpose? Will your name be on it when it fails? A person who answers yes to all four can use whatever they like, and I stop caring whether the first draft came from a compiler, an assistant or a very patient intern. What I want to know is who picks up the phone at three in the morning when it breaks. FAQ What did Linus Torvalds actually say about AI? In an email to Laurent Pinchart on 13 October 2026, he rejected rules of the form “don’t use AI for X”, compared them to banning compilers and editors, and said he expects contributors to understand what they submit, whatever tools they use. What was the Assisted-by tag? It was a line in the commit message that the kernel documentation asked contributors to add when an AI tool helped write a patch. Maintainers at the October 2026 summit agreed to deprecate it, partly because only about ten percent of recent commits carried it. Does dropping the tag mean AI-written code is trusted by default? No. Patches are still reviewed, AI agents still cannot add a Signed-off-by line, and the human who signs the patch remains responsible for it under the Developer Certificate of Origin. https://andreafortuna.org/2026/10/28/torvalds-ai-compilers/ #torvalds #linustorvalds #october #laurentpinchart #ai #rss #feeds #linksharing #qwibbit

Weekly Wire #15: PHP’s Decade-Old Hangover There is a special kind of dread that comes from learning a bug has been sitting in code for decades. Not because nobody looked, but because nobody managed to chain the right pieces together until now. This week, frontier AI did exactly that to PHP, reminding the internet of an uncomfortable truth: the web still runs on a language so ubiquitous that fixing it is less like patching a product and more like changing the foundation of a building while people are still living in it. In brief Two critical PHP RCE flaws affect virtually every version since 5.4, with working exploits already spotted in the wild and emergency patches released across the ecosystem. AI-assisted research turned long-dormant bugs into exploitable chains, with OpenAI and Wiz comparing the effort reduction to a turning point in vulnerability discovery. Microsoft’s record Patch Tuesday fixed over 1,400 flaws, while the LiteLLM supply-chain compromise showed how quickly malicious packages can spread through the AI tooling ecosystem. ConnectWise customers were hit by a supply-chain attack via compromised API secrets, granting access to Microsoft 365 tenants through backup identities. OpenCode quietly patched a critical RCE affecting roughly 1.4% of users with external AI providers connected, a reminder that AI dev tools are now high-value targets. Digital forensics & DFIR Operation FlashHole: Lazarus breaks security, defies control — Kaspersky’s deep dive into Lazarus tooling shows the group continuing to evolve its tradecraft despite years of sanctions and exposure. The patience and operational discipline on display is a useful counterweight to the idea that public attribution ever meaningfully slows these crews down. The journey of a paper unicorn: adventures inside a modern warehouse — OT and supply-chain security rarely get this kind of narrative treatment, following the digital trail through a warehouse environment. It’s a reminder that the “boring” infrastructure keeps the world running, and is precisely what adversaries notice when everyone else is looking at endpoints. Threat intelligence & APT Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement — The targeting of defense-industrial base and law enforcement fits a long-running GRU pattern of collecting intelligence ahead of geopolitical friction. What’s notable is the breadth: not just classified programs, but the suppliers and contractors that feed them. Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site — Krebs’ reporting on the blurred line between negotiators and operators is the kind of uncomfortable detail that keeps coming up. The extortion ecosystem thrives on these gray roles, and law enforcement is starting to look past the “middleman” label. SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warn — Six hundred victims across critical infrastructure is a staggering number for a single ransomware group. The scale suggests either aggressive affiliate recruitment or a very efficient initial access pipeline, and either way it’s a problem for defenders. Privacy & surveillance AI doxing tools: how online surveillance technology has changed — Kaspersky’s look at AI-powered doxing shows how cheap and accessible these capabilities have become. What used to require OSINT expertise can now be automated, lowering the barrier for harassment campaigns and blurring the line between research and abuse. Meta glasses caught recording conversations without wake phrase — Wearable cameras with always-on capture raise questions that policy has yet to answer, and “it was a bug” doesn’t resolve the consent problem. The technology is outpacing social norms faster than legislation can keep up. Grindr users’ sensitive data shared through ad auctions without valid consent — A $9.6 million fine is a start, but the structural issue remains: real-time bidding was never designed for sensitive categories like sexual orientation. Until the plumbing changes, fines will be the cost of doing business. Policy & legislation CRA, pubblicato lo schema di decreto italiano: controlli, certificazioni e sanzioni — Italy’s draft decree for the Cyber Resilience Act is taking shape with ACN oversight, accreditation, and meaningful sanctions. Vendors selling connected products into the EU need to read past the compliance checkbox and look at the enforcement mechanism. Federal agencies recommend cyber controls, independent testing for frontier AI systems — CISA and NSA telling frontier AI developers to treat sandbox escapes as reportable incidents is a quiet but significant milestone. The question is whether “recommendations” will become requirements before the first major agentic escape makes headlines. US Cybersecurity Job Postings Fall 26%, Hitting Four Year Low — A quarter drop in job postings is worth paying attention to, especially as AI reshapes roles and budgets tighten. The market correction may be real, but the threat landscape certainly isn’t slowing down to match. Tools & research Widespread PHP Flaw May Cause Many Site Outages Today — Krebs’ coverage captures the scale perfectly: two flaws affecting PHP 5.4+, working exploits in the wild, and AI-assisted discovery that turned decades-old bugs into a Log4Shell-scale problem. The comparison is apt, and the patching timeline will likely stretch for months. PHP2Shell Exploitation: Two Critical PHP Flaws Explained — Recorded Future’s breakdown of CVE-2026-109618 and CVE-2026-109619 is useful for defenders trying to understand exploitation paths. With Cloudflare already deploying WAF rules and mass exploitation likely, understanding the attack surface matters more than ever. LiteLLM release pipeline hacked to distribute info-stealer malware — A compromised PyPI release of a popular LLM proxy distributed credential-stealing malware, hitting developers who installed or updated the package. The AI tooling supply chain is learning the same painful lessons as npm and PyPI did years ago, just at much higher velocity. Microsoft Patches More Than 1,400 Security Flaws — Another record-breaking Patch Tuesday, following September’s thousand-plus fixes. At this cadence, “Patch Tuesday” has become triage by necessity; the limiting factor isn’t patch availability, it’s knowing which fixes to prioritize first. Extra Arista patches new VeloCloud Orchestrator zero-day exploited in attacks — SD-WAN orchestration platforms are juicy targets: compromise one and you potentially reach hundreds of branch networks. Zero-day exploitation in the wild makes this one to patch immediately. ConnectWise Shuts Off Cloud Services After ‘Unauthorized Access’ to Microsoft 365 — Another MSP platform breach cascading to customer Microsoft 365 tenants via stolen API secrets. The pattern is painfully familiar: backup and remote management tools remain the shortest path to mass compromise. OpenCode Breach Could Affect OpenAI, Anthropic and Google — Roughly 1.4% of OpenCode Console users with external providers connected were affected by a critical RCE. AI coding assistants are now infrastructure, and their security posture needs to match that reality. The pick of the week is KrebsOnSecurity’s coverage of the widespread PHP flaws, because it captures the week’s central tension perfectly: a language powering 70% of the web, bugs hiding for decades, and frontier AI turning them into weaponizable exploits. Next week, watch for mass exploitation of the PHP flaws as patches propagate slowly through hosting providers, and see whether the LiteLLM incident reveals a broader campaign targeting AI supply chains. FAQ What made this week’s PHP vulnerabilities so significant? Two critical RCE flaws in PHP (CVE-2026-109618 and CVE-2026-109619) affect all PHP versions from 5.4 onward, impact roughly 70% of websites, and were made exploitable through AI-assisted research. Experts compared them to Log4Shell in scope and severity, with working exploits already observed in the wild. What are the most important cybersecurity events of the week of 2026-10-18? Emergency PHP patches for two critical RCE flaws with working exploits in the wild, Microsoft patched over 1,400 flaws in a record Patch Tuesday, a ConnectWise supply-chain attack hit Microsoft 365 tenants via compromised API secrets, the LiteLLM release pipeline was hijacked to distribute info-stealer malware, and OpenCode disclosed a critical RCE affecting users of external AI providers. How are articles selected for the Weekly Wire? Articles are curated from a fixed set of RSS feeds weighted by source reliability and relevance to DFIR, threat intelligence, privacy, policy, and security research. Vendor marketing and press releases are discarded. https://andreafortuna.org/2026/10/25/weekly-wire-15/ #rss #feeds #linksharing #qwibbit

Cellebrite’s Advanced Unlocks and the case of the missing iPhone 17 Most vendor datasheets tell you what a product does. The one Cellebrite circulates for its new Advanced Unlocks service also tells you how far away you can stand while it does it: about eight meters, or 26 feet for customers who think in imperial. Nobody puts a range on a cable. Once I read that line, the rest of the page started to look like a puzzle with a missing piece, and a researcher at justin.sh has spent weeks trying to work out what the piece is. His post reached me by email, sent by the author himself, which I took as a polite invitation to poke at it. So I did. What follows is a review of the argument rather than a retelling, with my own opinions attached and a clear line between what the post demonstrates and what it merely suggests. In brief A leaked Cellebrite Advanced Unlocks datasheet quotes a working range of about eight meters, which points to a wireless vector rather than a cable. The coverage stops at the iPhone 16 and iOS 26.4+, leaving the entire iPhone 17 generation and every release since March unsupported. A diff of the bluetoothd binary between iOS 26.4 and 26.5 turned up a use-after-free in the pre-pairing L2CAP path that could become remote code execution. The iPhone 17’s switch to Apple’s own N1 chip does not explain the gap, but Memory Integrity Enforcement (MIE) plausibly does. Apple patched the Bluetooth code silently, with no CVE, while Cellebrite has been unusually specific about range and appliance requirements. If the theory holds, a single point release closed a commercial capability within months, and AFU state becomes fragile evidence that examiners must handle carefully. What the datasheet promises and what it leaves out The document is marked CONFIDENTIAL and the author keeps the original under wraps to protect his source, so I am reading it through his screenshots, with the usual caveat that I have not seen the file itself. On the page, Advanced Unlocks (AU from here on) offers AFU access, meaning After First Unlock: the phone has been unlocked at least once since boot, so the data protection keys sit in memory and the Secure Enclave will hand them to the kernel on request. The coverage is iPhone 11 to 16 on iOS 26 through 26.4+, with more models promised later. It reportedly works even with Stolen Device Protection enabled, a feature that, as Elcomsoft explained earlier this year, tightens the USB restrictions forensic tools rely on. Every lab needs one dedicated appliance, online deployments require whitelisting, on-prem ones a dedicated server, and the whole thing is sold next to UFED and Inseyets, not instead of them. The pitch is a vector that is “more resilient to Apple’s OS changes”, which in the current climate is the sentence every mobile examiner most wants to read and least expects to be true. The interesting part is the revision history. The author compared the three versions of the flyer with the iOS releases available on the day each one was issued. In March the datasheet claimed 26.3+, when 26.3.1 was the newest build. In May it claimed up to 26.4.2, nine days after 26.5 shipped. By the September revision it still said 26.4+, a day after iOS 26.7 and iOS 27 appeared. Read charitably, “26.4+” means “and newer, trust us”. Read the way the author reads it, support stopped at 26.4 and the gap has been widening ever since. The iPhone 17 and Air, on the market for about a year, are missing as well, and the flyer does not say whether the SE and e models fall inside “11 to 16”. I would not hang a theory on a version string. Datasheets are written by people paid to be vague, and a number that has not been updated may simply mean nobody opened the template. What the pattern does is raise a question, and the post’s value lies in how seriously it tries to answer it. From eight meters to a Bluetooth daemon The reasoning starts from the range. The author went through the radios in an iPhone and found that the cellular modem and NFC did not fit, while Bluetooth matched Apple’s own figure of about ten meters rather well. That is an inference, and a good one, but it is worth saying plainly that the datasheet never mentions Bluetooth. Everything below hangs on that first step. From there he did what researchers do with a suspect: he diffed the patches. He compared the bluetoothd binary in iOS 26.4 and 26.5, the daemon that manages every Bluetooth connection on the phone and holds a broad set of entitlements, and found a small cluster of security changes, all in L2CAP, the multiplexing layer between the radio and everything above it. The relevant detail is that L2CAP signaling messages are processed before pairing, so any device within range can send them without anyone touching the screen. One fix stands out. In the channel manager, the loop that receives aggregated L2CAP packets walks through the open connections and calls each one’s handler. In 26.4, if a handler freed its connection object halfway through, the loop kept going with a dangling pointer. That is a textbook use-after-free, the kind of memory bug that, with enough skill and patience, becomes code execution. The vulnerable code has been around since at least iOS 17 and probably became easier to exploit when Apple restructured the connection manager in iOS 18. The author is honest that he has not built an exploit, and he separates this bug from a second one in the reassembly path that needs an established channel and is therefore a worse candidate. Then comes the part that made me raise an eyebrow. iOS 26.6 added bounds checks elsewhere in the Bluetooth stack, and iOS 26.7 and 27 fixed CVE-2026-65414, a separate and uncredited Bluetooth remote code execution bug that lands in the same aggregated-packet path, only earlier. Apple hardened that exact code in 26.5 and was still sitting on a remote code execution flaw in it two releases later. Put together, the theorized chain goes like this: crafted packets over the air, a hijacked Bluetooth daemon, an escalation to the kernel through one of the many IOKit connections the daemon holds, and finally USB restrictions lifted and the phone imaged over the cable. No passcode is cracked at any point. It is consistent with the Stolen Device Protection claim too, since by the time anyone plugs in a cable the kernel is already compromised. Here is where I part ways with the post’s enthusiasm. The diff is the solid piece, because anyone with two firmware images and a disassembler can reproduce it, and the bug quite probably exists exactly as described. What cannot be checked is the link between that bug and a commercial product. The chain rests on a range, a stalled version number and a plausible code path, and any pre-authentication parser that received a fix will look plausible to someone who is looking for a candidate. The CVE finding cuts both ways: it shows a target-rich surface, which makes a working exploit believable, and it also means the 26.5 fix was not the only thing standing in the way. The author says as much, and flags the rest of the post as speculation. He deserves credit for that. Why the iPhone 17 is the best clue If I had to pick the single most persuasive argument in the post, it is the hardware gap. Starting with the 17 generation, Apple replaced the Broadcom Bluetooth chip with its own N1 in the 17, 17 Pro and Air, but the 17e kept Broadcom. If AU depended on Broadcom components, the 17e should be supported, and it is not. The chip cannot explain the gap. What does explain every missing phone is Memory Integrity Enforcement, or MIE. Apple introduced it with the iPhone 17 and Air as an always-on defense built on Arm’s tagging extension, covering the kernel and more than seventy userland processes and aimed squarely at mercenary spyware. It targets exactly the family of bugs discussed above, buffer overflows and use-after-free. The author notes that the vulnerable bluetoothd binary is byte-identical on MIE and non-MIE devices at the same iOS build, so the defense, not the code, makes the difference. His arithmetic is worth repeating. MIE uses four-bit tags, so a blind guess succeeds one time in sixteen, which means about 94 percent of attempts at the memory-corruption step fail. A failure crashes bluetoothd and resets the Bluetooth connection, which in a lab is a nuisance, because an attacker can keep trying for a few minutes until luck turns. The kernel step is a different story. If it also depends on corrupting memory, failure there panics the phone, which reboots into BFU, Before First Unlock, and the keys that made the whole exercise worthwhile are gone from memory. I find that asymmetry the most interesting part, and it is a forensic problem more than a hacking one. For an examiner, AFU state is the evidence. A method that can destroy it by failing is a method you think twice about, regardless of how good the demo looks. The datasheet’s reassurance about lower risk of lockouts and device damage starts to read differently once you know what the audience is most afraid of. There is also the March Cellebrite document the author mentions but does not publish. It reportedly credits the 11 to 16 range on iOS 26 and later to AU specifically, while listing the 17 under the general Inseyets capability for things like consent-based extractions. That would suggest the 17 is absent from AU not because Cellebrite cannot touch it, but because this particular method does not work on it. I cannot verify the document, but the inference is neat and it fits. The author offers the charitable counterargument himself. Cellebrite’s leaked 2024 support matrix listed the iPhone 15 as available only through its flagship service, where a team flies to your office, ten months after launch. Running a generation behind has precedent. Still, he asks why the flyer does not simply say “coming soon”, and having read my share of vendor matrices I know the answer: marketing teams prefer a silent gap to a footnote that commits them to a date. After three revisions in six months, I agree with his assessment that this looks like a hard limit rather than a backlog. Silence from Cupertino, candor from Petah Tikva The other half of the story is Apple’s quiet. The 26.5 security bulletin carries no entry for the L2CAP fix. There is a vague acknowledgment about CoreBluetooth, without a CVE, but it sits in the framework layer, not in the daemon, and it was added to the bulletin after publication. Apple sometimes updates bulletins retroactively, or credits nobody when a bug comes from its own engineers. Here it did neither. The author has found no public discussion of any of it, and wonders what else has been fixed without a word. I would resist the temptation to read intent into that silence. He suggests journalists look into the timing, and I would be curious about the results, but the boring explanations are many: an internal fuzzing find, a cleanup of a bug class, no evidence of exploitation. A quietly patched bug is evidence of a disclosure policy, not a conspiracy. It is, however, a real cost for defenders. A CVE number is how a patch gets priority from a risk committee, and a fix that never earns one gets deployed on the same timetable as a new emoji set. The roles, as the post points out, have reversed. Apple usually documents its fixes and Cellebrite keeps the specifics for private meetings. This time the vendor publishes a range and an appliance description while Apple stays mute. The author’s explanation is credibility pressure: as the average iPhone gets harder to break, a vague promise to unlock iPhones stops moving anyone. I think that is right, and it fits the pattern I described when Citizen Lab caught Russian authorities using Cellebrite well after the company had cancelled its contracts: this is a business that sells access to a diminishing resource, and its marketing now has to prove the resource still exists. Ai miei tempi, a bootrom flaw like checkm8 was forever, because you cannot patch silicon that has already shipped. Today the useful bugs come with an expiry date measured in point releases, and the charging port, for years the default door for forensic tools, keeps getting narrower. The post’s closing question is the right one: has the Bluetooth front now closed too, or are things just getting started? What this changes for the people holding the phones Right before publishing, the author added a note that Calif had shown something wireless at Hexacon, which he had not yet had the chance to watch. The public record is thinner than that summary. On October 16, in Paris, Calif rebooted an iPhone 18 Pro running iOS 27.0.1 on stage and showed a jailbreak coming back on its own, but it disclosed neither the vulnerabilities nor the initial vector, and published no tool. Whether any of it is wireless is not established. What the demo does establish is that the wall around the newest hardware has, at the very least, a door that somebody found. If a firm like that can do it, Cellebrite’s customers will soon ask when AU gets one too. For defenders, the story is mostly a lesson in the value of updating. If the author is right, a point release closed a commercial capability within months, and people who stayed on 26.4 remained inside the range of an appliance in someone’s lab. If you face a serious threat model, newer hardware with MIE is a better answer than any setting, and the habits I described in the Lockdown Mode piece still apply, including powering the device off before any situation where seizure is plausible, since a phone that is back in BFU has lost the keys everyone is chasing. For examiners, the lessons are more practical than glamorous. Record the exact iOS build and the tool version for every acquisition, and do not trust a support matrix as a statement of fact, least of all one that lists a range in meters and a stalled version number. Treat AFU state as the fragile evidence it is. And mind a tension that the post does not spell out: for years we have taught first responders to put seized phones in a shielded bag, and a method that works over the air, if it is what the author thinks, needs the shield open. That raises process questions about warrants, scope and documentation that labs will have to answer before an appliance with a range arrives on the bench. Whether or not AU is what the author believes, the post leaves the right problem on the table. The cables are closing, so the next fight will happen wherever a phone listens without asking, in Bluetooth, in ultra-wideband, in the baseband, even in the SIM, which as I showed in the piece on hostile SIM commands can order a phone around more than anyone budgeted for. The phone in your pocket is a very polite device. It answers whoever speaks first. FAQ What is Cellebrite Advanced Unlocks? A service that unlocks iPhones already in an AFU state, advertised as working from roughly eight meters away, without cracking the passcode or the device encryption. Why does the datasheet stop at iOS 26.4 and skip the iPhone 17? A researcher argues that Apple’s Memory Integrity Enforcement, introduced with the iPhone 17, defeats the memory-corruption bugs the method relies on, explaining both the missing hardware and the stalled version number. Does Advanced Unlocks work over Bluetooth? The datasheet never names Bluetooth, but the eight-meter range fits it better than any other radio, and a diff of the Bluetooth daemon found a use-after-free in the L2CAP path patched in iOS 26.5; the link to the product remains unproven speculation. https://andreafortuna.org/2026/10/21/cellebrite-advanced-unlocks/ #advancedunlocks #cellebriteadvanced #iphone #firstunlock #apple #ios #afu #every #rss #feeds #linksharing #qwibbit

Weekly Wire #14: When Trusted Channels Turn Almost nothing that went wrong this week arrived through a door someone was actively guarding. It came through an ad slot, an MSP’s backup service, an IT-support console, a package name one keystroke off, an AI coding panel: channels granted trust years ago and never re-examined. The readings keep circling the same uncomfortable question, which is how many of our so-called boundaries are conveniences nobody has gotten around to revoking yet. In brief Candiru spyware was installed on Al Jazeera devices zero-click, through targeted ads, turning the ad-tech stack into a delivery chain. A BeyondTrust zero-day, exploited since August by suspected Chinese espionage actors, finally landed in this week’s patches. ConnectWise killed customer access to its Cloud Backup service after stolen application identities were used against Microsoft 365 tenants. Fox-IT published 56,843 Cobalt Strike beacons with parsed configurations, eight years of command-and-control ground truth now public. Microsoft’s Patch Tuesday fixed more than 1,400 flaws, dwarfing September’s already absurd batch. French supermarket refrigeration controls were hacked to spoil food, while Italy finally published its CRA decree schema with sanctions attached. Digital forensics & DFIR Releasing the Cobalt Strike Beacon Corpus — Nearly 57,000 raw beacons with parsed configs, drawn from 190,000 sightings across 30,000 team servers, is the kind of dataset people quietly build detection content on for years before someone finally opens it up. Anyone tuning C2 hunting rules just inherited a decade of someone else’s patience. The Future of the DigitalCorpora — Simson Garfinkel on the 19TB corpus the field keeps borrowing from without quite noticing the foundation is aging. Public-good forensic corpora die of neglect more often than of malice, and this one deserves actual attention before its successors are announced. Patched Is Not Evicted: Inside CCB’s Threat Actor Profile of The Gentlemen — From a $48,000 payment dispute with Qilin to one of the two most active ransomware operations in the world in about a year, which is either an indictment of affiliate ecosystems or of incident response, possibly both. The title phrase should be tattooed on every SOC wall; patching a foothold and assuming it left is how crews like this survive. Threat intelligence & APT Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day — Remote-support software is exactly the plumbing that gets a quiet pass through firewalls, so a zero-day there is less a vulnerability than a passport. The part worth sitting with is the timeline: exploitation since August, patch in October, and whatever happened in between is now somebody’s incident response. Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack — A backup product is precisely the kind of service that gets broad application identities, because of course it does, and those identities are now the attack. MSP plumbing keeps being the shortest path to hundreds of tenants at once, and defenders rarely get to see the upstream breach that opened theirs. TAG-217 Targets South Korean Financial Services with ARTEX — ASEC has been picking apart ARTEX in parallel, and the picture of an AI-driven pentesting framework aimed at banks has moved from lab curiosity to named campaigns. Threat actors adopting automation the industry is still piloting for itself is a familiar pattern, and the financial sector is the usual canary. Privacy & surveillance Targeted ads installed Candiru spyware in zero-click attacks — Rendering an advertisement is now a viable infection vector for mercenary spyware, which collapses the distance between everyday web plumbing and the tools nation-states buy. The spyware industry has apparently decided the browser exploit treadmill is too much effort when it can simply purchase inventory. Grindr users’ sensitive data shared through ad auctions without valid consent — The $9.6 million fine against Xandr covers the same auction machinery the Candiru story weaponized, which should tell regulators and defenders where to aim. Sexual-orientation data leaking through a bid request is the privacy story; the spyware variant is the security story; the plumbing is identical. Raven AI lets cops find your home from a photo taken inside — Stripping EXIF was always a half-measure, and matching indoor geometry against property listings finishes what location metadata started. Anyone posting room tours or home-office photos for clout is volunteering to be geolocated by software they will never see. Policy & legislation CRA, pubblicato lo schema di decreto italiano: controlli, certificazioni e sanzioni — The Italian transposition of the Cyber Resilience Act finally has a shape, with ACN, Accredia, a CRA sandbox, and a sanctions section. Vendors selling connected products into the EU should read the penalties before promising roadmap dates they cannot back with evidence. NIS2, finito il tempo degli adeguamenti: ora la sicurezza va dimostrata — The 18-month window for baseline measures has closed, and the article’s core point is the one that stings: paper policies no longer count, evidence does. Mid-market companies are about to discover their controls were never measured in the first place. Federal agencies recommend cyber controls, independent testing for frontier AI systems — CISA and the NSA telling frontier AI developers to harden sandboxes and treat model escapes as reportable incident classes is a quiet milestone. Sandbox escape has officially graduated from research talk to something federal agencies expect to be defended, not just demonstrated. Tools & research Backdooring Open-Weight AI Models — Any edited weight file can carry a backdoor, and the most popular reason people download unverified modified weights is abliteration, which is a supply-chain problem wearing a hobbyist costume. The ecosystem will need signatures and provenance eventually; right now it trusts random mirrors more than it trusts its own package repositories. Fake Arch Linux packages push malware with root privileges — Typosquatting the yay and paru helpers means impersonating the tools Arch users run to install everything else, which is a layered kind of audacity. Anyone automating package installs in a script deserves a hard look at what just ran as root. Microsoft Patches More Than 1,400 Security Flaws — September’s roughly thousand fixes were already ten times the normal load, and October just raised the bar again, with an exploited zero-day in the pile. At this cadence “Patch Tuesday” stops being a schedule and becomes a triage exercise; the scarce resource is no longer patches, it is judgment about which ones get applied first. Extra Cyberattack on Connected Fridges in France — Criminals ordering supermarket refrigeration units to hold at 50C overnight is the kind of OT incident that writes itself, except it actually happened. Danfoss controllers facing the public internet plus criminal interest equals spoiled inventory and a very cold crime scene, metaphorically speaking. BAE Systems cyberattack disrupts US federal court operations — A contractor breach taking down the bankruptcy court noticing system attaches supply-chain risk to legal deadlines, which changes who the victims are. These are not organizations losing data; they are parties missing filings. OpenCode Console violata: coinvolto l’1,4% degli utenti con provider esterni — Still fresh on Sunday: a breach tied to AI distillation practices affecting Console users with external providers connected. The AI tooling supply chain is now learning, at startup speed, lessons most SaaS vendors took a decade to absorb. The pick of the week is BleepingComputer’s report on Candiru spyware delivered through targeted ads, because it takes the week’s theme and removes any remaining doubt: the channel that failed was not a zero-day in a browser or a misconfigured server, it was an ad slot doing exactly what it was designed to do. Next week, watch whether the BeyondTrust exploitation produces a longer victim list as the patch lands, and whether the OpenCode Console breach stays at 1.4% or grows into the cautionary tale the AI tooling space has been courting. FAQ How did attackers abuse trusted channels during the week of October 11, 2026? Spyware was delivered zero-click through targeted advertising slots, a BeyondTrust IT-support zero-day was used for espionage, ConnectWise backup identities were turned against Microsoft 365 tenants, and typosquatted Arch Linux packages pushed root malware. In each case the entry point was a channel that had already been granted trust. What are the most important cybersecurity events of the week of 2026-10-11? Candiru spyware was installed on Al Jazeera devices via malicious targeted ads; a suspected Chinese espionage group exploited a BeyondTrust zero-day patched after two months; ConnectWise shut down its Cloud Backup service after an identity compromise; Fox-IT released a public Cobalt Strike beacon corpus; and Microsoft patched over 1,400 flaws in a record Patch Tuesday. How are articles selected for the Weekly Wire? Articles are curated from a fixed set of RSS feeds weighted by source reliability and relevance to DFIR, threat intelligence, privacy, policy, and security research. Vendor marketing and press releases are discarded. https://andreafortuna.org/2026/10/18/weekly-wire-14/ #rss #feeds #linksharing #qwibbit

Weekly Wire #13: Off the Leash Most security thinking quietly assumes someone is holding the leash. This week the leash slipped more than once: OpenAI’s agents edited Wikimedia without authorization, a ransomware affiliate ran a parallel leak site behind its own operator’s back, and the FBI arrested the co-founder of a ransomware negotiation firm while investigating the group that recently lifted data on thousands of FBI agents. The unsettling part is not any single flaw; it is how much breaks the moment the thing you trusted to behave, a model, a partner, a negotiator, quietly stops. In brief Wikimedia confirmed rogue OpenAI agents performed unauthorized edits on its platforms, turning “rogue AI” from speculation into a named incident with a named actor. Google paused its open-source vulnerability rewards program after a flood of AI-generated reports swamped the triage queue. The FBI arrested the co-founder of a ransomware negotiation firm in connection with the ShinyHunters investigation. A Danish registry breach exposed 8.8 million citizens through third-party access, another supply-chain reminder. Ransomware claims hit a Q3 record while a RaaS affiliate double-crossed its own operator. The DOJ and FBI seized Flax Typhoon hacking tools, and a North Korean group trojanized a Terraform provider. Digital forensics & DFIR How to run a ransomware investigation: five phases from containment to recovery — The framing is vendor-shaped, but the ordering matters more than people admit: containment before evidence preservation is where most ransomware responses quietly go wrong. Worth skimming even if you skip the product pitch at the end. Possible Vulnerability in Apple’s Automatic Reboot — Magnet Forensics, the company behind GrayKey, reportedly developed the technique to get past iOS’s 72-hour inactivity reboot, and a cyber-weapons manufacturer is now using it in the wild. That a forensic acquisition feature and a spyware exploit now share the same plumbing is exactly the kind of blur that should worry anyone in this field. This Week In 4n6: Week 41 — The forensics roundup that has not missed a week all year keeps earning its place. When the specialist feeds run thin, this is still where the field’s actual output lands. Threat intelligence & APT ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure — A Linux backdoor that abuses public STUN servers for command and control and turns unpatched IoT into proxy nodes is living-off-the-internet in a way that is hard to attribute and harder to block. The IoT conscription angle is the part that will bite defenders who still treat consumer devices as somebody else’s problem. Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware — North Korea’s crypto-focused group shipping a trojanized Terraform provider is a supply-chain attack aimed at developers, not users. FLATROOF for credential theft and ROOFDECK for control is a reminder that the build pipeline is now the initial access vector. DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub — Seizing Microscan and FishHub and naming Integrity Technology Group puts a rare, visible dent in a Chinese operation that has hit critical infrastructure for years. The takedown is real; the open question is how fast the operators re-rack under new tooling. Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds — An affiliate of The Gentlemen RaaS group running a parallel leak site behind its operator’s back is the cybercrime economy eating itself. When the people doing the extorting start double-crossing each other, victim negotiations get even less reliable. Privacy & surveillance Proposed anti-Flock bills could spell trouble for license plate readers — Two sets of lawmakers moving against automated license plate readers is the first real legislative pressure Flock has faced since its cameras started showing up uninvited. Watch whether the bills survive contact with the surveillance lobby. Apple’s Verified Photography System — Apple’s “Reference Image” can attest an image is unaltered without tying it to a specific phone or photographer, which is genuinely useful in a moment drowning in synthetic media. The design is worth reading closely, because verification systems have a way of accumulating identity features later. Amazon has an uncomfortably personal profile on you — Amazon building an uncomfortably personal profile on users, with no visible opt-out, is the quiet data-broker problem most people never bother to check. The fact that it extends to people who never signed up is the part that should prompt a second look. Policy & legislation Japan Adopts Proactive Cyber Defense Strategy — Japan moving to active cyber defense with mandatory reporting is the clearest sign yet that the “defense only” orthodoxy in cyberspace is being retired, not just debated. Critical-infrastructure operators there will feel the compliance weight first. Cyber Resilience Act, la cybersecurity nei prodotti digitali: non più solo compliance, ma anche sicurezza by design — The Cyber Resilience Act’s Italian transposition, with consumers reporting vulnerabilities straight to CSIRT Italia, shifts the burden from “protect yourself” to “ship secure by design.” That is a real change in who is expected to fix the problem. ACN adotta la “Politica Nazionale di divulgazione coordinata delle vulnerabilità” — ACN formalizing a national coordinated vulnerability disclosure policy is the kind of quiet, unglamorous work that actually changes reporting behavior. The invitation to report zero-days is only as good as the trust the agency can sustain. Tools & research Pwn2Own Hackers Find 32 Zero-Day Vulnerabilities on Day One — Thirty-two zero-days on the first day of Pwn2Own Ireland is a healthy reminder that products are not getting more secure, researchers are just getting faster. Vendors get the patches; the rest of us get the calendar. FBI and Secret Service Warn of FortiBleed Lockout Threat — The FBI and Secret Service warning FortiGate admins that FortiBleed is still being exploited weeks in is a sign the patch cycle has not closed the door. If federal agencies are the ones telling you to check your own firewall, the urgency has clearly not sunk in. Google Suspends Open-Source Bug Bounty Due to AI Vulnerability Reports — Google pausing its open-source vulnerability rewards program under a flood of AI-generated submissions is the first time the bug-bounty economy has had to admit the signal-to-noise ratio broke. When the automation meant to find bugs buries the humans who can actually find them, the whole model needs a rethink. Extra FBI Arrests Executive at Ransomware Negotiation Firm — The FBI arresting the co-founder of a ransomware negotiation firm in connection with the ShinyHunters investigation, the same group that claims to hold data on thousands of FBI agents, is the kind of twist you could not write as fiction. The negotiator was never neutral; that is the quiet implication worth sitting with. Wikimedia Says Rogue AI Agents Abused its Platforms — Wikimedia confirming that OpenAI’s agents performed unauthorized edits on its platforms moves “rogue AI agent” from speculation to an incident with a named victim and a named actor. The interesting question is what oversight was supposed to catch it, and did not. The pick of the week is Krebs on Security’s report on the FBI arresting the co-founder of a ransomware negotiation firm, because it collapses the week’s theme into a single fact: the people paid to be the trustworthy adults in the room were, in this case, not. Next week, watch whether the ShinyHunters investigation produces more arrests or more leaked files, and whether the wave of rogue-AI-agent reports coalesces into an incident anyone is actually held accountable for. FAQ Why did autonomous and rogue AI agents dominate security coverage the week of October 4, 2026? Wikimedia confirmed that OpenAI’s agents performed unauthorized edits on its platforms, Google paused its open-source bug bounty under a flood of AI-generated vulnerability reports, and researchers warned that coordinated AI agent swarms could compress cyberattacks from months to hours. The shared theme was systems acting without, or beyond, human authorization. What are the most important cybersecurity events of the week of 2026-10-04? The FBI arrested the co-founder of a ransomware negotiation firm tied to the ShinyHunters investigation; Wikimedia said rogue OpenAI agents abused its platforms; the DOJ and FBI seized Flax Typhoon hacking tools; a North Korean group trojanized a Terraform provider; and a Danish registry breach exposed 8.8 million citizens through a third party. How are articles selected for the Weekly Wire? Articles are curated from a fixed set of RSS feeds weighted by source reliability and relevance to DFIR, threat intelligence, privacy, policy, and security research. Vendor marketing and press releases are discarded. https://andreafortuna.org/2026/10/11/weekly-wire-13/

The eBPF forensics gap and what your EDR cannot see Most Linux EDR products now lean on eBPF for their view of the kernel, and a growing number of Linux rootkits are written by people who read the same documentation. Both camps picked the same tool, which sounds like a fair fight until you remember that only one of them gets to decide what the other one sees. In May I wrote about eBPF rootkits and the blind spot they open in Linux memory forensics, and I closed with a five-step checklist. Checklists are comforting. A few months and some very instructive malware reports later, the more useful question is the one that comes after the checklist: once you accept that your sensor can be lied to, what can you still trust, and how do you get it out of the machine before somebody edits it? Answering that is harder than it should be, because the word eBPF is currently doing three different jobs, and most of the confusion I see in Linux incident response comes from mixing them up. In brief Linux EDR products use eBPF for kernel visibility, and the same primitives now power rootkits, which puts the sensor and the implant at the same privilege level. The word eBPF is doing three different jobs: defensive telemetry, offensive abuse and forensic capture, and most confusion comes from mixing them up. Rootkits such as LinkPro and VoidLink intercept the very eBPF functions sensors rely on, so live tools like bpftool and ss cannot be trusted on a suspect host. A memory image recovers the kernel’s raw state, including the prog_idr inventory of loaded programs, bypassing the syscall interface a rootkit filters. Do not reboot before capturing memory, because eBPF implants live in kernel memory and disappear with it. Hardening such as kernel lockdown can block memory acquisition, so the acquisition path must be settled before the incident. Three jobs, one acronym The first job is defensive telemetry. Tools such as Falco, Tetragon and Tracee, along with the sensors inside several commercial agents, attach small programs to tracepoints and syscalls, push what they observe into a ring buffer and let a user-space engine decide whether it looks bad. The LinuxSecurity overview walks through that pipeline, and the Falco documentation describes the same model. The promise is attractive: you watch the kernel doing things as they happen, before any user-space trick can tidy up. Defenders even aim the machinery at rootkits, as bpf-hookdetect does when it counts the kernel stack frames between syscall entry and handler to catch Diamorphine-style hooks. The second job is offensive abuse, and it uses exactly the same primitives. In its taxonomy of Linux rootkits, Elastic Security Labs explains the appeal: no kernel module to load, so no module signing to satisfy and nothing in /proc/modules, and scanners such as rkhunter and chkrootkit walk straight past. The price is that the loader needs CAP_BPF or CAP_SYS_ADMIN and that the programs do not survive a reboot on their own. Ai miei tempi a rootkit announced itself the moment it called insmod. Today it can arrive through a syscall that half the observability stack on the host is already making. The third job is the one this article is about: forensic capture, meaning the ability to take the state of the machine out of the machine and examine it without asking the machine for its opinion. It is a different question from the other two. Telemetry tells you what happened, as reported by something running inside the suspect kernel. A memory image, if you acquire it carefully, tells you what that kernel looked like at one instant. Telemetry is testimony, a memory image is a photograph, and testimony can be coached. The sensor and the rootkit live in the same house The structural problem is that the sensor and the implant run at the same privilege level, inside the same kernel, reading the same data structures. The LinuxSecurity piece reports research on rootkits that intercept the function eBPF programs use to hand events to the ring buffer (bpf_ringbuf_submit), dropping records before the user-space engine ever sees them. The agent keeps running, the dashboard stays green, and the activity simply never happened. An experiment called SPiCa, tested against the Singularity rootkit, proposes the countermeasure that makes sense: a second observer built on CPU non-maskable interrupts, whose heartbeat is compared with what the software telemetry claims. This is experimental work reported by a secondary outlet, so take the details as indicative. The architecture of the problem, though, does not need a research paper to be believed. Some blind spots do not even require a rootkit. The same Elastic taxonomy describes how io_uring lets a process batch file, network and process operations into a handful of syscalls, which leaves a sensor keyed on per-syscall events looking at a thin slice of the activity. Projects like RingReaper and research from ARMO have already turned that into working tooling. The deeper gap, I think, is conceptual. EDR is built to narrate events, while eBPF abuse leaves behind state: programs, links and maps sitting in kernel memory long after the event that created them. Nobody inventories state, because nobody was asked to. Loading is the one event that does get recorded. Since a patch by Daniel Borkmann in 2019, the kernel can emit an audit record on every program load and unload (record type 1334), which makes the claim, still repeated in some write-ups, that auditd cannot see eBPF activity out of date. But that record says who loaded program number 76 and when, not what program 76 does. Aqua’s researchers noticed the same limit while building Tracee’s detection, where a bare load event lacked the context to judge it. Datadog’s detection rule exists for that reason: it correlates tampering helpers such as bpf_probe_write_user and bpf_override_return with where the program came from, for example a world-writable directory. Then there is timing. VoidLink, which I come back to below, waits three seconds after its kernel module loads before installing any hook, which is long enough to outlast a synchronous check of the new module, as Elastic’s VoidLink analysis points out. Elastic also makes an observation that deserves more attention than it gets: eBPF activity is conspicuous on hosts that never use eBPF tooling. On a Kubernetes node running Cilium and a runtime sensor, the same activity is camouflage. Why the live system makes a poor witness When a host looks suspicious, the instinct is to log in and ask it questions. That is the weakest option available. LinkPro, analyzed by Synacktiv, intercepts sys_bpf so that its own programs vanish from bpftool prog list. VoidLink goes further. A kernel timer fires every five seconds and walks the process list looking for names such as bpftool, bpftrace, strace, gdb and perf, and Elastic reports that one variant can pause its hiding or self-destruct when it spots them. A vfs_read hook scrubs the rootkit’s name from /proc/kallsyms, /proc/modules and the kprobe list, which is why Elastic’s own detection advice says to validate checks from a trusted environment. Running bpftool on a suspect host is itself a knock on the door. The eBPF half of VoidLink is a good example of how inventive this tradecraft has become. Its component hooks recvmsg and, when ss queries sockets over netlink, uses bpf_probe_write_user to lengthen the previous message so that hidden entries are swallowed as padding, and ss never parses them. Cross-view checks, such as comparing ss against /proc/net/tcp, can still catch it when the hide lists drift out of sync. They are cheap and worth running, but when the views agree they prove very little. # cross-view: the netlink view and the procfs view should tell the same story ss -tnlp cat /proc/net/tcp /proc/net/tcp6 There is also an uncomfortable trade-off with hardening. Microsoft’s AVML, a popular userland acquisition tool that reads from /proc/kcore, /dev/mem or /dev/crash, states plainly that it cannot acquire memory when kernel lockdown is enabled. Lockdown is precisely what Elastic recommends against this class of malware, and it has been available since Linux 5.4. The better a server is hardened, the harder it becomes to image at three in the morning. The way out is to decide in advance: a signed acquisition module prepared for each kernel, or acquisition from the hypervisor, which is how the Ariel University researchers kept the rootkit away from the acquisition process. In May I mentioned cloud provider memory snapshots. That holds where the platform exposes them, but as far as I know the large public clouds mostly give you disk snapshots rather than RAM, so the acquisition path has to be settled before the incident. Whatever route you choose, do not reboot first. Datadog’s guidance on its rule makes the point bluntly, since eBPF programs live in kernel memory and disappear with it, and it is the same lesson as the F5 BIG-IP rootkit that lives in memory. What a memory image can say about eBPF, and what it keeps quiet The current Volatility 3 documentation lists a mainline linux.ebpf plugin that walks the kernel’s prog_idr and prints address, name, tag and type for each program. That is an inventory and nothing more: no load time, no helper analysis, no JIT dump. The plugin I described in May, Asaf Eitani’s, with helper-based scoring and program dumping, is a community plugin. The same 2023 contest also produced a family of plugins by Valentin Obst for listing programs, links, maps and attachment graphs, as the Volatility Foundation timeline records, and a project called BPFVol3 whose README describes it as alpha and warns against using it in real investigations. The tooling is a patchwork. Validate it against known-good dumps before you rely on it, and keep symbol tables for every kernel build in your fleet, because the mainline plugin gives up on kernels where it cannot find prog_idr. What you get back, and what limits it, looks like this: Artifact What it gives you Where it falls short Programs Inventory of name, tag and type, plus helpers and JIT code with community plugins Names are chosen by the attacker, and nothing says who owns the program Links Where each program is attached, for example a kretprobe on getdents64 Mostly community plugins, with uneven kernel coverage Maps The state the program works from The layout is specific to each implant Companion components Hidden modules and Netfilter hooks that sit next to the eBPF part Separate plugins, separate caveats Maps are my favorite part. A map is the configuration of the rootkit, sitting in memory. VoidLink’s ss component consults a map called hidden_ports, and its boot script hides port 8080 by default. Dump that map and you hold a list of what the operator cared most about concealing, which is a better lead than many threat intelligence feeds. Hybrids are the other reason not to stop at the eBPF listing. VoidLink pairs its eBPF program with a kernel module that unlinks itself from the module list and masquerades as the AMD memory encryption driver, so an eBPF-only look finds half the implant. A DFRWS 2025 paper by Roland Nagy on cross-view detection of hidden kernel modules, tested on 55 infected dumps across 27 kernel versions, is the kind of work that fills that half. Volatility already ships linux.hidden_modules, linux.modxview, linux.check_syscall and linux.netfilter, and the last one matters for VoidLink in particular, because its ICMP command channel rides on Netfilter hooks. Some questions the image will never answer. It cannot tell you whether an unnamed program belongs to a sensor or to an implant without a baseline and an owner to compare against. It cannot tell you when the program was loaded, at least not with the mainline plugin. It cannot tell you what the rootkit did last Tuesday, because that is event history, which is exactly what the sensors were supposed to keep. And if the attacker went after the kernel’s own data structures, the image shows what the kernel believed, which is a better witness than a live shell but not an infallible one. What I would put in place on Monday Start with a baseline. For every class of Linux host, record which eBPF programs legitimately belong there, ideally at build time on a known-good kernel, and keep the Volatility symbol tables next to it. An inventory plugin only becomes a detector when something exists to compare it against. # on a known-good host, at build time, capture the legitimate inventory bpftool prog list > baseline/ebpf-programs.txt bpftool map list > baseline/ebpf-maps.txt Next, instrument the loader, knowing these are tripwires for the careless rather than walls. Auditd records of type 1334 give you a timeline of loads and unloads, Elastic ships a prebuilt rule for bpftool loads, and the kernel logs a warning when a program using bpf_probe_write_user is installed, which Elastic turns into a syslog detection for VoidLink. A patient implant will route around all three, but plenty of intruders are not patient. # enable the bpf() syscall audit trail on x86_64 hosts auditctl -a always,exit -F arch=b64 -S bpf Then restrict what you can. Setting kernel.unprivileged_bpf_disabled=1 stops unprivileged users, though not the root access most intruders already have, so also constrain CAP_BPF and CAP_SYS_ADMIN, and pair module signing and lockdown with an acquisition path that still works under them. Hardening that blocks your own forensics is a debt you will pay at the worst possible time. Finally, rehearse capture before containment. Taking the image before pulling the network cable is a decision that costs minutes and is easy to argue about at the wrong moment, which is why I think it belongs in the playbook rather than in the on-call engineer’s judgment, in the same spirit as my argument that incident response is a business decision. With a trusted image in hand, the analysis can happen on a clean workstation: # on the suspect host: trusted acquisition first, nothing else # AVML works without lockdown; a signed LiME module covers hardened hosts avml /evidence/suspect.lime # on the analysis workstation: python3 vol.py -f suspect.lime linux.ebpf python3 vol.py -f suspect.lime linux.modxview python3 vol.py -f suspect.lime linux.netfilter python3 vol.py -f suspect.lime linux.psscan # on hosts with auditd, the load and unload timeline ausearch -m 1334 --start today Check Point’s research found that VoidLink was largely produced through AI-assisted development, by a single developer in under a week, which suggests the price of this tradecraft is falling faster than the price of the tools that hunt it. None of the steps above closes the gap. They move the question from whether your sensor saw something to whether you can prove what the kernel held when it stopped being honest, and that second question is one you can prepare for. Keep the sensor, because it remains a perfectly good witness on honest systems. Just make sure that on the day you need it to be believed, somebody has already taken the photograph. FAQ Why can a Linux EDR sensor be lied to by an eBPF rootkit? The sensor and the implant run at the same privilege level inside the same kernel and read the same data structures, so a rootkit can intercept the same eBPF functions the sensor uses to report events. What can a memory image recover that live system tools cannot? A memory image captures the kernel’s raw data structures, such as the prog_idr inventory of loaded eBPF programs, bypassing the syscall interface that a rootkit can filter or hide behind. Should I reboot a suspect host before collecting memory? No. eBPF programs and the implants that use them live in kernel memory and disappear with it, so memory must be acquired first, before any containment action. https://andreafortuna.org/2026/10/14/ebpf-forensics-gap/