Daily notes

n8n patched a bug in their Enterprise token exchange feature that let attackers log in as other users without passwords. The flaw ignored the JWT issuer claim, matching users on subject alone. Strix's AI security agent found it.

A Rust-rewritten botnet is hijacking routers, IP cameras, and Android boxes for DDoS attacks. RustDuck uses CVE-2017-17215, CVE-2025-29635, and other old vulnerabilities that should have been patched years ago.

Microsoft released 570 patches for July's Patch Tuesday, nearly triple last month's record. Two zero-days are under active attack, including an AD FS privilege escalation flaw. AI is now finding bugs faster than humans can patch them.

2,000+ publicly accessible vibe-coded applications holding sensitive corporate data. Shadow Builders are bypassing every security control you've built. This is the enterprise defense playbook for a problem most organizations haven't acknowledged exists yet.

The world's largest AI model repository was breached using a malicious dataset. Attackers exploited vulnerabilities in Hugging Face's dataset processing to gain code execution, then escalated to steal cloud credentials from internal infrastructure.

Researchers found a way to steal GitHub OAuth tokens through VS Code extensions using webview panels. The attack bypasses GitHub's token binding and could give attackers persistent access to private repositories.