New Cryptographic Context Injection technique bypasses AI guardrails via AES-encrypted payloads, leaking full Grok chat histories zero-click Adversa AI researcher Rony Utevsky devised a new attack technique, called Cryptographic Context Injection, that bypasses AI safety filters by sending instructions as AES-encrypted ciphertext and tricking the model into decrypting them inside its own code execution runtime. The technique was demonstrated against two live production systems: xAI’s Grok and Google’s Gemini. “Cryptographic Context Injection hides malicious instructions inside AES-encrypted text so guardrails can’t read them, then tricks the AI into decrypting and trusting them as its own.” reads the report published by Adversa AI. “In Grok, an ordinary “summarize this page” steals the user’s chat data with no click or warning. In Gemini, it produces content the model normally refuses. Both are live production systems.” The Grok case is the more serious of the two. A user asks Grok to summarize a webpage containing an encrypted payload and instructions to decrypt it. Grok visits the page, decrypts the payload in its Python sandbox, and follows the hidden instructions. It then accesses the user’s private session data, including their name, location, subscription plan, and full chat history, and puts this information into a URL that it opens automatically. The user receives no warning and does not need to click anything. The key technical distinction from earlier cipher-based prompt injection work is what happens during decryption. “Static safety guardrails classify inputs as text; they do not execute them. An attacker ships ciphertext along with the key material and an instruction to decrypt it, and the model runs that decryption inside its own code execution sandbox.” continues the report. “Everything a guardrail’s scanner would need is right there on the page, but recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time. “ Prior techniques like CipherChat and CodeChameleon used substitution ciphers, XOR, or base64, schemes the model can decode natively in its own context without an interpreter. AES-256-GCM can’t be decoded that way. Recovery requires the runtime, and that’s the channel the attack depends on. Once the runtime decrypts the payload, the attacker’s instructions appear as the output of code the model just ran, not as untrusted external content. “The runtime execution launders attacker-controlled data into trusted instructions the agent will act upon. That is how the attack got its name: cryptography helps fabricate trusted context for the agent.” states the report. “The same cryptographic backbone works whether the injection is direct or arrives indirectly, for example through the browsing channel.” The attacker payload inherits a credibility the same text would never get if pasted directly into the prompt. The Grok demo hides the data theft behind what looks like a normal request. The payload tells the model to create a “decryption key,” but the key is actually a template containing the user’s private data, such as their name, location, subscription tier, and chat history. Grok then uses this information as a URL parameter when opening an attacker-controlled website to “fetch additional context.” The data is sent through the URL as part of a seemingly normal web request. Adversa said the attack was still reproducible on August 19, 2026. Adversa traces the structural problem to Grok’s agentic framework, not to any model-layer failure. The framework lets instructions from an untrusted external page drive the invocation of a privileged, internet-connected tool. It allows private session metadata and conversation history to be resolved into the inputs of outbound calls. It enforces no egress boundary or consent gate on that path. Adversa’s description maps cleanly to SQL injection: a system that can’t distinguish its own trusted state from attacker-supplied data flowing through the same channel. The Gemini case uses the same basic trick but in a different way. A prompt asks Gemini to run a Python script that decrypts some data and returns a small JSON result. Instead, the decrypted data contains a fake Python error message with hidden instructions designed to bypass Gemini’s safety rules. Because Gemini treats the sandbox output as trusted context, those instructions can influence its behavior. Adversa used the technique to make Gemini generate detailed instructions for building an incendiary device. A modified version also exposed Gemini’s system instructions. Adversa reported the Grok issue to xAI on June 3, 2026, but received no further response after the initial acknowledgment. The attack was still working shortly before publication. The Gemini issue was not formally reported because Google’s bug bounty excludes jailbreaks. Adversa said Gemini’s vulnerability rate has nevertheless dropped sharply since June. For defenders, Adversa’s guidance is that nothing about this attack requires a fix at the model layer. Every control that bounds it sits in the harness around the agent. Untrusted content should be processed in a context with no tools and no credentials, returning only structured data to the privileged context. Outbound network calls and writes outside the workspace should require explicit confirmation with fully resolved arguments visible before approval. Per-session tool traces with resolved arguments should be logged, because without them there’s no forensics and no detection. Detection should alert on sequences, not individual payloads: untrusted content enters context, code executes, agent contacts a host outside its normal dependency graph. That chain is the signal, not any single ciphertext blob. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Cryptographic Context Injection)
Windows named pipes provide fast interprocess communication, but weak access controls can expose privileged services to untrusted processes. ThreatLocker explains how endpoint verification, command authorization, strict input validation, and narrowly scoped privileges can help secure named-pipe communication.
A critical flaw (CVSS 9.4) in NASA/JPL’s AIT-GUI let anyone send unauthenticated commands to spacecraft instruments. Cycode researchers found that AIT-GUI, the browser-based operator console in NASA/JPL open-source AMMOS Instrument Toolkit, shipped with no authentication, no session checks, and no CSRF protection on any of its state-changing endpoints. “AIT-GUI, the web front end of NASA/JPL’s open-source AMMOS Instrument Toolkit, starts an HTTP server with no authentication, no authorization, and no CSRF protection on any of its state-changing endpoints.” reads the report published by Cycode. “Anyone who can reach the port, or any website an operator merely visits in a browser, can: Issue arbitrary commands via POST /cmd Run server-side scripts via POST /script/run Execute command sequences via POST /seq“ The vulnerability is tracked as GHSA-p9r8-2q67-fp86, rated Critical (CVSS score of 9.4), and fixed in AIT-GUI 2.5.2. AMMOS (Advanced Multi-Mission Operations System) is an open-source framework used by NASA/JPL and other missions to control spacecraft and instruments, send commands, and process the data they send back. AIT-GUI is the web interface operators use to do this in real time. Sending a command through this software is not like filling out a simple online form. The vulnerability isn’t one thing. It’s four ordinary web weaknesses that compose into something with unusual consequences. The first is that the server reads its configured host setting into a variable and then ignores it, binding instead to 0.0.0.0, which means all network interfaces. An operator who sets host: localhost to keep the console on the loopback gets a server exposed to the entire reachable network anyway. The second and third weaknesses follow from the first. There’s no login requirement, no session gate, no CSRF token, and no cross-origin restriction on any route. POST /cmd takes whatever arrives in the command field, parses it, and hands it directly to the command bus: no check, no validation, nothing between the network and the hardware. The fourth weakness lives on POST /seq and POST /script/run, which build filesystem paths by joining raw user input onto a root directory with no confinement. A seqfile value of ../../../../something resolves outside the intended sequence directory. The researchers note that the correct confinement check already exists in the same codebase, on a sibling route called /scripts/load; the safe pattern was already written, just not applied consistently. The CSRF risk is especially serious because a firewall does not stop it. Browsers can send certain form requests from another website without first checking with the target site. So, if an operator opens a malicious page in the same browser they use for the console, it could send commands such as POST /cmd, POST /seq, or POST /script/run. The attacker does not need direct access to the system or its network port—they only need the operator to open a malicious link. Cycode’s research team used a combination of AI-assisted code analysis and human validation to find and confirm the issues. The AI handled the initial codebase review, flagging recognizable patterns: state-changing routes with no auth anywhere in their call path, user input flowing from a request parameter into a subprocess call without sanitization, and a configuration value that was read and then silently discarded. The human researcher then confirmed each pattern was exploitable and reduced each to a working proof-of-concept, including a self-contained CSRF demonstration that drove a real headless browser and recorded zero network preflights. That second step matters. A pattern match points to a candidate; a reproduced exploit confirms the finding is real. Cycode says explicitly it only reports the second kind. “More broadly: operational and ground-system software inherits the same web weaknesses as everything else, but with a far higher cost of failure. Auth, CSRF defense, and input confinement are not optional extras on a panel that commands hardware.” concludes the report. The fix is in AIT-GUI 2.5.2. Operators should upgrade immediately and verify the console port is not reachable from untrusted networks. Anyone who ran an exposed instance before the patch should treat it as a reason to audit command and sequence history, since an unauthenticated POST leaves no user-level trace by design. Maintainers hardening deployments should add authentication and CSRF protection to the command, script, and sequence routes; bind the server to the configured host instead of 0.0.0.0; and apply the existing path-confinement logic from /scripts/load to /seq and /script/run. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, NASA/JPL)
More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid. Truffle Security has been tracking this exposure for the past four years and says that 817 of the exposed keys were linked to companies, 526 of them being AWS root keys. According to the researchers, 242 of the keys are associated with Identity and Access Management (IAM) users with the AdministratorAccess policy. This role has full permissions to create, modify, delete, and view virtually all AWS services and resources within an account. They note that each key of the 768 live keys in the two sets “full control of a company's AWS account.” The company found 431,875 AWS secrets across code repositories, Git history, datasets, Docker images, registries, and CI logs and extracted 64,024 unique AWS keys that corresponded to 50,654 AWS accounts after removing duplicates.
Using the same email, phone number, payment method, and other identifiers makes it easier for data brokers and attackers to profile your activity. Anonyome Labs explains how separate digital personas can reduce correlation and limit the impact of breaches, spam, and identity theft.
Microsoft has patched a maximum-severity vulnerability in the Entra ID identity and access management (IAM) platform that has been exploited in attacks.
Toronto's Hospital for Sick Children (SickKids) says a cybersecurity incident exposed the personal information of some current and former employees and job applicants, stemming from a flaw in third-party software. Clinical systems and patient records were not affected. (264)
GitLab flaw CVE-2026-19478 is now under active exploitation, allowing unauthenticated attackers to modify or delete public projects. WatchTowr researchers warn of active exploitation of critical GitLab flaw CVE-2026-19478 (CVSS score of 9.4). This week, GitLab pushed out an emergency patch to address this flaw, which could let an attacker with zero credentials remotely modify or delete public projects and user data. “GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.” reads the advisory. GitLab issued an emergency patch on August 17, five days after its regular update. The vulnerability impacts only self-managed installations, users should upgrade to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. There’s a gap worth flagging for anyone still sitting on an older release. The available patches don’t cover the 18.2 through 18.10 branches, even though those versions technically fall inside the affected range. If you’re running anything in that window, staying put isn’t really an option; you’ll need to upgrade to a patched branch entirely rather than waiting for a fix that isn’t coming for your current one. hiimguardian reported the flaw through the company HackerOne bug bounty program. Organizations should urgently patch internet-facing GitLab servers. Until they can update, they should restrict unauthenticated access to /api/graphql, disable public repositories where possible, and check logs for requests containing @gl_introduced. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-19478)
GitLab flaw CVE-2026-19478 is now under active exploitation, allowing unauthenticated attackers to modify or delete public projects. WatchTowr researchers warn of active exploitation of critical GitLab flaw CVE-2026-19478 (CVSS score of 9.4). This week, GitLab pushed out an emergency patch to address this flaw, which could let an attacker with zero credentials remotely modify or delete public projects and user data. “GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.” reads the advisory. GitLab issued an emergency patch on August 17, five days after its regular update. The vulnerability impacts only self-managed installations, users should upgrade to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. There’s a gap worth flagging for anyone still sitting on an older release. The available patches don’t cover the 18.2 through 18.10 branches, even though those versions technically fall inside the affected range. If you’re running anything in that window, staying put isn’t really an option; you’ll need to upgrade to a patched branch entirely rather than waiting for a fix that isn’t coming for your current one. hiimguardian reported the flaw through the company HackerOne bug bounty program. Organizations should urgently patch internet-facing GitLab servers. Until they can update, they should restrict unauthenticated access to /api/graphql, disable public repositories where possible, and check logs for requests containing @gl_introduced. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-19478)
CERT Polska confirmed active exploitation of CVE-2026-73570, a critical unauthenticated RCE in Zimbra Collaboration Suite patched on July 20. CERT Polska, Poland’s national computer emergency response team, confirmed this week that threat actors are actively exploiting a critical vulnerability in Zimbra Collaboration Suite tracked as CVE-2026-73570. The flaw allows unauthenticated remote code execution and was patched less than a month ago. “The CERT Polska team informs about an actively exploited OS Command Injection vulnerability in Zimbra Collaboration Suite.” reads the advisory published by CERT Polska. “The vulnerability, identified as CVE-2026-73570 , allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of the zimbra user . The vulnerability affects instances that have the SNMP trap service enabled via the snmp_notify parameter and the swatchdog service running (enabled by default).” The vulnerability affects systems with SNMP trap notifications enabled and the swatchdog service running, which is enabled by default. The technical root cause is a sanitization failure in the SNMP monitoring component. Zimbra released version 10.1.20 on 20 July 2026 to address the issue. The fix came 28 days before active exploitation was confirmed, which is not a wide window, but apparently wide enough. The attack surface only exists when the optional zimbra-snmp package is installed and SNMP notifications are active, but swatchdog, the service that processes those notifications, is running by default on most installations. Below are recommendations by CERT Polska: “Due to the ongoing campaign exploiting this vulnerability, we recommend: verifying Zimbra logs /var/log/zimbra.log for the following entries: Service status change: <szkodliwy ładunek> changed from stopped to running Service status change: <szkodliwy ładunek> changed from running to stopped verification of files created by user zimbra in the last 30 days in the following directories: /opt/zimbra/jetty/webapps/ /opt/zimbra/jetty_base/webapps/ /tmp/ If you discover any signs of potential exploitation of this vulnerability, please contact our team immediately.” The exposure numbers aren’t reassuring. Shadowserver currently tracks over 12,100 Zimbra servers reachable from the Internet, split roughly between Europe (4,382) and Asia (4,492). That figure doesn’t distinguish between patched and unpatched instances, or between production servers and honeypots, so the real attack surface is smaller, but nobody knows by how much. CERT Polska published indicators of compromise alongside the advisory and gave administrators specific places to look. The team recommends checking /var/log/zimbra.log for service status change entries where the payload transitions from stopped to running and back, which is the signature of a malicious command being executed as a service. Admins should also check whether any files were created in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, or /tmp/ by the zimbra user in the last 30 days. Web shells dropped into those directories would give persistent access after the initial command injection. CVE-2026-73570 isn’t yet in CISA’s Known Exploited Vulnerabilities catalog, which currently lists 18 Zimbra Collaboration Suite entries, four of them added this year. The absence doesn’t mean the threat is lower; it means the catalog hasn’t caught up yet. Zimbra solutions have been targeted by nation-state actors for years. Russian espionage group Winter Vivern exploited a reflected XSS flaw in February 2023 to steal emails from NATO-aligned organizations through Zimbra webmail portals. In October 2024, US and UK agencies warned that APT29, linked to Russia’s Foreign Intelligence Service, was targeting vulnerable Zimbra servers via a credential-stealing flaw. Most recently, in March 2026, Seqrite Labs researchers documented APT28, tied to Russian military intelligence, exploiting a stored XSS vulnerability against Ukrainian government Zimbra deployments. Organizations in sectors targeted by Russian or Chinese state-backed groups should treat unpatched Zimbra servers as a high priority. CVE-2026-73570 is especially risky because attackers can exploit it without authentication, the vulnerable service is enabled by default, and many Zimbra servers are exposed online. These conditions make the flaw an attractive target for rapid exploitation. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Zimbra Collaboration Suite)
Confirm this action.
Leaving now will discard your changes.