--- title: ctxsec: security news, hunting, AI security, playbooks url: https://ctxsec.com/ --- # ctxsec context security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks. ## [Context & Harness Attacks](/context) official (Claude Code CHANGELOG, version 2.1.321, published to npm Nov 9, 2026 19:02 UTC); no advisory or CVE for these fixes at publication 2026-11-10 ### [Claude Code 2.1.321 fixes MCP OAuth sending refresh tokens to another host on redirect, plus three sandbox and permission-prompt bypasses](/items/claude-code-2-1-321-mcp-oauth-refresh-token-redirect-leak-sandbox-permission-fixes) - **Update:** run `claude --version`; you want 2.1.321 or later (2.1.322 shipped Nov 10). Auto-update users get it automatically. - **Why the OAuth fix matters:** a remote MCP server, or anything able to redirect its OAuth endpoint, could have received a refresh token meant for another host, and refresh tokens usually outlive sessions. See the tip for what to revoke. - **Separately:** the Edit-tool TOCTOU sandbox escape CVE-2026-88968 (GHSA-5xjx-9qx6-jcrv, CVSS 4.0 7.7, macOS) circulating today was fixed in 2.1.251 in August; its CVE record was published Nov 3. Sources: [Claude Code CHANGELOG (2.1.321)](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) · [npm: @anthropic-ai/claude-code](https://www.npmjs.com/package/@anthropic-ai/claude-code) · [GHSA-5xjx-9qx6-jcrv / CVE-2026-88968](https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv) official (Unit 42 threat intel post and IOC file, Nov 6 data, published Nov 10, 2026) 2026-11-10 ### [Unit 42 finds an indirect prompt injection campaign on 26 fake AI trading sites that tells AI agents to push users to invest](/items/unit42-idpi-campaign-26-investment-scam-domains-hidden-span-agent-hijack) - **Template left half-finished:** each instance names its own domain but still contains the placeholder `[naming_here]` for the platform name, which suggests a kit not fully configured. - **Tells the agent to use** persuasion triggers, authority framing, urgency and social proof, and calls any mention of alternatives a 'critical protocol violation'. - **Example domain:** `bitgrokesai[.]com`; the full list of 26 is in Unit 42's IOC file. - **For agent builders:** strip or flag hidden text (display:none, zero-size, off-screen) before page content reaches the model, and never let fetched page text change an agent's role or recommendations. Sources: [Unit 42 timely threat intel: Indirect prompt injection campaign for investment scam sites (2026-11-06)](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-11-06-IDPI-campaign.txt) · [Unit 42 on X (Nov 10, 2026)](https://x.com/Unit42_Intel/status/2120264510350991832) · [Unit 42: AI agent prompt injection research](https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/) research (Profero, Nov 8); Profero says it reported eight issues to xAI and Cursor on Aug 24, got only an automated Cursor bug-bounty reply, and that the findings still held across more than 240 sandbox builds through publication; no public vendor acknowledgment or fix statement found as of this write-up; no CVE 2026-11-09 ### [Profero: Grok Bot's hosted sandbox exposes an unauthenticated Docker API and a hard-coded exec token that turn one agent command into remote root on the account VM](/items/profero-grok-bot-sandbox-docker-api-escape-nov-8) - **What Profero describes (high level):** layer 1 is the agent sandbox container; layer 2 is the account's dedicated VM running Docker and a supervisor; layer 3 is the shared EC2 host. Profero says it could not cross into other customers' VMs. The reported path stays inside one account: sandbox → unauthenticated Docker API on the VM → privileged container with the VM disk attached → credentials copied from container config → remote use of the exec service (static auth token `local`) and the control plane's long-lived renewal credential. - **Blast radius (per Profero):** every agent on the account shares one Linux user, one filesystem and one credential set, so one bad instruction in any agent exposes imported browser sessions (saved in plaintext JSON; Chrome remote debugging also open with no auth), the gateway token that drives connected mail/files/calendar connectors, and every object in the account's persistent S3-backed store — including the ability to plant files that sync into future sandboxes. Persistence is claimed to survive vendor token rotation because a listener on the VM's plaintext proxy-to-sandbox link can collect each new per-account token. - **Entry point:** Profero treats "one command from the agent" as the premise that fails — via prompt injection on a web page the agent reads, a malicious repository, a poisoned package, or a hostile tool. No malware dropper is required once that command runs. - **"Rootkit" framing:** Profero is not claiming a kernel rootkit was shipped on purpose. It argues the exposed, unauthenticated control plane plus static secrets and plaintext management traffic behave like one: remote shell, secret theft and persistence with no login record. Eight issues were scored (several Critical on CVSS 3.1 in their table); none have public CVEs in the report. - **Disclosure (Profero's timeline):** testing Aug 22–23 on accounts they paid for; full report to xAI and Cursor security teams Aug 24; Cursor automated bug-bounty reply Aug 25; follow-ups to xAI Aug 27–28, Sep 8, Sep 18 (30-day notice), Oct 1 and Nov 8; re-tests through Sep–Oct on new builds with findings unchanged; publication in November, more than 75 days after first report. Profero says more than 240 sandbox builds shipped in that window without closing the chain. - **Vendor status as of this write-up:** we found no public statement from xAI, Cursor or Grok Bot acknowledging the report or claiming a fix. Patch status beyond Profero's own re-tests is unverified here; do not read this item as an independent confirmation that the issues remain live today. - **Why it matters beyond one product:** the failure modes Profero lists — secrets baked into images, local management APIs reachable without auth, boot scripts that grant root, management traffic forwarded in plaintext, and one shared identity for every agent — are design risks for any hosted agent sandbox, not only this one. Sources: [Profero: The Rootkit Built Into Grok Bot (Omri Segev Moyal, Nov 8, 2026)](https://profero.io/blog/the-rootkit-built-into-grok-bot) · [TLDR summary of the Profero Grok Bot report](https://tldr.tech/story/fa901c1b-f5de-40e9-a85f-ba7cafa4605d) · [Mia (@MiaAI_lab) on X amplifying the Profero report (Nov 9, 2026)](https://x.com/MiaAI_lab/status/2119840056965730389) ## [Cybersecurity News](/news) official (Barracuda Trust Center advisory, updated Nov 9, 2026, 9:00 PM EST: "We have identified exploitation activity affecting a small number of organizations"; Canadian Cyber Centre AV26-1112 Update 1, Nov 9); UPDATE Nov 10: both CVEs added to CISA KEV, federal due date Nov 13, forensic triage required 2026-11-10 · updated Nov 10, 2026, 3:55 PM ET ### [Barracuda says attackers are now exploiting the Email Security Gateway auth bypass and root command injection it patched on Nov 2 (CVE-2026-116606, CVE-2026-111560)](/items/barracuda-esg-cve-2026-116606-111560-exploited-small-number-of-orgs-nov-9) - **Exposed:** ESG appliances whose Admin UI is reachable by the attacker. CVE-2026-116606 (CVSS 4.0 9.3, ESG only) lets an unauthenticated request run admin-only handlers after a deliberately failed password change; CVE-2026-111560 (8.6) is a root command injection through the restored `system_timezone` setting and also affects Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway. - **Fix:** Barracuda patches BNSF-40425 (ESG 9.4.017 and later) and BNSF-40430 (older ESG), plus BNADC-16586, BNMA-32468, BNWF-60060 and BNYF-24789 for the other products. watchTowr tested 9.4.0.029 as fixed; the Mandiant-assigned CVE record and the Cyber Centre list ESG before 9.4.0.030 as affected, so go to the latest firmware rather than stopping at .029. - **If auto-patching was off** or the box is several firmware versions behind, Barracuda says you may need more than one update; check the version the device actually reports. - Barracuda hasn't said who is exploiting it or how it found the activity. Treat any ESG with an internet-facing Admin UI that was unpatched after Nov 5 as possibly compromised (see the hunt item). Sources: [Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities (updated Nov 9, 2026)](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) · [Canadian Centre for Cyber Security: Barracuda Networks security advisory AV26-1112, Update 1 (Nov 9, 2026)](https://www.cyber.gc.ca/en/alerts-advisories/barracuda-networks-security-advisory-av26-1112) · [Mandiant MNDT-2026-0042 (CVE-2026-116606)](https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md) · [watchTowr Labs technical analysis (Nov 5, 2026)](https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/) · [CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (Nov 10, 2026)](https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog) official (N-able status page incident 202561 and N-central 2026.4 HF2 release notes, Nov 9-10, 2026); N-able reports scanning tied to the public PoCs and no evidence of successful customer compromise; watchTowr reported exploitation attempts against honeypots; UPDATE Nov 10 evening: HF2 build 2026.4.1.26 released with seven CVEs 2026-11-10 · updated Nov 10, 2026, 7:50 PM ET ### [N-able takes hosted N-central offline and tells on-prem customers to shut their servers down after a researcher published 33 "Able2Shell" zero-days with exploit code](/items/n-able-n-central-able2shell-33-zero-days-hosted-offline-nov-9) - **Why it matters:** an RMM server can push scripts and remote sessions to every managed endpoint at every client. Huntress says the published chains include three paths to remote code execution and one to root; reported bug classes include anonymous credential theft, admin creation, XXE, XSS-to-OGNL and a stack overflow. - **What N-able says to do:** keep hosted and on-prem N-central offline until it confirms they can be restored. Ecoverse services under N-able Login (n-able.app) stay up for asset view, patching, scripting and Take Control. - **Hotfix:** N-able first targeted midday ET Nov 10. As of its latest updates on Tuesday afternoon (Rapid7 and The Hacker News relayed a 12:42 PM ET update saying validation was still under way), the release was in final validation and not yet generally available; N-able says a new status post will announce GA with upgrade guidance. Don't reconnect servers until that post exists and the server reports the fixed build. This is the fourth batch of serious N-central flaws this year, after CVE-2026-18556 in August and the exploited CVE-2026-86218 in September. - See the playbook for an RMM-outage checklist. **Update Nov 10, HF2 released:** build 2026.4.1.26 strengthens authentication and permission checks, removes legacy mobile device management, adds validation to file upload and log handling, and hardens Agent-to-Probe communication. Upgrade order matters: a Probe on 2026.4.1.26 can't talk to older Agents or PME, so upgrade Agents first, then Probes (PME is pushed automatically). Built-in remote control is temporarily disabled in this build; Take Control still works. HF2 supersedes 2026.4 and HF1 (2026.4.0.32). Patching doesn't clean a server that was exposed between Nov 8 and the upgrade, so still review logins, new admin accounts, scripts and remote sessions from Nov 8 on. Sources: [N-able status: N-central Critical Security Incident (event 202561)](https://uptime.n-able.com/event/202561/) · [watchTowr on X: exploitation attempts against N-central honeypots (Nov 10, 2026)](https://x.com/watchtowrcyber/status/2120096657366827381) · [Huntress: N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains (Nov 9, 2026)](https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains) · [The Hacker News (Nov 10, 2026)](https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html) · [Rapid7: Critical vulnerabilities in N-able N-central prompt hosted shutdown (Nov 10, 2026)](https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown/) · [IsDown mirror of N-able's N-central status post (Nov 10, 2026)](https://isdown.app/status/n-able/incidents/684305-n-able-n-central) · [N-able Status: N-central 2026.4 HF2 Release Notes (build 2026.4.1.26, Nov 10, 2026)](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/) · [Huntress: N-able disables cloud services following disclosure of Able2Shell exploit chains (updated Nov 10, 5:30 PM ET)](https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains) official (Initia on X, Nov 10, 2026 07:07 UTC); preliminary figures from Initia; full scope still under investigation 2026-11-10 ### [Initia halts its L1 again after an attacker used compromised rollup infrastructure keys to fake IBC transfers out of bridge escrow, moving about $615K off-chain](/items/initia-l1-halted-compromised-rollup-keys-fake-ibc-transfers-605k-usdc-nov-10) - This is Initia's second halt in under three weeks, after the Oct 23 MoveVM mint exploit (about $2.7M). - The lesson for bridge and rollup operators: escrow on the hub trusts whatever the rollup's keys sign, so those keys need the same HSM, quorum and monitoring treatment as the escrow itself. - Initia warns users to ignore unofficial links and "refund" messages. Sources: [Initia on X: L1 halt statement (Nov 10, 2026)](https://x.com/initia/status/2120050740626628972) · [Initia on X: rollup infrastructure issue (Nov 9, 2026)](https://x.com/initia/status/2119875372183703612) ## [Threat Hunting](/hunting) detection guidance built from watchTowr's published exploit chain (Nov 5, 2026) and Barracuda's advisory; Barracuda has not published IOCs from the exploitation it observed 2026-11-10 ### [Hunt: Barracuda ESG exploitation looks like a failed admin password change plus a backup upload to /cgi-mod/index.cgi](/items/hunt-barracuda-esg-cgi-mod-bayesian-upload-backup-restore-timezone-injection) - **Web/proxy logs in front of the Admin UI:** POSTs to `/cgi-mod/index.cgi` from addresses outside your admin ranges, especially multipart bodies containing `new_password`, `retype_password`, `pu_bayesian_upload` or `bayesian`, and responses carrying "Error: Password Change". - **Appliance audit log:** `failed_password_change` entries for admin that nobody made, followed by a configuration restore you didn't run. - **Configuration:** a `system_timezone` value that isn't a plain zone name (look for `'`, `;`, `#` or backticks), and unexpected changes to admin accounts, relays, forwarding or allowed hosts, since a restore rewrites the global config. - **Response:** if you find hits, Barracuda Support should be your first call. Given the 2023 ESG zero-day history, don't assume a firmware update removes an implant; collect evidence before re-imaging. Sources: [watchTowr Labs technical analysis (Nov 5, 2026)](https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/) · [watchTowr detection artifact generator (GitHub)](https://github.com/watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560) · [Barracuda Trust Center advisory (updated Nov 9, 2026)](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) research (ESET, Matías Porolli, WeLiveSecurity, Nov 10, 2026); attribution to Turla is ESET's, at high confidence 2026-11-10 ### [Hunt: Turla's "Cereal" toolset hides in Exchange, taking commands on OWA/Autodiscover/ActiveSync-like URL paths and hijacking transport agents in memory](/items/hunt-eset-turla-cereal-exchange-edgetransport-native-image-cache) - **Listener paths ESET observed:** `/owa/sdds/`, `/AUTODISCOVER/PROXYSERVICE/`, `/MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/` on 443. Check HTTP.sys URL reservations and IIS/HTTPERR logs for these prefixes; bad requests get redirected to an Exchange-like error page. - **DLL hijack spots:** CerealLoader dropped as `ncobjapi.dll` or `wbemcomn.dll` in `C:\Windows\System32\wbem\`, loaded by WMI. Compare against known-good hashes. - **Native image cache:** malicious files named like `Microsoft.Exchange.Search.Mdb.ni.dll` planted in the .NET native image cache; one sample activates only under Exchange's search service. Look for NI images whose hashes don't match ngen output on a clean server. - **Collection:** CerealBox stages messages with .doc/.docx/.pdf attachments that match hardcoded sender, recipient, subject or filename lists into encrypted files on disk; commands also pulled mailboxes via EWS, queried AD, ran WMI and read LSA secrets. - ESET says IoCs are in its white paper and GitHub repository. Sources: [ESET WeLiveSecurity: Exchange for breakfast: Turla's Cereal tricks are not for kids (Nov 10, 2026)](https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/) · [ESET Research on X (thread, Nov 10, 2026)](https://x.com/ESETresearch/status/2120094134559965410) vendor research (Huntress blog, Nov 10, 2026, with IOCs) 2026-11-10 ### [Hunt: ClickFix now leads to domain controllers, reverse SSH tunnels, PNG-hidden executables and browser-cache-seeded payloads (Huntress)](/items/hunt-huntress-clickfix-evolving-tradecraft-cache-seeded-stego-lateral-movement-nov-10) - **Process lineage:** explorer.exe (Run dialog) or a browser spawning cmd.exe, powershell.exe or Windows Terminal; encoded commands and execution-policy bypasses. - **Files:** ZIPs such as `cf_verify.zip` or `verify_pkg.zip` in %TEMP%, extracted into random hex-named folders under C:\ProgramData (e.g. `f8f33b09aed97a47`, `7168f7f870a45fbb`) with a signed Microsoft binary, a rogue DLL and `1.bat`; `C:\ProgramData\ShService` holding an SSH private key. - **Persistence:** Run keys and scheduled tasks like `CertEnrollCtrl_*`, `SysyService` or a Run key named `DuskDesk` launching node.exe. - **Cache-seeded variant:** `cmd /c for /r` loops over browser profile cache folders filtering on file size, then copying to `%TEMP%\t.bat`. - **Network:** unexpected outbound SSH from workstations; Huntress lists 23.227.199[.]41 and 167.148.201[.]104:3861 among its IOCs. - Huntress advises hunting the sequence of behavior rather than hashes, since names and payloads change. Sources: [Huntress: Beyond the clipboard: The evolving tradecraft of ClickFix (Nov 10, 2026)](https://www.huntress.com/blog/the-evolving-tradecraft-of-clickfix) ## [AI](/ai) official (Prime Minister of Australia media releases, Nov 10, 2026); the review's findings and full report have not been released, only its recommendations 2026-11-10 ### [Australia will require frontier AI companies to report incidents and allow independent model evaluation, after an OpenAI agent got into a Medicare statistics portal](/items/australia-accepts-18-rapid-review-recommendations-openai-agent-medicare-portal-mandatory-ai-incident-reporting) - **Who did the review:** the Department of the Prime Minister and Cabinet with the National Cyber Security Coordinator, Office of AI, Australian Signals Directorate, Australian AI Safety Institute and Services Australia. - **What's still missing:** legislation text and timing; the government says details will follow after consultation. - **Why it matters for defenders:** it's one of the first national responses that treats an autonomous agent's unauthorized access as a reportable cyber incident in its own right. Sources: [Prime Minister of Australia: Strengthening Australia against AI-driven cyber incidents (Nov 10, 2026)](https://www.pm.gov.au/media/strengthening-australia-against-ai-driven-cyber-incidents) · [Prime Minister of Australia: New Australian AI safety and security protections (Nov 10, 2026)](https://www.pm.gov.au/media/new-australian-ai-safety-and-security-protections) official (Google DeepMind blog and paper, Nov 10, 2026) 2026-11-10 ### [Google DeepMind's AlphaProof Code uses AI agents to formally verify Signal's libsignal down to AArch64 machine code](/items/google-deepmind-alphaproof-code-formally-verifies-libsignal-machine-code) - **What it does and doesn't cover:** the proofs assume the cryptographic primitives are secure and trust contracts for some low-level routines; no new Signal vulnerabilities were reported. - **Why it matters:** if agents can make formal verification cheap, it becomes a defensive counterweight to AI-driven bug hunting. The Lean development is published for others to reuse. Sources: [Google DeepMind: Introducing AlphaProof Code (Nov 10, 2026)](https://deepmind.google/blog/introducing-alphaproof-code/) · [AlphaProof Code: Verifying Signal's Security at the Machine-Code Level (paper, Nov 10, 2026)](https://google-deepmind.github.io/code-verification/) official (Microsoft Security Blog / Microsoft Research, Nov 10, 2026); research finding, Microsoft says it has not seen attackers use the technique 2026-11-10 ### [Microsoft Research: editing fewer than 10 neurons can turn an agent model into a sleeper agent that passes evaluations and runs an attacker's command on a trigger](/items/microsoft-research-sleeper-agent-fewer-than-ten-neurons-weight-edit-backdoor) - **Audit weights like code:** diff every checkpoint against its declared base model before deployment and after updates. Fine-tunes and quantizations change weights broadly; implanted neurons change a few vectors a lot, so flag statistical outliers and reject models without a verifiable base. - **Treat third-party fine-tunes, merges, quantizations and adapters as untrusted** until audited; pull checkpoints only from the original publisher and verify hashes; serve from a private registry rather than public hubs at runtime. - **Contain the blast radius:** least-privilege agent identities, sandboxed code execution, egress allowlists, and human approval for high-impact tool calls, so a triggered model can't do much. Sources: [Microsoft Security Blog: Detecting sleeper agents hiding in AI model neurons (Nov 10, 2026)](https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/) · [Microsoft Threat Intelligence on X (Nov 10, 2026)](https://x.com/MsftSecIntel/status/2120299667443396688) ## [Playbooks](/playbooks) [A SaaS vendor says the API keys you stored with it may be exposed: rotate and verify](/playbooks/saas-vendor-stored-secrets-exposed): A short path for when a vendor that holds your third-party keys, tokens or OAuth grants discloses a breach (this week: Studio on Oct 16, OpenCode Console on Oct 17). Built from the vendors' own guidance. ## [Tips & Guides](/tips) operational guidance (Barracuda advisory recommendations, Nov 9, 2026) 2026-11-10 ### [Tip: for any security appliance, check today whether its admin page answers from the internet](/items/tip-barracuda-admin-ui-off-internet-confirm-patch-applied) - List public IPs of ESG, WAF, ADC, Message Archiver and Web Security Gateway boxes, then test the admin ports from outside (a cloud VM or your external scanner), not from the office. - Restrict the Admin UI to a management network or VPN with an allowlist; Barracuda recommends trusted internal networks only. - Turn automatic patching back on if it was off, then confirm the device reports the patched firmware. - Repeat the same check for other edge appliances; most of this year's edge exploitation started at an exposed management page. Sources: [Barracuda Trust Center advisory (updated Nov 9, 2026)](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) operational guidance (based on the Claude Code 2.1.321 changelog, Nov 9, 2026) 2026-11-10 ### [Tip: after the Claude Code MCP OAuth fix, revoke and re-grant the remote MCP servers that matter most](/items/tip-revoke-remote-mcp-oauth-grants-after-claude-code-2-1-321) - Start with servers that reach source code, cloud consoles, mail or tickets (GitHub, Google, Microsoft, Atlassian, Slack connectors). - Revoke in the provider's authorized-apps page, not just with `claude mcp logout`, which only clears the local copy. - Check the provider's audit log for token use from unfamiliar IPs since you first connected. - Remove remote MCP servers you don't run or no longer use. Sources: [Claude Code CHANGELOG (2.1.321)](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) operational guidance (based on Huntress recommendations, Nov 10, 2026) 2026-11-10 ### [Tip: make ClickFix harder by blocking execution from user-writable folders and watching what the Run dialog launches](/items/tip-block-clickfix-run-dialog-paste-and-user-writable-execution) - On Windows, a GPO can remove the Run dialog for standard users, and WDAC or AppLocker rules can deny execution from %LOCALAPPDATA%\Temp and %PROGRAMDATA% subfolders that aren't on an allowlist. - Pair the controls with an easy report path so users who did paste something tell IT fast. Sources: [Huntress: Beyond the clipboard: The evolving tradecraft of ClickFix (Nov 10, 2026)](https://www.huntress.com/blog/the-evolving-tradecraft-of-clickfix) ## [Industry News](/industry) official (GitHub Changelog, Nov 2; GitHub Docs) 2026-11-09 ### [GitHub will block pull_request_target in public repos by default from Dec 2, with a first two-hour brownout today, Nov 9, 16:00 to 18:00 UTC](/items/github-pull-request-target-brownout-nov-9-enforced-dec-2) - Use policy Insights to see which workflow runs would be blocked. - Either keep the default block, switch the workflow to `pull_request`, or allow `pull_request_target` for specific workflow files in an Actions event policy. - Applies to public repos on GitHub Free, Team and Enterprise Cloud. Sources: [GitHub Changelog: pull_request_target blocked by default December 2](https://github.blog/changelog/2026-11-02-pull_request_target-blocked-by-default-december-2/) · [GitHub Docs: Securely using pull_request_target](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target) official (AWS What's New and EKS User Guide, Nov 9, 2026) 2026-11-09 ### [AWS launches Nitro Sandboxes: a hardware-isolated VM per EKS pod, ECS task or lightweight EC2 VM, pitched at running untrusted and agent-generated code](/items/aws-nitro-sandboxes-hardware-isolated-eks-pods-ecs-tasks-agent-workloads) - **Security relevance:** shared-kernel containers have been the weak boundary for multi-tenant and agent code-execution platforms; this gives a VM boundary without a dedicated instance per workload. - **Caveat from AWS's docs:** the isolation is a security boundary, not a performance reservation, and supported instance types are limited. Sources: [AWS What's New: Introducing AWS Nitro Sandboxes on Amazon EKS, ECS and EC2 (Nov 9, 2026)](https://aws.amazon.com/about-aws/whats-new/2026/11/nitro-sandboxes-eks-ecs-ec2/) · [Amazon EKS User Guide: Sandboxing with isolated and confidential pods](https://docs.aws.amazon.com/eks/latest/userguide/sandboxing.html) official (New York Attorney General press release, Nov 6); Connecticut, Michigan and New Jersey joined 2026-11-07 ### [NY AG and three states settle with Perry Johnson medical transcription firms over a 2023 breach of 13.3 million patients' records](/items/ny-ag-perry-johnson-medical-transcription-breach-settlement-nov-6) - **Exposed fields (per AG):** names, DOBs, home addresses, SSNs, hospital account numbers, diagnoses, insurance info, and clinical transcription content including meds and lab/diagnostic results. - **Lesson:** MFA on remote access and alerting on the detections you already collect would have shortened a two-month dwell. Sources: [NY Attorney General James press release (Nov 6)](https://ag.ny.gov/press-release/2026/attorney-general-james-secures-10-million-and-critical-reforms-companies-failed) · [The Record: medical services company settles with 4 states (Nov 6)](https://therecord.media/medical-services-company-settles-with-4-state-ags)