PyTorch ExecuTorch Security Audit Results

🎯 Rooted Bedside — HackTheBox Season 11 | Rank #2940 A Medium Linux machine simulating a medical AI research environment. The full chain: → CVE-2025-64512: Pickle deserialization via pdfminer.six to get initial RCE → Pivoted to an internal Vite dev server through Chisel tunneling → Path traversal on the dev server to extract SSH private keys from the host → Escaped the Docker container via SSH → Privilege escalation by planting a malicious PyTorch checkpoint (.pt) loaded unsafely by a root-executable training script Biggest lesson from this box: PyTorch .pt files are pickle files. Loading untrusted model checkpoints = arbitrary code execution. ML infrastructure needs the same security scrutiny as any other attack surface. On to the next one. 💚 #HackTheBox #CTF #CyberSecurity #RedTeam #OffensiveSecurity #Jordan #MENA

When it comes to creating secure code, are all LLMs created equal? Secure Code Warrior's all-new SCW AI Trust Index found that AI-generated code carries a staggering 15 vulnerabilities per codebase, on average. If you're a security leader looking to make more informed choices when modernizing your security program, you need to check out our benchmarking site and research paper today: https://ow.ly/HuV830sXqQP

A 64 MiB payload just crashed your container with 1.4 GiB of heap. Anthropic’s Buffa Rust Library has a new 0-Day Vulnerability CVE-2026-55407 . A Denial-of-Service DoS flaw lets attackers force unbounded heap allocation. The Problem: - The `decode unknown field` function parses a length from untrusted Protobuf data. - It allocates a `Vec u8 ` without an upper bound. - The real danger? A `WireType::StartGroup` branch loops over nested fields. - Each 2-byte field triggers a 40-byte allocation. The Agitation: - Endor Labs proved a 64 MiB payload explodes to 1.4 GiB of memory. - Inside a 256 MiB Docker container, the process is killed instantly. - Default APIs like `Message::decode` are exposed. This isn’t theoretical. The Solution: - Upgrade to Buffa and connectrpc v0.8.0 immediately. - The patch enforces a configurable per-message limit on unknown fields. - Can’t upgrade? Regenerate code with `preserve unknown fields=false`. This CVE proves memory-safe Rust still demands rigorous Cybersecurity analysis. AI-driven SAST from Endor Labs caught this logic flaw, not a pattern match. How is your team securing your infrastructure against this type of exploitation? Let’s discuss in the comments below. #Cybersecurity #Rust #Protobuf

Ransomware operators just built malware specifically designed to destroy AI models. JadePuffer's ENCFORGE ransomware targets 180 AI/ML file extensions including PyTorch checkpoints, Hugging Face SafeTensors, FAISS vector indexes, and training datasets. Entry came through CVE-2025-3248, an unauthenticated RCE flaw in Langflow. A single run can wipe weeks of GPU training and cost $75,000 to $500,000 per model to recover. If your org runs Langflow, update to v1.3.0 or later now. Restrict Docker socket access, run containers as non-root, and apply filesystem controls to model weight directories. ML infrastructure needs to be in scope for threat modeling. Is your team's AI infrastructure covered in your incident response plan? #ThreatIntel #Malware #SOCAnalyst

When it comes to creating secure code, are all LLMs created equal? Secure Code Warrior's all-new SCW AI Trust Index found that AI-generated code carries a staggering 15 vulnerabilities per codebase, on average. If you're a security leader looking to make more informed choices when modernizing your security program, you need to check out our benchmarking site and research paper today: https://ow.ly/lRzO30sXmxU

This evolution of JADEPUFFER from the Sysdig Threat Research Team is worth paying attention to. Ransomware built specifically for the AI stack: model checkpoints, vector databases, training datasets. The assets most organizations never thought to back up. Rebuilding a single production fine-tune can run up to $500,000 in compute and engineering. And when the initial payload failed, the attacker built a container-escape toolkit in real time. Six script iterations in about five minutes. Full breakdown here. 👇 https://okt.to/kATsLp #CloudSecurity #ThreatResearch #AISecurity #Ransomware #RuntimeSecurity

A new article from Rashmi Ramesh and the Information Security Media Group (ISMG) covers four vulnerabilities in the Langflow AI platform recently discovered by Ori Lahav and Rubrik Zero Labs. The implications of these CVEs, two of which are categorized as critical, are described in detail here: https://lnkd.in/gbrn6emC

⚙️ DevSec & OSS (Jul 19) The cost of saying yes has changed: on our radar — file it if it's in your stack. From the Captain’s Chair: Mohammad-Ali A’râbi: on our radar — file it if it's in your stack. AI Agents Explained: How to Build with Them Safely: another item on the daily watch. The Developer Has Changed. So Should Developer Conferences: we note it; relevance depends on your exposure. GitHub for Beginners: Your roadmap to mastering the GitHub essentials: on our radar — file it if it's in your stack. That standard is what the PCMedicalist and MCINTOSHI surfaces is built on. PCMedicalist DevSec Wire · pcmedicalist.com #DevSecWire via PCMedicalist · pcmedicalist.com #CyberSecurity #InfoSec

MCP Trust Checker — MCP Security Scanner 💀 An open-source, deterministic security scanner that evaluates Model Context Protocol (MCP) servers offline, helping users assess trust and security risks before connecting AI agents to them. Features: • Offline, deterministic security analysis with no account or telemetry required • Capability-Flow Trust Model for cross-tool toxic-flow and data exfiltration detection • Static analysis of tool definitions and source code with Unicode payload decoding • Trust scoring, SARIF/JSON/Markdown reports, CI integration and GitHub Action support • Rug-pull detection through integrity pinning and tool definition change tracking 🔗 The repo is available in the comment section. #CyberSecurity #MCP #AIAgents #AppSec #DevSecOps #OpenSource

This evolution of JADEPUFFER from the Sysdig Threat Research Team is worth paying attention to. Ransomware built specifically for the AI stack: model checkpoints, vector databases, training datasets. The assets most organizations never thought to back up. Rebuilding a single production fine-tune can run up to $500,000 in compute and engineering. And when the initial payload failed, the attacker built a container-escape toolkit in real time. Six script iterations in about five minutes. Full breakdown here. 👇 https://okt.to/DvKeF9 #CloudSecurity #ThreatResearch #AISecurity #Ransomware #RuntimeSecurity