AbraxasLabs_

CVE-2026-103956: Loom for AWS unauthenticated super-admin

Loom for AWS before 1.6.1 grants every request t-admin / g-admins-super when Cognito is unset and no external IdP is active, including requests with no Authorization header. A fresh deploy is an open admin panel. Labbed on v1.6.0 against v1.6.1. Unauthenticated GET /api/auth/me returns local-dev. Unauthenticated MCP register plus export returns the planted OAuth secret.

Vaultwarden, default X-Real-IP trusted-local bypasses login rate limits

Vaultwarden 1.37.3 defaults IP_HEADER to X-Real-IP and IP_HEADER_TRUSTED_PROXIES to local. Any non-global TCP peer is treated as a reverse proxy, so a client X-Real-IP becomes the login rate-limit key. Stock Docker published-port NAT is RFC1918. Unique headers never share a burst. 2FA after a correct password still runs. No CVE yet.

Bitwarden, EF cipher create skips collection ACL

Bitwarden Server 2026.9.2 lite on MariaDB/Postgres/SQLite nulls the caller UserId before attaching a new org cipher to collections. A confirmed member can plant a decryptable vault item into a collection they cannot write. Members sync it as a shared login. MSSQL/Dapper keeps the caller id. No CVE yet.

Beyond the Hype: Evaluating LLM Integration and Practical Limitations in Security Operation Centers

Elnaz Rabieinejad, Ali Dehghantanha, Fattane Zarrinkalam, and Sarina Dastgerdy

Twenty SOC practitioners, not a vendor deck. LLMs as drafts and leads for logs and first-pass triage. Nobody in the room trusted them for the high-stakes call.

Rootkits and Bootkits

Alex Matrosov, Eugene Rodionov, and Sergey Bratus

The book I hand people when they ask why the kernel still believes the firmware. Boot path, UEFI, and the malware that lives underneath the OS you thought you were analyzing.