Can you trust the trust dialog?

We discovered that running Claude Code in malicious folders could have executed system commands before the trust dialog even appears! Learn about the details in our latest blog post:

https://www.sonarsource.com/blog/claude-arbitrary-code-execution?utm_medium=social&utm_source=mastodon&utm_campaign=research&utm_content=social-claude-code-exec-260430-&utm_term=---&s_category=Organic&s_source=Social%20Media&s_origin=social

#appsec #security #vulnerability

We've launched a new free Web Security Academy topic on exploiting AI-powered security scanners! Learn how to use indirect prompt injection to steal data, cause damage & trigger exploit chains!

Dive in here: https://portswigger.net/web-security/llm-attacks/ai-powered-scanner-vulnerabilities

Fortinet remains the #1 targeted perimeter vendor:

• CVE-2026-35616 auth bypass: 1,535,690 sessions
• SSL VPN brute-force: 116,753 sessions (trending ↑)
• CISA KEV since April 6

See it on GreyNoise → https://www.greynoise.io/resources/at-the-edge-clear-041326

Ludus 2 (@badsectorlabs), new GOAD lab (@M4yFly), 🍪 hack (@XeEaton), DPAPI + Nemesis (@harmj0y + @tifkin_), iOS exploit kit found (@Mandiant), and more!

https://blog.badsectorlabs.com/last-week-in-security-lwis-2026-03-09.html

There's a lot of discourse on Twitter about people using LLMs to solve CTF challenges. I used to write CTF challenges in a past life, so I threw a couple of my hardest ones at it.

We're screwed.

At least with text-file style challenges ("source code provided" etc), Claude Opus solves them quickly. For the "simpler" of the two, it just very quickly ran through the steps to solve it. For the more "ridiculous" challenge, it took a long while, and in fact as I type this it's still burning tokens "verifying" the flag even though it very obviously found the flag and it knows it (it's leetspeak and it identified that and that it's plausible). LLMs are, indeed, still completely unintelligent, because no human would waste time verifying a flag and second-guessing itself when it very obviously is correct. (Also you could just run it...)

But that doesn't matter, because it found it.

The thing is, CTF challenges aren't about inventing the next great invention or having a rare spark of genius. CTF challenges are about learning things by doing. You're supposed to enjoy the process. The whole point of a well-designed CTF challenge is that anyone, given enough time and effort and self-improvement and learning, can solve it. The goal isn't actually to get the flag, otherwise you'd just ask another team for the flag (which is against the rules of course). The goal is to get the flag by yourself. If you ask an LLM to get the flag for you, you aren't doing that.

(Continued)

Datadog 🤝 Okta: "The enhanced logic developed by Datadog’s own Security Research team during this collaboration has been contributed back to the public Okta Security Detection Catalog, ensuring that the broader security community benefits from this joint research regardless of their tooling"

Read more here: https://sec.okta.com/articles/2026/03/datadog-okta-collaboration/