VamiGRC – 1# agentic GRC platform | ISO 27001 · ISO42001 · CRA · NIS2 · DORA · EU AI Act | Pentestin & Threat Modeling Agentic AI Systems

Bonn, Germany
Joined May 2025
VamiSec | AI-driven IT Security & GRC retweeted
Key fact: PlayStation paid out the maximum $50,000 bug bounty to researcher Jordy for reporting a critical security vulnerability, who joked he could finally buy GTA 6 with i
PlayStation has awarded a user the maximum bounty of $50,000 for reporting a "critical" security vulnerability Researcher Jordy joked that he "can at least buy GTA 6 with this"
1
1
141
VamiSec | AI-driven IT Security & GRC retweeted
The death of a research scientist in Irkutsk in early October forced the FSB to operate out in the open where it usually prefers to remain undetected. Over the last few years, the security service has seen its role strengthened in the fight against epidemics, high-risk laboratories and international cooperation over the plague and other pathogens handled by the deceased researcher. ➡️ l.intelligenceonline.fr/Lax
7
1
14
1,499
VamiSec | AI-driven IT Security & GRC retweeted
KI-Sicherheit: Neue Risiken, alte Schwachstellen dlvr.​it/TVwVx0 #News #Cybersecurity
1
17
VamiSec | AI-driven IT Security & GRC retweeted
Replying to @ryan_doser13
Lovable has dedicated IP’s on their load balancer. The issue is they were hosting pages on their dev sub-domain which was getting people to download an InfoStealer Trojan. Their IPs were substantially blacklisted and if your domain website A record pointed to them, then you would have problems with your own domains email deliverability since major email service providers also consister website reputation when making algorithmic email threat decisions. Tl:dr: loveable need to implement a proactive anti-abuse team.
1
66
VamiSec | AI-driven IT Security & GRC retweeted
Cisco SEG zero-day exploited with root access via email Cisco urged customers to patch a critical vulnerability in its Secure Email Gateway that has been exploited as a zero-day. The bug is tracked as CVE-2026-76519 and received a CVSS rating of 9.8 out of 10. It allows remote unauthenticated attackers to write files and execute commands with root privileges by sending a malicious email. The flaw exists in the Advanced Malware Protection feature and stems from improper handling of email attachments. Both Cisco and CISA issued separate advisories on Wednesday warning of active exploitation. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and set a Saturday deadline for federal agencies to apply fixes. The vulnerability affects physical and virtual appliances when the File Reputation service is enabled and Content Scanner Tools is earlier than version 25.3.0.5525. Cisco recommends customers running AsyncOS Software earlier than v16.5 migrate to 16.5.0-780 and states there are no workarounds.
🤖 Made with AI
1
82
VamiSec | AI-driven IT Security & GRC retweeted
🚨 Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls Details: cybersecuritynews.com/pan-os… Hackers are exploiting a high-severity flaw in Palo Alto Networks PAN-OS that allows authenticated attackers to run code with root privileges on affected firewalls. Tracked as CVE-2026-0322, the vulnerability affects the management interface, with the company confirming “very limited exploitation” and urging customers to apply fixes as soon as possible. The flaw is a code injection weakness, classified as CWE-94. An attacker must have authenticated access with high privileges and network access to the management interface. Successful exploitation allows code execution as root, giving the attacker the highest level of control over the affected firewall. #cybersecuritynews
4
96
8
293
22,810
VamiSec | AI-driven IT Security & GRC retweeted
CrowdStrike collaborated with the @FBICyberDiv to identify and disrupt individuals associated with the North Korean IT worker scheme, designed to infiltrate U.S. companies and generate revenue for the regime. The operation dismantled more than 40 laptop farms and seized nearly 200 devices, disrupting the infrastructure behind these schemes, raising the cost of doing business for the adversary. CrowdStrike's Head of Counter Adversary Operations Adam Meyers shares insights with The New York Times on the growing scale and sophistication of these operations. Read more: crwdstr.ke/6015BHGxOx
1
6
32
2,975
VamiSec | AI-driven IT Security & GRC retweeted
ICYMI: CrowdStrike worked alongside the @FBICyberDiv to identify and disrupt individuals tied to North Korea’s IT worker scheme, which places operatives inside U.S. companies to generate revenue for the regime. The result? More than 40 laptop farms dismantled. Nearly 200 devices seized. Learn more about CrowdStrike’s role: cs.link/utqJZ
1
4
1
23
2,594
VamiSec | AI-driven IT Security & GRC retweeted
‼️ Claude Exploited SQL Injection Flaws to Execute Commands on Real Servers Details: cybersecuritynews.com/claude… Anthropic has revealed that Claude models exploited software flaws, ran commands on real servers, submitted live forms, and bypassed web limits during internal tests. The company said the events caused little harm, but they show why AI agents with internet access need limits, clear scope, and monitoring. Anthropic’s review of model transcripts began in July 2026. Researchers checked cybersecurity tests where Claude was expected to work inside a closed lab. They later widened the review to web research tasks, internal agents, and reinforcement learning settings with internet access. Anthropic said no known case involved customer data or its internal systems. #cybersecuritynews
5
40
2
133
8,932
VamiSec | AI-driven IT Security & GRC retweeted
🔒 𝗖𝘆𝗯𝗲𝗿𝗦𝗲𝗰 𝗦𝘂𝗻𝗱𝗮𝘆 - 𝗡𝗲𝘄 𝗜𝘀𝘀𝘂𝗲 This week’s CyberSec Sunday is out! Featuring news, research and resources from 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁, 𝗦𝘁𝗲𝘃𝗲 𝗦𝘆𝗳𝘂𝗵𝘀, 𝗖𝗶𝘁𝗿𝗶𝘅, 𝗗𝗲𝗹𝗹 and more. A few things worth checking out this week: → Unsupported Windows versions will lose access to Windows Update → dMSA support can break AD trusts in mixed environments → Why Windows Credential Manager isn’t a generic secret store → Another NetScaler zero-day is being actively exploited → Critical Dell System Update flaw allows unauthenticated RCE as root → Outlook will start blocking MSIX attachments by default Plus this week’s 𝗙𝗿𝗼𝗺 𝘁𝗵𝗲 𝗙𝗶𝗲𝗹𝗱: 💥 ~𝟴𝟲% 𝗼𝗳 𝘁𝗵𝗲 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀 𝘄𝗲 𝗮𝘀𝘀𝗲𝘀𝘀 𝗵𝗮𝘃𝗲 𝗻𝗼 𝗮𝗽𝗽 𝗽𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝗽𝗼𝗹𝗶𝗰𝗶𝗲𝘀 𝗳𝗼𝗿 𝗕𝗬𝗢𝗗. We often see users accessing Outlook, Teams and OneDrive from personal phones without controls over what happens to company data. App Protection Policies can help protect that data without requiring full device enrollment. And a few extra resources on 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗶𝗻𝘁𝗲𝗿𝗻𝗮𝗹𝘀, 𝗔𝗗 𝗹𝗼𝗴𝗴𝗶𝗻𝗴, 𝗮𝗻𝗱 𝗰𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲 𝗲𝗻𝗿𝗼𝗹𝗹𝗺𝗲𝗻𝘁 𝘄𝗶𝘁𝗵 𝗣𝗼𝘄𝗲𝗿𝗦𝗵𝗲𝗹𝗹. 𝗖𝘆𝗯𝗲𝗿𝗦𝗲𝗰 𝗦𝘂𝗻𝗱𝗮𝘆 𝗴𝗼𝗲𝘀 𝗼𝘂𝘁 𝗲𝘃𝗲𝗿𝘆 𝗦𝘂𝗻𝗱𝗮𝘆. Subscribe if you want the next one in your inbox 👇 #CyberSecurity #ActiveDirectory #WindowsSecurity #MicrosoftSecurity
2
5
10
963
VamiSec | AI-driven IT Security & GRC retweeted
‼️ ‼ A zero-day in Gemini CLI (CVE-2026-31478) is being exploited in the wild right now, and it lets an attacker run commands on your machine and steal your credentials. The Gemini CLI is the terminal tool that connects Google's Gemini model to your files and shell, the same way a harnais connects a model to the world. The flaw lives in how it reads context files: a poisoned file in a directory you inspect is enough to trigger execution, no confirmation prompt shown. Tracebit found the same class of attack in 2025 through prompt injection and missing validation, and Redguard's June 2026 advisory showed arbitrary code execution for anyone who opened the tool in an untrusted directory before v0.39.0. The Cloud Security Alliance rates the exposure CVSS 10.0, which is the top of the scale. The fix is v0.43.1, out now. Update today, then audit which directories you have opened the CLI in and whether any of them held files you did not write. If you build on agentic AI, treat the toolchain as attack surface, not as a convenience. Early report: these facts come from first disclosures and are not confirmed yet. Expect them to change.
3
1
2
172
VamiSec | AI-driven IT Security & GRC retweeted
🚨 Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access Source: cybersecuritynews.com/palo-a… Ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. @ReliaQuestTR reports that multiple threat groups, including Qilin and Settra, are using the flaw to create unauthorized VPN sessions and enter internal networks through trusted remote access services. The activity presents a serious detection challenge because attackers connect through an organization’s own VPN. Their traffic can look like normal remote work, giving them time to steal credentials, move between systems, collect sensitive data, or prepare ransomware before security teams recognize the intrusion. #cybersecuritynews
7
222
33
673
65,417
VamiSec | AI-driven IT Security & GRC retweeted
Karpathy estimates only about 5,000 people have seen the most advanced internal AI uses. Basically very few people are using the top edge of what AI is capable of. And a massive number haven't used any at all. xitter.cf/karpathy/status/210936…
Dusting off this tweet from April because this gap in shared understanding of LLM capability is *widening*. It's now less "two groups of people speaking past each other" and more a sharp funnel. - Napkin math somewhere around 6B people (~75% of the population) have barely come in contact with LLMs at all. - Around 1-2B (~20%) are casual and infrequent users of free-tier ChatGPT-like products. This group sees derpy chatbots and treats them a bit like a better Google search, a writing aid, or etc. Maybe an agent tries to book you a flight. I have non-tech friends who (reasonably, imo) say they have not much use for it at all. Even many professionals outside of math&code are in this tier. For example, execs and many other functions spend a lot of their time talking to other people, so while they understand what is happening intellectually, it is still second-hand and a bit abstract. - Now we get to professional use of frontier-grade LLMs in math&code. Somewhere around 20M people (0.2%) see first-hand that large, complex projects that used to take them weeks/months can now be completed by agents with a prompt. Building apps, copying apps, translating apps, decompiling apps from binaries... This has all happened very quickly and recently - less than 1 year ago, I was writing code manually by hand, typing memorized computer code commands into a code editor character by character, occasionally pressing Tab to autocomplete a little chunk of code. - And finally we get to the ~5,000 people (~0.00006%) with access to frontier-grade systems internally. The external world has seen the preview. It looks like swarms of thousands of agents collaborating over weeks on software mega projects: minting zero days, running cyber attacks and defenses at machine speeds, discovering new science, advancing the frontier of mathematics. Things that would have taken top professionals in the industry years of work. Meanwhile, human review and comprehension are starting to fall behind. For example, people are still involved in the "archeology" of the OpenAI-HF incident from many months ago. Mathematicians may be poring over the 722 manuscripts on frontier mathematics for a while. The funnel is driven by a combination of factors: 1. The impact scales with ambition, problem size, and horizon. A question with a paragraph answer barely stresses the system. You need a reservoir of big, difficult problems that you really care about. This aspect drives the consumer / professional dimension of the funnel. 2. The jaggedness of the system (which I have written about a lot separately). Capability peaks in domains that are digital, verifiable and economically valuable. This is because LLM capability emerges from reinforcement learning on verifiable rewards on a curated environment mixture driven by revenue potential. This aspect primarily drives the area (e.g. math&code) dimension of the funnel. 3. Access. Free-tier, paid-tier, internal. So this is the weirdness of the moment. The general public has mostly not interacted with these systems. When they have, it looks like a derpy chatbot. The majority of professionals still see only a modest uplift. And a small sliver of professionals are experiencing the vertigo of the curve going vertical. And it is all happening at the same time.
6
9
96
10,110
VamiSec | AI-driven IT Security & GRC retweeted
Regulierung trifft den Mittelstand, Nachweise liegen in Excel und E-Mail-Ordnern. Deshalb habe ich Regelspoor gebaut: Die Plattform analysiert NIS2, DSGVO, ISO 27001 und mehr, sammelt Belege automatisch und macht aus Compliance konkrete nächste Schritte. Live soon.
1
1
2
22