AI Supply Chain Risks, FreeBSD Flaw and DigiCert’s Breach Response

Summary

Security Now examines malicious AI models and agent skills, an AI-discovered FreeBSD flaw, exposed Edge credentials and DigiCert’s response to a breach involving certificates used to sign malware.

Key points

Researchers reported malicious models on Hugging Face and malicious agent skills on Clawhub, including payloads designed to steal credentials and establish reverse shells.
The NullifAI technique reportedly hides malicious Python code in compressed pickle-based models to evade scanning.
Isle Security used AI-assisted analysis to find CVE-2026-42511 in FreeBSD’s DHCP client; Joshua Rogers developed a proof of concept for a local-network-to-root exploit chain.
A reported Edge issue allows a logged-in Windows user to recover stored credentials from a browser memory dump; the discussion says Microsoft considers this intended behavior.
Let’s Encrypt temporarily stopped certificate issuance after discovering a missing required extension in cross-signed intermediate certificates, then changed its configuration and resumed issuance.
The FCC extended a waiver allowing security and other software updates for certain previously authorized routers and other devices until at least January 2029.
Steve Gibson praised DigiCert’s breach disclosure; the available transcript reports that certificates were used to sign malware, including Zong Steeler.

Article Details

Topics: [23:28] AI-assisted discovery of a FreeBSD DHCP client vulnerability
[32:33] Let’s Encrypt certificate issuance suspension
[40:53] Malicious AI models and agent skills in public repositories
[59:01] Cybersecurity information-sharing legislation
[01:00:26] Edge credentials exposed in process memory
[01:20:55] Privacy tradeoffs of cloud and local AI analysis
[01:25:17] DigiCert breach investigation and disclosure
FCC waiver for security updates to previously authorized devices
AI vulnerability discovery and security judgment in software development