Compliance – Trackr.Live

§ Tag

An Unreviewed Terraform Plan Can Execute Contributor-Controlled Code. The External Data Source Runs During Planning, Not Only Apply

When a CI workflow auto-plans a contributor’s pull request in a privileged context, a data source can execute on the runner the moment terraform plan runs — before anyone reads the diff. Here is what that actually exposes, where the detection really lives, and why the process tree is a grandchild deep.

The AD FS Master Key Behind Every Signed Token Was Readable Through a Loose ACL, and the July Patch Only Watches by Default

CVE-2026-56155 is an overly permissive ACL on the AD FS DKM container — the object holding the key that protects your token-signing certificate. The July patch ships the fix in audit mode, so read access to a Golden SAML enabler stays open until you flip a registry key or October arrives.

EventRecordID Gaps Catch Crude Deletion. Unreferencing Plus Renumbering Can Keep the Sequence Clean

An attacker who can manipulate the active or offline EVTX can pull a single 4624 out of the Security log without inherently firing Event ID 1102 — and, by renumbering the records that follow, without leaving a hole in the EventRecordID sequence your rule watches. Here is why gap detection misses that, and what actually catches it.

Policies

The DPRK Developer on Your Payroll Runs Over a KVM Dongle and an RMM Tool. The Interview Never Caught It; Your Endpoint and Connection Logs Can

Eight US-based ‘laptop farmers’ sentenced in five months, across cases spanning more than 100 US companies in one prosecution and nearly 70 in others: the North Korean IT worker is already on payroll, and what resolves it is correlating unauthorized remote-access tooling with the connection and endpoint telemetry it throws off — not the hiring interview, and not sign-in geography alone.

A Fork PR Poisoned the pnpm Cache Your Release Workflow Trusted, and GitHub’s Audit Log Never Logged the Write

The TanStack compromise published 84 poisoned npm versions across 42 packages by writing a cache entry into the default-branch scope from an untrusted fork PR. GitHub has since made that write path read-only for low-trust triggers — but cache creation still never touches the audit log, so post-hoc detection has to live on the runner and in cache-inventory differencing instead.

io_uring Reads Your Files and Opens Sockets Without Calling the Syscalls Your auditd Rules Watch

A process on a Linux host where io_uring is enabled can read files, connect out, and write to disk without issuing any of the file and network syscalls your auditd rules and EDR hooks watch. Here is the creation-time syscall that still fires, what to alert on, and why the real fix is a sysctl (already the default on RHEL 9).

A Phished OTP Can Buy the Attacker a Passkey in Your Tenant, and the Registration Audit Trail Is Your Most Direct Signal

O-UNC-066 appears built to walk a victim through a fake passkey enrollment while the operator registers an attacker-controlled passkey in the real Entra tenant. It survives the password reset, and the most direct durable evidence is the authentication-method registration audit trail — written from a session your controls let through because the registration action was protected only by relayable MFA.

Artificial Intelligence

Invisible Unicode Tags Smuggle Instructions Past Your LLM Filter. The Detection Is a Byte Pattern on the Raw Stream

A block of Unicode characters that renders as nothing can carry a full paragraph of instructions into your LLM, and your content filter can miss it because it inspects a sanitized or transformed representation while the model receives the original code points. Here is where the detection actually has to live, and what you spend the first week of tuning on.

Static Tundra Pulls Your Startup-Config Over Smart Install. The Switch That Leaks It Breaks Its Own Audit Trail

FSB Center 16’s Static Tundra crew is still working a 2018 Cisco Smart Install bug to steal startup-configs from end-of-life gear, then modifying TACACS+ so the box stops narrating the theft. The detection has to live off the device.

CVE-2026-3055 Bleeds Session Tokens Your NetScaler Barely Logs. The Detection Lives Off the Box

The NetScaler memory-overread class has a third sequel. CVE-2026-3055 leaks session tokens through an endpoint the appliance barely logs — so its own logs won’t prove you’re clean, and the detection has to move upstream to the response size and downstream to the reused token, while patching does nothing to the sessions already bled.