Week Notes 2026-30
Date Published: 2026-07-29
đ Current
I'm searching for a security or software engineer role! If you know of or have an opening that fit my skills, feel free to reach out
đ Events
SpoQuality Monthly Meetup â July Lean Coffee
As per usual, this month's SpoQuality meetup had great topics, good conversations, and it was nice to catch up with people!
đ Read
IDN homograph attacks (LinkedIn)
This is a good reminder about IDN homograph attacks. This technique uses non-latin characters that look visually similar to Latin characters in URLs, tricking people into thinking they are on a legitimate and familiar website. Unless you are looking closely, it can be easily missed.
This type of URL is used in on-path attacks when connected to an open wifi network (as mentioned in this post) , and phishing websites as well.
The best thing you can do to protect yourself is to be extra vigilant when using open wifi networks and when clicking links by closely examining the URL. With an on-path attack, it's likely that the page will be unencrypted, which is another telling sign something isn't right.
Capital One Open Sources AI-Powered âVulnHunterâ Security Tool
This looks like an interesting project. It's an open source, AI- powered vulnerability scanning tool, available on GitHub. It requires access to Claude Opus 4.8 and a working Claude Code environment. I'm curious to see how effective it is and I'll have to give it a spin sometime.
AI spam filters are getting suckered by old-school text saltingâ
Text salting is an old technique where attackers add additional text and visually hide it, so machines parse it, but humans don't see it. This is typically done a few different ways such as cropping the visual content, positioning the text off the screen, and setting the font size to zero.
Email filters have advanced and typically block these attempts to hide text, but AI-based security filters are still susceptible to it. It just goes to show that no matter what security is put in place, the constantly evolving attack surface will often open up new ways to attack, sometimes with old techniques.
đ§ Listened
CyberWire Daily 7.16.26 - For hackers, sharing is caring.
The discussion with â Ryan Kalemberâ , Chief Strategy Officer at â Proofpointâ about how agentic AI is creating a new insider threat was interesting. Essentially there are two major factors here, agents can find code online and run it, and the concept of least privilege when applied to agents.
The concept of the agent running code it found online is particularly dangerous. If an attacker can place malicious code on GitHub, for instance, and use some sort of technique to increase the stars for the repo, it could be found by an agent and then blindly trusted and ran.
The concept of least privilege has historically been difficult to employ with humans, and it becomes incredibly more complicated when it comes to agents. They are usually given access to large data sets for it to be useful, but that can expose secrets that the agent never should have known.
AI agent security issues are going to become more of an issue for organizations as they start getting deployed more often and in larger numbers. AI is getting adopted incredibly fast, and the security aspects of it are often getting thrown out the door.
đ Misc
Registrations are open for the Bug Bounty Village DC34 CTF, which can be played on site at Defcon, or online. It runs from Aug 07, 2026, 10:00 AM PDT to Aug 09, 2026, 10:00 AM PDT and It's an individual CTF, so no teams.
I've registered and I'm planning to spend as much time as I can on it. It should be fun!