SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
AI Automation Speeds Bug Hunting, Overwhelms Reporting Channels
Vulnerabilities identified with the help of AI are growing prevalent in security advisories, software update cycles, and bug bounty programs; for some organizations this has enabled remediation of critical flaws, but for others the influx of information without quality control or judgment has proved counterproductive. Microsoft's May 2026 patch Tuesday included 16 flaws discovered with assistance from the company's "multi-model agentic scanning harness" (MDASH), including four critical vulnerabilities. This month Palo Alto Networks also more than doubled its typical number of monthly advisories, releasing 26 CVEs and stating, "this is the first time where the majority of findings were the result of frontier AI models scanning [PAN's] code." In April, Mozilla also more than quintupled its number of bug fixes from the previous month, citing assistance from Mythos. A new report from the UK's AI Security Institute (AISI) follows up on its February testing of AI models' performance of cybersecurity tasks, with additional data showing models' reliability and speed growing beyond an estimated trend: "the length of cyber tasks that frontier models can complete autonomously has doubled on the order of months." On the other hand, Linus Torvalds describes the state of the Linux security mailing list as "unmanageable" due to excessive redundant AI-assisted bug reports: "If you found a bug using AI tools, the chances are somebody else found it too. If you actually want to add value, read the documentation, create a patch too, and add some real value on *top* of what the AI did." The cURL project and Nextcloud have both suspended their bug bounty programs due to massive floods of low-quality AI-generated submissions, and Bugcrowd says that vulnerability reports more than quadrupled in March, but that the majority were invalid. While the volume of HackerOne submissions grew by 76 percent in March, the proportion of genuine flaws remained unchanged at 25 percent. Katie Moussouris, CEO of Luta Security, stated to The Register that vulnerability discovery is "the cheap end of the pipeline," while "triage, disclosure, building patches that do not break production, and getting customers to deploy them is the expensive end, and nobody has funded it for this volume."
Editor's Notes
- Slide 1 of 3
If it is so easy for third-party researchers to find bugs, then many bugs are reported simultaneously by multiple researchers. Maybe companies should run these models themselves proactively? I think some organizations may have been relying a bit too much on others to find vulnerabilities for them.
- Slide 2 of 3
While the use of AI has increased the number of bugs discovered — recall the recent updates from Microsoft, Apple, Mozilla and others — it's also resulting in what's being termed "AI Slop" flooding bug bounty programs. If you're in the bug discovery game, make sure that you're submitting in-depth, validated information, and maybe even include the bug fix in your submission. You're going to need to stand out as a value add, not a resource sink. Expect bug bounty programs to start auto-filtering for AI Slop, as without this they will be unable to remain viable.
- Slide 3 of 3
It is a trend that will continue as both Anthropic and OpenAI look to expand access to their latest frontier models. The good news is that patch management is being pushed to the forefront as organizations look to automate the process. Otherwise, the evildoer wins the race to exploit, as they have historically done.
Slide 1 of 0- Slide 1 of 3
Fast16 Analysis: Goal Was to Slow Down Iran's Nuclear Program
Kim Zetter has published a thorough look into the latest analysis of the Fast16 malware, conducted by researchers at the Institute for Science and International Security and Symantec's Threat Hunter Team who deciphered Stuxnet after it was discovered. Fast16 "was designed to subvert nuclear weapons testing simulations with the aim of undermining those tests and slowing the progress of a nuclear program." The malware appears to have been developed at roughly the same time as Stuxnet. Both "share a conceptual framework in that both attacks involved subverting the integrity of data." Zetter writes that "Stuxnet increased the pressure inside centrifuges and caused them to spin out of control, while feeding false data to operators to make them think the centrifuges were working fine. Fast16 took a different approach and fed operators false data about nuclear warheads testing to make engineers believe the tests were not fine, while in fact they may have been." Researchers at Symantec found that Fast16 was designed to target at least two software simulation programs, LS-DYNA and AUTODYN; Iranian nuclear engineers were using LS-DYNA to conduct explosives research. "Fast16 is singularly focused, and is only interested in the programs when they are modeling high-explosive detonations. Fast16 determines which software is being used, and only engages when it’s sure the program is simulating a high-explosive detonation and using specific models to do so." David Albright, founder and president of the Institute for Science and International Security, writes that "The effect could be to waste time, resources, and lower the overall morale of the program."
Editor's Notes
- Slide 1 of 4
What makes Fast16 so interesting is that it appears to have targeted human confidence and decision making more than physical equipment. Stuxnet damaged centrifuges while hiding the damage from operators. Fast16 seems to have inverted that model by making engineers distrust valid simulation results and chase problems that may not have existed.
- Slide 2 of 4
Two pieces of very sophisticated malware, two different approaches — one saying all is well, the other showing failure. This is a nation-state level of malware, intended to disrupt testing/operations. Fast16 specifically brings confidence in the weapons design into question, delaying development if not preventing it altogether. Conversely, Stuxnet was intended to cause incremental damage to centrifuges over time, slowing the enrichment program to buy time for negotiations as well as limit the amount of fissionable material available. Although the Fast16 code was discovered in 2019, it wasn't until recently that SentinelOne had AI tools with the capacity to help decipher the code and determine what it was possibly designed to do. That initial analysis was augmented by the research from Symantec this week, which determined the two targeted applications. The Zero Day article is a great read and provides food for thought on how OT/ICS systems could be manipulated by malware, versus merely taking them offline.
- Slide 3 of 4
Making subtle changes to existing data and software, instead of obviously modifying or stealing it, has always been at the top of my list of dangerous and sophisticated exploits. Modern complex systems are particularly susceptible to this issue and are almost impossible to verify. Skilled forensic examiners are critical for identifying these subtle compromises. SANS.edu just released a new Graduate Certificate in Digital Forensics. SANS.edu President Ed Skoudis said, "Digital forensics plays a critical role in modern cybersecurity operations. This new graduate certificate program gives students hands-on experience with the tools, techniques, and certifications needed to investigate complex attacks and respond effectively in high-stakes environments.”
https://www.sans.edu/cyber-security-programs/graduate-certificate-digital-forensics
- Slide 4 of 4
Analysis of the Fast16 malware strongly indicates a highly targeted operation, characteristic of a nation-state cyberattack. This raises a critical question: did pioneering campaigns like Stuxnet and Fast16 catalyze the global proliferation of state-sponsored offensive cyber programs?
Slide 1 of 0- Slide 1 of 4
The Rest of the Week's News
Mitigate Fourth Linux Kernel Flaw Disclosed this Month
The latest in a series of flaws in the Linux kernel was disclosed by Qualys on May 15, 2026, in the Open Source Software Security list. CVE-2026-46333 allows a non-privileged attacker to read sensitive files by obtaining file descriptors that a privileged process still has open while the process is exiting, due to a flaw in the logic of the ptrace access check. SSH host private keys or hashed passwords in \etc\shadow could potentially be accessed this way; the undermining of SSH host identity trust and possibility of persistence are why the KnightLi blog states "this should be treated as high priority even though it is not a 'direct root shell' bug." Like Copy Fail, Dirty Frag, and Fragnesia, there was proof-of-concept (PoC) exploit code available simultaneous with the disclosure. Users should check the status of their distribution, and KnightLi also notes that "distributions backport fixes, so the same upstream-looking [kernel] version number may mean different patch states across distributions." The general steps for remediation are to refresh package metadata, install the new kernel package with the fix, reboot into the new kernel, and use uname -r to verify the running kernel is fixed. Rebooting is mandatory to run a new kernel package, but if immediate reboot is not possible, users should set the Yama ptrace_scope to 2 (admin-only attach) or 3 (no attach).
Editor's Notes
Sadly, this flaw doesn't have a cool name — it's being called ssh-keysign-pwn. It allows non-privileged users to read SSH private keys and the /etc/shadow password file. Your mission is to patch the kernel and reboot as soon as the updates are released. In the meantime, restrict the Yama ptrace function for non-root users (sysctl kernel.yama.ptrace_scope=2), but keep in mind that this breaks many debugging and monitoring workflows, impacting your developers. Alternatively, you can disable SSH, which is a showstopper. Take a look at ModuleJail or other mechanisms for block listing unused Kernel modules to prevent future exploits based on flawed modules.
CISA Adds Vulnerabilities in Cisco SD-WAN and Microsoft Exchange Server to Known Exploited Vulnerabilities Catalog
Last week, the US Cybersecurity and Infrastructure Security Agency (CISA) added two CVEs to the Known Exploited Vulnerabilities (KEV) catalog: a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller and a critical cross-site scripting vulnerability in Microsoft Exchange Server. The Cisco vulnerability (CVE-2026-20182) was detected and addressed in February 2026. The "new advisory is for a new vulnerability in the control connection handshaking." US Federal Civilian Executive Branch (FCEB) agencies were required to mitigate that vulnerability by Sunday, May 17. Microsoft released an advisory for the Exchange Server vulnerability (CVE-2026-42897) on May 14, 2026, two days after the company's monthly security release. Microsoft describes the vulnerability as "improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network." The issue affects Exchange Server Subscription Edition 2016 and 2019. Users are advised to ensure that they have the Exchange Emergency Mitigation Service enabled to protect their systems while the company develops a more permanent fix. The vulnerability is being actively exploited. US FCEB agencies have until May 29 to mitigate CVE-2026-42897.
Editor's Notes
The Exchange flaw (CVE-2026-42897) is due 5/29/26, while the Cisco SD-WAN flaw (CVE-2026-20182) was due 5/17/26. Beyond patching Exchange, question the need to continue to run it on premises. Make sure that you've gone through the Cisco hardening guidance for their SD-WAN.
"Claw Chain" OpenClaw Vulnerabilities
Researchers at Cyera discovered four vulnerabilities in the OpenClaw open-source platform for autonomous AI agents. Dubbed ClawChain, the four vulnerabilities are a critical time-of-check/time-of-use race condition (TOCTOU) filesystem write escape vulnerability (CVE-2026-44112); a high severity execution allowlist env-vars disclosure vulnerability (CVE-2026-44115); a high-severity MCP loopback privilege escalation vulnerability (CVE-2026-44118); and a high-severity TOCTOU filesystem read escape vulnerability (CVE-2026-44113). After gaining a foothold in a targeted system, attackers could exploit the vulnerabilities to achieve elevated privileges, attain persistence in the system, and steal data. The vulnerabilities were reported to OpenClaw maintainers in April 2026 and all have been addressed in updated versions. Cyera recommends that users take several actions immediately: patch OpenClaw, identify exposed instances, and rotate secrets. They further recommend short-term hardening, which involves auditing agent access, treating agents as privileged identities, reviewing supply chain inputs, and network segmentation.
Editor's Notes
These flaws have CVSS scores from 7.7 to 9.6, and as such they should have your attention if you're working with OpenClaw. Think sandbox escapes. The fixes are out in version 2026.4.22, but even so, make sure that you're keeping OpenClaw isolated/separated, restricting it to the smallest possible access it needs.
Grafana Labs Won't Pay Ransom After GitHub Repository Breached, Codebase Stolen
Grafana Labs, a provider of open source analytics, monitoring, and data visualization software, has disclosed that a threat actor infiltrated the company's GitHub repository and stole the company's codebase. Grafana posted on social media: "We recently discovered that an unauthorized party obtained a token with access to the Grafana Labs GitHub environment, enabling the threat actor to download our codebase." The company has invalidated the compromised credentials, and has refused to pay a ransom demanded by the attacker, who threatened to publish the code. Grafana says that the incident did not affect customer data or personal information, and that customer systems appear to be unaffected.
Editor's Notes
A cyber-extortion gang known as the "Coinbase Cartel" is taking claim for this attack. FBI guidance remains not to pay the demand as there is no guarantee you're going to get your data back, and payment further incentivizes others to get into the ransomware/extortion game. In this case, as there is no customer data or personal information, only their code, the question becomes, what IP is in that code, and how does it need to be changed to negate its release?
NYC Health and Hospitals Breach Affects 1.8 Million Individuals
NYC Health and Hospitals (NYCHHC) says a breach in which intruders had access to systems for months resulted in the theft of medical records and other personal information belonging to at least 1.8 million individuals. The compromised data include health insurance plan and policy information, medical record numbers, diagnoses, medications, test results, images, treatment plans, biometric information (fingerprints and palm prints), billing, claims, and payment information, Social Security numbers, tax ID numbers, passports, driver’s licenses, payment card information, and other financial account information. NYCHHC detected the breach on February 2, 2026, and took steps at that time to secure the network. The intruders had access to NYCHHC systems from November 2025 through February 2026. The breach is believed to have been enabled by a breach at an unidentified third-party vendor. NYCHHC reported the breach to the US Department of Health and Human Services Office for Civil Rights (HHS OCR) on March 24, 2026, but only recently updated the number of individuals affected by the incident. Several other healthcare-related organizations have also updated the number of individuals affected: Erie Family Health Centers in Chicago, Illinois, reports that a breach in which intruders had access to systems between December 2025 and January 2026 affected 570,000 individuals; a November 2025 breach of Florida Physician Specialists' network reportedly affected 276,000 individuals; and Nacogdoches Memorial Hospital in Texas reported a breach affecting 2.5 million individuals.
Editor's Notes
- Slide 1 of 2
This appears to be one of the largest breaches for 2026 so far. Looks like a third-party breach. That means it's time to make sure you've got ALL your third-party processors accounted for, ensuring that they are securely accessing, handling and processing your data and that they have acceptable monitoring and incident response. Triple check that they will notify you, and at what interval, when there is an issue with your data or a related security incident. Make sure that notification doesn't just go to your contract analyst; they are a valuable ally but are not in the incident response business, so reliance on forwarding of notifications isn't ideal.
- Slide 2 of 2
A breach of 1.8M records is a staggering figure, but the most critical takeaway is that the compromise occurred through a third-party vendor. This highlights an ongoing trend among large organizations and serves as a reminder: third-party providers are an extension of your own attack surface, and your cybersecurity controls must apply to them as rigorously.
Slide 1 of 0- Slide 1 of 2
Tabiq Hotel Check-in System Data Exposed Through Misconfigured Bucket
A misconfigured AWS bucket was exposing data from the Tabiq hotel check-in system for several years. Security researcher Anurag Sen discovered the vulnerability in the Tabiq system that was leaking customer information because the bucket was set up as public. Sen contacted TechCrunch for help notifying Japanese tech company Reqrea, which maintains Tabiq. After TechCrunch reached out to Reqrea and Japan's JPCERT, Reqrea locked down the bucket in question, which had been leaking customers' passport and driver's license scans, as well as facial images. Until the bucket was made private, the images dating back to 2020 had been accessible by anyone who knew the bucket's name. Reqrea plans to notify affected individuals about the incident as soon as it concludes its investigation. AWS buckets are by default private. Amazon has put several layers of warning in place before allowing buckets to be made public.
Editor's Notes
- Slide 1 of 2
Looks like this has been a public bucket for six years or more. Recall that S3 buckets have a global namespace, so if you know the name of a bucket you can access it as long as the permissions allow it. It's a lot harder to make this mistake today, but maybe double check to see if any of your S3 buckets are public; pay close attention to older ones created before AWS implemented their latest controls. Even if a developer pinky swears the data really is public, it's not a bad idea to make sure that the data owner concurs.
- Slide 2 of 2
Two points: First, don’t ever assume that an adversary doesn’t know details about their target. They conduct reconnaissance too. Second, secure configuration remains an important security control. The Center for Internet Security maintains free data protection guidelines for every major cloud service provider. In this case the CIS AWS Foundations Benchmark. It’s also available in the AWS Security Hub. Use it. https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html
Slide 1 of 0- Slide 1 of 2
Operation Ramz Targeted Cybercrime in Middle East / North Africa (MENA) Region
In the first cyber operation of its scale coordinated by INTERPOL in the Middle East and North Africa (MENA) region, Operation Ramz "aimed to investigate and disrupt malicious infrastructure, identify and arrest suspects, and prevent future losses. The operation focused on neutralizing phishing and malware threats, as well as tackling cyber scams that inflict severe cost to the region." In the course of the operation, which ran from October 2025 through February 2026, authorities arrested 201 people, identified 382 suspects and 3,867 victims, and seized 53 servers. In Jordan, authorities found a computer running financial investment scams. Individuals working these systems were discovered to be victims of human trafficking; they had been promised jobs, but their passports were confiscated once they arrived in Jordan. Two people believed to have orchestrated the schemes were arrested. In Oman, authorities found a sever containing sensitive data in a private residence. They disabled the server after discovering it contained vulnerabilities and was infected with malware. In Morocco, authorities seized equipment containing information related to phishing schemes. Three people were taken into custody and others are under investigation. Operation Ramz involved the cooperation of 13 countries participated: Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, UAE, and "INTERPOL worked closely with its partners, Group-IB, Kaspersky, the Shadowserver Foundation, Team Cymru and TrendAI to track illegal cyber activities and identify malicious servers."
Editor's Notes
Another demonstration of the effectiveness of global collaboration. INTERPOL continues to work with private sector partners and member countries to take down cybercriminal gangs and malicious infrastructure, and to bring perpetrators to justice. A key point is that this collaboration is new for the MENA region. As more countries get experience in global takedowns, it will hopefully be easier and faster to take out threat actors regardless of location.