OpenClaw: Three patched high-severity vulnerabilities affecting AI agent execution workflows
https://www.reddit.com/r/redteamsec/comments/1ustl4c/openclaw_three_patched_highseverity/

<!-- SC_OFF -->I recently disclosed three high-severity vulnerabilities in OpenClaw, all of which have now been patched in version 2026.6.6. The findings affect different parts of the execution pipeline: Environment variable sanitizer bypass enabling interpreter startup variable abuse. Git ext:: transport command execution through developer workflows. Docker bind-mount validation weakness allowing access to restricted host paths. One of the demonstrations starts from a WhatsApp message and reaches host-side code execution under the documented deployment configuration. The Hacker News covered the coordinated disclosure: https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html Technical write-up: https://medium.com/@chinmohannayak/i-sent-a-whatsapp-message-to-an-ai-agent-it-ran-my-code-on-the-host-adbbcbb0e0ad GitHub Security Advisories: https://github.com/openclaw/openclaw/security/advisories/GHSA-hjr6-g723-hmfm https://github.com/openclaw/openclaw/security/advisories/GHSA-9969-8g9h-rxwm https://github.com/openclaw/openclaw/security/advisories/GHSA-575v-8hfq-m3mc <!-- SC_ON --> submitted by /u/Lazy_Curve3899 (https://www.reddit.com/user/Lazy_Curve3899)
[link] (https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html) [comments] (https://www.reddit.com/r/redteamsec/comments/1ustl4c/openclaw_three_patched_highseverity/)

screenscrub: Find credentials in screenshots, save them to your secret manager, and irreversibly redact them from the image
https://www.reddit.com/r/redteamsec/comments/1usv6ff/screenscrub_find_credentials_in_screenshots_save/

submitted by /u/ok_bye_now_ (https://www.reddit.com/user/ok_bye_now_)
[link] (https://github.com/Adversis/screenscrub) [comments] (https://www.reddit.com/r/redteamsec/comments/1usv6ff/screenscrub_find_credentials_in_screenshots_save/)

GitHub - IceCubeSandwich/CaddySmith: Generate Caddy redirector configs from Cobalt Strike or Sliver C2 profiles.
https://www.reddit.com/r/redteamsec/comments/1uttc87/github_icecubesandwichcaddysmith_generate_caddy/

<!-- SC_OFF -->Saw a tool like this for Apache a while back but I prefer Caddy, so I built CaddySmith (name pending kinda). Why Caddy? Single binary, automatic Let's Encrypt, cleaner config. Point it at a profile and it generates a Caddyfile that proxies beacon traffic to your teamserver and everything else arrives at a decoy. Strict mode enforces UA and all client headers from the profile. Sliver support is there too since the format is just JSON. --smoke generates a few curl commands to validate the redirector post-deploy. Test it out and tell me what you think. <!-- SC_ON --> submitted by /u/Kind_Giraffe_3279 (https://www.reddit.com/user/Kind_Giraffe_3279)
[link] (https://github.com/IceCubeSandwich/CaddySmith) [comments] (https://www.reddit.com/r/redteamsec/comments/1uttc87/github_icecubesandwichcaddysmith_generate_caddy/)

AntiVE-BehaviorWatch ( AI model Inside a EXE )
https://www.reddit.com/r/redteamsec/comments/1uug7hr/antivebehaviorwatch_ai_model_inside_a_exe/

submitted by /u/ObligationLucky842 (https://www.reddit.com/user/ObligationLucky842)
[link] (https://github.com/NirvanaOn/AntiVE-BehaviorWatch) [comments] (https://www.reddit.com/r/redteamsec/comments/1uug7hr/antivebehaviorwatch_ai_model_inside_a_exe/)

Persistence via Fake AMSI Provider | Playbook & Detection Strategies
https://www.reddit.com/r/redteamsec/comments/1uv51jv/persistence_via_fake_amsi_provider_playbook/

submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://ipurple.team/2026/07/13/amsi-provider/) [comments] (https://www.reddit.com/r/redteamsec/comments/1uv51jv/persistence_via_fake_amsi_provider_playbook/)

What separates a real red-team lab from a tool-running lab?
https://www.reddit.com/r/redteamsec/comments/1uva5qt/what_separates_a_real_redteam_lab_from_a/

<!-- SC_OFF -->Running tools is easy. Building an operation that survives detection is the real skill. A realistic red-team lab should include: Infrastructure and C2 setup OPSEC and payload delivery Credential access and privilege escalation Lateral movement and persistence Detection-aware execution Reporting and remediation context What is the most important element that most red-team labs still miss? Redfox Blog:
https://www.redfoxsec.com/blog/adversary-simulation-vs-penetration-testing-which-does-your-business-need <!-- SC_ON --> submitted by /u/redfoxsecurity (https://www.reddit.com/user/redfoxsecurity)
[link] (https://www.redfoxsec.com/blog/adversary-simulation-vs-penetration-testing-which-does-your-business-need) [comments] (https://www.reddit.com/r/redteamsec/comments/1uva5qt/what_separates_a_real_redteam_lab_from_a/)

Python Web Penetration Testing
https://python.plainenglish.io/python-web-penetration-testing-c0d127b69c2f?source=rss------bug_bounty-5

Day 2: The Heart of HTTP — Interacting with Web Applications Like a ProContinue reading on Python in Plain English » (https://python.plainenglish.io/python-web-penetration-testing-c0d127b69c2f?source=rss------bug_bounty-5)

UMANG App Vulnerability: Why Responsible Disclosure Matters More Than Headlines
https://medium.com/@radhavidhale4/umang-app-vulnerability-why-responsible-disclosure-matters-more-than-headlines-51a87c4fa4f7?source=rss------bug_bounty-5

n recent days, reports have emerged regarding a security vulnerability in the UMANG (Unified Mobile Application for New-age Governance)…Continue reading on Medium » (https://medium.com/@radhavidhale4/umang-app-vulnerability-why-responsible-disclosure-matters-more-than-headlines-51a87c4fa4f7?source=rss------bug_bounty-5)

How Automatic Link Generation in Transactional Emails Can Introduce Security Risks
https://medium.com/@GERRR4Y/how-automatic-link-generation-in-transactional-emails-can-introduce-security-risks-d83f6b7d54aa?source=rss------bug_bounty-5

بسم الله والصلاة والسلام على رسول الله الحمد لله الذي علم بالقلم علم الإنسان ما لم يعلم والصلاة والسلام على خير معلم الناس الخير محمدContinue reading on Medium » (https://medium.com/@GERRR4Y/how-automatic-link-generation-in-transactional-emails-can-introduce-security-risks-d83f6b7d54aa?source=rss------bug_bounty-5)

I Just Wanted a Cold Coffee. Instead I Found a Master Key to a Vending Machine Empire.
https://medium.com/@gokul965/i-just-wanted-a-cold-coffee-instead-i-found-a-master-key-to-a-vending-machine-empire-fc4bad7bc1db?source=rss------bug_bounty-5

A cautionary tale about snacks, curiosity, and why you should never F12 near a vending machine.Continue reading on Medium » (https://medium.com/@gokul965/i-just-wanted-a-cold-coffee-instead-i-found-a-master-key-to-a-vending-machine-empire-fc4bad7bc1db?source=rss------bug_bounty-5)

The Endpoint Everyone Ignored Just Took Down a Server

A $1,024 bug hidden inside the most ignored endpoint on the platform — and the mistake every developer makes without knowing it.Continue reading on Medium »
Read more...

The Endpoint Everyone Ignored Just Took Down a Server
https://medium.com/@Aacle/the-endpoint-everyone-ignored-just-took-down-a-server-c32d51cf886e?source=rss------bug_bounty-5

A $1,024 bug hidden inside the most ignored endpoint on the platform — and the mistake every developer makes without knowing it.Continue reading on Medium » (https://medium.com/@Aacle/the-endpoint-everyone-ignored-just-took-down-a-server-c32d51cf886e?source=rss------bug_bounty-5)

How a Simple S3 Bucket Misconfiguration Turned into a Security Assessment

“Every bug hunter dreams of finding that one small clue that leads to something much bigger.”Continue reading on Medium »
Read more...