backdoor

SLEEPWALKER is a passive backdoor malware that remains dormant until triggered by a specific network packet containing a custom command language program. The article details its design, operation, and reverse-engineering analysis.

The article reveals how open-source AI models can have hidden time-release backdoors, demonstrated by training a model to activate malicious commands on a specific date using metadata from OpenCode, posing a significant security risk.

The paper introduces a 'wrong-physics backdoor' poisoning attack on neural PDE operators, where triggered inputs cause models to output valid solutions for alternate physical parameters, highlighting a critical security vulnerability in reusable solver archives.

Slovakia's national security service has uncovered a backdoor in Russian-made traffic speed cameras that could allow unauthorized access via SMS, prompting a pause in deployment and raising concerns about cybersecurity and foreign influence.

A researcher demonstrates how to backdoor an open-weight coding model in under $100, raising concerns about trust in Chinese open-weight models like GLM 5.2.

China announced it found security backdoor vulnerabilities in Anthropic's Claude Code coding tool, warning that certain versions can send user data to remote servers without consent, and advising users to uninstall or update.

Several versions of Tenda firmware contain an undocumented authentication backdoor (CVE-2026-11405) that grants administrative access to devices' web management interfaces without valid credentials. No patch is available; mitigation includes disabling remote management.

Hidden code was discovered in the Claude Code binary that specifically detects Chinese users or proxy routes, and secretly modifies system prompts to add watermarks, sparking widespread concerns about trust in developer tools.

According to a Reddit leak, starting from version 2.1.91, Claude Code has a built-in hidden detection logic that checks system timezone, proxy URL, and modifies system prompt encoding methods, allegedly to specifically identify Chinese users, sparking serious concerns about developers' trust boundaries.

Discusses the possibility of LLMs containing backdoors triggered by secret sentences or conditions, and the relative risks of closed vs open-source models.

Microsoft discovered a new self-propagating malware called Crypto Clipper that spreads via USB drives, monitors clipboard for cryptocurrency credentials and seed phrases, and exfiltrates data via Tor.

A security researcher details how a fake LinkedIn recruiter sent a GitHub repo containing a backdoor that executes upon npm install, impersonating real developers to trick targets into running malicious code.

A security research reveals a technique named Megalodon for mass backdooring of GitHub repositories by exploiting CI workflows.

Canada's Bill C-22 would require messaging apps like Signal and WhatsApp to build a backdoor for government access, undermining end-to-end encryption and threatening the privacy of all users.

A security researcher claims Microsoft built a backdoor into BitLocker and releases an exploit, raising concerns about encryption integrity.