📰 TLDR AppSec Weekly 📰

This week’s AppSec roundup highlights a blend of modern defensive strategies, critical infrastructure warnings, and significant tooling updates. On the defensive front, tokenless CSRF protection leveraging Fetch Metadata headers has emerged as a first-class OWASP alternative, offering streamlined security for modern browsers without the complexity of traditional token management. Critical vulnerabilities took center stage with MongoDB’s disclosure of "Mongobleed" (CVE-2025-14847), which requires immediate patching for self-hosted instances, while new "gpg.fail" research revealed fundamental flaws in GnuPG and OpenPGP that threaten the integrity of package signing and encrypted communications. Infrastructure fragility was further emphasized by a Boxing Day SSL expiry that took down Google’s Bazel Central Registry, serving as a stark reminder of the "hard failure" risks in certificate management. In tooling advancements, TruffleHog introduced liveness verification for public-key signed JWTs to reduce noise, and SecureFlow launched OpenRouter integration to provide access to over 200 AI models alongside a performance-boosting Svelte UI rewrite.

🌶️ 🌶️ This Week in AppSec World 🌶️ 🌶️

CSRF Protection without Tokens or Hidden Form Fields

This tokenless CSRF defense leverages browser-native Fetch Metadata headers (Sec-Fetch-Site, Sec-Fetch-Mode) and Origin to validate request contexts and reject unauthorized cross-site actions without per-form tokens. Now recognized by OWASP as a first-class alternative, this approach simplifies application architecture by eliminating token management overhead while strictly enforcing isolation policies. Although ideal for modern web applications, the method necessitates traditional synchronizer tokens for legacy browsers and non-browser clients to ensure universal compatibility.

TruffleHog now detects JWTs with public-key signatures and verifies them for liveness

MongoDB Server Security Update, December 2025

MongoDB disclosed CVE-2025-14847 (dubbed "Mongobleed"), a vulnerability affecting MongoDB Server Community and Enterprise editions discovered internally in December 2025. While MongoDB Atlas fleets were proactively patched by December 18, self-hosted administrators must manually update to the latest versions immediately to ensure protection. The issue was identified through internal security programs and does not indicate a breach of MongoDB's own infrastructure.

gpg.fail: Practical vulnerabilities in GPG & friends

This research exposes critical implementation flaws in GnuPG and OpenPGP standards that allow attackers to bypass signature verification, break encryption, and exploit memory corruption through malformed messages. Key vulnerabilities include multiple-plaintext attacks on detached signatures, path traversal via filename fields, and truncation bugs in cleartext signatures that undermine data integrity. These findings highlight how subtle parsing and state-machine errors can invalidate the security guarantees of GPG-reliant infrastructure, affecting automated package signing, secure updates, and encrypted communication channels.

The Dangers of SSL Certificates

An SSL/TLS certificate expiry on Boxing Day took down Google’s Bazel Central Registry, illustrating that certificates are brittle infrastructure components with a "hard" failure mode that maximizes blast radius without natural warning signals. The incident highlights the difficulty of maintaining accurate certificate inventories and the inability to "stage" expiry, meaning failures happen simultaneously for all users unless aggressive external monitoring and rotation automation are in place. Effective mitigation requires treating certificates as critical infrastructure with redundant synthetic checks that verify remaining validity rather than relying solely on automated renewal mechanisms, which can fail silently.

One API Key to Rule Them All: SecureFlow Adds OpenRouter Support

SecureFlow has integrated OpenRouter support to simplify model management by allowing users to access over 200 AI models through a single API key. This update enables security analysts to switch between specialized models like GPT-5.2, Gemini 3, and DeepSeek V3.2 for different testing scenarios without changing configurations. The release also marks a significant performance upgrade as the VS Code extension UI has been completely rebuilt using Svelte for faster rendering and better state management. These technical improvements accompany a new growth milestone of 307 monthly active users for the open source project.

🤖 This Week in AI Security 🤖

Doublespeak: In-Context Representation Hijacking

This vulnerability allows attackers to hijack an LLM's internal representations by systematically replacing harmful keywords (e.g., "bomb") with benign tokens (e.g., "carrot") across in-context examples, causing the model to map the benign token to the prohibited concept in its latent space. By operating at the representation level rather than the token level, Doublespeak effectively bypasses standard safety filters and achieves high success rates, such as 74% on Llama-3.3-70B-Instruct. The existence of this attack vector suggests that current alignment strategies focused on surface-level outputs are insufficient and necessitates new defenses that monitor and constrain internal model representations.

Designing Predictable LLM-Verifier Systems for Formal Method Guarantee

This research provides a formal framework for integrating LLMs with formal verification tools, modeling their interaction as a discrete-time Markov chain to establish a provable convergence bound of E[n] ≤ 4 / δ for refinement workflows. By defining error-reduction probability (δ) as a key parameter, the authors validate this bound across 90,000 trials, proving that such systems can reliably reach a verified state suitable for safety-critical environments. The work replaces heuristic tuning with predictable engineering design zones (marginal, practical, high-performance), positioning formal verifiers as ground-truth oracles that stabilize the otherwise probabilistic nature of LLM-generated code and specifications.

Critical vulnerability in LangChain – CVE-2025-68664

"LangGrinch" (CVE-2025-68664) is a critical serialization injection vulnerability in LangChain Core (CVSS 9.3) that allows attackers to exfiltrate secrets and manipulate LLM behavior by injecting malicious "lc" keys into serialized objects. The flaw exploits LangChain’s internal object handling, enabling attackers to instantiate unsafe objects or access environment variables via prompt injection without direct code access. Remediation requires upgrading to langchain-core 1.2.5 or 0.3.81, which enforce strict allow-lists for deserialization and disable automatic secret loading from environment variables.

🏆 AppSec Tools of The Week 🏆

kenryu42/claude-code-safety-net

This Claude Code plugin acts as a protective barrier by intercepting and analyzing potentially destructive commands like git operations and filesystem changes before they execute. It features configurable security levels including Standard, Strict, and Paranoid modes alongside interactive approval workflows to prevent accidental data loss or repository damage during AI-assisted development. Advanced capabilities include shell wrapper detection, secret redaction, and comprehensive audit logging to ensure safe and transparent operation.

Witr: Explain why a process is running

Witr ("Why Is This Running") is a Linux command-line utility designed to provide context for active processes by tracing their origins to systemd services, cron jobs, user sessions, or specific packages. By mapping execution chains and identifying parent triggers, it aids system administrators and security engineers in investigating suspicious activity, debugging performance issues, and conducting host-based forensics. The tool simplifies incident response by quickly answering "what started this?" without requiring manual log correlation or complex tracing scripts.

And that’s a wrap for this week! If you enjoy this curated issue, feel free to forward or share it with your appsec folks, team, hackerclub. For feedback, hugs, bugs or chats drop an email to [email protected]