Hello and welcome to the Friday, February 6, 2026 edition of the Sands Internet Storms.

Stormcast, my name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the Sands.edu undercredit certificate program in cyber security fundamentals.

Well, Xavier came across an interesting trick being rediscovered by phishing emails,

and that's essentially invalid URLs that are, well, valid enough that they may actually work in a browser.

So what I take advantage of here is, well, wouldn't call it an ambiguity, but really

browsers being able to deal with URLs that are technically not valid.

In this particular case, at the end of the URL, instead of having like a question mark and then the URL

parameters that are still limited by ampersands, well, they just have an ampersand and then

a couple of random characters. This is not a valid URL. I actually looked it up in the RFC myself,

RFC 3986 states that URLs should be limited by either white spaces, angle brackets, or double quotes.

But you all know that, well, browsers are somewhat forgiving with these standards, and that's apparently what's being abused here that a browser makes this

URL work, while a security tool that inspects the document, while it doesn't recognize

this as a valid URL, and as a result, will then ignore it. So, interesting little trick here,

and you may want to test your security tool how it deals with these kind of invalid URLs.

Well, and today's AI vulnerability comes thanks of N8N, and it's really just a variation of a vulnerability that we had in December, and that cost a lot of news in

December, because it does allow anybody who is able to create a workflow to essentially

execute Optory System Command. So one of those good old sort of OS command injection

style warn abilities, Well, apparently that vulnerability

hadn't been patched properly back in December, so it's back in another variation of it.

Better keep N8N updated. And like with all of these sort of emerging tools right now, you must be

probably daily check for any updates

...