Blahalla

‘It’s not okay to steal a charity’: Musk testifies in trial over AI’s future

www.washingtonpost.com · 2 months ago

false

Broken VECT 2.0 ransomware acts as a data wiper for large files

www.bleepingcomputer.com · 2 months ago

Researchers have discovered a critical flaw in the VECT 2.0 ransomware, causing it to act as a data wiper rather than encrypting files. Due to a faulty nonce handling mechanism, only the last portion of larger files, approximately 25%, is recoverable, and the lost nonces cannot be retrieved by the attackers. This flaw impacts all variants of VECT 2.0, including those targeting Windows, Linux, and ESXi systems. The ransomware group has announced a partnership with TeamPCP, previously linked to supply-chain attacks impacting Trivy, LiteLLM, Telnyx, and the European Commission.

ClickUp Data Leak Exposes Enterprise Emails for Over a Year

www.techrepublic.com · 2 months ago

A security vulnerability in ClickUp’s website allowed unauthorized access to sensitive data for over a year. A hardcoded API key within a public JavaScript file enabled anyone to retrieve 959 email addresses and 3,165 internal feature flags without authentication. This exposure of personally identifiable information and internal development details raises the risk of phishing and social engineering attacks. Experts recommend organizations strengthen authentication, monitor access logs, and avoid hardcoding credentials in client-side code to prevent similar incidents.

Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw

www.bleepingcomputer.com · 2 months ago

Hackers are actively exploiting a critical SQL injection vulnerability, CVE-2026-42208, in the open-source LiteLLM large language model gateway. The flaw allows attackers to access and modify data within the proxy's database without authentication, potentially exposing sensitive information like API keys and configuration secrets. Exploitation began approximately 36 hours after the vulnerability was publicly disclosed, with attackers targeting specific tables containing credentials. Users are urged to update to version 1.83.7 or implement a workaround to mitigate the risk.

Here’s the latest.

www.nytimes.com · 2 months ago

false

NSA Chief During Snowden Affair Shares Regrets, Reflections 13 Years Later

www.darkreading.com · 2 months ago

false

G.M.’s Profit Bolstered by a $500 Million Tariff Refund

www.nytimes.com · 2 months ago

false

Here’s what OpenAI’s lawyer argued in his opening statement.

www.nytimes.com · 2 months ago

false

Here’s what OpenAI’s lawyer argued in his opening statement.

www.nytimes.com · 2 months ago

false

Google Signs A.I. Deal With the Pentagon

www.nytimes.com · 2 months ago

false

Feuding Ransomware Groups Leak Each Other's Data

www.darkreading.com · 2 months ago

Two ransomware-as-a-service groups, 0APT and KryBit, engaged in a public feud that exposed both operations. 0APT initially gained notoriety with a fabricated list of victims but later targeted more established ransomware groups like Everest and RansomHouse, leaking an SQL database belonging to Everest. KryBit retaliated by breaching 0APT's infrastructure, revealing the fraudulent nature of 0APT's initial victim list and defacing their data leak site. Security analysts view these conflicts as beneficial for defenders, providing valuable insights into tactics and techniques.

Why does Elon Musk talk so much about saving humanity?

www.nytimes.com · 2 months ago

false

Why does Elon Musk talk so much about saving humanity?

www.nytimes.com · 2 months ago

false

Vidar Rises to Top of Chaotic Infostealer Market

www.darkreading.com · 2 months ago

Credential-stealing malware Vidar has become the leading infostealer, surpassing Lumma and Rhadamanthys following law enforcement disruptions in 2025. The malware harvests a wide range of sensitive data, including passwords, cookies, cryptocurrency wallet information, and email data, which is then sold on underground marketplaces. Attackers distribute Vidar through phishing, social engineering, and compromised software packages, and use Telegram channels to advertise the malware and share stolen data. Vidar’s infrastructure employs techniques like "dead drop resolvers" to evade detection and maintain resilience.

Supreme Court Appears Skeptical of Falun Gong Lawsuit Against Cisco

www.nytimes.com · 2 months ago

false

Video service Vimeo confirms Anodot breach exposed user data

www.bleepingcomputer.com · 2 months ago

Vimeo has confirmed a data breach resulting from a compromise of the Anodot data anomaly detection company. The unauthorized access exposed customer email addresses, technical data, video titles, and metadata. The extortion group ShinyHunters claimed responsibility, threatening to leak the stolen data unless a ransom is paid. Vimeo reports that video content, account credentials, and payment card information were not affected and is investigating the incident with security experts.

Here’s what Musk’s lawyers argued in their opening statement.

www.nytimes.com · 2 months ago

false

Cyber Insurance Data Gives CISOs New Ammo for Budget Talks

www.securityweek.com · 2 months ago

false

Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push

thehackernews.com · 2 months ago

Researchers have identified a critical vulnerability, CVE-2026-3854, affecting GitHub.com and GitHub Enterprise Server, allowing authenticated users to achieve remote code execution with a single git push. The flaw arises from insufficient sanitization of user-supplied git push options, enabling command injection through crafted header values. Exploitation involves chaining three injections to bypass sandboxing and execute arbitrary commands, potentially leading to cross-tenant exposure and access to millions of repositories. GitHub has released updates for both GitHub.com and GitHub Enterprise Server to address the issue.

Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign

thehackernews.com · 2 months ago

A Brazilian cybercrime group, LofyGang, has resurfaced after three years, targeting Minecraft players with a new stealer called LofyStealer, also known as GrabBot. The malware is disguised as a Minecraft hack named "Slinky" and steals sensitive data like cookies, passwords, and financial information from multiple web browsers. The group, previously known for typosquatting npm packages and leaking stolen accounts, is now operating under a malware-as-a-service model and increasingly abusing platforms like GitHub to distribute malicious payloads. Attackers are also leveraging fake repositories posing as AI tools and game cheats to distribute malware.

Vimeo Confirms User and Customer Data Breach

www.securityweek.com · 2 months ago

Vimeo has confirmed a data breach affecting user and customer data, resulting from an attack targeting a third-party vendor, Anodot. Stolen data includes technical information, video titles, metadata, and some customer email addresses, but does not involve video content, login credentials, or payment card information. The cybercrime group ShinyHunters has claimed responsibility, alleging data was obtained from Snowflake and BigQuery instances, and threatening to leak the information unless a ransom is paid. The group has previously targeted organizations like Rockstar Games, Zara, Wynn Resorts, Rituals, and Vercel via Anodot.

Who are the lawyers representing Elon Musk, OpenAI and Microsoft?

www.nytimes.com · 2 months ago

false

ADT Confirms Major Data Breach Exposing Millions of Names, Partial SSNs

www.techrepublic.com · 2 months ago

ADT has confirmed a data breach impacting millions of customers. Hackers accessed customer names, phone numbers, addresses, dates of birth, tax IDs, and partial Social Security numbers through a compromised employee account linked to cloud business tools. The breach occurred via voice phishing, compromising an Okta single sign-on account and leading to data exfiltration from a Salesforce instance. Approximately 5.5 million records were reportedly leaked, and affected customers are being offered credit monitoring and advised to be vigilant against phishing scams.

Every AI system in 2026 has the same substrate failure: interpretation forms before observation completes, then governs everything that follows

open.substack.com · 2 months ago

false

Elon Musk Assails Sam Altman on Social Media Before OpenAI Trial

www.nytimes.com · 2 months ago

false

Here Are the Key Players in the OpenAI Trial

www.nytimes.com · 2 months ago

false

If you deploy 3x/week, your pentest misses ~150 changes per cycle. That's not testing failure but Deployment Velocity Gap. Here's why!

www.codeant.ai · 2 months ago

There is a deployment velocity gap because systems change weekly while annual penetration testing provides only a point in time evaluation, leaving most interim deployments untested. Average mean time to detection under an annual model is about 180 days, while sprint or continuous cadences reduce detection to under 14 days and mean time to remediation to under 7 days. Continuous testing increases coverage, lowers false positives, and cuts vulnerability escape rates from around twenty five percent to under five percent, with fixes in development estimated to be about six times cheaper than fixes in production. Modeling for a weekly release team shows expected breach costs and total cost of ownership fall substantially when moving from annual to continuous testing, and annual pentesting is described as compliance theater for teams releasing more than once a month.

The Mythos Moment: Enterprises Must Fight Agents with Agents

www.securityweek.com · 2 months ago

false

US reportedly charges Scattered Spider hacker arrested in Finland

www.bleepingcomputer.com · 2 months ago

A nineteen-year-old individual, a dual citizen of the United States and Estonia, has been arrested in Finland and faces federal charges in the U.S. related to their involvement with the Scattered Spider hacking collective. The suspect allegedly participated in breaches affecting multiple corporations, resulting in millions of dollars in ransom demands and significant remediation costs for victims. Scattered Spider, comprised largely of young individuals, utilizes social engineering and MFA fatigue techniques to steal credentials for extortion. This group has targeted numerous high-profile companies, including Caesars, MGM Resorts, and Jaguar Land Rover.

Securing the git push pipeline: Responding to a critical remote code execution vulnerability

github.blog · 2 months ago

A critical remote code execution vulnerability was recently discovered affecting github.com and GitHub Enterprise Server. The vulnerability allowed users with push access to repositories to execute arbitrary commands on the server by exploiting an unsanitized character within git push options. A fix was rapidly deployed to github.com and patches are now available for GitHub Enterprise Server versions 3.14.25 and later. Investigations revealed no exploitation beyond testing by the reporting researchers, and no customer data was compromised. The vulnerability has been assigned CVE-2026-3854.

Webinar Today: A Step-by-Step Approach to AI Governance

www.securityweek.com · 2 months ago

false

This trial comes amid a growing national backlash against A.I.

www.nytimes.com · 2 months ago

false

Fresh Wave of GlassWorm VS Code Extensions Slices Through Supply Chain

www.darkreading.com · 2 months ago

A new wave of malicious Visual Studio Code extensions, part of the ongoing GlassWorm campaign, has been discovered. These "sleeper" extensions initially appear benign but can be updated to deliver self-replicating malware and poison the software supply chain. Attackers are cloning legitimate extensions to trick developers into installing the malicious versions, making detection difficult. The GlassWorm malware aims to steal credentials and spread to other projects, furthering its propagation.

Checkmarx confirms LAPSUS$ hackers leaked its stolen GitHub data

www.bleepingcomputer.com · 2 months ago

Application security company Checkmarx has confirmed that the LAPSUS$ group leaked data stolen from its GitHub repository. The initial access was likely due to a supply-chain attack attributed to TeamPCP, specifically related to the Trivy incident. Attackers published malicious code and Docker images affecting Checkmarx’s KICS security scanner, potentially exposing credentials and configuration files. The leaked data, which is available on clearnet portals, does not reportedly contain customer information, and an investigation is ongoing.

Robinhood Vulnerability Exploited for Phishing Attacks

www.securityweek.com · 2 months ago

Robinhood has acknowledged a vulnerability exploited in its account creation process that enabled a phishing campaign. Attackers used a Gmail "dot trick" to create new accounts mimicking existing users, then injected malicious links into device name fields during signup. This triggered legitimate notification emails containing the phishing links, which bypassed authentication checks. The company stated that customer funds and personal information were not impacted, but the incident may be linked to a 2021 data breach.

Cisco Identity Services Engine Remote Code Execution and Path Traversal Vulnerabilities

sec.cloudapps.cisco.com · 2 months ago

Multiple vulnerabilities in Cisco Identity Services Engine and Cisco ISE Passive Identity Connector could allow an authenticated remote attacker with valid administrative credentials to achieve remote code execution or perform path traversal on affected devices. Cisco has released software updates that address these vulnerabilities and there are no workarounds. The issues are tracked as CVE-2026-20147 and CVE-2026-20148 and carry a critical security impact rating.

What are Elon Musk’s claims against Altman and OpenAI?

www.nytimes.com · 2 months ago

NULL

[Research] Full-chain RCE in Microsoft Semantic Kernel & Agent Framework 1.0 (6 Bypasses)

nuka-ai.github.io · 2 months ago

A critical Remote Code Execution vulnerability exists in Microsoft’s Agent Framework, impacting versions 1.47.0 and 1.48.0 and Agent Framework 1.0. The vulnerability, associated with CVE-2026-25592, bypasses previous attempts at security fixes due to underlying architectural flaws such as Type Confusion and Late Canonicalization. This allows attackers to execute code, potentially overwriting application source code, and creates a "False Green" scenario where security scans fail to detect the threat. Microsoft’s response has been deemed inadequate, raising concerns about similar vulnerabilities in other AI frameworks and highlighting a significant supply chain security failure.

Oakland, which is playing host to the trial, is not exactly known as a tech hub.

www.nytimes.com · 2 months ago

false

Here’s the contentious history behind OpenAI.

www.nytimes.com · 2 months ago

false

Here’s the contentious history behind OpenAI.

www.nytimes.com · 2 months ago

false

Here’s the contentious history behind OpenAI.

www.nytimes.com · 2 months ago

NULL

VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi

thehackernews.com · 2 months ago

The VECT 2.0 ransomware operation functions more as a data wiper than a typical ransomware due to a critical flaw. This flaw results in files larger than 131KB being permanently destroyed instead of encrypted, making data recovery impossible even with a ransom payment. The group, which operates on a ransomware-as-a-service model, recently partnered with BreachForums and TeamPCP to expand its reach and lower barriers to entry for affiliates. The VECT 2.0 ransomware exhibits unusual geofencing behavior, potentially indicating inexperienced operators or reliance on outdated code.

Alleged Chinese State Hacker Extradited to US

www.securityweek.com · 2 months ago

A Chinese national, Xu Zewei, has been extradited to the US and charged with cyberattacks linked to the Silk Typhoon, Hafnium, and Murky Panda APT groups. He allegedly conducted attacks on behalf of China’s Ministry of State Security and Shanghai State Security Bureau, targeting US universities and researchers involved in COVID-19 research. The group exploited Microsoft Exchange Server zero-day vulnerabilities, deploying web shells to gain remote access, impacting thousands of systems globally. Xu faces multiple charges, including wire fraud and computer hacking, while another individual, Zhang Yu, remains a fugitive.

Microsoft to deprecate legacy TLS in Exchange Online starting July

www.bleepingcomputer.com · 2 months ago

Microsoft will discontinue support for legacy Transport Layer Security versions 1.0 and 1.1 for POP and IMAP connections to Exchange Online, starting in July 2026. These older protocols are considered insecure and have been deprecated by the industry. Connections will then require TLS 1.2 or later to succeed, and users are encouraged to update email clients and custom applications to ensure compatibility. This change is part of a wider effort to enhance internet traffic security.

The Bot Left a Fingerprint: Detecting and Attributing LLM-Generated Passwords

blog.gitguardian.com · 2 months ago

A recent study revealed that passwords generated by large language models are predictable and biased, allowing researchers to identify the origin with moderate accuracy. Analysis of leaked passwords showed approximately 28,000 were likely created by AI, with Anthropic, Qwen, and Google being common sources. These AI-generated passwords are often found in sensitive files, increasing security risks and vulnerability to attack. Experts recommend avoiding LLMs for password generation and employing tools to scan for and manage secrets.

Critical Cursor bug could turn routine Git into RCE

www.csoonline.com · 2 months ago

A critical vulnerability in the Cursor AI agent allows for remote code execution through seemingly routine Git operations. Security researchers found that malicious repositories could trigger embedded Git logic, enabling attacker-controlled code execution on a developer’s machine. The flaw, tracked as CVE-2026-26268, stems from the AI agent autonomously performing Git operations like executing hooks, which can be exploited via prompt injection. Cursor has released version 2.5 to patch the vulnerability, which expands the attack surface of agentic IDEs by removing user interaction as a safeguard.

Inside an OPSEC Playbook: How Threat Actors Evade Detection

www.bleepingcomputer.com · 2 months ago

Cybercriminals are increasingly prioritizing operational security to sustain large-scale fraud operations. Researchers observed a post detailing a three-tier infrastructure model separating public access, operations, and monetization, emphasizing strict compartmentalization and identity management. Common mistakes leading to exposure include identity reuse, weak fingerprinting evasion, and inadequate separation between operational stages. Advanced techniques like time-delayed triggers, behavioral randomization, and dead man’s switches are being implemented to enhance resilience and avoid disruption. Defenders should focus on cross-platform correlation, advanced behavioral detection, and monitoring the entire attack chain.

Hugging Face LeRobot Flaw Opens Door to Remote Code Execution Attacks

gbhackers.com · 2 months ago

A critical remote code execution vulnerability, tracked as CVE-2026-25874, has been discovered in Hugging Face’s LeRobot framework. The vulnerability allows unauthenticated attackers to execute system commands due to the insecure use of the pickle.loads() function to deserialize network data without proper authentication or encryption. The framework's architecture, which utilizes gRPC and binds to 0.0.0.0 in production environments, significantly increases the risk of exploitation. To fix the issue, organizations should replace pickle serialization with safer alternatives, implement TLS encryption, and enforce authentication.

Silk Typhoon Hacker Extradited to U.S. from Italy

gbhackers.com · 2 months ago

A Chinese national, Xu Zewei, has been extradited to the United States to face charges related to cyber intrusions linked to the Silk Typhoon (HAFNIUM) campaign. Prosecutors allege Xu, operating under the direction of China’s Ministry of State Security, targeted American universities, law firms, and COVID-19 research institutions, stealing sensitive data. The intrusions exploited zero-day vulnerabilities in Microsoft Exchange Server, deploying web shells to maintain access. Xu’s case exposes a network of Chinese cyber contractors who facilitate state-sponsored espionage while obscuring government involvement. He faces charges including wire fraud, unauthorized access, and aggravated identity theft.