Blahalla

Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

thehackernews.com · 2 months ago

A Mirai-derived botnet called Tengu uses a compromised Linux device's hardware watchdog to reboot when defenders kill its main process. Nozomi Networks Labs observed the dropper reaching honeypots through Telnet credential brute force, showing strong persistence mechanisms upon restart. This botnet supports 25 distributed denial-of-service attacks.

Cyera Acquiring Oasis Security in $1 Billion Deal

www.securityweek.com · 2 months ago

Cyera announced its agreement to acquire agentic access management provider Oasis Security in a reported $1 billion deal. This acquisition unifies identity and data security platforms, allowing Cyera to govern both human and non-human identities. The expanded platform helps customers manage emerging risks associated with artificial intelligence agents within their environments.

24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login

thehackernews.com · 2 months ago

Cybersecurity researchers detected over 36,872 internet-exposed Baseboard Management Controller (BMC) interfaces running IPMI protocol. Of these systems, more than 24,650 disclose password-derived authentication hashes before a user can log in. Researchers sound an alert regarding severe vulnerabilities within public server management protocols.

Designing Patterns to Prevent IDOR

sevhunt.com · 2 months ago

IDOR flaw allows unauthorized access via manipulated IDs. Developers must validate all accessed resources belong to the user's tenant using architectural patterns like those shown in TypeScript/tRPC. Prevention requires explicit, robust authorization checks.

Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe

www.securityweek.com · 2 months ago

Apple patched dozens of vulnerabilities across multiple operating systems, including fixing 155 flaws in macOS Tahoe 26.6 and 87 issues with iOS and iPadOS 26.6. These updates also resolved hundreds of security holes on platforms like watchOS, tvOS, and visionOS. Additionally, Apple fixed CVE-2026-43810, allowing a remote user to corrupt kernel memory and change attack economics.

Simple Job Board ≤ 2.11.0 - Unauthenticated RCE (CVE-2024-1813)

mobeta.fr · 2 months ago

Security researchers identified an unauthenticated Remote Code Execution (RCE) vulnerability, tracked as CVE-2024-1813, in the Simple Job Board plugin. This critical flaw affects versions 2.11.0 and lower for WordPress installations using the PressTigers plugin. Site administrators must update immediately to patch this security weakness.

JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach

thehackernews.com · 2 months ago

OpenAI exploited a zero-day in self-hosted Artifactory, achieving privilege escalation and lateral movement. JFrog released fixes for cloud deployments following the attack.

How AI is powering business email compromise at scale

research.eye.security · 2 months ago

Research unveiled AI-powered phishing kits that automate Business Email Compromise schemes. Furthermore, the report details critical, unauthenticated remote code execution vulnerabilities in WordPress core via wp2shell. These flaws are tracked by CVE-2026-60137 and CVE-2026-63030.

How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old Vulnerability

lavahq.io · 2 months ago

Researchers identified 36,872 internet-exposed Baseboard Management Controllers (BMCs) running the vulnerable IPMI protocol. The flaw CVE-2013-4786 allowed an attacker to access password-derived hashes for 24,650 systems without logging in. Furthermore, over 30% of these exposed passwords are recoverable using common wordlists or predictable factory defaults.

OT Security Startup Frenos Raises $1.52 Million

www.securityweek.com · 2 months ago

Frenos, an OT security startup, raised $1.52M seed funding. Its AI platform uses network digital twins for safe, simulated penetration testing to assess operational technology security posture. The company can validate attack paths without risking production systems.

Fake Claude Code Installer Delivers MacSync macOS Infostealer Through Google Ads

gbhackers.com · 2 months ago

Malvertising targeting macOS users searching "how to install Claude Code" delivers MacSync infostealer. Attackers use fake Google Ads/claude.ai links, employing encoded shell commands and disabling TLS with curl's -k flag for silent download.

Infoblox joins crowded EASM market with DNS-centric approach

www.csoonline.com · 2 months ago

Infoblox entered EASM with a DNS-first approach, discovering internet assets without agents and finding issues like dangling CNAME records. They also added Supply Chain Intelligence to monitor vendor assets for exposure and dark web risks.

Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root

thehackernews.com · 2 months ago

OpenWrt released version 24.10.8 to address a critical DHCPv6 stack overflow vulnerability, cataloged as CVE-2026-53921. This flaw allows unauthenticated attackers to reach the DHCPv6 server and overwrite a buffer in odhcpd using crafted packets. Researchers rated the issue 9.8 on CVSS 3.1.

Dismantled Kratos Phishing Kit Becomes Blueprint for Attacks on Microsoft 365 Users

gbhackers.com · 2 months ago

Kratos phishing leaks fuel Microsoft 365 attacks. PhaaS used adversary-in-the-middle techniques to bypass MFA, stealing credentials via large scale operations with anti-analysis/obfuscated code. Attackers continue account takeovers.

Former Citigroup CISO Blauner on What Makes A Great Security Leader

www.darkreading.com · 2 months ago

Former CISO Charles Blauner discussed the transformation of the CISO role, explaining that success requires business acumen and operational resilience beyond technical expertise. He advises aspiring cybersecurity professionals to build strong networks while preparing for AI's influence on future jobs. Overall, he posits organizational resilience as the profession's next critical frontier.

Over 24,000 exposed server BMCs leak password hash via decades-old flaw

www.bleepingcomputer.com · 2 months ago

Researchers found over 36,000 internet-exposed servers leaking password hashes via Baseboard Management Controllers (BMCs). This vulnerability exploits CVE-2013-4786, an IPMI 2.0 weakness rooted in a decades-old protocol flaw. Over 24,000 exposed BMCs leak authentication material usable for offline password cracking with dedicated GPU rigs.

Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays

thehackernews.com · 2 months ago

The Iranian state-backed group Nimbus Manticore (also known as GalaxyGato and UNC1549) conducted fresh attacks across Middle East, Africa, and South Asia. The intrusions deployed a previously undocumented Windows backdoor called NightLedger. These operations also utilized two custom WebSocket tunnelers.

CastleLoader Campaign Deploys NeedleStealer to Steal Crypto Wallet Seeds and Browser Sessions

gbhackers.com · 2 months ago

NeedleStealer steals crypto phrases/hijacks sessions. Noidret uses Rust wallet spoofing; another Golang payload installs malicious extensions for credentials. Cross-platform tooling via NodeJS injectors affects campaigns like Urutyka and Garrigin. These tactics show an evolving malware ecosystem.

Microsoft Unveils MAI-Cyber-1-Flash, Its First Cybersecurity AI Model

www.securityweek.com · 2 months ago

Microsoft unveiled MAI-Cyber-1-Flash, its initial cybersecurity AI model designed to find complex code vulnerabilities. The tool integrates into MDASH, which orchestrates over 100 specialized agents for vulnerability identification and remediation. Testing within the CyberGym framework showed MAI-Cyber-1-Flash surpassed competitors like Anthropic’s Mythos and OpenAI’s GPT-5.6 Sol.

The state of vibe-coded app security: my analysis of 549 self-described AI-generated repos (study + raw data)

ogbuilds.ai · 2 months ago

Researchers audited 549 public "vibecoded" GitHub repositories using a deterministic rules engine, analyzing the state of app security in these projects. The study revealed that 23.3% of substantive repos committed exposed secrets, while 30.2% contained critical or high security findings. Furthermore, nearly half (48.8%) utilized dangerous injection methods, such as dangerouslySetInnerHTML.

Axon Is Another License Plate Surveillance Company

www.schneier.com · 2 months ago

Municipalities may switch surveillance systems, such as Denver ditching Flock arrays for Axon readers. The author argues that swapping one license-plate reader brand for another does not lessen citizens' loss of privacy. Furthermore, Axon cameras retain high effectiveness at capturing extensive personal details beyond mere vehicle identification numbers.

Act Security Emerges from Stealth to Fight the Patch Problem

www.securityweek.com · 2 months ago

Act Security warns AI-discovered flaws in cloud envs. Unmanaged permissions let attackers exploit weak spots pre-patching. The company fixes this by removing exploitable access paths for structural security.

Hacker Conversations: Tal Kollander’s Journey From Black Hat to Hack Blocker

www.securityweek.com · 2 months ago

Tal Kollander defines a hacker as anyone accessing computers without proper authorization. She categorizes these individuals into white hats who report findings, black hats seeking illegal gain, and grey hats operating between both extremes. Kollander stresses that unauthorized access defines a hacker, overriding considerations of national loyalty or intent.

Critical TeamCity Flaw Lets Unauthenticated Attackers Execute System Commands

gbhackers.com · 2 months ago

JetBrains warns of CVE-2026-63077 in TeamCity On-Premises. Unauthenticated remote attackers can run OS commands via the agent polling protocol. Upgrade to versions like 2025.11.7 or 2026.1.3 immediately as CI/CD secrets are at risk.

Chinese Hackers Use RedRelay Multi-Hop Network to Conceal Global Cyber Operations

gbhackers.com · 2 months ago

Chinese state hackers use RedRelay/ORBWEAVER via Guangdong Chanming's infrastructure for global cyber ops. Traced tools like FCN tunneling and stn.exe link this to state-sponsored intrusions.

AI-Discovered Linux Kernel Zero-Day Enables Root Privilege Escalation

gbhackers.com · 2 months ago

CVE-2026-53264 is a Linux kernel zero-day (net/sched) allowing local privilege escalation to root via a use-after-free race condition. Exploitation requires CAPNETADMIN and specific operations.

Hush Security Raises $30 Million for AI Agent Governance

www.securityweek.com · 2 months ago

Cybersecurity startup Hush Security announced it raised $30 million in a Series A funding round from Akamai Technologies and others. The company provides a machine access platform that secures enterprise AI agents by implementing scoped just-in-time permissions at runtime. With this investment, Hush plans to expand its engineering teams and ecosystem support efforts for AI governance.

Tengu Mirai Botnet Uses Watchdog Reboots and Binary Bricking to Resist Removal

gbhackers.com · 2 months ago

Tengu, a Mirai-derived botnet, evolves beyond DDoS using hybrid C2 (plaintext/ChaCha20-Poly1305). It achieves persistence via systemd scripts and watchdog manipulation, delivering payloads over HTTP or IPFS with 25+ attack vectors.

ChatGPT Joins Most Faked Brands Ranking in Phishing, Check Point Says

www.techrepublic.com · 2 months ago

Check Point’s Q2 2026 Brand Phishing Report revealed ChatGPT entered its top 10 most impersonated brands. Scammers utilized fake ChatGPT Plus payment failure emails to harvest victims' full credit card numbers. The security firm noted that scams frequently exploit urgency, using alerts or required updates to trick users into acting quickly.

Fake ShinyHunters Emails Give Victims 48 Hours to Pay $2,000 Bitcoin Ransom

gbhackers.com · 2 months ago

Scammers use fake ShinyHunters emails, demanding $2k BTC with leaked data from companies like Amtrak/Hallmark. They falsely allege device compromise but show no malware; attackers only reuse public breach datasets. Authorities warn this is a scam.

Data breach at medical billing firm MCBS affects 1.26 million people

www.bleepingcomputer.com · 2 months ago

Healthcare billing company MCBS disclosed a 2025 network breach that exposed sensitive information for over 1.2 million people. Unauthorized access occurred between September 22 and 26, stealing data including SSNs, names, and medical histories. The ransomware group PEAR claimed exfiltrating 3.3 terabytes of patient records from the firm's systems.

In This Costa Rican Forest, Monkeys Come Face-to-Face With A.I.

www.nytimes.com · 2 months ago

Scientists can study primate intelligence in the wild using CapuchinAI, a specialized portable testing station. This device equips researchers with capabilities, including facial recognition software and an interactive touch screen. The technology aids scientists studying animal behavior in natural settings like Costa Rica.

Police Say Binance Is Making It Harder to Fight Crime

www.nytimes.com · 2 months ago

European investigators assert that using cryptocurrency giant Binance complicates efforts to track down scammers and solve various cybercrimes. This development highlights challenges law enforcement faces when investigating financial crimes within major crypto platforms.

Why your AI safety certificates are worthless at runtime

www.csoonline.com · 2 months ago

AI safety needs runtime checks, not just design certs. Agents with API access change security via dynamic tool chaining and state cascades. Standard certs fail securing this fluid perimeter; NIST is addressing it.

Google Adopts New Threat Actor Naming System

www.securityweek.com · 2 months ago

Google Threat Intelligence Group adopts a new two-word cryptonym naming system for tracking malicious groups. The convention uses a unique public term coupled with a second word that classifies the group by region or motivation, such as 'Relic' for Russia. This system will rename groups like Sandworm to provide streamlined industry mapping.

LegacyHive Exploit Abuses Windows Profile Loading to Hijack User Registry Hives

gbhackers.com · 2 months ago

LegacyHive is a newly discovered proof-of-concept (PoC) for Windows that exploits profile initialization and offline registry hive manipulation to redirect user-level registry paths, potentially allowing access to resources associated with another account. This technique was published by the Nightmare-Eclipse disclosure actor shortly after Microsoft’s July 2026 Patch Tuesday.

Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In

thehackernews.com · 2 months ago

JetBrains warned customers of on-premise TeamCity about CVE-2026-63077, a critical flaw allowing arbitrary code execution with a CVSS score of 9.8. This vulnerability affects all On-Premises versions, necessitating an immediate update for affected users. Organizations must upgrade to either version 2025.11.7 or 2026.1.3 to resolve the security issue.

Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit

thehackernews.com · 2 months ago

STAR Labs published an exploit for CVE-2026-53264, a use-after-free race condition within the kernel's network traffic-control subsystem. This vulnerability enables ordinary local users to gain root access on CentOS Stream 9 builds. Researcher Lee Jia Jie used artificial intelligence to discover the flaw and accelerate exploit development.

Hugging Face breach shows why incident response needs a multi-model AI strategy

www.csoonline.com · 2 months ago

The recent breach of Hugging Face’s platform was the latest in a string of AI-assisted intrusions to come to light in recent weeks, showing that attackers can now use LLMs to automate entire attack chains.

Top 10 Best VPN Alternatives For Secure Remote Access in 2026

gbhackers.com · 2 months ago

In the rapidly evolving landscape of 2026, the traditional VPN is increasingly showing its age. While a VPN creates a secure, encrypted tunnel to a private network, it often functions like an “all-access key,” granting users broad, undifferentiated access once connected.

PortSwigger Introduces Burp AT Agentic AI for Automated Penetration Testing

gbhackers.com · 2 months ago

PortSwigger has launched Burp AT, an agentic AI system that allows penetration testers to delegate web security investigation tasks while maintaining direct control over the testing scope, approvals, and final conclusions. The public beta is currently available for Burp Suite Professional users.

Dysphoria IoT Botnet Uses Blockchain Domains and 200,000 Devices for DDoS Attacks

gbhackers.com · 2 months ago

A rapidly evolving IoT botnet dubbed “Dysphoria” has emerged as a significant global threat, leveraging blockchain-based domain resolution and a hybrid command-and-control (C2) architecture to sustain large-scale distributed denial-of-service (DDoS) operations.

Unpatched Fastjson Vulnerability Exploited in Attacks

www.securityweek.com · 2 months ago

The critical remote code execution bug can be exploited without authentication, under the library’s stock default configurations.

Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day

www.securityweek.com · 2 months ago

Impacting on-premises deployments, the OS command injection allows attackers to access privileged internal functionality.

Hackers Pose as IT Helpdesk on Microsoft Teams to Deploy GoGRPC Backdoor

gbhackers.com · 2 months ago

An evolving intrusion campaign in which threat actors impersonate IT helpdesk personnel via Microsoft Teams to gain initial access and deploy a custom Go-based backdoor dubbed “GoGRPC.” Active since January 2026, the activity is assessed to be linked to an initial access broker (IAB) operation that likely facilitates downstream ransomware attacks.

Multiple FFmpeg Flaws Allow Arbitrary Memory Corruption via Malicious Videos

gbhackers.com · 2 months ago

Multiple high-severity vulnerabilities in FFmpeg could allow attackers to corrupt memory, disclose process data, or exhaust system resources. This can happen if users or automated media-processing services are manipulated into handling specially crafted video, audio, image, or subtitle files. The vulnerabilities affect FFmpeg versions up to 8.1.28.

Microsoft Says New Cybersecurity AI Model Helps MDASH Hit 95.95% at Half the Cost

thehackernews.com · 2 months ago

Microsoft has launched its first cybersecurity-specific model inside MDASH, its multi-model vulnerability identification and remediation harness. The company says MDASH, using MAI-Cyber-1-Flash and GPT-5.4, scored 95.95% on CyberGym. It also claims the configuration costs 50% less than its current best MDASH combination of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex.

Operation STANDOFF Uses GitHub Redirects Across 44 Servers to Hide Multi-Malware C2 Traffic

gbhackers.com · 2 months ago

Operation STANDOFF is a Russian‑speaking cybercriminal campaign that uses a cluster of at least 44 TimeWeb‑hosted servers that all masquerade as benign GitHub redirectors to conceal multi‑malware command‑and‑control (C2) and proxy traffic.

Apple iOS 26.6 Update Fixes Flaws Allowing Kernel-Level Code Execution and Root Access

gbhackers.com · 2 months ago

Apple has released iOS 26.6 and iPadOS 26.6, a significant security update that addresses numerous vulnerabilities across core operating system components, media frameworks, WebKit, wireless services, and application frameworks. Released on July 27, 2026, this update is available for iPhone 11 and later models, as well as supported iPads.

OpenAI CEO Sam Altman Claims AI Has Reached Singularity as Systems Begin Improving Themselves

gbhackers.com · 2 months ago

OpenAI CEO Sam Altman has stated that artificial intelligence has entered the long-discussed stage of technological singularity, referring to the current period as the point where AI systems can increasingly improve future AI capabilities.