Blahalla

MCBS Data Breach Affects 1.2 Million Individuals

www.securityweek.com · 2 months ago

The PEAR ransomware group claimed to have stolen 3 TB of information from the medical business management company.

GitLab RCE Flaws Allow Attackers to Execute Commands via Malicious Jupyter Notebooks

gbhackers.com · 2 months ago

A critical remote code execution (RCE) vulnerability chain in GitLab’s Jupyter Notebook diff renderer. This issue is rooted in two long-standing memory safety vulnerabilities within the Oj Ruby JSON parser. The vulnerabilities impact both GitLab Community Edition and Enterprise Edition releases from version 15.2.0 through 19.0.1.

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories– SonicWall Zero-Day, Cl0p Windchill Attack, AI-Weaponized Threats, Data Breaches & More

gbhackers.com · 2 months ago

Welcome to this week’s edition of the GBHackers cybersecurity newsletter, your weekly cybersecurity bulletin covering the 50 most important stories from July 20, 24, 2026.

GitHub, PyPI add time-absed defenses against supply chain attacks

www.bleepingcomputer.com · 2 months ago

GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit their impact.

Why TikTok’s Algorithm Keeps You Trapped in a Breakup Loop

www.nytimes.com · 2 months ago

As social media companies face scrutiny over addictive design features, mental health experts cite a stream of breakup content as an example of the failure to protect users.

A Son of Wealth Finds His Calling in a High-End Grocery Store

www.nytimes.com · 2 months ago

How the scion Sammy Nussdorf found his calling among the carefully arranged shelves of Meadow Lane, his chic market in Lower Manhattan.

Steam forum ClickFix attacks infect gamers with XMRig cryptominers

www.bleepingcomputer.com · 2 months ago

Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers.

Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable

thehackernews.com · 2 months ago

A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL.

Malicious sites use JavaScript to build malware in browser memory

www.bleepingcomputer.com · 2 months ago

A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory.

ShinyHunters data leaks fuel $2,000 sextortion email scam

www.bleepingcomputer.com · 2 months ago

Threat actors are using email addresses exposed in data breaches leaked by the ShinyHunters extortion group to send sextortion emails demanding $2,000 in Bitcoin.

Silicon Valley Splits Over Closing the Borders to Chinese A.I.

www.nytimes.com · 2 months ago

Anthropic and OpenAI confront elements of the tech industry regarding open-source models originating from China. These companies disagree on whether Chinese AI models should remain unrestricted or face regulatory limitations. The dispute highlights mounting geopolitical tensions over control of AI technology.

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

thehackernews.com · 2 months ago

Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0.

A featured Chrome extension "Planet Search" (2M installs) routes every query to the nextgeeker[.]com hijacker network

malext.io · 2 months ago

Planet Search, a Chrome extension with 2M installs, hijacks searches. Queries meant for planet-search.com silently redirect through undisclosed servers to nextgeeker.com, tracking full search strings for affiliate revenue.

CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking

thehackernews.com · 2 months ago

Phishing campaigns traditionally tricked victims into entering credentials for later account compromise. Recent investigations reveal this model changes, showing that insurance-focused phishing operations now employ a more immediate approach. These attackers aim to compromise accounts quickly rather than simply harvesting usernames and passwords.

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

thehackernews.com · 2 months ago

Group linked to Cl0p ransomware exploits flaws in PTC Windmill and FlexPLM deployments for data extortion. Attackers chained a pre-authentication information disclosure vulnerability in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet. This combination enables the group to conduct new data theft campaigns against these industrial systems.

DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

thehackernews.com · 2 months ago

The operators of the DevMan ransomware-as-a-service scheme maintain a dedicated web platform for affiliates. Swiss cybersecurity company PRODAFT tracks this centralized operation, calling it Funky Mantis. The portal combines build generation, finance management, and tools allowing affiliates to oversee earnings and manage aspects related to victims.

OpenAI confirms ChatGPT is down worldwide

www.bleepingcomputer.com · 2 months ago

OpenAI confirmed that ChatGPT experienced global connectivity issues starting within the last 30 minutes. Users across multiple regions, including Europe, India, Japan, and Australia, reported being unable to access the AI chatbot. The company acknowledged the service disruption via its status page and began investigating the cause of the outage.

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

thehackernews.com · 2 months ago

Security researcher Yuhang Wu at depthfirst published a working proof-of-concept exploit targeting unpatched self-managed GitLab 18.11.3 servers. The vulnerability executes commands as git, allowing an ordinary authenticated user to trigger it using crafted Jupyter notebooks and requesting their diff. This chain requires no administrator rights or continuous integration runner access.

Rockwell Patches Code Execution Flaws in Arena Simulation Software

www.securityweek.com · 2 months ago

Rockwell patched four high-severity memory corruption flaws (CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, CVE-2026-8314) in Arena Simulation up to v17.00.00. These allow arbitrary code via user interaction on affected industrial systems.

Hackers Use Stealer Logs to Bypass MFA and Launch Ransomware Attacks

gbhackers.com · 2 months ago

Infostealer malware links credential theft & ransomware by harvesting session cookies/passwords. Attackers use stolen cookies for session hijacking, bypassing MFA. A 2025 report shows 88% of web app breaches involve stuffed credentials.

Google Launches Unified Cryptonym-Based Naming System for Threat Actors

gbhackers.com · 2 months ago

Google's new naming system simplifies threat attribution after Mandiant/TAG integration. It uses a two-word cryptonym format to identify groups and assign categories, like tracking the Russian group as SANDWORM RELIC.

Phantom Stealer Campaign Uses JavaScript and PowerShell to Steal Browser Credentials

gbhackers.com · 2 months ago

Phishing used fake UPS/Malaysian LHDN notices to deploy Phantom Stealer v3.5.0. It uses JS loaders/PowerShell in memory, injecting into aspnetcompiler.exe. The malware harvests credentials/cookies (Chromium/Gecko) and crypto data via STARTTLS SMTP on port 587.

Hackers Exploit Industrial PLCs and Manipulate HMI Displays to Hide Attacks

gbhackers.com · 2 months ago

Six federal agencies have updated a joint advisory warning that Iranian-affiliated advanced persistent threat (APT) actors are actively exploiting internet-exposed programmable logic controllers (PLCs) across U.S. critical infrastructure, manipulating human-machine interface (HMI) displays so operators cannot visually detect the intrusion.

CISOs vs. Boards: Myth or Misunderstanding?

www.darkreading.com · 2 months ago

Escalating threats are forcing boards to prioritize security, but communication gaps persist. Boards and security teams each say they need more support to bridge the divide.

Friday Squid Blogging: Illex Squid Catch in the Falklands

www.schneier.com · 2 months ago

Lower catch this year. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

OnTrac notifies customers of data breach after network hack

www.bleepingcomputer.com · 2 months ago

OnTrac parcel delivery company is informing that hackers breached its corporate network and may have accessed personal details belonging to its customers.

What syscall-layer tooling cannot see in P2P infrastructure

nullrabbit.ai · 2 months ago

A technique-by-technique analysis of why syscall-layer detection structurally misses network resource-exhaustion attacks against blockchain node infrastructure. No counting window, no CPU-cost field, no frame parser, and over TLS the captured bytes are ciphertext. Five reproduced techniques against real consensus clients, none can be expressed as a technique-attributable rule.

Escape Artists: 'Incorrigible' AI Models Resist Rehabilitation

www.darkreading.com · 2 months ago

The hacking of Hugging Face by a rogue OpenAI agent is significant, but unsurprising, and preventing the next AI model escape will be difficult, at best.

Hermes AI agent used to automate attack on Thai Finance Ministry

www.bleepingcomputer.com · 2 months ago

A threat actor used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation activity during an alleged breach of Thailand's Ministry of Finance.

Announcing the External Penetration Testing Program Pack

www.sectemplates.com · 2 months ago

This release contains everything you need to scope your first pentest, work with a vendor, execute, and get the types of reports you need from an external tester. This will enable you to perform your first product or infrastructure level penetration test, and provide you with a process moving forward for future engagements. This is open source, we don't sell anything.

Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts

www.bleepingcomputer.com · 2 months ago

Hackers are changing the DNS settings on Wi-Fi devices at hotels and conference centers to redirect users to fake Microsoft 365 login pages.

Tego AI Discloses Second Claude Flaw in a Week: Hidden Link Silently Sends Files to Attackers

gbhackers.com · 2 months ago

Tel Aviv, Israel, July 24th, 2026, CyberNewswire One week after disclosing that Anthropic’s Claude Tag Slack integration could be driven by plain “@Claude” text, Tego AI today published a second piece of research on the Claude ecosystem. This one focuses on Claude Code, Anthropic’s agentic command-line coding tool.

Microsoft blames massive Microsoft 365 outage on maintenance bug

www.bleepingcomputer.com · 2 months ago

Microsoft says a bug in its automated network maintenance request system caused Thursday's massive outage by mistakenly removing IP routes from more devices than intended, disrupting Azure and Microsoft 365 services.

BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery

thehackernews.com · 2 months ago

The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware.

In Other News: Dolphin X AI-Powered Malware, Car Anti-Theft Device Hack, 400 Linux Kernel Flaws

www.securityweek.com · 2 months ago

Noteworthy stories that might have slipped under the radar: Siemens ROX II industrial switch vulnerabilities, Russian Zimbra webmail espionage campaign, Stadler Rail ransomware extortion attempt.

Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

thehackernews.com · 2 months ago

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync.

Chick-fil-A data breach affects more than 13,000 customers

www.bleepingcomputer.com · 2 months ago

Chick-fil-A has confirmed that over 13,000 customers had their accounts breached in a wave of credential stuffing attacks targeting its website and mobile app between June 17 and June 19.

Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack

www.bleepingcomputer.com · 2 months ago

Slopsquatting, phantom squatting, and HalluSquatting all exploit the same late-binding attack pattern, where AI coding agents trust hallucinated package, repo, or domain names. ActiveState explains how pre-fetch verification and governed dependency management can help stop these attacks before malicious code enters the pipeline.

Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading

gbhackers.com · 2 months ago

A recently disclosed vulnerability in Foxit PDF Reader may allow a local attacker with existing code execution to elevate their privileges to NT AUTHORITY\SYSTEM. This issue, tracked as CVE-2026-57239, affects Foxit PDF Reader installations prior to version 2026.

Google Adds Selfie Video Sign-In to Help Users Recover Locked Accounts

www.techrepublic.com · 2 months ago

Google added selfie video recovery for eligible accounts, using encrypted videos and liveness checks to help users regain access when locked out.

Cl0p Targets Internet-Exposed Windchill Servers in Global Engineering Data-Theft Campaign

gbhackers.com · 2 months ago

Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments. Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by staging and exfiltration of sensitive engineering and product design data.

Vatican's Official Prayer App Leaks 700K+ Global Users' PII

www.darkreading.com · 2 months ago

A porous API endpoint exposes, names, email addresses, location, and site status, all of which can be easily gleaned by anyone with a browser.

Illinois Man Pleads Guilty to Phishing 4,500 Snapchat Users to Steal Private Photos

gbhackers.com · 2 months ago

An Illinois man has pleaded guilty to a phishing and account-compromise scheme that targeted thousands of Snapchat users, leading to the theft of private images from numerous women.

Europol flags 4,340 URLs for removal in 'The Com' crackdown

www.bleepingcomputer.com · 2 months ago

Europol has flagged 4,340 URLs for removal during a multi-week operation targeting online content linked to "The Com," a loosely organized network of nihilistic violent extremist groups.

Default Azure Automation Setting Enables Cross-Tenant Identity Takeover

www.darkreading.com · 2 months ago

Microsoft addressed a public-by-default configuration and chain of code flaws in Azure Automation which could have let attackers seize another tenant's identity and access other tenants' data, credentials, and cloud workloads.

The way AI voice phishing gets demonstrated is making people worse at spotting it

www.callstrike.ai · 2 months ago

AI voice phishing isn't a cloned voice with a bot doing the talking. It's a human operator running a real time voice changer. Which matters, because every "how to spot a voice phishing / deepfake" tell is a text to speech artifact and none of them survive voice conversion. Disclosure.. I build voice phishing simulation for a living, so I have a horse in this race.

AegisAI Raises $36 Million for AI-Powered Email Security

www.securityweek.com · 2 months ago

The company has raised a total of $49 million in funding, including from Battery Ventures, Accel and Foundation Capital.

SectopRAT Gives Attackers Remote Access to Passwords, Credit Cards, Cookies and Corporate Files

gbhackers.com · 2 months ago

SectopRAT is at the center of a highly targeted malvertising campaign abusing Anthropic’s Claude platform to deliver a stealthy, HVNC‑enabled RAT that gives attackers deep, persistent access to victims’ passwords, credit cards, cookies and corporate files. The artifact masqueraded as a genuine Claude Desktop installer but redirected victims to claude.ai.download-app[.

ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link

thehackernews.com · 2 months ago

Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization. The vulnerability has been codenamed AgentForger by Zenity Labs.

Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers

thehackernews.com · 2 months ago

A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine.