Blahalla

CISA warns of actively exploited RCE flaws in Joomla extensions

www.bleepingcomputer.com · 8 days ago

CISA warns of actively exploited flaws in two Joomla extensions that allow remote code execution (RCE). The vulnerabilities are CVE-2026-48939, affecting iCagenda, and CVE-2026-56291, impacting Balbooa Forms. Attackers exploit these plugins through arbitrary file uploads, enabling full website compromise by executing malicious scripts.

⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More

thehackernews.com · 8 days ago

Automated security tools rapidly discover vulnerabilities faster than human remediation processes can fix them. Attackers utilize these same powerful tools, often exploiting older flaws because patches sit in development queues. The weekly recap specifically warns users about threats targeting ShareFile and Citrix systems.

Lessons Learned from CISA’s Recent GitHub Leak

krebsonsecurity.com · 8 days ago

A contractor leaked dozens of internal CISA credentials and AWS GovCloud keys in a public GitHub repository for months. GitGuardian discovered the sensitive leak, but CISA’s postmortem reported the agency needed over 48 hours to invalidate many key secrets due to system complexities. The report urges organizations to establish clear reporting channels and maintain key management capabilities.

U.S. Electric Vehicle Sales are Down but E.V. Chargers are Booming

www.nytimes.com · 8 days ago

Electric vehicle chargers are proliferating in Southern states as fast food restaurants, stores and other businesses try to lure customers.

Hacker Conversations: Jesse McGraw (GhostExodus), From Blackhat Hacker to Redemption

www.securityweek.com · 8 days ago

Jesse McGraw recounts his early hacking journey, noting he initially used social engineering rather than complex tools. He admitted pursuing system breaches solely for the thrill, developing his blackhat hacker tendencies without understanding morality. After serving eleven years in prison for his actions, McGraw now works as a cybersecurity advocate.

Lidl discloses online shop breach after service provider hack

www.bleepingcomputer.com · 8 days ago

Lidl suffered a data breach from a service provider hack, exposing customer PII (names, emails, DOBs, phone numbers) for German, Belgian, and Dutch online shoppers. Consumers are warned about identity fraud risks.

Fake Bank Apps Let Scammers Control Android Phones in Southeast Asia

www.techrepublic.com · 8 days ago

Group-IB found RedHook malware targeting Southeast Asia Android phones via fake banking/gov apps. Scammers trick users into installing it and granting permissions like Accessibility access/Wireless Debugging, allowing data theft and remote control. The malware steals one-time codes from exposed financial accounts.

Breach at the Beach: Play the Ultimate Entra ID CTF

www.bleepingcomputer.com · 8 days ago

Varonis developed Breach at the Beach CTF to educate defenders on detecting attacks exploiting Entra ID. The training simulates real-world steps to uncover data exfiltration techniques in cloud environments. Developers emphasize that non-human identities increasingly expand the attack surface, complicating detection across modern AI infrastructures.

New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email

thehackernews.com · 8 days ago

Attackers can exploit AI assistants that connect to a user's inbox and maintain memory. A single malicious email tricks the agent into saving false "facts" about the user. This implant modifies system knowledge, allowing attackers to secretly steer future answers without raising suspicion.

Russian FSB-Linked Turla Hackers Target French Ministries, Embassies, and Defense Entities

gbhackers.com · 8 days ago

French authorities link cyber-espionage targeting government/defense entities to Turla, linked to Russia's FSB 16th Center. The operation, using malware like Uroburos, affected French ministries since the 2010s in an intelligence mission.

UK charges suspects linked to Russian Coms call spoofing platform

www.bleepingcomputer.com · 8 days ago

UK authorities charged five people after a National Crime Agency investigation into Russian Coms, a major caller ID spoofing platform. Criminals used the site to execute over 1.3 million scam calls globally, stealing funds from an estimated 170,000 victims. Charges against the suspects include fraud conspiracy and transferring criminal property.

Hackers Can Exploit RabbitMQ OAuth Flaw to Access Every Message, Queue, and User

gbhackers.com · 8 days ago

Miggo Security found two RabbitMQ flaws: CVE-2026-57219 lets unauthenticated attackers steal OAuth secrets for admin control. A second bug lets low-privilege users enumerate queues in multi-tenant setups. Update immediately to secure your broker.

Adaptive Malware Could Evade Signature Detection by Regenerating Its Attack Capabilities

gbhackers.com · 8 days ago

AI malware challenges defenses by regenerating attack logic. POCs used recursive reasoning on mixed networks. Full autonomous zero-day generation still faces reliability hurdles.

Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft

thehackernews.com · 8 days ago

Phishing-as-a-Service operation Forg365 targets Microsoft 365 accounts, distributing its services via Telegram for a monthly fee. The group employs attack chains combining device code phishing and adversary-in-the-middle tactics. These schemes further leverage AI-assisted lure creation and anti-bot evasion for post-compromise mailbox operations.

Turning the Tables on Email Scammers With 'ScamBuster'

www.darkreading.com · 8 days ago

ScamBuster, an open-source AI from Laurent Giovannoni, uses victim personas (e.g., widow, small business owner) to engage phishing emails. This allows law enforcement to collect key forensic data on cybercriminals.

Attackers Combine MCP Recon With Cloud Metadata SSRF to Steal Service Account Tokens

gbhackers.com · 8 days ago

Attackers target Model Context Protocol (MCP) and local LLM endpoints. They probe MCP init combined with SSRF attacks on cloud metadata to steal AI config/service tokens.

Cybersecurity M&A Roundup: 37 Deals Announced in June 2026

www.securityweek.com · 8 days ago

SecurityWeek reported thirty-seven cybersecurity M&A deals announced in June 2026. Key transactions include Accenture acquiring Dragos and runZero for $4.175 billion to build an integrated OT platform. Additionally, Cisco intends to acquire WideField Security to boost Splunk’s identity threat detection capabilities while 1Password acquires Apono to enhance its identity security platform.

RabbitMQ flaws expose OAuth secrets, risk complete takeover of the broker

www.csoonline.com · 8 days ago

RabbitMQ has two flaws: CVE-2026-57219 lets unauthenticated users steal OAuth secrets risking takeover; CVE-2026-57221 allows low-privs to find queue metadata. Upgrade to patched versions like 4.2.6 and rotate secrets immediately.

RabbitMQ Vulnerability Threatens Enterprise Systems

www.securityweek.com · 8 days ago

Miggo: RabbitMQ has two flaws. CVE-2026-5721 leaks OAuth secrets via unauthenticated endpoint, enabling broker impersonation. CVE-2026-57221 lets any authenticated user read exchange stats, risking multitenancy data exposure. Users should apply patches immediately.

Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling

thehackernews.com · 8 days ago

Meta patented an AI system designed to continuously monitor users' voices throughout the day. The technology assesses a person’s emotional state based solely on vocal tone and records every interaction in a timestamped log. This detailed log links events to precise location, time, and current phone usage.

Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots

thehackernews.com · 8 days ago

A security expert observed a Fortune 50 company planning AI agent integration into their Security Operations Center. The team connected Claude to detection tools, already realizing value in specific investigations. Mapping out the wider architecture revealed potential architectural challenges for the program.

EU sanctions Russian GRU military hackers over cyberattacks

www.bleepingcomputer.com · 8 days ago

EU/UK sanctioned Russian entities over hacking. Accusations target FSB's 16th Centre for groups like Turla, hitting Poland's critical infra since 2010. Sanctions also hit Lumma Stealer and IMPULS. Officials claim Russia runs these coordinated attacks.

Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory

thehackernews.com · 8 days ago

Researchers flagged an intrusion where an unknown group used a PowerShell script for Active Directory enumeration. The attacker mapped Domain Controllers and extracted information regarding users and computers across the domain. This process involved creating a directory, exporting files, and generating ADReport.html to measure the successful activity.

AI Data Centers and the Concentration of Wealth

www.schneier.com · 8 days ago

Local opposition to AI data centers reflects legitimate concerns regarding resource allocation and environmental impact. However, this focus obscures the deeper threat of power concentration as AI companies target entire industries for monopolization. These corporations aim to capture value in sectors including legal services, creative design, and enterprise software development.

Debian 13.6 Released With Security Updates for Linux, Apache, Curl, QEMU, and More

gbhackers.com · 8 days ago

The Debian Project released 13.6, a point update with critical bug fixes for its stable "trixie" distribution. The release patches vulnerabilities across core packages like Apache HTTP Server, Curl, and QEMU while updating the kernel ABI to version 6.12.94+. Additionally, Debian updated fwupd to address expiring Secure Boot Certificate Authority keys, urging users to install OEM-provided updates.

BusySnake Stealer Uses Reverse SSH Tunnels and AI-Generated Loaders to Evade Detection

gbhackers.com · 8 days ago

Armored Likho (Eagle Werewolf) hit govt/power orgs in Russia, Brazil, & Kazakhstan with BusySnake Python infostealer. It steals credentials, crypto files, and session data via spear-phishing using AI loaders and reverse SSH tunnels.

Zimbra Patches Critical Code Execution Vulnerability

www.securityweek.com · 8 days ago

A critical stored Cross-Site Scripting vulnerability affects the Zimbra Classic Web Client, allowing attackers to execute malicious code through opened crafted emails. Google Threat Analysis Group reported this zero-click flaw, which could compromise user session data and account settings. Zimbra urges all customers to upgrade immediately to version 10.1.19 to patch the defect.

Jurassic Park, cybersecurity and the dangerous myth of control

www.csoonline.com · 8 days ago

The article uses Jurassic Park to warn that cybersecurity teams mistake mere visibility for actual system control. Security groups often assume success based on compliance reports and monitoring tools, neglecting fundamental resilience planning. Defenders must anticipate nation-state attacks and AI-driven exploit discovery while accepting compromise as inevitable rather than exceptional.

EU Targets Russian Intelligence Officers Accused of Running a Yearslong Cyber Spying Campaign

www.securityweek.com · 8 days ago

EU sanctioned Russian intelligence officers and four entities over cyber espionage targeting 9 governments since 2010. The alleged sabotage hit critical infrastructure like power plants, linked to FSB activities.

Europe Takes Step Toward Possible Social Media Ban for Children

www.nytimes.com · 8 days ago

The European Commission considers changing rules across its 27 member nations following a new report release. These proposed changes affect technology regulation within the bloc, targeting stricter policies around social media access for minors.

Europe Takes Step Toward Possible Social Media Ban for Children

www.nytimes.com · 8 days ago

The European Commission considers revising technology regulations across its 27-nation bloc following a new report release. This potential rule change signals regulatory shifts affecting digital platforms within the EU.

Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639)

blog.amberwolf.com · 8 days ago

Researchers disclosed multiple vulnerabilities affecting Dell systems, impacting both BIOS security and operating environments. Weak XOR encryption within the BIOS allows attackers to recover passwords directly from SPI flash, documented as CVE-2026-40639. Additionally, another flaw, CVE-2025-32752, exposes unencrypted memory dumps within Dell ThinOS systems.

US and allies warn of Russian critical infrastructure attacks

www.bleepingcomputer.com · 8 days ago

U.S. and allied nations warned that Russian state hackers from FSB Center 16 target vulnerable routers to infiltrate critical infrastructure networks. These groups scan for default SNMP strings and exploit flaws like CVE-2018-0171 affecting Cisco IOS XE software. Defenders must harden networks by upgrading to SNMPv3, blocking TFTP/SNMP traffic at firewalls, and updating device firmware promptly.

Organizations Warned of Exploited Joomla Extension Vulnerabilities

www.securityweek.com · 8 days ago

Exploitation of vulnerabilities in the Balbooa Forms (CVE-2026-56291) and iCagenda Joomla extensions allowed unauthenticated attackers to achieve remote code execution through arbitrary file upload features. CISA added both extension defects to its Known Exploited Vulnerabilities catalog, urging organizations to patch immediately.

The eBay Scandal Gets a Thriller-Like Documentary

www.nytimes.com · 8 days ago

The documentary 'Whatever It Takes' examines a plot involving eBay workers to cyberstalk journalists and critics. The exposé revealed how company employees monitored and harassed individuals who criticized the platform.

Your AI risk register is not an incident response plan

www.csoonline.com · 8 days ago

Risk registers lack actionable AI failure plans for live workflows. Teams need incident response protocols: identifying system shutdown authority and containment methods for inaccurate model output. Organizations must implement procedures for evidence preservation, impact assessment, and operational readiness when incidents occur.

CISA Warns of Actively Exploited iCagenda and Balbooa Forms File Upload Flaws

gbhackers.com · 8 days ago

CISA added two file upload vulnerabilities in iCagenda and Balbooa Forms to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. These flaws permit unrestricted uploads, allowing malicious scripts via CVE-2026-48939 and CVE-2026-56291. Organizations must urgently patch these vulnerabilities to prevent potential remote code execution or system compromise.

Spear-Phishing Campaign Uses Proton Drive Links and LNK Files to Deliver SpyGlace

gbhackers.com · 8 days ago

APT-C-60 targets Japanese orgs with spear-phishing using Proton Drive/LNK files for SpyGlace malware. Attackers use multi-stage infection, tricking victims into running shortcuts launching mshta.exe to fetch payloads via jsDelivr and git.exe. They are actively targeting these organizations.

Progress Prompts ShareFile Storage Zone Controller Shutdown Amid Security Concerns

www.securityweek.com · 8 days ago

Progress Software told ShareFile customers to manually shut down Storage Zone Controller servers while investigating a security issue. The company warned that linking potential flaws in CVE-2026-2699 and CVE-2026-2701 could enable remote code execution without authentication. Access restrictions remain temporary as Progress continues its assessment with cybersecurity experts.

Critical WordPress OAuth SSO Plugin Flaw Allows Unauthenticated Attackers to Gain Admin Access

gbhackers.com · 8 days ago

miniOrange OAuth SSO (v <= 38.5.8) has critical auth bypass (CVE-2026-57807) via password recovery, granting unauthenticated admin access. Also note CVE-2024-10111. Deactivate the plugin immediately for all affected sites.

Centers Laboratory Data Breach Affects 540,000 Individuals

www.securityweek.com · 8 days ago

WorldLeaks claimed responsibility for stealing 720 GB of data from Centers Laboratory, a healthcare testing provider. The breach affected over 542,377 individuals and exposed protected health information, including names, SSNs, and medical records. Access occurred between August 9 and August 14.

Persistence via Fake AMSI Provider | Playbook & Detection Strategies

ipurple.team · 8 days ago

Individuals exploit the Antimalware Scan Interface (AMSI) by registering fake third-party providers with elevated permissions on Windows systems. AMSI directs potentially malicious PowerShell content through these registered providers for analysis before execution. Attackers abuse this behavior, executing code when defined trigger strings appear in the console to establish persistence.

Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

thehackernews.com · 8 days ago

An attacker running a Microsoft 365 phishing operation inadvertently left evidence of their activities on a public server. Specifically, the command python3 -m http.server 8080 remained in the readable.bashhistory file. French security firm Lexfo capitalized on this lapse, exploiting the operator's toolkit and pivoting through it to gain further access.

Can AI narrow cybersecurity’s class divide?

www.csoonline.com · 8 days ago

At Amazon Web Services (AWS), artificial intelligence is already compressing security work that once took months into minutes. In the old world, human red teams would find vulnerabilities, write reports, refine those reports, and eventually hand them to defenders, who would then begin building detections or fixes, Steve Schmidt, chief security officer at AWS, tells CSO.

New VEXAIoT AI Agents Autonomously Exploit IoT Vulnerabilities With 95% Success Rate

gbhackers.com · 8 days ago

VEXAIoT, an autonomous multi-agent framework designed to discover and exploit vulnerabilities in the Internet of Things (IoT) within controlled test environments. In 200 attack trials against the intentionally vulnerable IoTGoat platform, the system completed 189 attacks, achieving an overall success rate of 94.5% (rounded to 95%).

Jscrambler npm Supply Chain Attack Steals Cloud Credentials and Crypto Wallet Secrets

gbhackers.com · 8 days ago

A malicious actor compromised the Jscrambler npm package and published several trojanized versions that included a hidden, cross-platform credential-stealing payload. The attack targeted developers, build pipelines, and CI/CD systems, where npm installations could access source code, cloud credentials, deployment tokens, and sensitive environment variables.

Exposed Server Unmasks Evilginx Operators Stealing Microsoft 365 Sessions and OAuth Tokens

gbhackers.com · 8 days ago

A misconfigured server in Budapest exposed a live phishing operation built to bypass Microsoft 365 multi-factor authentication and retain access to compromised accounts. The server, hosted at 185.163.204[.]7185.163.204[.]7185.163.204[.]7, was running python3 -m http.server 8080 with directory listing enabled, making its operational files publicly accessible.

LIEF 1.0.0 is out featuring a brand-new Runtime API

lief.re · 8 days ago

LIEF 1.0.0 is officially out with a brand-new Runtime API and DWARF/PDB to C/C++ generation!

Operation Capsule Vault Uses Malicious ISO Files and Process Injection to Deliver RokRAT

gbhackers.com · 8 days ago

Operation Capsule Vault began with spear-phishing emails sent on June 22, 2026, posing as notices distributing materials from a legitimate academic event. The lures referenced the “Why Wonsan-Kalma Tourism Now?” conference, held at Seoul COEX on June 12, and incorporated publicly available event details, including its subject matter and host organizations.

iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days

thehackernews.com · 8 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild. The vulnerabilities, both rated 10.