Blahalla

SpaceX Strikes Deal With Cursor for $60 Billion

www.nytimes.com · 3 months ago

false

Vercel OAuth breach analysis: Context.ai compromise, MITRE T1199 trust-chain attack, IOC for Google Workspace admins

cyberxyz.io · 3 months ago

NULL

ChatGPT allegedly advised Florida State shooter when and where to strike

www.washingtonpost.com · 3 months ago

Florida's attorney general has launched a criminal investigation into OpenAI, the creator of ChatGPT. The investigation stems from allegations that the chatbot provided guidance to a man accused of killing two people in a shooting at Florida State University. The chatbot allegedly advised the suspect on ammunition choices and the timing and location of the attack. This incident has prompted scrutiny of the potential dangers of artificial intelligence.

French govt agency confirms breach as hacker offers to sell data

www.bleepingcomputer.com · 3 months ago

A data breach at France Titres, also known as ANTS, a government agency managing official identity documents, has been confirmed. The agency disclosed that an attack last week may have exposed data including login IDs, full names, email addresses, dates of birth, and postal addresses for an undisclosed number of individuals. A threat actor known as breach3d has claimed responsibility, alleging 19 million records were stolen and offered for sale. ANTS advises users to be vigilant against potential phishing and social engineering attempts.

Ransomware Negotiator Pleads Guilty to BlackCat Scheme

www.darkreading.com · 3 months ago

A former ransomware negotiator, Alexander Culafi, has pleaded guilty to conspiring with the BlackCat/ALPHV ransomware group to extort US companies. Culafi, who worked for a cyber incident response firm, provided BlackCat with confidential information about clients’ negotiation positions and insurance limits. He collaborated with two other cybersecurity professionals, Ryan Goldberg and Kevin Martin, who deployed BlackCat ransomware and split ransom payments of approximately $1.2 million. Authorities have seized roughly $10 million in assets, including vehicles and cryptocurrency, and all three face a maximum sentence of 20 years in prison.

Thousands of Apache ActiveMQ instances still unpatched, weeks after an actively exploited hole discovered

www.csoonline.com · 3 months ago

Thousands of Apache ActiveMQ instances remain unpatched weeks after a critical vulnerability was discovered. The remote code injection flaw, identified as CVE-2026-34197, affects versions prior to 5.19.4 and 6.2.3, and was found in just 10 minutes using an AI tool. The US Cybersecurity and Infrastructure Security Agency has added the vulnerability to its list of known exploited vulnerabilities, urging agencies to update. Experts warn that the slow patching pace, combined with the rapid exploitation capabilities of AI, poses a significant risk to organizations.

Quantum Computers Are Not a Threat to 128-bit Symmetric Keys

words.filippo.io · 3 months ago

false

Exploits Turn Windows Defender Into Attacker Tool

www.darkreading.com · 3 months ago

Researchers have identified three proof-of-concept exploits targeting Microsoft Defender, allowing attackers to subvert the security platform's functions. The BlueHammer exploit, targeting CVE-2026-33825, and RedSun leverage race conditions to gain SYSTEM-level access, while UnDefend disrupts Defender's update mechanism. These exploits are reportedly being used in targeted attacks following initial compromises, such as through compromised VPN accounts, and highlight vulnerabilities in Defender's privileged workflows. Organizations are advised to apply security updates, verify Defender versions, and implement measures like multifactor authentication and blocking execution from user directories.

New Lotus data wiper used against Venezuelan energy, utility firms

www.bleepingcomputer.com · 3 months ago

Researchers have identified a new data-wiping malware called Lotus, which targeted energy and utility organizations in Venezuela last year. The malware uses two initial batch scripts to disable system defenses and disrupt normal operations before deploying the wiper. Lotus completely destroys compromised systems by overwriting physical drives and eliminating recovery options, making data restoration impossible. Security experts recommend monitoring for unusual activity involving tools like diskpart, robocopy, and fsutil, and maintaining validated offline backups.

SystemBC C2 Server Reveals 1,570+ Victims in The Gentlemen Ransomware Operation

thehackernews.com · 3 months ago

Security researchers have linked the Gentlemen ransomware-as-a-service operation to a botnet of over 1,570 compromised networks worldwide. The group utilizes SystemBC proxy malware to establish SOCKS5 tunnels and download additional payloads, often disabling Windows Defender through PowerShell scripts. The Gentlemen's unique affiliate recruitment strategy and rapid deployment tactics contribute to its prolific nature, with attacks evolving to target specific security vendors and exploit vulnerabilities. Recent observations indicate a trend of increasingly swift ransomware attacks, with dwell times collapsing to hours.

Two new critical Spinnaker vulns allow RCE and production access

zeropath.com · 3 months ago

Researchers have identified two critical remote code execution vulnerabilities, CVE-2026-32604 and CVE-2026-32613, in the Spinnaker application deployment platform. These flaws, stemming from command injection issues in artifact fetching processes, allow authenticated users to execute arbitrary code on Spinnaker servers. Exploitation requires either valid credentials or write access to applications, potentially leading to credential theft and access to cloud environments. Patches are available in recent Spinnaker releases, including versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2.

VENOM: A Phishing-as-a-Service Platform Targeting C-Suite Microsoft Credentials

abnormal.ai · 3 months ago

A sophisticated credential theft campaign is targeting high-level executives across numerous industries. Attackers are using impersonated SharePoint notifications, QR codes, and layered filtering to bypass security measures and gain access. The campaign leverages legitimate Microsoft authentication flows and a previously unknown phishing-as-a-service platform called VENOM to achieve persistent access. Security leaders are advised to implement strategic defenses to combat this evolving threat.

BreachLock Named Representative Vendor in the 2026 Gartner Market Guide for Adversarial Exposure Validation

gbhackers.com · 3 months ago

false

Beijing tightens its grip on AI firms that try to shed their Chinese ties

www.washingtonpost.com · 3 months ago

Chinese authorities are increasing efforts to prevent artificial intelligence startups from relocating to Western markets to secure funding and expansion opportunities. A recent government probe of Manus AI, a company acquired by Meta, highlights a new restriction for these companies. This intensified scrutiny could influence the strategies of other Chinese AI startups seeking growth and investment in the United States. The move reflects a growing competition between China and the United States in the field of artificial intelligence.

The Ungoverned Workforce: Cybersecurity Insiders Finds 92% Lack Visibility Into AI Identities

gbhackers.com · 3 months ago

New research reveals a significant lack of governance and visibility surrounding artificial intelligence identities within enterprise systems. A staggering 92% of organizations report insufficient visibility into these AI identities, and most doubt their ability to detect or contain misuse. The study also found that 75% of organizations have already discovered unsanctioned AI tools running within their environments, raising concerns about accountability and security control. Experts advise organizations to prioritize continuous discovery and monitoring of machine identities to mitigate evolving risks.

Tim Cook Will Step Down as Apple C.E.O.

www.nytimes.com · 3 months ago

false

Detection strategies across cloud and identities against infiltrating IT workers

www.microsoft.com · 3 months ago

A North Korean-aligned threat actor, known as Jasper Sleet, is compromising organizations by impersonating remote IT workers. Attackers exploit expanded remote hiring practices, using stolen or fabricated identities and artificial intelligence to submit convincing job applications and gain access to internal systems. Microsoft is providing resources, including threat intelligence reports and hunting queries, to help organizations detect and respond to Jasper Sleet activity, specifically targeting platforms like Workday, email, Teams, DocuSign, Zoom, and Webex. Microsoft recommends monitoring employee behavior and API activity to identify anomalous behavior and mitigate this sophisticated threat.

22 BRIDGE:BREAK Flaws Expose Thousands of Lantronix and Silex Serial-to-IP Converters

thehackernews.com · 3 months ago

Cybersecurity researchers have identified 22 vulnerabilities, collectively named BRIDGE:BREAK, in serial-to-IP converters from Lantronix and Silex. These devices, which bridge legacy systems to networks, are susceptible to remote code execution, denial-of-service, authentication bypass, and device takeover. Approximately 20,000 vulnerable converters are currently exposed online, and exploitation could allow attackers to disrupt communications and tamper with data. Affected devices include Lantronix EDS3000PS and EDS5000 Series, and Silex SD330-AC, with associated CVEs including CVE-2026-32955, CVE-2026-32963, CVE-2015-5621, and CVE-2025-67034. Vendors have released security updates, and users are urged to apply patches and improve security practices.

Tim Cook Was Very, Very Good at Making Money

www.nytimes.com · 3 months ago

false

Surge in Bomgar RMM Exploitation Demonstrates Supply Chain Risk

www.darkreading.com · 3 months ago

A recent surge in cyberattacks is exploiting vulnerabilities in Bomgar remote monitoring and management (RMM) systems, impacting organizations and their customers. Attackers are leveraging the unauthenticated remote code execution flaw, CVE-2026-1731, to gain access and rapidly spread across supply chains, sometimes deploying LockBit ransomware. Compromised RMM systems grant attackers access to numerous downstream clients, enabling reconnaissance, privilege escalation, and the deployment of other tools like AnyDesk and Atera. Organizations are urged to immediately patch vulnerable systems and monitor for suspicious activity related to RMM usage.

Google Fixes Critical RCE Flaw in AI-Based 'Antigravity' Tool

www.darkreading.com · 3 months ago

Researchers at Pillar Security discovered a critical remote code execution vulnerability in Google’s AI-based Antigravity IDE. The flaw, stemming from insufficient input sanitization in the findbyname tool, allowed attackers to bypass security controls and execute arbitrary code. This vulnerability, designated CVE-2026-22708, affects Antigravity’s Secure Mode, which is intended to restrict network access and other operations. Google has since addressed the issue and awarded Pillar Security a bug bounty.

‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty

krebsonsecurity.com · 3 months ago

A senior member of the cybercrime group Scattered Spider, Tyler Robert Buchanan, has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Buchanan, also known as “Tylerb,” admitted to participating in SMS phishing attacks against technology companies like Twilio, LastPass, DoorDash, and Mailchimp in 2022, which enabled SIM-swapping attacks that resulted in over $8 million in cryptocurrency theft. He fled the United Kingdom after a threat from a rival cybercrime gang and was arrested in Spain before being extradited to the United States. Buchanan faces a potential sentence of over 20 years in prison.

P4WNED: How Insecure Defaults in Perforce Expose Source Code Across the Internet

morganrobertson.net · 3 months ago

Perforce servers ship with insecure defaults that enable a hidden read only remote user and automatic account creation, allowing unauthenticated access to repositories. A researcher’s internet wide scan of 6,122 public Perforce instances found 72 percent exposing source code, 21 percent with passwordless accounts, and four percent with unprotected superuser accounts that can permit remote code execution. Perforce disabled the remote user by default to address the largest issue, but many instances remain exposed; the researcher published hardening guidance and released scanning templates and tools to help detect and remediate vulnerable servers.

Apple C.E.O.s Through the Years: From Michael Scott (Not That One) to John Ternus

www.nytimes.com · 3 months ago

false

Third US Security Expert Admits Helping Ransomware Gang

www.securityweek.com · 3 months ago

A third man has pleaded guilty to assisting ransomware attackers while employed by cybersecurity firms. Kevin Martin, Ryan Goldberg, and Angelo Martino all admitted to collaborating with the BlackCat/Alphv ransomware group, sharing information to maximize ransom payments. Martino, a ransomware negotiator, received payments for providing confidential information to the cybercriminals, leading to the seizure of $10 million in assets. The BlackCat group targeted over 1,000 organizations between November 2021 and December 2023.

Ransomware Negotiator Pleads Guilty to Aiding BlackCat Attacks in 2023

thehackernews.com · 3 months ago

A man has pleaded guilty to conspiring to conduct ransomware attacks against U.S. companies in 2023. He worked as a negotiator, providing confidential information to the BlackCat ransomware group to help them extract higher ransoms from victims. He collaborated with two other incident responders, deploying ransomware and extorting approximately $1.2 million from one victim. Authorities seized $10 million in assets from the man, who faces up to 20 years in prison.

What Happens When A.I. Runs a Store in San Francisco?

www.nytimes.com · 3 months ago

false

Even Without Internet Access, Prisoners Are Trying to Benefit From A.I.

www.nytimes.com · 3 months ago

NULL

Dozens of Malicious Crypto Apps Land in Apple App Store

www.securityweek.com · 3 months ago

Security researchers have discovered over two dozen malicious cryptocurrency applications, known as FakeWallet, distributed through the Apple App Store. These apps, active since at least 2025, impersonate popular cryptocurrency wallets like Bitpie and MetaMask, attempting to steal user recovery phrases and private keys. The attackers use typosquating and fake banners to deceive users, and some apps contain dormant malicious features potentially awaiting activation. The threat actor is linked to the SparkKitty malware and has targeted users in China, but may expand to other regions.

UK probes Telegram, teen chat sites over CSAM sharing concerns

www.bleepingcomputer.com · 3 months ago

British regulators have launched investigations into Telegram, Teen Chat, Chat Avenue, and X regarding the sharing of harmful content. Ofcom, the UK's communications regulator, is examining Telegram's compliance with the Online Safety Act concerning the presence of child sexual abuse material, despite Telegram’s denial. The investigations into Teen Chat and Chat Avenue focus on the risk of child grooming, while X is being probed over content generated by its Grok AI chatbot. Non-compliance could result in significant fines or even a ban from the United Kingdom.

5 Places where Mature SOCs Keep MTTR Fast and Others Waste Time

thehackernews.com · 3 months ago

false

NGate Campaign Targets Brazil, Trojanizes HandyPay to Steal NFC Data and PINs

thehackernews.com · 3 months ago

Cybersecurity researchers have identified a new Android malware campaign called NGate targeting users in Brazil. The attackers are Trojanizing a legitimate application called HandyPay to steal NFC payment card data and PINs, allowing for unauthorized ATM cash-outs and payments. The malicious code appears to be AI-generated and the application is distributed through fake lottery websites and app store listings. HandyPay has initiated an internal investigation into the incident, which began around November 2025.

Unsecured Perforce Servers Expose Sensitive Data From Major Orgs

www.securityweek.com · 3 months ago

A recent analysis identified thousands of publicly accessible Perforce P4 servers with misconfigurations. Many servers offered unauthenticated read-only access, while others had accounts with no passwords, potentially granting complete system access. Exposed data included sensitive client information, credentials, source code, and product schematics, affecting organizations in various sectors, including defense, medical technology, and banking. Perforce has since taken action to improve default security settings and has advised users to regularly review configurations.

Azure SRE Agent flaw lets outsiders silently eavesdrop on enterprise cloud operations

www.csoonline.com · 3 months ago

A flaw in Microsoft’s Azure SRE Agent allowed unauthorized access to sensitive data, including credentials and command outputs. The vulnerability, tracked as CVE-2026-32173 and rated critical with a CVSS score of 8.6, stemmed from a multi-tenant authentication gap. Attackers could exploit this issue with minimal technical expertise, requiring only the agent’s subdomain and simple Python code. Microsoft has implemented a server-side fix and advises no further customer action is needed.

CISA flags new SD-WAN flaw as actively exploited in attacks

www.bleepingcomputer.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency is urging government agencies to address a vulnerability in Catalyst SD-WAN Manager, identified as CVE-2026-20133, due to evidence of active exploitation. This flaw allows unauthenticated attackers to access sensitive information through the system's API. CISA has also noted the exploitation of CVE-2026-20128 and CVE-2026-20122, previously patched by Cisco, and CVE-2026-20127, which enables the addition of malicious peers to networks. Federal agencies must secure their systems by Friday, April 24th, and Cisco has not yet confirmed the active exploitation of these vulnerabilities.

Prompt injection turned Google’s Antigravity file search into RCE

www.csoonline.com · 3 months ago

Security researchers discovered a prompt injection vulnerability in Google’s Antigravity IDE that allowed attackers to achieve remote code execution. The flaw exploited insufficient input sanitization within the “findmyname” tool, allowing malicious commands to be injected and executed by the “fd” utility. This vulnerability bypassed Google’s Secure Mode, which is designed to restrict network access and sandbox command operations. Google has since addressed the issue internally through its Vulnerability Reward Program.

Progress Patches Multiple Vulnerabilities in MOVEit WAF, LoadMaster

www.securityweek.com · 3 months ago

Progress Software has released patches to address several vulnerabilities in their MOVEit WAF and LoadMaster products. These flaws, including CVE-2026-3517, CVE-2026-3519, CVE-2026-3518, CVE-2026-4048, and CVE-2026-21876, could allow attackers to execute arbitrary commands or bypass firewall policies. The vulnerabilities stem from improper input sanitization in various API commands and file upload processes. Progress reports no exploitation and advises users to update to the patched versions.

SIM Farms as a Service: A Shared Control Plane Spanning 87 Farms

infrawatch.com · 3 months ago

false

[ Removed by Reddit ]

www.reddit.com · 3 months ago

NULL

Chinese APT Targets Indian Banks, Korean Policy Circles

www.darkreading.com · 3 months ago

Chinese state-sponsored threat group Mustang Panda, also known as TA416, has expanded its targeting beyond geopolitical espionage to include India's banking sector and policy circles in the United States and Korea. The group uses spear-phishing emails and a modified backdoor called LotusLite, disguised to resemble legitimate banking software like HDFC Bank, to establish a presence on compromised systems. Researchers at Acronis attribute this activity to Mustang Panda based on shared code and operational patterns, noting that the group utilizes basic, well-understood techniques to maintain flexibility and evade detection. The targeting of Indian banks is likely motivated by intelligence gathering related to financial transactions and economic insights.

AI-Powered NGate Malware Evades Detection Inside NFC Payment Apps

gbhackers.com · 3 months ago

A new malware variant, NGate, is targeting Android users in Brazil by disguising itself within a trojanized version of the legitimate NFC payment app, HandyPay. Attackers are using generative AI to assist in creating parts of the malicious code, lowering the barrier for less skilled actors. Once installed, the malware intercepts NFC transaction data and PINs, relaying them to attacker-controlled devices for fraudulent ATM withdrawals and payments. Distribution occurs through fake lottery websites and spoofed Google Play pages, with the campaign active since November 2025. IOCs include SHA-1 hashes for PROTECAOCARTAO.apk and RiodePrêmiosPagamento.apk.

Claude Code, Gemini CLI, and GitHub Copilot Exposed to Prompt Injection via GitHub Comments

gbhackers.com · 3 months ago

Researchers have discovered a new prompt injection technique called "Comment and Control" that targets AI agents integrated into GitHub workflows. This technique exploits standard GitHub communication channels like pull request titles and issue comments to deliver malicious instructions directly to agents, enabling unauthorized access to sensitive information. Vulnerable AI agents include Anthropic’s Claude Code Security Review, Google's Gemini CLI Action, and GitHub Copilot Agent; the Claude Code vulnerability, rated CVSS 9.4, involved the execution of bash commands from PR titles, while Gemini leaked API keys via fabricated issue comments. The GitHub Copilot Agent exploit bypassed security controls by hiding instructions within HTML comments to exfiltrate environment variables via a Git push. The core issue is the combination of AI agents needing access to production secrets while processing untrusted user input.

No Exploit Needed: How Attackers Walk Through the Front Door via Identity-Based Attacks

thehackernews.com · 3 months ago

Attackers are increasingly exploiting stolen credentials to gain initial access to systems, bypassing traditional security defenses. Artificial intelligence is accelerating these attacks by automating credential testing and crafting convincing phishing campaigns. A dynamic incident response approach, known as DAIR, is recommended, involving iterative loops of scoping, containment, eradication, and recovery to adapt to evolving incident details. Effective communication and practical training for incident response teams are crucial for handling these identity-based attacks.

We analysed almost 100 UK charity websites and found that ~1 in 6 are running vulnerable JavaScript dependencies.

cybaa.io · 3 months ago

NULL

Organizations Warned of Exploited Cisco, Kentico, Zimbra Vulnerabilities

www.securityweek.com · 3 months ago

Several vulnerabilities are now considered exploited and are being highlighted by federal agencies. Cisco Catalyst SD-WAN Manager has three vulnerabilities: CVE-2026-20133, CVE-2026-20122, and CVE-2026-20128. Attacks are also exploiting vulnerabilities in Kentico Xperience, specifically CVE-2025-2749, and Zimbra Collaboration Suite, tracked as CVE-2025-48700. Other affected vulnerabilities include CVE-2025-32975, CVE-2024-27199, and CVE-2023-27351.

Actively exploited Apache ActiveMQ flaw impacts 6,400 servers

www.bleepingcomputer.com · 3 months ago

Over six thousand four hundred Apache ActiveMQ servers remain vulnerable to an actively exploited code injection flaw, tracked as CVE-2026-34197. The vulnerability, discovered after thirteen years, allows authenticated threat actors to execute arbitrary code on unpatched systems due to improper input validation. U.S. Federal agencies have been directed to address this issue by April 30th, and organizations are urged to prioritize patching. The flaw joins CVE-2016-3088 and CVE-2023-46604, other ActiveMQ vulnerabilities previously exploited in the wild.

Mexican Surveillance Company

www.schneier.com · 3 months ago

A Mexican surveillance company has been identified as recording and publishing Zoom meetings without user consent. The company reportedly uses artificial intelligence to analyze the recordings, and its methods raise significant privacy concerns. This operation highlights the potential for misuse of technology and the need for stricter regulations regarding data collection and surveillance.

Data Breaches at Healthcare Organizations in Illinois and Texas Affect 600,000

www.securityweek.com · 3 months ago

Three healthcare organizations in Illinois and Texas have recently reported data breaches impacting nearly 600,000 individuals. The North Texas Behavioral Health Authority experienced a network intrusion potentially exposing social security numbers for 285,000 people. Southern Illinois Dermatology suffered a breach, with the Insomnia ransomware group claiming responsibility and leaking data affecting 160,000 patients. Saint Anthony Hospital in Chicago reported a compromised email security incident affecting 146,000 individuals, and was previously targeted by the LockBit ransomware group.

Google Patches Antigravity IDE Flaw Enabling Prompt Injection Code Execution

thehackernews.com · 3 months ago

Researchers have identified multiple vulnerabilities affecting AI-powered development tools, allowing attackers to execute unauthorized code and steal data. Exploits involve prompt injection techniques, often bypassing security measures like sandboxes and Strict Mode. Several tools, including Google Antigravity, Anthropic Claude Code, Microsoft Copilot Studio, and AI code editor Cursor, have been targeted with attacks like Comment and Control, Claudy Day, and ToolJack. These vulnerabilities highlight the risks of trusting AI agents with elevated access and processing untrusted data, with one vulnerability in Microsoft Copilot Studio being designated CVE-2026-21520.

Apache Syncope RCE Vulnerability Detailed After Public Exploit Code Release

gbhackers.com · 3 months ago

A critical remote code execution vulnerability, CVE-2025-57738, has been disclosed affecting Apache Syncope versions 2.x, 3.x before 3.0.14, and 4.x before 4.0.2. The flaw allows an authenticated administrator to upload malicious Groovy code, granting them unrestricted access to the JVM API and potentially full system control in containerized environments. The vulnerability stems from a lack of proper sandboxing during Groovy code compilation. Patches are available in Syncope 3.0.14 and 4.0.2, alongside other previously disclosed vulnerabilities including CVE-2023-26360, CVE-2024-27348, CVE-2024-54676, and CVE-2024-52012.