Blahalla

www.schneier.com · 3 months ago

A Mexican surveillance company has been identified as recording and publishing Zoom meetings without user consent. The company reportedly uses artificial intelligence to analyze the recordings, and its methods raise significant privacy concerns. This operation highlights the potential for misuse of technology and the need for stricter regulations regarding data collection and surveillance.

Data Breaches at Healthcare Organizations in Illinois and Texas Affect 600,000

www.securityweek.com · 3 months ago

Three healthcare organizations in Illinois and Texas have recently reported data breaches impacting nearly 600,000 individuals. The North Texas Behavioral Health Authority experienced a network intrusion potentially exposing social security numbers for 285,000 people. Southern Illinois Dermatology suffered a breach, with the Insomnia ransomware group claiming responsibility and leaking data affecting 160,000 patients. Saint Anthony Hospital in Chicago reported a compromised email security incident affecting 146,000 individuals, and was previously targeted by the LockBit ransomware group.

Google Patches Antigravity IDE Flaw Enabling Prompt Injection Code Execution

thehackernews.com · 3 months ago

Researchers have identified multiple vulnerabilities affecting AI-powered development tools, allowing attackers to execute unauthorized code and steal data. Exploits involve prompt injection techniques, often bypassing security measures like sandboxes and Strict Mode. Several tools, including Google Antigravity, Anthropic Claude Code, Microsoft Copilot Studio, and AI code editor Cursor, have been targeted with attacks like Comment and Control, Claudy Day, and ToolJack. These vulnerabilities highlight the risks of trusting AI agents with elevated access and processing untrusted data, with one vulnerability in Microsoft Copilot Studio being designated CVE-2026-21520.

Apache Syncope RCE Vulnerability Detailed After Public Exploit Code Release

gbhackers.com · 3 months ago

A critical remote code execution vulnerability, CVE-2025-57738, has been disclosed affecting Apache Syncope versions 2.x, 3.x before 3.0.14, and 4.x before 4.0.2. The flaw allows an authenticated administrator to upload malicious Groovy code, granting them unrestricted access to the JVM API and potentially full system control in containerized environments. The vulnerability stems from a lack of proper sandboxing during Groovy code compilation. Patches are available in Syncope 3.0.14 and 4.0.2, alongside other previously disclosed vulnerabilities including CVE-2023-26360, CVE-2024-27348, CVE-2024-54676, and CVE-2024-52012.

Microsoft spots Sapphire Sleet macOS attack using AppleScript and social engineering

gbhackers.com · 3 months ago

A cyber campaign linked to the North Korean threat actor Sapphire Sleet is targeting macOS users through social engineering tactics. Attackers pose as recruiters to trick victims into downloading malicious AppleScript files disguised as software updates, bypassing security controls. Once executed, the script downloads additional payloads to steal sensitive data like browser credentials, cryptocurrency information, and system logs, often targeting cryptocurrency, finance, and blockchain sectors. Microsoft has reported the findings to Apple, which has deployed security updates to address the threat.

Former ransomware negotiator pleads guilty to BlackCat attacks

www.bleepingcomputer.com · 3 months ago

A former cybersecurity incident response company employee, Angelo Martino, has pleaded guilty to charges related to BlackCat ransomware attacks against U.S. companies. Working with accomplices, Martino shared sensitive victim information with the ransomware operators, facilitating extortion attempts and receiving a share of the ransom proceeds. Victims included a financial services firm paying $25,660,000 and a nonprofit paying $26,793,000. The FBI has linked the BlackCat operation to over 60 breaches and over $300 million in ransom payments.

$290 Million Kelp DAO Crypto Heist Blamed on North Korea

www.securityweek.com · 3 months ago

North Korea-linked Lazarus Group, specifically the TraderTraitor subgroup, is responsible for a $290 million cryptocurrency heist targeting the Kelp DAO DeFi protocol. Attackers compromised LayerZero’s Decentralized Verifier Network by poisoning two RPCs and launching a denial-of-service attack, exploiting Kelp DAO’s single-verifier configuration. The stolen funds were subsequently deposited into the Aave v3 lending protocol, triggering a cascade of liquidations and a nearly $8 billion drop in Aave’s total value. LayerZero recommends a multi-DVN setup to prevent similar attacks, a suggestion Kelp DAO did not implement.

Why identity is the driving force behind digital transformation

www.csoonline.com · 3 months ago

false

PureRAT Hides PE Payloads in PNGs for Fileless Execution

gbhackers.com · 3 months ago

A recent cyber campaign utilizes a sophisticated multi-stage attack leveraging steganography to deliver the PureRAT malware. The attack begins with a malicious shortcut file that executes a PowerShell script, which then downloads and runs a VBScript loader. This loader retrieves and executes a.NET payload hidden within a PNG image, bypassing conventional security measures through process hollowing and advanced UAC bypass techniques. The PureRAT implant, also protected, collects system information and allows for remote control through plugins, including keylogging and credential theft.

A Wish List for John Ternus, the Man Replacing Tim Cook as Apple’s CEO

www.nytimes.com · 3 months ago

false

Top techniques attackers use to infiltrate your systems today

www.csoonline.com · 3 months ago

Attackers are increasingly using identity-based attacks, like phishing, stolen credentials, and social engineering, to infiltrate systems, often bypassing traditional security measures. Threat actors are exploiting vulnerabilities in remote monitoring and management tools, such as ConnectWise ScreenConnect, and employing techniques like ClickFix to distribute malware. Additionally, attackers are compromising machine identities, leveraging platforms like Tycoon 2FA for adversary-in-the-middle attacks, and exploiting supply chain vulnerabilities, exemplified by the Shai-Hulud npm package worm. Experts recommend layered defenses, including phishing-resistant authentication and zero trust principles, to combat these evolving threats.

NGate Android malware uses HandyPay NFC app to steal card data

www.bleepingcomputer.com · 3 months ago

A new variant of the NGate malware is targeting Android users, specifically in Brazil, by disguising itself within a modified version of the HandyPay mobile payment application. This malware steals payment card information through the device's NFC chip and sends it to the attacker. The shift to HandyPay is attributed to its lower cost and reduced visibility compared to other NFC relaying tools. Users are advised to download apps only from trusted sources, disable NFC when not in use, and utilize Play Protect to avoid infection.

The thin gray line: Handala, CyberAv3ngers and Iran’s proxy ops

www.csoonline.com · 3 months ago

Iran is employing a strategy of using radical activist groups like CyberAv3ngers and Handala Hack Team as proxies to conduct cyberattacks against US infrastructure, allowing for plausible deniability and avoiding direct conflict. These groups, while appearing to be independent hacktivist collectives, are believed to be directly linked to the Iranian Ministry of Intelligence and heavily-resourced. This tactic, part of a broader effort by Iran and other nations like Russia, China, and North Korea, involves masking state-sponsored operations through seemingly grassroots organizations. The use of proxies allows Iran to exert influence and carry out attacks while minimizing the risk of immediate retaliation.

Thinking of using a chatbot for medical advice? Read this first.

www.washingtonpost.com · 3 months ago

false

GitHub Issue Alerts Exploited in OAuth Phishing Scam Targeting Developers

gbhackers.com · 3 months ago

Hackers are exploiting GitHub’s issue-notification system to phish developers and gain unauthorized access to their repositories. Attackers create fake security alerts that appear to be legitimate GitHub notifications, tricking developers into authorizing malicious OAuth applications. These applications can then access private repositories, inject backdoors, and compromise workflows, enabling supply-chain attacks. Security experts recommend verifying alerts directly through GitHub’s security center and regularly reviewing authorized OAuth applications.

CISA Alerts Defenders to Exploited Cisco Catalyst SD-WAN Manager Security Flaws

gbhackers.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency has issued an urgent warning about the active exploitation of Cisco Catalyst SD-WAN Manager vulnerabilities. Three vulnerabilities, CVE-2026-20133, CVE-2026-20122, and CVE-2026-20128, are being actively exploited, allowing attackers to gain access to sensitive data, modify system files, and escalate privileges. Federal agencies and private organizations are required to implement immediate mitigations within three days. CISA recommends patching vulnerable systems, following guidance directives, or discontinuing use of the product if mitigations cannot be applied.

6,000+ Publicly Exposed Apache ActiveMQ Instances Found Vulnerable to CVE-2026-34197

gbhackers.com · 3 months ago

Over six thousand internet-facing Apache ActiveMQ servers are vulnerable due to a critical security flaw tracked as CVE-2026-34197. This vulnerability stems from improper input validation and allows attackers to execute malicious code. The Cybersecurity and Infrastructure Security Agency has added CVE-2026-34197 to its Known Exploited Vulnerabilities catalog, urging immediate remediation. Organizations are advised to upgrade ActiveMQ versions, block public internet access, and monitor systems for signs of compromise.

Gentlemen RaaS Hits Windows, Linux, and ESXi With New C-Based Locker

gbhackers.com · 3 months ago

A ransomware-as-a-service operation called Gentlemen is targeting Windows, Linux, NAS, BSD, and VMware ESXi systems. The group utilizes cross-platform lockers, including a C-based locker specifically designed for ESXi hypervisors, employing a double extortion model of encryption and data leakage. Attackers typically gain Domain Admin access, deploy Cobalt Strike beacons, and disable security tools like Microsoft Defender to facilitate widespread encryption across networks, often leveraging PowerShell and Group Policy. To persist on ESXi systems, the malware copies itself, creates boot scripts, and manipulates VMFS write buffers.

CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines

thehackernews.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency has added eight vulnerabilities to its catalog of actively exploited flaws. These include improper authentication vulnerabilities in PaperCut NG/MF (CVE-2023-27351), Quest KACE Systems Management Appliance (CVE-2025-32975), and Cisco Catalyst SD-WAN Manager, along with a path traversal flaw in Kentico Xperience (CVE-2025-2749). Other vulnerabilities affect JetBrains TeamCity (CVE-2024-27199), Synacor Zimbra Collaboration Suite (CVE-2025-48700), and Cisco Catalyst SD-WAN Manager (CVE-2026-20122, CVE-2026-20128, CVE-2026-20133). Federal agencies must patch the Cisco vulnerabilities by April 23, 2026, with the remaining vulnerabilities requiring remediation by May 4, 2026. Exploitation of some of these vulnerabilities has been linked to ransomware attacks and targeted campaigns.

12 Fraudulent Browser Extensions Disguised as TikTok Downloaders Compromise 130K Users

gbhackers.com · 3 months ago

Security researchers have discovered a coordinated campaign involving twelve fraudulent browser extensions disguised as TikTok video downloaders that have compromised over 130,000 users. These extensions, available for Chrome and Edge, initially function normally before activating malicious tracking features after six to twelve months. The attackers use a shared codebase and deceptive domain names to quickly replace flagged extensions and evade detection, and some even received a “Featured” badge from official stores. The extensions harvest extensive user data, including device fingerprints and battery status, and operate using dynamic remote configuration to bypass security reviews.

Command Execution via Drag-and-Drop in Terminal Emulators

sdushantha.github.io · 3 months ago

Researchers have discovered a vulnerability in several terminal emulators allowing command execution through a drag-and-drop feature. Malicious actors can embed hidden commands within file names, which are then executed when dragged into a terminal. The exploit utilizes control characters to bypass sanitization and trick the terminal into running unintended commands. Affected terminal emulators include Kitty and xfce4-terminal, which have since been patched, although no CVEs have been assigned.

AI-Driven Exploitation Could Shrink Defenders’ Patch Window

gbhackers.com · 3 months ago

Artificial intelligence is rapidly changing cyberattacks, enabling automated discovery and exploitation of software vulnerabilities at unprecedented speeds. This shift significantly reduces the traditional patch window, potentially shrinking response time from weeks to hours. Open-source software is particularly vulnerable due to AI's ability to quickly analyze publicly available code, raising concerns about supply chain attacks. Security teams must adapt by embracing proactive measures like stronger endpoint protections, SBOMs, rapid patching, and utilizing AI-driven defensive tools to counter this accelerated threat landscape.

Malicious GGUF Models Could Trigger Remote Code Execution on SGLang Servers

gbhackers.com · 3 months ago

Security researchers have identified a critical vulnerability in the SGLang framework, enabling Remote Code Execution. This flaw, tracked as CVE-2026-5760, arises from an insecure configuration of Jinja2, allowing malicious commands to execute when a compromised GGUF model is loaded. Attackers can exploit this by hosting weaponized models and tricking users into deploying them, potentially gaining full control of the server. The vulnerability shares characteristics with CVE-2024-34359 and CVE-2025-61620.

CISA Warns Compromised Axios npm Package Fueled Major Supply Chain Attack

gbhackers.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about a supply chain attack targeting the widely used Axios JavaScript library. Threat actors compromised versions 1.14.1 and 0.30.4 of Axios, injecting a malicious dependency called plain-crypto-js version 4.2.1. This allowed attackers to deploy a remote access trojan, potentially enabling them to steal source code and access corporate networks. Affected organizations should downgrade Axios to versions 1.14.0 or 0.30.3, remove the plain-crypto-js directory, and rotate exposed credentials.

SideWinder Spoofs Chrome PDF Viewer, Zimbra to Steal Government Webmail Logins

gbhackers.com · 3 months ago

A cyber campaign attributed to the SideWinder advanced persistent threat group is targeting government webmail logins in South Asia. Attackers are using a fake Chrome PDF viewer and a cloned Zimbra login page hosted on Cloudflare Workers to steal credentials from organizations including the Bangladesh Navy and Pakistan’s Ministry of Foreign Affairs. The phishing kit, identified as "Z2FALTS," employs a blurred PDF lure and reverse-proxies assets to mimic legitimate websites, while also leveraging recycled sensitive documents as bait. Researchers have identified multiple Cloudflare Workers and accounts linked to the operation, highlighting a sustained and modular credential harvesting infrastructure.

Lovable AI App Builder Hit by Reported API Flaw Exposing Thousands of Projects

gbhackers.com · 3 months ago

A vulnerability in the Lovable AI application builder is exposing sensitive data from projects created before November 2025. The flaw allows unauthorized users with free accounts to access project source code, database credentials, customer information, and AI chat histories. Recent projects are protected, but older projects receive a "200 OK" response, granting full access. Several large technology companies, including Nvidia, Microsoft, Uber, and Spotify, are potentially impacted because employees may have used the platform to develop internal tools.

Amazon Plans to Invest Up to $25 Billion in Anthropic

www.nytimes.com · 3 months ago

false

Apple CEO Tim Cook to step down in September

www.washingtonpost.com · 3 months ago

false

Vercel confirms Context.ai-linked breach exposed customer environment variables; ShinyHunters lists $2M sale on BreachForums

icbrief.org · 3 months ago

Vercel has confirmed a data breach linked to Context.ai, an AI assistant used by an employee. Attackers gained access to an employee's Google Workspace account, allowing them to access some Vercel environments and environment variables. The stolen data, including API keys, is being offered for sale on BreachForums for two million dollars. Context.ai also experienced unauthorized access to its AWS environment earlier this year impacting consumer OAuth tokens.

KelpDAO suffers $290 million heist tied to Lazarus hackers

www.bleepingcomputer.com · 3 months ago

Hackers, believed to be linked to the Lazarus Group, orchestrated a 290 million dollar crypto-heist targeting the KelpDAO DeFi project and impacting Compound, Euler, and Aave. The attack involved compromising RPC nodes to feed falsified data, allowing unauthorized transfers of rsETH tokens through Tornado Cash. LayerZero reported the incident was isolated to rsETH and attributed the attack to the Lazarus Group, specifically TraderTraitor. This recent theft follows a similar 280 million dollar attack on the Drift Protocol, demonstrating a pattern of sophisticated, long-term planning by state-sponsored actors.

China's Apple App Store infiltrated by crypto-stealing wallet apps

www.bleepingcomputer.com · 3 months ago

Malicious applications impersonating popular cryptocurrency wallets have infiltrated Apple's App Store, specifically targeting users in China. These FakeWallet apps, part of a larger campaign linked to SparkKitty, use tactics like typosquatting and fake branding to trick users into downloading them, often disguised as games or calculators. Once installed, the apps redirect users to phishing sites to download trojanized apps that steal recovery phrases and drain cryptocurrency assets. Apple has since removed the 26 apps from the App Store.

California Accuses Amazon of Price Fixing in Legal Filing

www.nytimes.com · 3 months ago

false

Vercel Employee's AI Tool Access Led to Data Breach

www.darkreading.com · 3 months ago

A security breach at Vercel stemmed from a compromised OAuth token belonging to a Vercel employee who used it to grant broad permissions to an AI tool, Context.ai. Attackers exploited this access to obtain some Vercel environments and variables, though those marked as “sensitive” remain secure. Context.ai experienced its own breach, revealing the compromise of OAuth tokens for some consumer users and highlighting the expanding risks associated with AI tools and OAuth permissions. Vercel is collaborating with Mandiant and other firms to investigate, and has contacted potentially impacted customers to rotate credentials.

Serial-to-IP Devices Hide Thousands of Old & New Bugs

www.darkreading.com · 3 months ago

Researchers have discovered 20 new vulnerabilities in popular serial-to-IP converter models from Lantronix and Silex, devices critical for connecting older industrial machinery to networks. These devices, often targeted in cyberattacks like the 2015 Ukrainian power grid attack, frequently run outdated software and libraries, leading to thousands of known vulnerabilities. Specifically, the Lantronix EDS3000PS had a critical vulnerability, CVE-2025-70082, allowing password changes without prior knowledge, while the EDS5000PS contained five remote code execution vulnerabilities with critical CVSS scores of 9.8. The study highlights a widespread lack of security hardening techniques, leaving these devices vulnerable to exploitation.

Tim Cook Will Step Down as Apple C.E.O.

www.nytimes.com · 3 months ago

false

Analysis of the April 2026 Booking.com Supply Chain Breach and ClickFix Tactics

infosecwriteups.com · 3 months ago

Booking.com recently disclosed a data breach impacting customer Personally Identifiable Information, with attackers gaining unauthorized access through the company’s supply chain, specifically partner hotels. Threat actors likely used a tactic called ClickFix, tricking hotel staff into running malicious scripts to steal session cookies, bypassing authentication measures. The stolen data, while not financial, poses a significant risk of fraud and impersonation, as attackers can use details like check-in dates and hotel names to create convincing phishing messages. Booking.com previously experienced a similar breach in 2021, resulting in a substantial fine under European data protection regulations.

The Gentlemen ransomware now uses SystemBC for bot-powered attacks

www.bleepingcomputer.com · 3 months ago

Researchers have discovered that affiliates of the Gentlemen ransomware-as-a-service operation are now utilizing a SystemBC proxy botnet of over 1,570 compromised hosts, primarily targeting corporate environments. The botnet, which has been active since 2019 and previously linked to infections of commercial virtual private servers, is used to covertly deliver payloads. Attackers gain access through Domain Controller credentials, leveraging tools like Cobalt Strike, Mimikatz, and Group Policy for lateral movement and encryption. Gentlemen ransomware employs a hybrid encryption scheme using X25519 and XChaCha20 and is actively recruiting new affiliates via underground forums.

Amtrak Data Breach Exposes 2.1M Records, Reports Suggest Larger Leak

www.techrepublic.com · 3 months ago

Amtrak is dealing with a data breach impacting over 2.1 million customer records, with reports suggesting the total could be much higher, potentially reaching 9.4 million. The exposed data includes names, addresses, email addresses, and customer service records, raising concerns about identity theft and fraud. The breach, attributed to the group ShinyHunters, involved access to Amtrak’s Salesforce environment and highlights the risks associated with cloud-based systems. Affected users are advised to change passwords, enable two-factor authentication, and monitor account activity.

The MCP Disclosure Is the AI Era’s ‘Open Redirect’ Moment

www.techrepublic.com · 3 months ago

Researchers have identified a critical vulnerability in the Model Context Protocol, or MCP, a standard used to connect enterprise AI assistants to internal tools. This flaw, present “by design,” potentially affects over 200,000 MCP servers and enables AI supply chain attacks. Security professionals are drawing comparisons to past systemic vulnerabilities like open redirects, emphasizing the rapid speed at which exploitation can occur. A Chinese state-sponsored group, GTG-1002, reportedly exploited MCP tools in a cyber-espionage campaign targeting major technology companies and government agencies. To address this, security experts recommend shifting data access governance to the data layer itself, employing a zero-trust approach to authentication and policy enforcement.

Elon Musk Ignores French Prosecutors, Widening Tech Rift With Europe

www.nytimes.com · 3 months ago

false

Seiko USA website defaced as hacker claims customer data theft

www.bleepingcomputer.com · 3 months ago

The Seiko USA website was defaced over the weekend, displaying a message claiming a Shopify customer database breach. Attackers allege they stole customer information including names, email addresses, order history, and account details, threatening to leak the data if a ransom is not paid. They instructed Seiko to contact them through a specific customer account in the Shopify admin panel, setting a 72-hour deadline. The authenticity of the claims is currently unverified, and Seiko USA has not yet publicly responded to the incident.

Microsoft Defender Flaws Exploited on Windows, Two Left Unpatched

www.techrepublic.com · 3 months ago

Microsoft Defender and Windows users face new security threats with three actively exploited vulnerabilities. BlueHammer, RedSun, and UnDefend are the names of these exploits, with BlueHammer being the only one currently patched. RedSun allows attackers to gain SYSTEM-level access by overwriting system files and has been confirmed on Windows 10, Windows 11, and various Windows Server versions. UnDefend disrupts Microsoft Defender’s definition updates, potentially disabling it altogether.

Over 800 Android Apps Targeted in PIN-Stealing Trojan Campaign

www.techrepublic.com · 3 months ago

Over 800 Android applications have been compromised in a widespread banking trojan campaign. Hackers are using techniques like phishing, fake app updates, and the Native Session Installation API to sideload malicious payloads onto devices. Once installed, the malware, including RecruitRat, SaferRat, Astrinox, and Massiv, abuses Accessibility Service permissions and overlays to steal PINs, app logins, and intercept sensitive data. Users are advised to avoid sideloading apps, review accessibility permissions, and be cautious of suspicious links or offers.

Deterministic Chain Analysis: The Missing Layer in a Mythos-Ready Security Program

dev.to · 3 months ago

false

Chrome Privacy Concerns Rise as Expert Warns of Fingerprinting Risks

www.techrepublic.com · 3 months ago

Privacy concerns are growing regarding Google Chrome's vulnerability to browser fingerprinting, a technique that tracks users through technical details like operating system and screen resolution. A privacy consultant reports that thirty fingerprinting methods currently function within Chrome. While Google previously attempted to address this through the Privacy Sandbox initiative, those plans have been abandoned, leaving third-party cookies operational. Google has recently implemented Device Bound Session Credentials to prevent session theft and is addressing a large-scale Chrome extension data breach affecting roughly 20,000 individuals.

Vercel Breach Explained: OAuth Risk in AI + SaaS Environment

www.grip.security · 3 months ago

A recent security incident at Vercel highlights the increasing danger of SaaS ecosystem vulnerabilities. An employee’s OAuth access granted to the AI tool Context.ai was exploited after Context.ai was compromised, leading to potential exposure of Vercel’s internal systems and data. This incident reveals a pattern of SaaS-to-SaaS attack chains and is accelerated by AI agents requiring extensive access, creating significant risk due to over-permissioned OAuth grants and a lack of visibility. Security teams should immediately review OAuth access to Context.ai and audit permissions granted to third-party AI tools.

Vercel Confirms Major Security Incident as Hacker Claims $2M Ransom Demand

www.techrepublic.com · 3 months ago

Cloud development platform Vercel has confirmed a security incident after a threat actor claimed unauthorized access to internal systems and demanded a $2 million ransom. The actor, allegedly affiliated with ShinyHunters, claims to have obtained sensitive data, including API keys, database contents, and employee credentials. Compromised systems could expose developer environments, CI/CD pipelines, and dependent applications, potentially allowing attackers to manipulate deployments and access production services. Vercel advises organizations to rotate credentials, restrict access, and monitor logs to mitigate similar risks.

SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files

thehackernews.com · 3 months ago

A critical security vulnerability, CVE-2026-5760, has been identified in the SGLang serving framework, allowing for remote code execution. The vulnerability arises from improper sandboxing during template rendering, enabling attackers to inject and execute arbitrary Python code through specially crafted GGUF model files. Exploitation occurs when a victim downloads and loads a malicious model, and a request is made to the "/v1/rerank" endpoint. This vulnerability is similar to CVE-2024-34359 and CVE-2025-61620 and can be mitigated by using ImmutableSandboxedEnvironment.

Building a LLM honeypot that monitors all 65535 ports

discounttimu.substack.com · 3 months ago

false

2026’s Breach List So Far: FBI Hacked, 1B Androids at Risk, 270M iPhones Vulnerable

www.techrepublic.com · 3 months ago

Several significant cyber incidents have occurred this year, impacting organizations and individuals worldwide. The FBI experienced a major intrusion compromising surveillance data, while an iPhone exploit called DarkSword, found on Ukrainian websites, potentially affects millions of devices. A database containing 149 million login credentials was exposed without password protection. Additionally, the telecom provider Brightspeed suffered a ransomware attack, and Nike experienced a data breach involving trade secrets. Google released a substantial Android security patch addressing CVE-2026-21385, which was already being exploited.