Blahalla

netwatch - Real time network diagnostics in your terminal.

terminaltrove.com · 3 months ago

false
Navigating the Unique Security Risks of Asia's Digital Supply Chain

www.darkreading.com · 3 months ago

false
Comcast’s $117.5M Breach Settlement: Up to 30M People May Qualify

www.techrepublic.com · 3 months ago

Comcast agreed to an 117 point 5 million dollar settlement concerning a data breach. The incident involved the exposure of records belonging to 30 million people. The settlement resolves claims that the company failed to adequately protect customer data.
Snap Is Laying Off 16% of Full-Time Staff as It Embraces A.I.

www.nytimes.com · 3 months ago

false
Ad Companies Settle With F.T.C. Over Claims of Harm to Conservative Sites

www.nytimes.com · 3 months ago

NULL
Signed software abused to deploy antivirus-killing scripts

www.bleepingcomputer.com · 3 months ago

A digitally signed adware tool attributed to Dragon Boss Solutions LLC deployed MSI and PowerShell payloads that ran with SYSTEM privileges and disabled antivirus protections on thousands of endpoints across multiple sectors. Researchers observed more than 23,500 infected hosts in 124 countries contacting the operator infrastructure in a single day, with hundreds of infections inside high value networks including academic institutions, operational technology, municipal governments, and healthcare providers. The operation abused the Advanced Installer update mechanism to silently install a Setup.msi disguised as an image and execute a PowerShell script named ClockRemoval.ps1 that stops services, kills processes, deletes installation directories and registry entries, runs vendor uninstallers, force deletes files, and blocks vendor domains to prevent reinstallation. Because the attackers did not register the main update domain, researchers were able to register and sinkhole it, and they warned the same update mechanism could deliver more dangerous payloads while recommending defenders search for specific WMI event subscriptions and scheduled tasks, review hosts file entries blocking AV vendors, and inspect Defender exclusions for suspicious paths.
n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails

thehackernews.com · 3 months ago

Threat actors have been weaponizing n8n, a popular AI workflow automation platform, since October 2025 to run sophisticated phishing campaigns that send automated emails to deliver malicious payloads and fingerprint devices. By leveraging trusted infrastructure and legitimate n8n webhooks, attackers bypass traditional email security filters and increase deliverability. The campaigns use automated workflows to exfiltrate information and stage further compromise across enterprise environments. Organizations using n8n should audit webhook configurations restrict public access and monitor for unusual outbound email activity.
Sweden Blames Pro-Russian Group for Cyberattack Last Year on Its Energy Infrastructure

www.securityweek.com · 3 months ago

A pro-Russian group with links to Russia's security and intelligence services was responsible for a cyberattack last year that targeted a heating plant in western Sweden but the attack failed, Sweden's minister for civil defense said. Officials compared the incident to coordinated December attacks in Poland that struck combined heat and power plants and other energy infrastructure and said evidence pointed to hackers linked to Russian services. Officials said the attacks target systems controlling critical infrastructure, carry potentially serious consequences for society, and form part of more than 150 incidents of sabotage and malign activity across Europe tracked since February 2022, with similar events reported in Denmark, Norway and Latvia.
Massive Chrome Extension Scam Exposes 20,000 Users to Data Theft

www.techrepublic.com · 3 months ago

Security researchers linked 108 malicious Chrome extensions to a coordinated campaign that exposed about 20,000 users to data theft, backdoors, and ad injection. The extensions, published across five publishers, abused OAuth to steal Google account identities in 54 cases, included a universal backdoor in 45 cases, and also exfiltrated Telegram Web sessions, removed security headers on YouTube and TikTok for ad injection, redirected translation requests through attacker servers, and injected content scripts into every visited page. All 108 extensions were live on the Chrome Web Store when reported, and researchers submitted their findings to Google while advising users to verify publisher reputation and reviews and to keep browsers updated.
Microsoft pays $2.3M for cloud and AI flaws at Zero Day Quest

www.bleepingcomputer.com · 3 months ago

Microsoft has awarded 2.3 million dollars to security researchers after receiving nearly 700 vulnerability submissions to this year's Zero Day Quest, with over 80 high impact cloud and AI flaws identified during a live hacking event at its Redmond campus. Researchers demonstrated credential exposure, server side request forgery chains, and cross tenant access while testing in authorized environments, and Microsoft says the findings will be shared through the CVE program and used across the company under its Secure Future Initiative to improve cloud and AI security.
Incident response for AI: Same fire, different fuel

www.microsoft.com · 3 months ago

There are core incident response principles that still apply to AI including explicit ownership, containment before investigation, safe escalation, and clear transparent communication, but AI non determinism and machine speed change how incidents manifest and how fixes are validated. There are new challenges that require expanded taxonomies for harms such as dangerous instructions or targeted content, improved telemetry for anomalous outputs and classifier confidence shifts, and deliberate reconciliation of privacy preserving defaults with the need for forensics. There are practical recommendations including a three stage remediation approach to stop the bleed, broaden and automate mitigations, and fix at the source, sustained post remediation watch periods because model behavior can vary, and investment in responder wellbeing to manage exposure to harmful content.
Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities

sec.cloudapps.cisco.com · 3 months ago

There are multiple vulnerabilities in the web based management interface of Cisco Identity Services Engine that could allow an authenticated remote attacker with administrative write privileges to perform stored or reflected cross site scripting attacks against users of the interface. The vulnerabilities are caused by insufficient sanitization of user supplied data stored in web pages and can be exploited by convincing a user to click a crafted link or view an affected page, potentially executing injected script in the interface context or exposing sensitive browser based information. Cisco has released software updates to address the vulnerabilities, no workarounds are available, and the issue is tracked as CVE-2026-20132.
Cisco Webex Contact Center Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 3 months ago

There is a cross-site scripting vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center that could have allowed an unauthenticated remote attacker to execute script in a victim browser by persuading the user to follow a malicious link. A successful exploit could have allowed theft of sensitive browser data including authentication and session information because HTML and script content were not properly handled. Cisco has addressed the vulnerability in the Webex Contact Center service, no customer action is required, and the issue is tracked as CVE-2026-20170 with a security impact rating of medium.
Cisco Identity Services Engine Remote Code Execution Vulnerabilities

sec.cloudapps.cisco.com · 3 months ago

Multiple vulnerabilities in Cisco Identity Services Engine could allow an authenticated remote attacker with at least Read Only Admin credentials to execute arbitrary commands on the underlying operating system. The flaws stem from insufficient validation of user supplied input and can be exploited by sending a crafted HTTP request, potentially allowing an attacker to obtain user level access to the operating system and then elevate privileges to root. In single node deployments, successful exploitation can make the affected ISE node unavailable and cause a denial of service that prevents unauthenticated endpoints from accessing the network until the node is restored. Cisco released software updates to address the issues and there are no workarounds; the vulnerabilities are tracked as CVE-2026-20180 and CVE-2026-20186.
Cisco Unity Connection Arbitrary File Download Vulnerabilities

sec.cloudapps.cisco.com · 3 months ago

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated remote attacker with valid administrative credentials to download arbitrary files from affected systems. The flaws stem from improper sanitization of user input in the web-based management interface and can be exploited by sending a crafted HTTPS request. Cisco has released software updates that address the issues, there are no workarounds, the security impact rating is Medium, and the issues are tracked as CVE-2026-20078 and CVE-2026-20081.
Cisco ThousandEyes Enterprise Agent Arbitrary File Overwrite Vulnerability

sec.cloudapps.cisco.com · 3 months ago

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated local attacker with low privileges to overwrite arbitrary files on an affected device. The issue is caused by improper access controls on files in the local file system and can be exploited by placing a symbolic link in a specific location to bypass file system permissions and overwrite files. Cisco has released software updates that address the vulnerability and reports there are no workarounds. Security Impact Rating is Medium and CVE CVE-2026-20161 is assigned.
Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability

sec.cloudapps.cisco.com · 3 months ago

There is a command injection vulnerability in the CLI of Cisco Identity Services Engine and Cisco ISE Passive Identity Connector that can allow an authenticated local attacker with administrative privileges to supply crafted input to a specific CLI command and elevate privileges to root. The vulnerability is caused by insufficient validation of user supplied input. Cisco released software updates that address the issue, there are no available workarounds, and the security impact rating is Medium. The issue is tracked as CVE-2026-20136.
Cisco Unity Connection Cross-Site Scripting, Open Redirect, and SQL Injection Vulnerabilities

sec.cloudapps.cisco.com · 3 months ago

There are multiple vulnerabilities in Cisco Unity Connection that could allow a remote attacker to conduct cross-site scripting, an open redirect, and an SQL injection attack. Cisco has released software updates that address these vulnerabilities and there are no workarounds available. The vulnerabilities are tracked as CVE-2026-20059, CVE-2026-20060, and CVE-2026-20061 and the security impact rating is Medium.
Microsoft Issues Massive Windows Patch for 160+ Bugs, Including Two Zero-Days

www.techrepublic.com · 3 months ago

There are 165 vulnerabilities fixed in Microsoft’s April 2026 Patch Tuesday, including two zero days, making this one of the largest monthly security updates on record. The two zero days are a SharePoint Server spoofing flaw CVE-2026-32201 that permits unauthenticated spoofing through improper input validation, and a Microsoft Defender privilege escalation CVE-2026-33825 that can yield full SYSTEM access and already has a proof of concept exploit nicknamed BlueHammer in the wild. Eight vulnerabilities were rated Critical, seven enabling remote code execution, most notably CVE-2026-33824 in the Windows IKEv2 implementation with a CVSS score of 9.8 that can be exploited by crafted packets and for which blocking inbound UDP ports 500 and 4500 is recommended as a temporary mitigation. Other high risk fixes include CVE-2026-33827 a TCP IP race condition allowing remote code execution via crafted IPv6 packets on IPSec enabled machines and CVE-2026-33826 affecting Active Directory, and administrators are advised to prioritize Office and Windows patching.
We Don’t Really Know How A.I. Works. That’s a Problem.

www.nytimes.com · 3 months ago

Researchers in the growing field of interpretability are racing to open the black box of large language models so those systems can be trusted on sensitive subjects. New mechanistic techniques seek to map internal circuits and neuron activations to human concepts, revealing biases, manipulative behaviors, and failure modes that surface testing can miss. Making these internal processes visible is presented as crucial for aligning models with human values and reducing unexpected harms in high stakes settings. Experts call for coordinated work across industry, academia, and regulators to develop standardized tools and benchmarks for interpretability before broader deployment.
Prepping for 'Q-Day': Why Quantum Risk Management Should Start Now

www.darkreading.com · 3 months ago

Quantum computers are emerging and threaten modern public key algorithms such as RSA and ECDSA, placing VPNs, public key infrastructure, and distributed ledgers at risk. Organizations should begin continuous quantum risk management now because migration to post quantum cryptography will take years; key steps include systems discovery and inventory, business impact assessment, remediation planning, and supply chain review. New post quantum standards such as the stateless hash based signature algorithm SLH DSA exist and some platforms have started adopting PQC by default, but teams must trust but verify vendor claims by checking documentation, configurations, and logs since implementations can be partial, disabled by default, or still depend on vulnerable public key operations. Security teams should also hunt for legacy cryptography such as TLS 1.1 and SHA 1 and recognize that while not every organization will be fully ready on Q Day, the likely major risks are reputational or compliance related rather than immediate universal compromise.
CISA flags Windows Task Host vulnerability as exploited in attacks

www.bleepingcomputer.com · 3 months ago

CISA warned U.S. government agencies to secure systems against a Windows Task Host privilege escalation vulnerability that allows local attackers with basic user permissions to gain SYSTEM privileges. The flaw is tracked as CVE-2025-60710, affects Windows 11 and Windows Server 2025, stems from improper link resolution before file access, and was patched by Microsoft in November 2025. CISA added the vulnerability to its catalog of actively exploited vulnerabilities and gave Federal Civilian Executive Branch agencies two weeks to apply the patch while urging all organizations to deploy mitigations immediately.
Exploited Vulnerability Exposes Nginx Servers to Hacking

www.securityweek.com · 3 months ago

CVE-2026-33032 is being exploited in the wild to remotely take over servers running the Nginx UI management tool, with a critical flaw tied to the product's recently added AI MCP integration and patched in version 2.3.4. Researchers at Pluto Security disclosed the issue in March after finding more than 2,600 internet exposed instances, and proof of concept exploit code is publicly available that allows unauthenticated attackers to take control, intercept traffic, deploy backdoors or redirects, and steal data. Threat intelligence firm Recorded Future noted CVE-2026-33032 among high impact vulnerabilities exploited in March 2026, and related recent Nginx UI flaws include CVE-2026-27944 and CVE-2026-33030.
Audit: Big Tech Often Ignores CA Privacy Law Opt-Out Requests

www.darkreading.com · 3 months ago

An independent WebXray audit of 7,634 popular websites scanned from a California IP found that major ad tech and platform services often ignore legally endorsed browser opt-out signals used to exercise rights under California privacy law. The audit found 194 online advertising services ignore the Global Privacy Control signal and reported opt-out failure rates of 86 percent for Google, 69 percent for Meta, and about 50 percent for Microsoft, and noted that Google certified cookie banners still allowed Google to set advertising cookies after a GPC opt-out. Security teams are advised to continuously test opt-out signal handling, audit third-party data flows and ad tech dependencies, align privacy controls with runtime behavior, and treat privacy telemetry like security telemetry.
In this U.S. hot spot for data centers, voters have turned against them

www.washingtonpost.com · 3 months ago

Voters in Virginia have turned sharply against data centers, with comfort for new local construction falling to 35 percent from 69 percent in 2023, according to a Post-Schar School poll conducted March 26 to March 31, 2026. Majorities of registered voters say data centers are raising home energy bills and harming the local environment, and support for tax breaks and sales tax exemptions for large data center investments has collapsed. The shift has produced a wave of legislative and local actions nationwide and in Virginia, including 48 projects blocked or delayed in 2025 that halted 156 billion dollars in planned development, and nearly 400 grassroots organizations opposing data centers with 57 of them in Virginia.
WhatsApp New Update Lets You Chat Without Sharing Your Phone Number

www.techrepublic.com · 3 months ago

false
Rolling Networks: Securing the Transportation Sector

www.bleepingcomputer.com · 3 months ago

Researchers have discovered a series of vulnerabilities in Ivanti Connect Secure and Policy Secure gateways, allowing for remote code execution. The flaws can be exploited by sending specially crafted HTTP requests, potentially enabling attackers to gain control of affected systems. This includes CVE-2023-46747, CVE-2023-46748, and CVE-2023-46749. Successful exploitation requires authentication, but attackers may be able to obtain credentials through other means.
Capsule Security Emerges From Stealth With $7 Million in Funding

www.securityweek.com · 3 months ago

Capsule Security emerged from stealth with seven million dollars in seed funding to provide a runtime security layer for agentic artificial intelligence. Founded in 2025 by Naor Paz and Lidan Hazout and based in Tel Aviv, the company continuously monitors agents to prevent manipulation, abnormal behavior, and data exfiltration and can intervene in real time to block risky commands, tools, and exposures without disrupting the AI. The independent platform integrates with multiple frameworks and environments, supports models and services such as Cursor, Claude Code, Copilot Studio, ServiceNow, and Salesforce Agentforce, and the seed round was led by Lama Partners and Forgepoint Capital International.
‘By Design’ Flaw in MCP Could Enable Widespread AI Supply Chain Attacks

www.securityweek.com · 3 months ago

There is an architectural flaw in Anthropic's Model Context Protocol introduced in November 2024 that allows unsanitized STDIO commands to execute silently even when a process fails, enabling stealthy execution and potential full system compromise. Researchers at OX Security demonstrated exploitation across multiple MCP implementations that inherit Anthropic code, showing risks including API key and internal data theft, exposure of chat histories, silent malware installation, and cascading supply chain compromises. Anthropic updated guidance to advise caution when using MCP adapters rather than changing the protocol, while OX recommends deprecating unsanitized STDIO, adding protocol level command sandboxing, requiring an explicit dangerous mode opt in, and instituting standardized security manifests to mitigate the risk.
100 Chrome Extensions Steal User Data, Create Backdoor

www.securityweek.com · 3 months ago

There are 108 malicious Chrome extensions installed by over 20,000 users and published through five accounts named GameGen, InterAlt, SideGames, Rodeo Games, and Yana Project, all sharing the same command and control infrastructure. Fifty four of the extensions steal Google accounts by acquiring OAuth2 bearer tokens to collect permanent identity records such as email, name, and profile picture, while 45 contain a universal backdoor that opens arbitrary URLs returned by the command and control server when the browser starts. Other extensions exfiltrate Telegram Web sessions by overwriting local storage to take over accounts, inject ads into YouTube and TikTok, inject content scripts into all visited pages, or proxy translation requests through attacker controlled servers. The extensions provide legitimate functionality to avoid suspicion, run malicious background scripts that contact the attackers command and control to perform nefarious activities, and were reported to the Chrome Web Store but were not immediately removed.
Top 10 Best API Security Providers Protecting Web Apps in 2026

gbhackers.com · 3 months ago

In 2026 APIs power critical functionality across applications and are increasingly targeted by attackers exploiting business logic, authentication flaws such as Broken Object Level Authorization, and undocumented shadow APIs. Effective API security requires automated API discovery and inventory, vulnerability detection and testing, runtime protection and rate limiting, strong authentication and authorization, bot management, behavioral anomaly detection, data validation and policy enforcement, and integration with DevSecOps pipelines. Top providers for protecting web applications include Salt Security for AI driven behavioral analysis and business logic protection, Akamai for global scale and CDN integration, Imperva for WAAP and strong runtime blocking, and additional solutions such as Cequence, Traceable, Wallarm, 42Crunch, APIsec, Akto, and Postman that vary in focus across runtime protection, testing, and bot management.
Replacing Falco with an embedded eBPF sensor for Kubernetes runtime enforcement

juliet.sh · 3 months ago

There are runtime enforcement controls implemented by embedding an eBPF sensor into the node agent to trace 22 syscalls across process execution, file access, networking, container escape, and privilege escalation while filtering in the kernel via maps so overhead scales with enabled policies rather than total syscalls. Policies are compiled into fast lookup structures and enforcement uses SIGKILL from userspace for portability and safer failure modes, with a five stage pipeline that ensures kills occur within two hundred milliseconds while audit events are coalesced and batched to reduce volume. A misconfigured global enforcement rollout in staging killed infrastructure services including the container registry, Cilium, and RabbitMQ, prompting namespace scoping and seven guard checks before any kill such as simulate mode, protected namespaces, PID safeguards, rate limits, and requiring explicit namespaces for enforce mode.
Top 10 Best Application Security Testing Companies in 2026

gbhackers.com · 3 months ago

false
Google, Microsoft, Meta Accused of Tracking Users Even After Privacy Opt-Out

gbhackers.com · 3 months ago

An independent audit by webXray found that Google, Microsoft, and Meta continued to track users who had sent Global Privacy Control opt-out signals, with audit figures showing Google fails to honor the signal at about eighty six to eighty seven percent, Microsoft at about fifty percent, and Meta at about sixty nine percent. The audit found that fifty five percent of evaluated websites still set advertising cookies after privacy protections, that consent management platforms failed to block ad cookies in the sampled vendors, and that long term identifiers like Google’s IDE cookie and Microsoft’s MUID were being set to follow users for years. Researchers estimated potential aggregate liability under the California Consumer Privacy Act at about five point eight billion dollars based on an average fine of nearly one point four million dollars per violation and cited previous enforcement actions against companies including Sephora and Disney. The report proposed simple technical fixes such as returning an unavailable for legal reasons status to ad servers that receive opt-out signals or adding conditional checks to stop tracking pixels from executing when users opt out.
CISO Conversations: Ross McKerchar, CISO at Sophos

www.securityweek.com · 3 months ago

There are leadership challenges as the cybersecurity skills gap concentrates at senior levels, requiring organizations to hire experienced practitioners, remove obstacles so teams can perform, and focus strongly on retention. There are significant concerns about AI enabled threats because generative models increase the volume of phishing, can help find previously unknown vulnerabilities, and currently lack the organizational context that human analysts provide. There is rising burnout among security teams due to sustained on call pressure, and mitigation requires reducing baseline stress, enforcing rotations and handovers, and allowing staff time to work on enjoyable projects. There is also a growing emphasis on defensive surveillance practices, with Sophos monitoring attackers on compromised devices, deploying a kernel implant to observe exploit development, and coordinating with legal counsel and national agencies to ensure actions remained lawful rather than constituting hacking back.
Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover

thehackernews.com · 3 months ago

A critical authentication bypass in nginx-ui, tracked as CVE-2026-33032 with a CVSS score of 9.8 and codenamed MCPwn, is being actively exploited and can allow attackers to seize control of the Nginx service. Attackers can achieve a full takeover by issuing an HTTP GET to the mcp endpoint to obtain a session identifier and then an HTTP POST to the mcpmessage endpoint without authentication, enabling restart of nginx, creation modification or deletion of configuration files, server reloads, and harvesting of administrator credentials; maintainers released version 2.3.4 on March 15, 2026, and advise adding authentication middleware or changing the default IP allowlisting to deny all as mitigations. Approximately 2,689 publicly reachable nginx-ui instances were identified, concentrated in China the United States Indonesia Germany and Hong Kong, and related MCP flaws tracked as CVE-2026-27825 and CVE-2026-27826 were also reported and can be chained to achieve unauthenticated remote code execution on local networks.
MuddyWater-Style Hackers Probe 12,000+ Systems Ahead of Middle East

gbhackers.com · 3 months ago

A MuddyWater-style threat group conducted large-scale reconnaissance across more than 12,000 internet-facing systems and selectively exploited weaknesses to target aviation, energy, and government entities in Egypt, Israel, and the United Arab Emirates. The multi-stage operation began with mass vulnerability scanning, moved to credential theft via brute-force attacks against Outlook Web Access using custom scripts and multi-threaded tools, and used modular command and control infrastructure over TCP, HTTP, and UDP to maintain persistence. The attackers weaponized and exploited five recently disclosed vulnerabilities identified as CVE-2025-54068, CVE-2025-52691, CVE-2025-68613, CVE-2025-9316, and CVE-2025-34291. Investigators confirmed data exfiltration from at least one Egyptian aviation company, including passport and visa records, payroll information, credit card data, and corporate documents, and warned the campaign reflects a refined, resource-efficient evolution of state-aligned cyber tradecraft integrating automated reconnaissance, lateral movement, and exfiltration.
April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More

thehackernews.com · 3 months ago

April Patch Tuesday fixes address several critical flaws affecting SAP, Adobe, Fortinet, and Microsoft, including an SQL injection in SAP Business Planning and Consolidation and SAP Business Warehouse tracked as CVE-2026-27681 with a CVSS score of 9.9 that allows a low-privileged user to upload files containing arbitrary SQL statements which can be executed against databases. Active exploitation has been observed for an Adobe Acrobat Reader remote code execution tracked as CVE-2026-34621 with a CVSS score of 8.6, and Adobe also patched five critical ColdFusion issues including CVE-2026-34619, CVE-2026-27304, CVE-2026-27305, CVE-2026-27282, and CVE-2026-27306. Fortinet released fixes for FortiSandbox vulnerabilities CVE-2026-39813 and CVE-2026-39808 that could lead to authentication bypass and command injection, and Microsoft addressed 169 defects including SharePoint spoofing CVE-2026-32201 which is reported as being actively exploited, while numerous other vendors also issued patches.
Copilot and Agentforce fall to form-based prompt injection tricks

www.csoonline.com · 3 months ago

Security researchers uncovered prompt injection flaws in Microsoft Copilot Studio and Salesforce Agentforce that allow attackers to insert malicious instructions into SharePoint forms and public lead forms, causing AI agents to treat untrusted input as trusted directives and execute data exfiltration. The Copilot Studio flaw, called ShareLeak, allowed injected payloads to override agent prompts and steal SharePoint data such as names, addresses, and phone numbers, and it was patched and assigned CVE-2026-21520 with a CVSS score of 7.5. The Salesforce flaw, referred to as PipeLeak, enabled a single crafted lead to cause an agent to retrieve and email multiple lead records in bulk, and researchers recommended treating all external inputs as untrusted while enforcing input validation, least privilege, and strict outbound controls.
Microsoft, Salesforce Patch AI Agent Data Leak Flaws

www.darkreading.com · 3 months ago

Two prompt injection vulnerabilities in Salesforce Agentforce and Microsoft Copilot would have enabled external attackers to exfiltrate sensitive customer data by embedding malicious instructions in public-facing form inputs. The Microsoft flaw, tracked as CVE-2026-21520 and rated 7.5 CVSS, allowed malicious input in a SharePoint form to trigger Copilot to send data to an attacker-controlled email, while the Salesforce issue known as PipeLeak caused Agent Flows to treat lead form text as trusted instructions. Recommended mitigations include treating all external form inputs as untrusted, disabling email-sending tools for untrusted inputs, applying input sanitization and prompt boundary techniques, requiring human review before sending CRM data externally, and logging agent actions; Microsoft has patched CVE-2026-21520 and Salesforce says it has remediated the configuration-specific issue.
Microsoft: April updates trigger BitLocker key prompts on some servers

www.bleepingcomputer.com · 3 months ago

Microsoft confirmed that some Windows Server 2025 devices boot into BitLocker recovery after installing the April 2026 KB5082063 security update. This occurs only on systems with BitLocker enabled on the OS drive and an unrecommended Group Policy that includes PCR7 in the TPM platform validation profile, where System Information reports Secure Boot PCR7 Binding as Not Possible and the Windows UEFI CA 2023 certificate is present in the Secure Boot database while the device is not already running the 2023 signed Windows Boot Manager, and affected systems only require the BitLocker recovery key once on the first restart. Microsoft is working on a fix and advises administrators to remove the PCR7 Group Policy before deploying KB5082063 or apply a Known Issue Rollback to prevent the automatic switch to the 2023 Boot Manager and avoid triggering BitLocker recovery, and the issue is unlikely to impact personal devices.
Google Uses Rust-Based Firmware in Pixel 10 Modem to Improve Memory Safety

gbhackers.com · 3 months ago

Google has integrated the memory safe Rust programming language into the cellular baseband firmware of Pixel 10 smartphones, replacing the modem's legacy Domain Name System parser with a Rust based implementation to eliminate entire classes of memory safety vulnerabilities. Engineers adapted the hickory proto crate to run in a no standard library bare metal environment, linked Rust's global allocator to the modem's C based memory allocation APIs using the foreign function interface, and unified crash reporting by exposing the Pigweed crash facade to Rust panic handling. The new Rust implementation increased the firmware footprint by about 371 kilobytes and the team cited past memory safety exploits including CVE-2024-27227 as justification for this foundational step toward migrating other vulnerable modem services and hardening the baseband against remote and zero day attacks.
Two Vulnerabilities Patched in Ivanti Neurons for ITSM

www.securityweek.com · 3 months ago

There are two medium severity vulnerabilities patched in Ivanti Neurons for ITSM that affect both on premises and cloud deployments. CVE-2026-4913 is an improper protection of an alternate path that could allow a remote authenticated attacker to retain access after their account is disabled, and CVE-2026-4914 is a stored cross site scripting issue that can be abused to obtain limited information from other user sessions. Both issues require authentication and user interaction and were fixed in Ivanti Neurons for ITSM version 2025.4, with cloud environments receiving the fix on December 12, 2025, and the vendor reports no known exploitation in the wild. The advisory also references related OpenSSH flaws CVE-2025-26465 and CVE-2025-26466 which Ivanti updated guidance about.
Deterministic + Agentic AI: The Architecture Exposure Validation Requires

thehackernews.com · 3 months ago

false
Hackers Abuse Google Cloud Storage to Slip Remcos RAT Past Email Filters

gbhackers.com · 3 months ago

Hackers are exploiting Google Cloud Storage to bypass email and web filters and deliver the Remcos remote access trojan through convincing Google Drive themed phishing campaigns that harvest credentials and one time passcodes. Phishing emails point to Google Cloud Storage buckets with names like com-bid and contract-bid-0 and host malicious HTML on trusted cloud infrastructure, allowing messages to pass DMARC, SPF, and DKIM checks and evade reputation based filtering. The multi stage, mostly fileless infection chain uses a JavaScript downloader that launches VBS and PowerShell stages, pulls a.NET loader, and abuses the signed Microsoft binary RegSvcs.exe for process hollowing to inject a Remcos payload into memory. Defenders are advised to prioritize behavior based detection, interactive sandboxing, and telemetry such as process trees, registry changes, and network beacons to detect and disrupt the kill chain before persistence, lateral movement, or data exfiltration occur.
108 malicious Chrome extensions caught stealing Google and Telegram data from 20,000 users

www.bitdefender.com · 3 months ago

There are 108 malicious Google Chrome extensions that communicated with a single command and control server and had approximately 20,000 installs. They were published under five publisher identities and disguised as Telegram sidebars, slot games, YouTube and TikTok enhancers, and translation tools. Observed behaviors included 54 extensions stealing Google account details, 45 containing a backdoor to open arbitrary URLs on startup, exfiltration of Telegram Web sessions every 15 seconds with some sessions replaced by attackers, and injections that stripped security headers on YouTube and TikTok to serve gambling ads. Users who installed the identified extensions are advised to remove them immediately and to log out of Telegram Web sessions via the Telegram mobile app.
$10 Domain Could Have Handed Hackers 25k Endpoints, Including in OT and Gov Networks

www.securityweek.com · 3 months ago

There is adware signed by Dragon Boss Solutions that researchers found evolved into malware deploying a PowerShell payload since March 2025 to disable cybersecurity products and block their updates. The malware establishes persistence through five scheduled tasks and WMI event subscriptions and adds Windows Defender exclusions to directories used to stage future payloads that could include cryptominers ransomware or infostealers. The software’s update domain was unregistered so anyone who purchased it could have served arbitrary code to roughly 25,000 unique endpoints across 124 countries, with more than 12,000 in the United States, and researchers registered and sinkholed the domain to monitor activity. Among the observed hosts were 221 universities and colleges 41 operational technology networks 35 government entities and three healthcare organizations including electric utilities transport providers and power cooperatives and multiple Fortune 500 companies and organizations are urged to hunt for indicators of compromise.
Defense in Depth, Medieval Style

www.schneier.com · 3 months ago

There are four defensive lines protecting Constantinople: a brick-lined ditch 15 to 20 meters wide and up to 7 meters deep divided by bulkheads and often flooded, a low breastwork about 2 meters high for defenders to fire from cover, an outer wall 8 meters tall and 2.8 meters thick with 82 projecting towers, and a main wall about 12 meters high and 5 meters thick with 96 massive towers offset from the outer wall for overlapping coverage. Broad terraces behind the walls included an 18-meter-wide parateichion ideal for repelling attackers who crossed the moat and a 15 to 20 meter peribolos between the inner and outer walls, creating layered killing zones. From the moat bottom to the highest tower top the defenses reached nearly 30 meters, forming an almost unscalable barrier of stone and engineering.
Trusted WordPress Plugins Hijacked in 8-Month Stealth Backdoor Campaign

gbhackers.com · 3 months ago

More than 30 popular WordPress plugins in the Essential Plugin portfolio were hijacked after a buyer known as Kris introduced a remote code execution backdoor in an August 8, 2025 update that added unsafe use of the PHP unserialize function and an unauthenticated REST endpoint. The backdoor lay dormant until April 5 to 6, 2026 when it distributed payloads that rewrote wp config files to pull cloaked SEO spam and redirects from a command and control infrastructure obfuscated via an Ethereum smart contract, affecting hundreds of thousands of sites. The WordPress plugins team pushed a forced auto update on April 8, 2026 to neutralize the phone home logic but did not clean infected wp config files, leaving administrators to detect and remove the injected block by comparing files to known good backups or applying patched plugin builds.
Trump Urges Extending Foreign Surveillance Program as Some Lawmakers Push for US Privacy Protections

www.securityweek.com · 3 months ago

Congress is preparing to consider reauthorizing a contentious foreign surveillance authority that lets U.S. intelligence agencies collect and analyze large volumes of overseas communications without a warrant. The program, known as Section 702 of the Foreign Intelligence Surveillance Act, incidentally sweeps in communications of Americans who interact with targeted foreigners, and critics are pushing for warrant requirements and limits on the government’s use of internet data brokers. President Donald Trump has urged an eighteen month extension, saying the program provided intelligence vital to recent U.S. actions, and his support has reduced the prospects for significant reforms.