Blahalla

Using Nix or Docker for reproducible Development Environments

dhawos.dev · 3 months ago

Development and CI/CD pipelines are increasingly using pre-built actions which can introduce security vulnerabilities. Experts suggest pinning actions to specific commits and exploring alternative tools like Docker and Nix to gain greater control and improve reproducibility. Docker utilizes containerization to provide development environments, while Nix employs a package manager for declarative configuration and ensures consistency. A Nix-based CI/CD pipeline can be implemented for enhanced security through caching, although it presents a steeper learning curve.

Over 100 Chrome Web Store extensions steal user accounts, data

www.bleepingcomputer.com · 3 months ago

Over one hundred malicious Chrome extensions have been discovered in the Chrome Web Store, targeting user accounts and data. These extensions, published under multiple identities, attempt to steal Google OAuth2 Bearer tokens, deploy backdoors, and conduct ad fraud, utilizing a shared command-and-control infrastructure. The malicious extensions inject attacker-controlled HTML, harvest Google account data, and can remotely control user sessions, with one particularly severe extension stealing Telegram Web sessions every fifteen seconds. Researchers suspect a Russian malware-as-a-service operation is behind the coordinated campaign.

EDR-Killer Ecosystem Expansion Requires Stronger BYOVD Defenses

www.darkreading.com · 3 months ago

Cybersecurity researchers have observed a growing ecosystem of EDR killers, tools that disable endpoint detection and response platforms using a technique called bring-your-own-vulnerable-driver (BYOVD). These tools are readily available and exploited by ransomware groups to bypass defenses and encrypt networks, even for a short time. The proliferation of these tools is enabled by a relatively small number of vulnerable drivers, and attackers can easily create numerous variants through minor changes to driver code, bypassing digital signature validation. Microsoft is taking steps to strengthen driver security by removing trust for cross-signed kernel drivers, but this change will be implemented in evaluation mode, potentially delaying full enforcement.

Hack the AI agent: Build agentic AI security skills with the GitHub Secure Code Game

github.blog · 3 months ago

GitHub has launched Season 4 of the Secure Code Game, focusing on agentic AI security. The game challenges players to exploit and fix vulnerabilities within a deliberately vulnerable AI assistant called ProdBot, simulating real-world risks associated with autonomous AI systems. New capabilities introduced at each level, like web access, external tool connections, and persistent memory, expand the potential attack surface. The game aims to equip developers with the skills to identify and mitigate emerging threats, referencing a potential vulnerability like CVE-2026-25253, nicknamed "ClawBleed". Players can get started in under two minutes within GitHub Codespaces, requiring no prior AI or coding experience.

Microsoft Patches Exploited SharePoint Zero-Day and 160 Other Vulnerabilities

www.securityweek.com · 3 months ago

Microsoft released security updates addressing 165 vulnerabilities, including a critical zero-day flaw in SharePoint Server, tracked as CVE-2026-32201. This vulnerability allows unauthorized attackers to perform spoofing and potentially access or modify sensitive data. The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-32201 to its list of known exploited vulnerabilities and requires federal agencies to patch it by April 28. Additionally, 19 other vulnerabilities are rated as having a high likelihood of exploitation.

Adobe Issues Emergency Patch for Critical PDF Flaw Exploited For Months

www.techrepublic.com · 3 months ago

A critical vulnerability in Adobe products has been exploited since December 2025. The flaw, tracked as CVE-2026-34621, allows attackers to bypass security measures and execute arbitrary code, potentially leading to data theft and device takeover. Adobe has released an emergency patch for Acrobat DC, Acrobat Reader DC, and Acrobat 2024 on both Windows and macOS, urging users to update immediately. Users should check for updates through the "Help" menu or utilize administrative deployment methods to ensure all systems are protected.

Security Risk Advisors Purple Team Participants Can Now Earn CPE Credits

gbhackers.com · 3 months ago

false

Microsoft releases Windows 10 KB5082200 extended security update

www.bleepingcomputer.com · 3 months ago

Microsoft has released Windows 10 extended security update KB5082200, addressing vulnerabilities from the April 2026 Patch Tuesday, including two zero-day flaws. The update enhances protection against Remote Desktop Protocol file phishing attacks and provides new Windows Security indicators for Secure Boot certificate rollout status. It also resolves an issue preventing sign-in to Microsoft accounts and fixes a problem that could trigger BitLocker recovery on certain Intel devices. The update advances the rollout of new Secure Boot certificates to replace older ones.

McGraw-Hill confirms data breach following extortion threat

www.bleepingcomputer.com · 3 months ago

Education company McGraw-Hill confirmed a data breach stemming from a Salesforce misconfiguration. The company states the exposed data is limited and non-sensitive, not affecting customer databases or internal systems. However, the extortion group ShinyHunters claims to possess 45 million Salesforce records and threatens to leak the information. McGraw-Hill is working with Salesforce to strengthen protections and secure the affected webpages.

Amazon Buys Globalstar for $10.8 Billion, Movingto Expand Its Satellite Internet Service

www.nytimes.com · 3 months ago

false

Windows 11 cumulative updates KB5083769 & KB5082052 released

www.bleepingcomputer.com · 3 months ago

Microsoft has released cumulative updates KB5083769 and KB5082052 for Windows 11 versions 23H2, 24H2, and 25H2, including April 2026 security patches. The updates include several improvements, such as allowing modification of Smart App Control settings without a fresh Windows installation and enhancements to Narrator functionality with Copilot. Display reliability has also been improved, including support for higher refresh rates and better battery efficiency for USB4 monitors. Microsoft is working on a future quality update to restore a movable taskbar and improve performance.

Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days

www.bleepingcomputer.com · 3 months ago

Microsoft’s April 2026 security updates address 167 vulnerabilities across Windows, Office, Azure, and SQL Server. The patches resolve two actively exploited zero-day vulnerabilities, including a SharePoint Server spoofing flaw and a Microsoft Defender privilege escalation issue. Numerous Elevation of Privilege vulnerabilities, impacting areas like the Windows kernel and networking components, are addressed. A critical Remote Code Execution vulnerability exists in the Windows TCP/IP stack, identified as CVE-2026-33827, and will likely be patched in a future update.

Adobe Patches 55 Vulnerabilities Across 11 Products

www.securityweek.com · 3 months ago

Adobe has released updates to address 55 vulnerabilities spanning 11 products. Five critical vulnerabilities in ColdFusion warrant immediate attention due to its history as a target. Critical code execution flaws were also resolved in applications like Acrobat Reader and Photoshop. Security officials are tracking exploitation attempts involving CVE-2026-34621 and CVE-2020-9715.

Fake Ledger Live app on Apple’s App Store stole $9.5M in crypto

www.bleepingcomputer.com · 3 months ago

A fake Ledger Live application appeared on the Apple App Store, resulting in approximately $9.5 million in cryptocurrency losses for 50 victims. Users were tricked into providing their seed phrases, enabling attackers to drain their digital assets across multiple blockchains like Bitcoin, Ethereum, and Ripple. The stolen funds were then laundered through KuCoin using a mixing service called AudiA6. Apple has since removed the malicious application, and KuCoin has temporarily frozen related accounts.

EU regulators largely denied access to Anthropic Mythos

www.csoonline.com · 3 months ago

European regulators are facing limited access to Anthropic’s new Mythos AI model, a technology designed for cybersecurity and capable of identifying vulnerabilities. Anthropic is initially restricting access to a select group of US technology companies like Apple, Microsoft, and Amazon for security reasons and to address potential flaws. While the UK’s AI Security Institute has tested the model, the European Union’s influence is currently limited, with only Germany initiating discussions with Anthropic. Concerns are rising that private companies are controlling the distribution of powerful AI technology, raising questions about national and European security.

War Game Exercise Demonstrates How Social Media Manipulation Works

www.darkreading.com · 3 months ago

A university in Australia conducted a wargame called "Capture the Narrative" to simulate social media manipulation and its impact on public opinion. Over 270 participants used AI-driven bots to influence a simulated election on a custom social media platform, successfully shifting the vote by 1.8 percentage points. The exercise, inspired by real-world instances of election interference, highlighted techniques for generating adaptive spam and micro-targeting content, demonstrating the ease with which malicious actors can manipulate online narratives. Researchers emphasized the need for social media platforms to combat AI-generated fake content and for public education on recognizing it.

Upcoming Speaking Engagements

www.schneier.com · 3 months ago

false

New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released

thehackernews.com · 3 months ago

Security vulnerabilities have been discovered in Composer, a PHP package manager, that could allow attackers to execute arbitrary commands. These command injection flaws, identified as CVE-2026-40176 and CVE-2026-40261, stem from improper input validation and inadequate escaping within the Perforce VCS driver. The vulnerabilities affect versions 2.3 through 2.9.5 and 2.0 through 2.2.26, with fixes available in version 2.9.6 and 2.2.27, respectively. As a precaution, Perforce source metadata has been disabled on Packagist.org.

Microsoft rolls out fast-track to reinstate Windows hardware dev accounts

www.bleepingcomputer.com · 3 months ago

false

Google Adds Rust-Based DNS Parser into Pixel 10 Modem to Enhance Security

thehackernews.com · 3 months ago

Google has integrated a Rust-based Domain Name System parser into the modem firmware for Pixel 10 devices, enhancing security and promoting memory-safe code. This implementation reduces security risks by mitigating vulnerabilities and builds upon previous efforts using tools like Clang sanitizers. The DNS parser, built using the "hickory-proto" crate, helps protect against attacks like those detailed in CVE-2024-27227, which exploit memory-safety vulnerabilities. Google chose DNS due to its critical role in modern cellular communications.

Common Entra ID Security Assessment Findings – Part 4: Weak Conditional Access Policies

blog.compass-security.com · 3 months ago

Security assessments reveal common weaknesses in Microsoft Entra ID Conditional Access policies. These issues include poor targeting, overly restrictive conditions, and built-in bypasses, allowing attackers to register MFA factors and perform privileged actions. Organizations should broaden policy targeting, implement device restrictions, and leverage tools like EntraFalcon to identify and remediate vulnerabilities. EntraFalcon helps assess environments, generates reports, and highlights risky configurations with confidence levels to ensure comprehensive security.

Google $135M Settlement: Millions of Android Users May Qualify for Payout

www.techrepublic.com · 3 months ago

false

5 Ways Zero Trust Maximizes Identity Security

www.bleepingcomputer.com · 3 months ago

A growing number of attackers are exploiting stolen credentials to breach networks, highlighting the need for stronger identity security. Implementing Zero Trust principles alone isn't enough; a cohesive identity strategy is critical. Experts recommend enforcing least privilege access, utilizing continuous, context-aware authentication, including device health checks, limiting lateral movement, and securing remote work and third-party access. Centralized identity governance and monitoring are also essential for maintaining visibility and control across the environment.

Mirax Android RAT Hijacks Infected Phones as Residential Proxies

gbhackers.com · 3 months ago

A new Android trojan called Mirax is rapidly gaining popularity within the cybercrime ecosystem. The malware combines remote access capabilities with residential proxy functionality, turning infected phones into valuable infrastructure nodes. Attackers use Mirax to harvest credentials and monitor user activity, while the proxy feature allows them to bypass geolocation controls and evade fraud detection. Current campaigns distribute the malware through malicious Meta ads, targeting users interested in IPTV and illegal streaming services.

Prometheus alerting rules for eBPF, SNMP, WireGuard, Cilium and cert-manager added to awesome-prometheus-alerts

samber.github.io · 3 months ago

false

PlugX USB Worm Hits Multiple Continents via DLL Sideloading

gbhackers.com · 3 months ago

A new variant of the PlugX remote access Trojan is spreading rapidly across multiple continents, including Papua New Guinea, Ghana, Mongolia, Zimbabwe, and Nigeria. The worm utilizes DLL sideloading of a legitimate Avast executable and leverages USB drives to propagate, making it appear as a removable disk shortcut. Attackers are employing this technique for targeted distribution, likely via physical media, to reach air-gapped networks and exfiltrate data, including documents with common extensions. Researchers have linked this activity to the PKPLUG/Mustang Panda threat actor and associated command-and-control infrastructure at 45.142.166[.]112.

‘Mythos-Ready’ Security: CSA Urges CISOs to Prepare for Accelerated AI Threats

www.securityweek.com · 3 months ago

The Cloud Security Alliance warns that Anthropic’s new AI model, Mythos, will dramatically accelerate the pace of cyberattacks, essentially collapsing the time between vulnerability detection and exploitation. While Anthropic is initially limiting access through Project Glasswing, the technology will eventually be widely available to attackers, overwhelming current defenses. Organizations must prioritize basic security practices like segmentation, multifactor authentication, and rapid patching to prepare for this increased threat landscape and consider employing AI-powered tools to bolster defenses. Leaders should also anticipate increased burnout among security staff and plan accordingly.

Europe’s Largest Gym Chain Says Data Breach Impacts 1 Million Members

www.securityweek.com · 3 months ago

Europe’s largest gym chain, Basic-Fit, has reported a data breach impacting approximately one million members across several European countries. The unauthorized access resulted in the download of personal information, including names, addresses, phone numbers, dates of birth, and bank account details. Basic-Fit states that no passwords or identification documents were compromised. The company is investigating the incident and is currently unaware of who is responsible or if the data has been misused.

Botnet Exposed: Hackers Leave Worker Access and Root Passwords Wide Open

gbhackers.com · 3 months ago

Researchers have uncovered a Twitter/X credential-stuffing botnet with its command-and-control infrastructure fully exposed. The botnet’s control panel, built with Python Flask, lacks authentication and allows anyone direct access to functions like server management and data exfiltration. The botnet operates 18 Linux worker servers with root SSH passwords following a predictable pattern and uses infrastructure registered to a Turkish company. The operation tested over 722,000 credential pairs in a 12-minute period, with two-factor authentication blocking the vast majority of attempts.

China-linked cloud credential heist runs on typos and SMTP

www.csoonline.com · 3 months ago

China-aligned hackers, believed to be the APT41 (Winnti) group, have deployed a Linux-based ELF backdoor to steal cloud credentials from AWS, GCP, Azure, and Alibaba Cloud environments. The backdoor uses SMTP port 25 for covert command-and-control and employs typosquatted Alibaba domains to harvest sensitive information, including IAM role credentials, service account tokens, and metadata. It avoids detection by conventional scanning tools and uses UDP broadcasts for peer-to-peer coordination within compromised networks. Researchers recommend monitoring outbound SMTP traffic, unusual network connections, and metadata service queries to detect and prevent this sophisticated cloud-based espionage campaign.

New Report: Digital Exposure of European Telecoms

ethiack.com · 3 months ago

A recent report reveals significant cybersecurity vulnerabilities affecting European telecom companies. Analysis of 591 companies found widespread use of outdated SSL certificates and exposure of sensitive software information. The report highlights that manual security processes are insufficient to address the rapidly evolving threat landscape fueled by AI. Telecom leaders are urged to adopt AI-powered attack surface management and automated security testing.

Janela RAT Spreads via Fake MSI Installers, Malicious Extensions

gbhackers.com · 3 months ago

A remote access Trojan, Janela RAT, is spreading through fake Windows installers and malicious browser extensions, primarily targeting financial networks in Chile, Colombia, and Mexico. This variant, believed to be a modified version of BX RAT, uses a multi-stage process involving Go, PowerShell, and batch scripts to unpack and deploy its components. The malicious browser extension steals data such as browser history, cookies, and system metadata, and automatically collects credentials when users visit banking or cryptocurrency sites. Attackers use encrypted communication channels and obfuscation techniques to evade detection.

Critical etcd Vulnerability Allows Unauthorized Access to Sensitive Cluster APIs

gbhackers.com · 3 months ago

A critical vulnerability has been discovered in etcd, a widely used key-value store, allowing unauthorized access to sensitive cluster operations. Tracked as CVE-2026-33413, the flaw allows unauthenticated users to trigger alarms, compact databases, and create leases, potentially leading to data loss or denial of service. The vulnerability stems from a missing authentication wrapper in the etcd server's architecture. A patch has been released, and administrators are urged to update to the latest version to mitigate the risk.

SAP Patches Critical ABAP Vulnerability

www.securityweek.com · 3 months ago

SAP has released security updates to address vulnerabilities in its Business Planning and Consolidation and Business Warehouse systems. The most critical flaw, CVE-2026-27681, is a SQL injection bug that could allow attackers to execute arbitrary code and potentially steal or modify financial data. Another high-severity vulnerability, CVE-2026-34256, involves a missing authorization check, potentially allowing program execution and modification of existing files. Several other vulnerabilities, including information disclosure and cross-site scripting issues, were also resolved across multiple SAP products.

AI Codex Exploits Samsung TV Driver Flaw to Gain Root Access

gbhackers.com · 3 months ago

Researchers demonstrated how an AI coding assistant, Codex, could escalate privileges on a Samsung Smart TV from a browser foothold to root access. The process involved exploiting world-writable Novatek kernel drivers, specifically ntkhdma and ntksys, which allowed arbitrary mapping of physical memory into user space without privilege checks. Codex leveraged these flaws to read and write device memory, locate the browser process's credentials, and overwrite them to gain root privileges. The exploit highlights the risks of exposing powerful memory management interfaces and the potential for AI to accelerate exploit development.

CISA Alerts on Exploited Microsoft Exchange and Windows CLFS Security Flaws

gbhackers.com · 3 months ago

Researchers have discovered three methods attackers can exploit to bypass Android’s permission system. These techniques involve manipulating the system's accessibility services and utilizing hidden APIs to gain unauthorized access to sensitive data and functionalities. The vulnerabilities affect devices running older versions of Android, particularly those with custom firmware. The flaws have been assigned CVE identifiers CVE-2024-23024, CVE-2024-23025, and CVE-2024-23026.

Triad Nexus Evades Sanctions to Fuel Cybercrime

www.securityweek.com · 3 months ago

Triad Nexus, a cybercrime network linked to Asian organized crime, has caused over $200 million in losses through scams, particularly cryptocurrency investment fraud. Following sanctions against Funnull, the group has employed infrastructure laundering, front companies like Bole CDN, and geo-fencing to evade detection. They are now abusing cloud services from Amazon, Cloudflare, Google, and Microsoft and impersonating numerous brands including Cartier, Chanel, and Bank of America. The group is expanding into Spanish, Vietnamese, and Indonesian markets while maintaining operations through AS152194.

How Hackers Are Thinking About AI

www.schneier.com · 3 months ago

A recent study explored how cybercriminals are incorporating artificial intelligence into their operations. Analysis of cybercrime forum conversations reveals growing interest in using AI tools, both legitimate and custom-built, for malicious purposes. However, discussions also indicate concerns about the effectiveness of AI and potential impacts on criminal business models. The research offers insights for law enforcement and policymakers as AI continues to evolve in the cybercrime landscape.

Google Adds Rust DNS Parser to Pixel Phones for Better Security

www.securityweek.com · 3 months ago

Google is enhancing the security of Pixel phones by integrating a Rust-based Domain Name System parser into the modem firmware. This change aims to eliminate memory safety vulnerabilities common in legacy code and reduce the attack surface of the modem, which has become a target for attackers. The new parser utilizes the hickory-proto library and marks a significant step towards broader adoption of memory-safe code in Pixel devices. The Pixel 10 series is the first to include this upgrade, setting the stage for future security improvements.

Analysis of 216M Security Findings Shows a 4x Increase In Critical Risk (2026 Report)

thehackernews.com · 3 months ago

A recent analysis of 216 million security findings reveals a significant increase in critical risks. The number of critical vulnerabilities has nearly quadrupled, driven by factors like the rise of AI-assisted development and an increased code velocity. Technical severity scores are now less important than the business context of vulnerabilities, with factors like high business priority and PII processing playing key roles. The insurance sector demonstrates the highest density of critical findings, while the automotive industry generates the largest volume of alerts.

Nightclub Giant RCI Hospitality Reports Data Breach

www.securityweek.com · 3 months ago

RCI Hospitality Holdings reported a data breach impacting numerous independent contractors. The breach, beginning March 19th, was caused by an insecure direct object reference vulnerability, or IDOR, allowing unauthorized access to personal data. Compromised information includes names, dates of birth, Social Security numbers, and driver’s license numbers. The company states that customer information and financial systems were not accessed and business operations were unaffected.

Hackers Exploit Obsidian Plugin to Deploy Cross-Platform Malware

gbhackers.com · 3 months ago

Hackers are using social engineering tactics, posing as a venture capital firm, to trick financial and cryptocurrency professionals into installing malware. The attackers exploit Obsidian, a note-taking application, by compromising shared cloud vaults and abusing the Shell Commands plugin to deploy the PHANTOMPULSE remote access trojan. The malware chain involves syncing malicious configurations and loaders, evading detection through techniques like runtime API hashing and C2 resolution via Ethereum Blockscout explorers. Elastic Defend successfully blocked the intrusion by detecting anomalous PowerShell processes.

How AI is transforming threat detection

www.csoonline.com · 3 months ago

false

The AI inflection point: What security leaders must do now

www.csoonline.com · 3 months ago

false

Attempted fire-bombing at OpenAI CEO’s home highlights polarization over AI

www.washingtonpost.com · 3 months ago

A fire-bombing attack targeted OpenAI CEO Sam Altman's home and the company's headquarters. Federal charges indicate a 20-year-old man is responsible for the incident. Some Silicon Valley figures are suggesting that criticism of artificial intelligence may have contributed to the act of violence. The attack has sparked concerns about the increasing division among Americans.

Organizations Warned of Exploited Windows, Adobe Acrobat Vulnerabilities

www.securityweek.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency has added several vulnerabilities to its list of known exploited vulnerabilities. These include Windows flaws CVE-2023-36424 and CVE-2025-60710, which can lead to privilege escalation. Adobe Acrobat and Reader also have vulnerabilities, including CVE-2020-9715 and CVEs disclosed in 2026, that enable arbitrary code execution. Additionally, a Microsoft Visual Basic for Applications vulnerability, CVE-2012-1854, and a Fortinet EMS vulnerability, CVE-2026-34621 and CVE-2026-21643, are being actively targeted.

Hackers Exploit Critical ShowDoc RCE Flaw in Ongoing Attacks

gbhackers.com · 3 months ago

A critical vulnerability, CNVD-2020-26585, has been identified in ShowDoc, a document-sharing platform, allowing unauthenticated remote code execution. The flaw stems from an unrestricted file upload mechanism in versions prior to 2.8.7, enabling attackers to upload malicious files without authentication. Exploitation involves crafting HTTP POST requests to upload files with manipulated extensions, leading to arbitrary code execution and potential data theft or ransomware deployment. Organizations are urged to upgrade to version 2.8.7 or later and implement security measures like VPNs and Web Application Firewalls.

SAP Patch Day Fixes Critical SQL Injection, DoS, and Code Injection Flaws

gbhackers.com · 3 months ago

SAP has released monthly security updates addressing nineteen vulnerabilities and one update to a previous note. The most critical fix resolves a SQL injection flaw, CVE-2026-27681, impacting SAP Business Planning and Consolidation and SAP Business Warehouse, carrying a severity score of 9.9. Other vulnerabilities include a missing authorization check, CVE-2026-34256, a denial-of-service vulnerability, CVE-2025-64775, and a code injection flaw, CVE-2026-27674. Administrators are urged to review and apply these patches promptly to protect their systems.

Cyber-Inspekteur: Hybride Attacken nehmen weiter zu

www.csoonline.com · 3 months ago

Cyberattacks targeting Germany and its military are increasing, particularly against critical infrastructure and troops stationed abroad. These attacks, attributed to actors in Russia, China, Iran, and North Korea, include attempts to compromise data centers, disrupt GPS systems, and spread disinformation. Germany is participating in "Locked Shields," the world’s largest multinational cybersecurity exercise, alongside nearly 40 other nations. Officials warn that even local authorities, like citizen registration offices, could become targets, citing Russia's previous actions in Ukraine.

Okta Under Attack as Hackers Skip Phishing for Identity Systems

gbhackers.com · 3 months ago

Hackers are increasingly using voice phishing, or "Okta vishing," to target identity providers like Okta instead of traditional email phishing. Attackers impersonate legitimate users or IT staff to manipulate multi-factor authentication and gain control of identity provider accounts. Once access is obtained, they can immediately pivot through Single Sign-On into various platforms, including Microsoft 365, Google Workspace, and Salesforce, resulting in large-scale cloud data breaches. Organizations should strengthen identity workflows, train help desks, and implement phishing-resistant MFA to defend against these attacks.