Blahalla

Microsoft Blocks Windows 11 Security Update on Dell PCs Over Intel Driver Causing Shutdowns and Battery Drain

gbhackers.com · 3 months ago

Microsoft stopped the Windows 11 security update KB5101650 for certain Dell PCs because of an incompatibility between an Intel driver and a new USB-C Connection Manager interface. This conflict impacts systems running versions 24H2 and 25H2, causing unexpected shutdowns, reduced performance, and fast battery draining. Microsoft works with Dell to make a fix before releasing the patch.

3 Russian Nationals Indicted for Running Bulletproof Hosting Network Behind $62 Million Cyberattacks

gbhackers.com · 3 months ago

US indicted 3 Russian nationals & 2 St. Petersburg firms for bulletproof hosting used in ransomware, malware, phishing attacks costing $62M+. Charged with fraud against Volosovik, Zatolokin, & Pankova. Defendants face multiple federal charges.

Apple Tests New iMessage Warning for Malicious Messages

www.techrepublic.com · 3 months ago

Apple is testing a new security alert in iOS 26.6, warning users about potentially malicious iMessages. This feature enables smartphone owners to identify and report suspicious communications directly through the messaging app.

New bugs in Claude for Chrome allow extensions to abuse AI privileges

www.csoonline.com · 3 months ago

Two vulnerabilities found in Anthropic’s Claude for Chrome extension remain exploitable months after they were reported to the company, a research by Manifold Security noted.

US Charges Russian Individuals and Firms for Running Cybercrime Services

www.securityweek.com · 3 months ago

US DOJ indicted Russian nationals (Volosovik, Zatolokin, Pankova) & firms (ML.Cloud, Media Land). They provided hosting for ransomware, phishing, and cybercrime markets targeting 42 entities across 21 US states. Losses reached millions of dollars.

SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough.

thehackernews.com · 3 months ago

Traditional cloud proxies struggle with modern workflows, including browser use and generative AI tools. Enterprise work now relies on SaaS apps, browsers, and autonomous agents, creating security blind spots. Security models must adapt because employees frequently paste intellectual property into these diverse digital sources.

LabubaRAT Rust Malware Masquerades as NVIDIA Software to Backdoor Windows Systems

gbhackers.com · 3 months ago

Adversary Pursuit Group (APG) found LabubaRAT, an undocumented Rust-based remote access trojan posing as legitimate NVIDIA software components. The malware uses artifacts such as version metadata and mutex names to establish persistent access on Windows systems. This implant functions as a reusable, panel-managed framework utilizing C2 infrastructure for command control across campaigns.

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

thehackernews.com · 3 months ago

Security researcher Chaotic Eclipse released LegacyHive, a proof-of-concept exploit targeting the Windows User Profile Service (ProfSvc). This vulnerability allows arbitrary hive load and elevates privileges on the system. The service manages user accounts and environments within core Windows components.

A Video Screen That Is Also a Camera

www.schneier.com · 3 months ago

Researchers at ETH Zurich developed a new technology called the Fourier pixel. This hypercharged pixel generates and senses arbitrary light fields by manipulating light’s intensity, oscillation phases, and polarization. The team published these technical findings in the journal Nature.

Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow

www.securityweek.com · 3 months ago

ServiceNow patched RCE (CVE-2026-6875). Ivanti fixed Xtraction path traversal/open redirect (CVE-2026-14902, CVE-2026-14903). Fortinet released 11 advisories for unauthenticated remote attackers. Patches are available now.

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

thehackernews.com · 3 months ago

The Cursor IDE on Windows executes any binary file named git.exe found in a project's root directory without prompting users for approval. This flaw allows malicious code to run automatically and continuously as long as the repository remains open. Attackers can exploit this mechanism, potentially accessing sensitive data like source code, SSH keys, or cloud tokens using the user's permissions.

Dell Warns of Critical PowerProtect Data Domain Flaws Allowing Remote Attackers to Take Complete Control

gbhackers.com · 3 months ago

Dell disclosed two critical vulnerabilities in PowerProtect Data Domain appliances: CVE-2026-53483 and CVE-2026-53481. Both flaws score a CVSS v3.1 of 9.8, enabling unauthenticated remote attackers to seize complete control of the systems. Specifically, CVE-2026-53483 involves improper authentication, while CVE-2026-53481 allows path traversal, severely compromising enterprise backup environments.

White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative

www.securityweek.com · 3 months ago

White House launched Gold Eagle to speed vulnerability patching in critical infrastructure. It pairs open source maintainers with industry via CISA/Treasury per EO 14409. This improves software security.

11 Malicious NuGet Game Cheat Packages Deploy Pepesoft Windows Surveillance Malware

gbhackers.com · 3 months ago

Socket analyzed 11 malicious NuGet packages for game utilities (Albion Online, GTA5RP). They exploit dotnet tool install to run a downloader fetching pepesoft.exe payload. Malware uses DoH DNS and fetches config from Cloudflare/S3. Researchers identified these threats.

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

unit42.paloaltonetworks.com · 3 months ago

TuxBot v3 Evolution, an LLM-developed IoT botnet, cross-compiles for ARM, MIPS, RISC-V. It uses a Go C2 server with DDoS services. Attackers brute-force Telnet and use DGA/P2P protocols to maintain control.

When 80,000 fans log on at once: The 2026 World Cup’s unique cybersecurity issues

www.csoonline.com · 3 months ago

With the World Cup in full swing, stadiums across North America are currently accommodating thousands of fans every match day. That said, the stadiums’ biggest security challenge isn’t of a physical nature. It is not hyperbolic to say that football stadiums are some of the most chaotic endpoint environments in enterprise IT.

Progress Confirms Zero-Day Vulnerability Behind ShareFile Disruption

www.securityweek.com · 3 months ago

The company has rolled out a fix and is restoring access for Storage Zones Controller customers who apply it.

CISA warns admins to patch actively exploited SharePoint flaws

www.bleepingcomputer.com · 3 months ago

CISA warns attackers exploit CVE-2026-32201, CVE-2026-45659, & CVE-2026-56164 for RCE/auth bypass on SharePoint. Patching is urged for related CVEs: CVE-2026-55040 and CVE-2026-58644. Implement hardening measures immediately.

HN Security - My Semgrep C/C++ ruleset is ready for prime time again

hnsecurity.it · 3 months ago

The author released an updated Semgrep ruleset designed for C/C++ vulnerability research. Developed since 2022, the tool enhances automated discovery of binary vulnerabilities in complex codebases. These improvements integrate extensive testing results from NIST's Software Assurance Metrics And Tool Evaluation project to guide secure coding workflows.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Rockwell

www.securityweek.com · 3 months ago

Siemens, Schneider Electric, & Rockwell patched ICS vulnerabilities. Fixes include a CVSS 10 Opencenter X auth bypass and unauthenticated CLI access via 1715 Redundant IO. Vendors also addressed SCADA arbitrary code execution flaws. CISA/VDE CERT issued further alerts today.

Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

thehackernews.com · 3 months ago

Security groups OX Security, SafeDep, Socket, and StepSecurity saw four compromised npm packages in the @asyncapi namespace distributing a multi-stage botnet loader. Affected packages are @asyncapi/[email protected], @asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/specs(v6.11.2). Developers should immediately update these modules to mitigate the botnet risk.

SheetAgent RAT Runs 14 Virtual Machine Checks and Self-Deletes When Analysis Is Detected

gbhackers.com · 3 months ago

Indian job seekers were targeted with a phishing lure for Cabinet Secretariat roles. Attackers used a ZIP archive deploying SheetAgent RAT via malicious shortcuts and PowerShell scripts to install ControlR RMM and a.NET dropper. This extracted payload disguised itself in WindowsDefenderSyncService.exe.

From Twitter to X: 20 Years of Memes, Movements and Hot Takes

www.nytimes.com · 3 months ago

The platform initially appeared on July 15, 2006, after an earlier soft launch. Following its acquisition by Elon Musk, the company rebranded the service as X.

Cybersecurity needs more prevention and less reliance on cure

www.csoonline.com · 3 months ago

Ask any medical doctor, and they’ll tell you that prevention is better than cure. It’s more cost-effective and it has better outcomes. The same is true in cybersecurity. But we believe that our industry has veered too far away from this simple concept.

The Memory Heist - How I tricked Claude into leaking your deepest, darkest secrets

www.ayush.digital · 3 months ago

Study shows AI's memory + browsing risks; "memory heist" simulates data theft from assistants like Claude. Attackers could steal private info (names, security answers). Unauthorized access is possible.

Microsoft: Some Dell PCs shut down after recent Windows updates

www.bleepingcomputer.com · 3 months ago

Microsoft blocked KB5101650 for Dell PCs (Win 11 25H2/24H2) due to conflict between the USB-C Connection Manager and Intel Innovation Platform Framework Processor Participant driver, causing shutdowns. A fix is pending.

(More) Unauthenticated Arbitrary Code Execution in ServiceNow

palk.sh · 3 months ago

Unauthenticated RCE affects default ServiceNow components. Attackers use JS payloads via fields like the forgot password page for sandbox escape, running jobs as System to steal all third-party credentials. Patches started Feb 2025.

Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits

www.darkreading.com · 3 months ago

The West African country advanced rules to force organizations to disclose cyberattacks, joining other nations in a shift to mandated transparency.

US charges alleged operators of Russian bulletproof hosting service

www.bleepingcomputer.com · 3 months ago

U.S. federal prosecutors have unsealed charges against three Russian nationals, accusing them of providing bulletproof hosting (BPH) services to ransomware gangs that caused over $62 million in damages to victims worldwide.

Critical Vulnerabilities Patched With Fresh Chrome 150, Firefox 152 Updates

www.securityweek.com · 3 months ago

Mozilla issued Firefox 152 updates resolving two critical defects via CVE-2026-15718 and CVE-2026-15719. Separately, Google released Chrome 150, patching fifteen vulnerabilities including use-after-free flaws tracked as CVE-2026-15764 and CVE-2026-15765. Both browser vendors confirmed that though exploit code exists for these bugs, they observed no in-the-wild attacks.

FaceTime Scammers Combine Credential Theft, Remote-Access Apps, and iOS Exploits for Device Takeover.

gbhackers.com · 3 months ago

Apple-focused scam operations are increasingly using FaceTime as a high-trust social-engineering channel to steal credentials and, in higher-risk cases, prepare victims for device compromise. Apple said threat actors may approach targets via phone calls, FaceTime, SMS, email, and other communications, posing as a legitimate organization.

Microsoft Fixes Multiple Windows RDP Flaws Exposing Sensitive Data Over the Network

gbhackers.com · 3 months ago

Microsoft patched five information-disclosure vulnerabilities in the Windows Remote Desktop Protocol (RDP). The critical flaws include CVE-2026-50445, CVE-2026-50497, CVE-2026-55003, CVE-2026-57979, and CVE-2026-57982. Exploitation could allow attackers to retrieve sensitive data from vulnerable hosts' application memory over the network.

7 skills and traits of elite security engineers

www.csoonline.com · 3 months ago

Security engineers play a pivotal role in enterprise cybersecurity, because they are the professionals who design, build, and deploy security systems to protect an organization’s data, applications, systems, networks, and other IT components against a variety of cyber threats.

Critical SonicWall SMA 1000 SSRF and Remote Code Execution Flaws Actively Exploited in the Wild

gbhackers.com · 3 months ago

SonicWall confirmed flaws in SMA1000 appliances. The highest risk is CVE-2026-15409, an unauthenticated Server-Side Request Forgery flaw with a CVSS score of 10.0. Separately, CVE-2026-15410 permits authenticated code injection via the Management Console (CVSS 7.2), requiring immediate patching through platform hotfixes.

Hackers Abuse OAuth Device Codes and Entra ID Enrollment for Persistent SaaS Access

gbhackers.com · 3 months ago

AI phishing abuses OAuth/Entra ID for SaaS access. Toolkits like Jalisco generate real-time codes, capturing tokens post-MFA. Thieves use this token theft with rogue device registration to gain persistent refresh tokens.

Google Chrome 150 Update Fixes 15 Security Vulnerabilities, Including 2 Critical Use-After-Free Flaws

gbhackers.com · 3 months ago

Chrome 150 patches Ozone, Skia, V8 for multiple flaws: Use-after-free (CVE-2026-15764, CVE-2026-15765), type confusion (CVE-2026-15776), and overflow. It also fixes CVE-2026-15773 and CVE-2026-15775. The update addresses numerous CVEs through researcher contributions.

Critical Claude for Chrome Flaw Lets Malicious Extensions Read Gmail, Google Docs, and Calendar

gbhackers.com · 3 months ago

Claude for Chrome has a vulnerability (CVSS 9.6) allowing misuse of AI by malicious extensions. Lack of isTrusted check permits programmatic event injection, letting attackers bypass approvals to access data in Gmail, Google Docs, or Calendar.

China-Linked Hackers Weaponize Claude Code and DeepSeek in Government Intrusion Campaign

gbhackers.com · 3 months ago

Suspected China group used Claude Code and DeepSeek-v4-pro in attacks against Taiwanese governments/finance. TencShell malware was found on servers, exposing tools, code, and kits. Attackers used LLMs for command execution and phishing page development.

Fortinet Patches 7 Security Flaws Affecting FortiOS, FortiProxy, FortiPAM, FortiSASE, and FortiSandbox

gbhackers.com · 3 months ago

Fortinet issued security updates addressing seven vulnerabilities across products like FortiOS and FortiSandbox. The most severe flaw, CVE-2026-59835, exposes VNC access via unauthenticated means in FortiSandbox. Patches also resolve critical issues including path traversal (CVE-2026-59839) and multiple header injections, alongside other flaws such as CVE-2025-43892 and CVE-2026-59837.

Notepad++ v8.9.7 Security Update Fixes 5 Vulnerabilities, Including Stack Buffer Overflow and Zip Slip Flaws

gbhackers.com · 3 months ago

Notepad++ 8.9.7 patched five flaws: Zip Slip (CVE-2026-57233), stack overflow (CVE-2026-54758), startswith bypass (CVE-2026-52886), and macro HMAC issues across session/file processing. The update addresses multiple vulnerabilities for users.

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

thehackernews.com · 3 months ago

SonicWall warned of active exploitation targeting two zero-day vulnerabilities in Secure Mobile Access (SMA) 1000 series appliances. One flaw is CVE-2026-15409, a Server-side request forgery vulnerability. Remote unauthenticated attackers could exploit this weakness to achieve arbitrary command execution on the systems.

Artlist ClickFix Campaign Uses Infostealer-Stolen WordPress Credentials to Deploy RAT Malware

gbhackers.com · 3 months ago

Artlist subdomain was abused mid-July 2026 to distribute RAT via fake CAPTCHA prompts. Attackers first stole credentials from an Israeli developer using pirated Adobe Acrobat Pro DC infection, deploying ClickFix social engineering and EtherHiding C2 infrastructure.

Microsoft Patch Tuesday July 2026 – Record 570 Vulnerabilities Patched

gbhackers.com · 3 months ago

Microsoft released a record 570 patches in July 2026, addressing three zero-days, two of which attackers exploited in the wild. Organizations must prioritize fixing critical issues like CVE-2026-56155 (AD FS) and CVE-2026-56164 (SharePoint Server). The update also includes patches for CVE-2026-55040, a SharePoint flaw, and the publicly disclosed BitLocker bypass, CVE-2026-50661.

SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits

www.securityweek.com · 3 months ago

SonicWall urges updates for SMA1000 appliances against CVE-2026-15409 (SSRF via Workplace) and CVE-2026-15410 (arbitrary OS commands). CISA added both to KEV, advising swift patching.

Microsoft is forcing an enterprise transition to passkeys

www.csoonline.com · 3 months ago

Passkeys have been around for some time, but enterprise-wide adoption to this point has been slow for a number of reasons. But soon, many Microsoft customers won’t have a choice. Starting September 1, Microsoft will roll out passkeys as the default authentication method in its cloud-based identity and access management (IAM) service Entra ID.

Patch Tuesday roundup: Microsoft fixes a monthly record 569 holes; SAP patches a critical memory corruption bug

www.csoonline.com · 3 months ago

Earlier this month Microsoft warned that, because the latest AI models can now help discover vulnerabilities, CSOs will see a higher volume of security updates every month. It wasn’t kidding. Today the company issued a record number of patches, with 59 rated as critical. And Microsoft is now recommending that customers accelerate their patching schedules to more quickly deal with critical flaws.

Data Centers to Add Billions in Power Costs in 13 States

www.nytimes.com · 3 months ago

A grid operator conducted an auction that expects to add $6.3 billion in charges to consumers and businesses due to data center electricity needs. This figure underscores the massive energy demands powering large-scale data centers, significantly impacting infrastructure costs.

Cribl Adds Agentic Detection Engineering & Boosts SecOps With CardinalOps Deal

www.darkreading.com · 3 months ago

Cribl acquired CardinalOps, integrating AI-based detection engineering into its product suite. This integration allows customers to map security controls and detection rules directly to the MITRE ATT&CK framework. SecOps teams can identify coverage gaps and operationalize threat intelligence, positioning Cribl as a robust alternative to legacy SIEM solutions.

SVD-2026-0702: SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise

advisory.splunk.com · 3 months ago

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.

SVD-2026-0703: Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise

advisory.splunk.com · 3 months ago

Splunk has a high-severity Path Traversal vulnerability (CVE-2026-20297) in its App Install REST Endpoint affecting Enterprise and Cloud Platform. Exploitation via editlocalapps/installapps allows writing files outside app dirs, potentially to $SPLUNKHOME/etc/. Users must upgrade immediately for resolution.