Blahalla

Microsoft Tests AI-Powered Copilot Tool to Diagnose Windows 11 Performance Issues

gbhackers.com · 8 days ago

Microsoft is gradually rolling out an optional Copilot feature called PC Insights, which provides the AI assistant with access to real-time information about Windows 11 hardware and performance. This feature, first reported by Windows Latest, is currently being tested with users in the United States and is not yet widely available.

New GhostCommit Technique Hides Exploits in Images to Evade AI Code Reviewers

gbhackers.com · 9 days ago

Researchers have revealed a technique called “GhostCommit,” which involves prompt injection by hiding malicious instructions within images included in pull requests. This technique has the potential to bypass text-only AI code reviewers and later manipulate coding agents into exposing repository secrets.

OpenAI temporarily relaxes GPT-5.6 Sol usage limits

www.bleepingcomputer.com · 9 days ago

OpenAI temporarily lifted the five-hour usage restriction for Plus, Pro, and Business plans after facing high demand for its most powerful model over 48 hours. The company also reset current usage limits across all plans. Additionally, OpenAI improved GPT-5.6 Sol's efficiency to reduce token consumption, helping users work longer before hitting their allotted cap.

Vulnerability in Realtek driver allows DMA controller abuse from user mode with no additional hardware or driver

zwclose.github.io · 9 days ago

A vulnerability in the Realtek SD card reader driver exposes device registers to non-privileged users. This flaw permits user mode applications to program the DMA controller, enabling arbitrary physical memory reads and writes. Researchers successfully developed a complex proof-of-concept demonstrating direct access to the host's first 4GB of physical memory.

Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more time

www.bleepingcomputer.com · 9 days ago

Anthropic extended paid subscriber access to Claude Fable 5 until July 19. The promotion applies across Pro, Max, Team, and premium Enterprise subscriptions. Anthropic warns users that Fable 5 consumes the weekly usage limit quickly compared to other available models.

CVE-2026-47291: Windows Critical Unauthenticated Remote Code Execution in HTTP.sys

byteray-ai.github.io · 9 days ago

Critical RCE in Windows HTTP.sys (CVE unknown) via unauthenticated exploit. Integer overflow in UlpParseNextRequest causes kernel pool buffer overflow, overwriting memory.

RedHook Android malware now uses Wireless ADB for shell access

www.bleepingcomputer.com · 9 days ago

RedHook malware abuses Android's Wireless Debugging, tricking victims for Accessibility permissions. It activates ADB via the loopback interface and uses Shizuku to gain shell privileges (UID 2000) for data theft and screen streaming.

Cybersecurity Newsletter Weekly – The 40 Biggest Cybersecurity Stories – Accenture Breach, AI Attack, Exploits Releases, Data Breaches & More

gbhackers.com · 9 days ago

CVE-2025-5777 in CitrixBleed 2 allows MFA session hijacking for lateral movement. Claude AI prompt injection turns chatbots into C2 agents with RCE. IonStack exploit chain grants root on Android 17 via one link click. Threat actors must patch these vulnerabilities immediately.

Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install

thehackernews.com · 10 days ago

The jscrambler npm package version 8.14.0 ships with a malicious preinstall hook. This hook silently drops and executes a native infostealer build for Windows, macOS, and Linux during installation. Users only need to install this specific version to run the payload without further commands or imports.

Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns

thehackernews.com · 10 days ago

Researchers disclosed sustained cyber espionage activity targeting several Pakistani law enforcement organizations. Suspected China- and India-aligned groups executed these operations between February 2024 and April 2026. The group compromised assets at Balochistan Police, impacting servers hosting web applications that manage criminal and citizen data.

Ghost Accounts Abuse GitHub API in Mass Recon Campaign

www.securityweek.com · 10 days ago

Malicious groups use dormant "ghost accounts" and the public GitHub API for massive reconnaissance, mapping repos via publicly accessible and sometimes private commit paths. Datadog urges monitoring for anomalous user agents and data exfiltration to prevent breaches.

Scanning malicious websites with arbitrary number of VPN tunnels (Part 2)

discounttimu.substack.com · 10 days ago

An author developed a web scanner utilizing LLM agents and multiple VPN tunnels for simulating geo-specific security testing. The system uses isolated network namespaces to simulate access from various countries, including Taiwan and Singapore. It runs Playwright/Chromium within these namespaces to batch-scan URLs, comparing collected data using exact and fuzzy hashes.

Australia warns of global campaign targeting vulnerable CMS platforms

www.bleepingcomputer.com · 10 days ago

ACSC warns of global webshell exploitation on WordPress, Joomla, Craft CMS via CVE-2025-34085, CVE-2026-1969, & CVE-2026-3395. Attackers use AI; update plugins/themes and restrict web access now.

AWS GovCloud Credential Leak Leads CISA to Share Critical Cyber Incident Lessons

gbhackers.com · 10 days ago

CISA exposed AWS GovCloud credentials in a contractor's public GitHub repo ("Private-CISA"). Admin keys/passwords were leaked. CISA reset all affected credentials and tightened repository controls.

Hackers Infect C++ and C# Project Files to Spread Multi-Stage Windows Backdoor

gbhackers.com · 10 days ago

Researchers found a Windows Trojan compromising C++/C projects via supply chain means. It uses components like Trojan.DownLoader49 to persist by replacing DLLs (e.g., profapi.dll) and steals data like Discord tokens and passwords. The malware affects development projects.

'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets

www.bleepingcomputer.com · 10 days ago

Ghostcommit steals secrets by hiding prompt injection in PNGs. It bypasses AI reviewers ignoring images. An agent reads the image payload to exfiltrate.env content as integer constants.

Zimbra Releases Security Patch for Stored XSS Vulnerability in Classic Web Client

gbhackers.com · 10 days ago

Zimbra released the Daffodil v10.1.19 patch to address a stored Cross-Site Scripting (XSS) vulnerability in its Classic Web Client. This flaw permits an attacker to execute malicious JavaScript by delivering specially crafted emails into a logged-in user’s webmail session. Security teams must prioritize applying this update and review access logs for unusual client-side activity.

Dell BIOS Flaw Lets Attackers Extract Plaintext Passwords Without Brute Force

gbhackers.com · 10 days ago

Dell BIOS flaw (CVE-2026-40639) allows unauthenticated attackers with physical access to extract plaintext admin/user passwords from SPI flash dumps using weak encoding on the DVAR store.

Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

thehackernews.com · 10 days ago

Zimbra urges customers to apply updates following a critical vulnerability in the Classic Web Client. Researchers described the flaw as stored cross-site scripting (XSS), which permits arbitrary code execution within a user's session. Exploiting this could allow specially crafted emails to execute malicious scripts, although no CVE identifier has been assigned yet.

Meta Removes A.I. Feature on Instagram After Days of Backlash

www.nytimes.com · 11 days ago

Users and Hollywood agencies raised privacy and copyright concerns about the new tool, Muse Image.

Apple Sues OpenAI, Accusing It of Stealing Company Secrets

www.nytimes.com · 11 days ago

The two companies struck a deal in 2024 to offer A.I. services on Apple devices, but their partnership has soured.

No Manners Here: The Ruthless Rise of The Gentlemen Ransomware

unit42.paloaltonetworks.com · 11 days ago

Unit 42 explores The Gentlemen ransomware operations, revealing the affiliate model driving its rapid growth. Learn more here.

New U-Boot flaws could enable stealthy firmware attacks

www.bleepingcomputer.com · 11 days ago

Six vulnerabilities in the widely used U-Boot bootloader have been discovered that could allow attackers to execute malicious code during device boot, potentially enabling stealthy firmware attacks that compromise security protections and install persistent malware.

Exposed Server Reveals 25,000 Compromised WordPress Websites

www.techrepublic.com · 11 days ago

The exposed WP-SHELLSTORM server disclosed critical findings from a large website hacking campaign. Researchers retrieved thousands of webshells and operational logs used during the attack. Furthermore, the compromised server revealed valuable cloud credentials and various specialized tools employed by attackers.

Friday Squid Blogging: “Squidbleed” Vulnerability

www.schneier.com · 11 days ago

In a rare combined cybersecurity/squid post, a twenty-nine-year-old squid proxy bug can leak HTTP requests. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

Closing the Timing Gap: Defensive Temporal Observability

arxiv.org · 11 days ago

Lately I’ve been thinking about time. Uptime, pulse checks, execution time, response time. We’ve always treated these as health metrics. They tell us whether a system is alive, responsive, and performing as expected. But what if they’re also security metrics? That idea isn’t entirely new.

Jen Ellis: Connecting Cyber Community With Political Machinery

www.darkreading.com · 11 days ago

Security Pro File: On the heels of her recent honors as a Member of the Order of the British Empire (MBE), we take a look back at the events that shaped Jen Ellis' advocacy on behalf of security researchers.

Claude Code Espionage Campaign Exposes a New Enterprise AI Risk

www.techrepublic.com · 11 days ago

Anthropic’s AI-run espionage report shows why enterprises need stronger governance for AI agents, MCP connectors, and enterprise data access.

Ryuk ransomware member pleads guilty in the US, faces 15 years in prison

www.bleepingcomputer.com · 11 days ago

A 34-year-old Armenian man has pleaded guilty to hacking U.S. companies and deploying the infamous Ryuk ransomware to encrypt their systems.

Massive Telstra Outage Hits Mobile Networks, Rail, and Payments in Australia

www.techrepublic.com · 11 days ago

A Telstra software defect disrupted mobile services, rail communications, payments, and emergency calls across Australia, exposing infrastructure risks.

Chrome 150 Adds Android Back Button, Major Security Fixes

www.techrepublic.com · 11 days ago

Chrome 150 adds an in-menu back button to Android, reorganizes several controls, and delivers important browser security fixes.

Cybercriminals Flock to Healthcare Businesses as Attacks Surge

www.darkreading.com · 11 days ago

While cyberattacks against hospitals and clinics grew modestly in the first half of 2026, attacks on service providers and other healthcare businesses more than doubled.

Police suspects Dutch hackers were involved in Odido breach

www.bleepingcomputer.com · 11 days ago

The Dutch National Police (Politie) says it has found "strong indications" that Dutch hackers have been involved in a February breach at the telecommunications provider Odido.

URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat

thehackernews.com · 11 days ago

Progress Software has told ShareFile customers to shut down the Windows servers running their Storage Zone Controllers, confirming to The Hacker News that it is responding to a "credible external security threat.

Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

thehackernews.com · 11 days ago

Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases. The compromised version, @injectivelabs/[email protected], came embedded with fake telemetry functionality that exfiltrated data from cryptocurrency wallets.

Progress urges ShareFile customers to shut down servers over "credible" threat

www.bleepingcomputer.com · 11 days ago

Progress Software is emailing ShareFile customers who use Storage Zone Controllers to immediately shut down their servers after identifying what it describes as a "credible external security threat" targeting the on-premises secure file-sharing software.

Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative

www.microsoft.com · 11 days ago

Microsoft’s latest Secure Future Initiative report outlines progress on secure foundations, AI-powered defense, and future-ready cybersecurity.

Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot

thehackernews.com · 11 days ago

Researchers at firmware security firm Binarly have found six new flaws in U-Boot, the small program that starts up hardware as varied as home routers, smart cameras, and the management chips inside data-center servers. Four of the bugs can crash a device.

Hackers exploit critical auth bypass in Gitea Docker image

www.bleepingcomputer.com · 11 days ago

Hackers are actively exploiting a critical vulnerability in the official Docker image for the Gitea self-hosted Git service that allows attackers to impersonate any user, including administrators.

Top 10 Best Cloud Security Providers – 2026 Review

gbhackers.com · 11 days ago

As businesses continue to migrate critical applications and data to the cloud, the traditional security perimeter has dissolved. The responsibility for securing these dynamic, distributed environments now falls on a complex shared responsibility model between cloud service providers (CSPs) and the customer.

New York Bans Smart Glasses Across 1,240 Courts

www.techrepublic.com · 11 days ago

New York will ban Meta and other smart glasses from all 1,240 state courts starting July 20 over privacy and recording concerns.

Top 10 Best Social Engineering Testing Companies in 2026

gbhackers.com · 11 days ago

In the fast-evolving digital landscape of 2026, an organization’s most sophisticated technological defenses can be rendered useless by a single click from a well-intentioned but unsuspecting employee. Cybercriminals are increasingly bypassing firewalls and encryption by exploiting the most unpredictable and vulnerable component of any security system: the human element.

Money launderer accused of stealing seized crypto while in prison

www.bleepingcomputer.com · 11 days ago

A Bulgarian national has been charged with stealing $290,000 in government-seized cryptocurrency while serving 121 months in prison for helping launder millions stolen from American fraud victims.

In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops

www.securityweek.com · 11 days ago

Other noteworthy stories that might have slipped under the radar: Abnormal AI sued by Anthropic, AssuranceAmerica data breach affects 7 million people, NSA brings back TAO.

Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched

thehackernews.com · 11 days ago

Researchers at Ledger's Donjon security team have shown that a precisely timed laser pulse, aimed at the chip inside a Tangem crypto wallet card, can reset the card's password to anything the attacker picks. No old password. No backup card. Once it is reset, whoever did it controls the wallet and can move the coins out. This is not an emergency for most owners.

EU extends mass scanning of messages without a warrant

www.csoonline.com · 11 days ago

Members of the European Parliament (MEPs) have failed to block a proposal extending the mass scanning of private communications, a measure they have previously rejected twice. This time too, more votes were cast against the proposal than in favor, but due to the absence of numerous MEPs on the eve of the summer recess, the motion to reject did not attain the necessary absolute majority.

CrowdStrike identifies five new prompt injection threats to AI

www.csoonline.com · 11 days ago

Security company CrowdStrike has identified five new prompt injection techniques that could leave enterprises at risk. Prompt injections attacks exploit the growing use of AI within organizations. They work by tricking LLMs into accepting instructions that a human operator would recognize as dubious.

Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws

thehackernews.com · 11 days ago

Details have emerged about three now-patched security flaws in the OpenClaw personal artificial intelligence (AI) assistant that, if successfully exploited, could enable credential theft, privilege escalation, and arbitrary code execution on the host. A brief description of the high-severity vulnerabilities is as follows - GHSA-hjr6-g723-hmfm (CVSS score: 8.

The Replicant in Your Directory: AI Agents and the Identity Security Gap

www.bleepingcomputer.com · 11 days ago

AI agents are accelerating the growth of non-human identities, making it harder for organizations to understand what exists, who owns it, and what it can access. Netwrix explains why stronger visibility and identity governance are essential as AI expands the enterprise attack surface.

Fresh ATM Crypto Software Bugs: Jackpot or Bust?

www.darkreading.com · 11 days ago

Organizations, and possibly ATMs, are at risk of compromise, thanks to holes in a Microsoft BitLocker security wrapper.