Blahalla

Organizations Warned of Exploited Windows, Adobe Acrobat Vulnerabilities

www.securityweek.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency has added several vulnerabilities to its list of known exploited vulnerabilities. These include Windows flaws CVE-2023-36424 and CVE-2025-60710, which can lead to privilege escalation. Adobe Acrobat and Reader also have vulnerabilities, including CVE-2020-9715 and CVEs disclosed in 2026, that enable arbitrary code execution. Additionally, a Microsoft Visual Basic for Applications vulnerability, CVE-2012-1854, and a Fortinet EMS vulnerability, CVE-2026-34621 and CVE-2026-21643, are being actively targeted.

Hackers Exploit Critical ShowDoc RCE Flaw in Ongoing Attacks

gbhackers.com · 3 months ago

A critical vulnerability, CNVD-2020-26585, has been identified in ShowDoc, a document-sharing platform, allowing unauthenticated remote code execution. The flaw stems from an unrestricted file upload mechanism in versions prior to 2.8.7, enabling attackers to upload malicious files without authentication. Exploitation involves crafting HTTP POST requests to upload files with manipulated extensions, leading to arbitrary code execution and potential data theft or ransomware deployment. Organizations are urged to upgrade to version 2.8.7 or later and implement security measures like VPNs and Web Application Firewalls.

SAP Patch Day Fixes Critical SQL Injection, DoS, and Code Injection Flaws

gbhackers.com · 3 months ago

SAP has released monthly security updates addressing nineteen vulnerabilities and one update to a previous note. The most critical fix resolves a SQL injection flaw, CVE-2026-27681, impacting SAP Business Planning and Consolidation and SAP Business Warehouse, carrying a severity score of 9.9. Other vulnerabilities include a missing authorization check, CVE-2026-34256, a denial-of-service vulnerability, CVE-2025-64775, and a code injection flaw, CVE-2026-27674. Administrators are urged to review and apply these patches promptly to protect their systems.

Cyber-Inspekteur: Hybride Attacken nehmen weiter zu

www.csoonline.com · 3 months ago

Cyberattacks targeting Germany and its military are increasing, particularly against critical infrastructure and troops stationed abroad. These attacks, attributed to actors in Russia, China, Iran, and North Korea, include attempts to compromise data centers, disrupt GPS systems, and spread disinformation. Germany is participating in "Locked Shields," the world’s largest multinational cybersecurity exercise, alongside nearly 40 other nations. Officials warn that even local authorities, like citizen registration offices, could become targets, citing Russia's previous actions in Ukraine.

Okta Under Attack as Hackers Skip Phishing for Identity Systems

gbhackers.com · 3 months ago

Hackers are increasingly using voice phishing, or "Okta vishing," to target identity providers like Okta instead of traditional email phishing. Attackers impersonate legitimate users or IT staff to manipulate multi-factor authentication and gain control of identity provider accounts. Once access is obtained, they can immediately pivot through Single Sign-On into various platforms, including Microsoft 365, Google Workspace, and Salesforce, resulting in large-scale cloud data breaches. Organizations should strengthen identity workflows, train help desks, and implement phishing-resistant MFA to defend against these attacks.

Synology SSL VPN Client Vulnerability Enabled Remote Access to Sensitive Files

gbhackers.com · 3 months ago

Synology has released an update to address two vulnerabilities in its SSL VPN Client. The first, CVE-2021-47960, allows attackers to retrieve sensitive system files through a specially crafted web page. The second, CVE-2021-47961, enables attackers to access user PIN codes also via user interaction with a malicious web page. Users should upgrade to version 1.4.5-0684 or newer to mitigate these risks.

ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers

thehackernews.com · 3 months ago

A critical vulnerability, CVE-2025-0520, is currently being exploited in the ShowDoc document management system. This vulnerability allows attackers to upload arbitrary PHP files and execute remote code due to improper file validation. ShowDoc version 2.8.7 patched this issue in October 2020, but many servers remain vulnerable. Threat actors are actively exploiting this vulnerability, dropping web shells on vulnerable systems and the current version of the software is 3.8.1.

APT41 Targets Linux Cloud Servers With New Winnti Backdoor

gbhackers.com · 3 months ago

A new Linux backdoor linked to the China-based APT41, also known as Winnti, has been discovered targeting cloud environments. The implant uses a novel SMTP-based command-and-control system, allowing it to evade detection by standard security tools that often overlook SMTP traffic. The malware harvests credentials from AWS, GCP, Azure, and Alibaba Cloud, encrypting the data with AES-256 before exfiltration. Researchers identified typosquat domains impersonating Alibaba Cloud and Qianxin services, all registered on Alibaba Cloud infrastructure, demonstrating a familiar operational security technique.

CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software

thehackernews.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency has added six vulnerabilities to its list of known exploited vulnerabilities. These include an SQL injection flaw in Fortinet FortiClient EMS, a use-after-free vulnerability in Adobe Acrobat Reader, an out-of-bounds read vulnerability in Microsoft Windows, a deserialization flaw in Microsoft Exchange Server, an improper link resolution vulnerability in Host Process for Windows Tasks, and an insecure library loading vulnerability in Microsoft Visual Basic for Applications. Active exploitation has been observed for CVE-2026-21643, CVE-2023-21529, and CVE-2012-1854, with one vulnerability being used to deploy ransomware. Federal agencies must patch these vulnerabilities by April 27, 2026.

CISA Warns Fortinet SQL Injection Flaw Is Being Actively Exploited

gbhackers.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about a critical SQL injection vulnerability affecting Fortinet FortiClient Enterprise Management Server software. This flaw, identified as CVE-2026-21643, allows attackers to execute unauthorized code without authentication. Federal agencies must address the vulnerability by April 16, 2026, and all organizations are urged to patch or discontinue use of the product immediately. Threat actors are actively exploiting this weakness in real-world attacks.

Rockstar’s GTA Game Hacked, 78.6 Million Records Published Online

gbhackers.com · 3 months ago

Rockstar Games experienced a data breach impacting over 78.6 million internal records. Hackers, known as ShinyHunters, used a supply-chain attack targeting Anodot, an analytics platform Rockstar utilizes, to gain access to a Snowflake data warehouse. The stolen authentication tokens allowed impersonation of internal services, bypassing typical security measures. The leaked data includes financial metrics from Grand Theft Auto Online and Red Dead Online, generating roughly $500 million annually, but does not contain user passwords, payment information, or source code.

Fake Proxifier GitHub Installer Spreads ClipBanker Crypto Malware

gbhackers.com · 3 months ago

Researchers have discovered several vulnerabilities affecting multiple popular versions of the Atlassian Confluence data center and server products. These security flaws could allow an unauthenticated attacker to execute arbitrary code. Specifically, CVE-2023-46747, CVE-2023-46748, and CVE-2023-46749 are being actively exploited. Affected users are urged to immediately apply the recommended security patches to mitigate the risk of compromise.

Top 10 Best Single Sign-On (SSO) Vendors For Enterprises in 2026

gbhackers.com · 3 months ago

false

Codex Hacked a Samsung TV

blog.calif.io · 3 months ago

Researchers collaborated with OpenAI to demonstrate how artificial intelligence can autonomously discover and exploit hardware vulnerabilities. Using the Codex AI model, they escalated privileges to root on a Samsung Smart TV by auditing source code and testing against a live device. The AI exploited a flaw in the /dev/ntksys driver, enabling arbitrary memory mapping and kernel credential overwrites. This research illustrates the potential for AI to automate post-exploitation tasks and raises concerns about future security implications.

Man Held in Attack on OpenAI Chief’s Home Had List of A.I. Leaders, Officials Say

www.nytimes.com · 3 months ago

NULL

Anthropic’s Mythos signals a structural cybersecurity shift

www.csoonline.com · 3 months ago

New analyses reveal Anthropic’s Claude Mythos Preview is accelerating the vulnerability discovery and exploitation process, compressing the window between vulnerability identification and attack. Experts predict a surge in patches and AI-discovered vulnerabilities, requiring organizations to rapidly improve response times and patch management. The UK’s AI Security Institute found Mythos Preview capable of autonomously attacking weakly defended systems, surpassing other AI models in complex attack simulations. CISOs are advised to strengthen cybersecurity fundamentals, engage stakeholders on risk, and conduct gap analyses to prepare for this structural shift in cyber defense.

European Gym giant Basic-Fit data breach affects 1 million members

www.bleepingcomputer.com · 3 months ago

Basic-Fit, a European gym chain, recently experienced a data breach affecting approximately one million members across several countries. Hackers gained unauthorized access to member data, including names, addresses, phone numbers, dates of birth, bank account details, and membership information. The company claims to have stopped the breach quickly and reports no identification documents or passwords were compromised. Basic-Fit is notifying affected individuals and monitoring for any data leaks with external security experts.

Why Orgs Need to Test Networks to Withstand DDoS Attacks During Peak Loads

www.darkreading.com · 3 months ago

Organizations must proactively test their defenses against distributed denial of service attacks, especially during periods of high demand like tax filing season. Traditional testing during maintenance windows is insufficient because application and infrastructure changes can impact defenses. Security teams should continuously identify and remediate vulnerabilities to ensure legitimate users aren’t affected by attacks. Past incidents, such as disruptions to government systems in the Netherlands and Poland, highlight the importance of consistent defense validation.

CSA: CISOs Should Prepare for Post-Mythos Exploit Storm

www.darkreading.com · 3 months ago

Anthropic has unveiled Claude Mythos, a large language model capable of discovering and exploiting vulnerabilities across major systems, including a 27-year-old flaw in OpenBSD. To prepare for potential misuse, Anthropic is sharing Mythos with select organizations through Project Glasswing, supported by a $100 million investment. The Cloud Security Alliance (CSA) is urging organizations to proactively adapt their security programs, anticipating a surge in AI-driven vulnerabilities and emphasizing foundational security practices like segmentation and multifactor authentication. The CSA highlights that current patching processes may be overwhelmed and recommends increased automation and additional resources to address the accelerating volume of vulnerability disclosures.

Man charged with firebomb attempt at home of OpenAI CEO Sam Altman

www.washingtonpost.com · 3 months ago

Federal authorities have charged a man in connection with an attempted firebombing at the home of OpenAI CEO Sam Altman. The suspect was apprehended at OpenAI’s San Francisco headquarters and reportedly possessed a document expressing anti-AI sentiments. The document allegedly contained a list of names of prominent AI executives. The Justice Department is pursuing charges related to the incident.

Adobe Patches Actively Exploited Zero-Day That Lingered for Months

www.darkreading.com · 3 months ago

A critical vulnerability, CVE-2026-34621, has been discovered and patched in Adobe Acrobat and Reader for Windows and macOS. The flaw allows for arbitrary code execution and has been actively exploited since at least November 2023. Attackers can trigger the vulnerability simply by having a user open a malicious PDF file, which then silently gathers system information before potentially deploying additional exploits. Adobe has released updates and advises users to install them promptly.

GrafanaGhost: The AI That Leaked Everything Without Being Hacked

www.techrepublic.com · 3 months ago

Security researchers discovered a vulnerability, dubbed GrafanaGhost, that allowed data exfiltration from Grafana environments without any traditional security alerts. The attack exploited Grafana’s AI assistant by embedding hidden instructions within data, bypassing model-level guardrails and URL validation. This highlights a broader problem: AI features are being integrated into platforms lacking AI-specific threat models, creating new exfiltration channels. Organizations must inventory AI integrations, strengthen data-layer controls, and proactively test for vulnerabilities like indirect prompt injection.

Stolen Rockstar Games analytics data leaked by extortion gang

www.bleepingcomputer.com · 3 months ago

Rockstar Games has confirmed a data breach after the ShinyHunters extortion gang leaked data obtained from a third-party security incident at Anodot. The leaked data, containing over 78 million records, includes internal analytics related to Grand Theft Auto Online and Red Dead Online, such as in-game revenue and player behavior metrics. The attackers reportedly stole authentication tokens from Anodot to access Rockstar’s Snowflake environments. This incident follows a previous breach in 2022 involving the Lapsus$ group.

Critical flaw in wolfSSL library enables forged certificate use

www.bleepingcomputer.com · 3 months ago

A critical vulnerability has been identified in the widely used wolfSSL library, potentially allowing attackers to forge certificates and compromise secure connections. The flaw, tracked as CVE-2026-5194, involves improper validation of hash algorithms during certificate verification and impacts multiple signature algorithms like ECDSA/ECC, DSA, ML-DSA, Ed25519, and Ed448. Exploitation could trick devices into accepting malicious certificates, trusting fraudulent servers or connections. The vulnerability was resolved in wolfSSL version 5.9.1, and users are urged to apply the update immediately.

Empty Attestations: OT Lacks the Tools for Cryptographic Readiness

www.darkreading.com · 3 months ago

Critical infrastructure operators face significant challenges in demonstrating cryptographic readiness, particularly within Operational Technology (OT) environments. Unlike IT systems, OT prioritizes availability over security, often running on legacy protocols with weak authentication and encryption. Adversaries, like Volt Typhoon, are exploiting these vulnerabilities to gain long-term access and harvest encrypted data for future decryption or to forge firmware updates, creating a "harvest now, decrypt later" or "trust now, forge later" scenario. Current attestation frameworks designed for IT are unsuitable for OT, leading to a false sense of security and hindering genuine progress.

FBI takedown of W3LL phishing service leads to developer arrest

www.bleepingcomputer.com · 3 months ago

Law enforcement officials in the United States and Indonesia have dismantled the W3LL phishing platform and arrested the alleged developer. The platform, which operated from 2019 to 2024, allowed cybercriminals to steal credentials and attempt more than $20 million in fraud by creating fake login portals. The W3LL kit bypassed multi-factor authentication and facilitated the sale of over 25,000 compromised accounts through a marketplace. Authorities state the phishing platform targeted over 17,000 victims worldwide and supported business email compromise attacks.

Elon Musk, Who Owns X, Appears to Post on TikTok

www.nytimes.com · 3 months ago

false

OpenAI rotates macOS certs after Axios attack hit code-signing workflow

www.bleepingcomputer.com · 3 months ago

OpenAI is rotating its macOS code-signing certificates after a supply chain attack involving a compromised Axios package version 1.14.1. The incident, linked to North Korean threat actors known as UNC1069, resulted in a malicious package being executed within an OpenAI GitHub Actions workflow. While OpenAI found no evidence of certificate compromise or data access, they are revoking the old certificate on May 8, 2026, and requiring users to update their macOS applications to avoid functionality issues. Users should update through official channels and avoid installing software from unofficial sources.

Booking.com Hack Exposes Customer Data, Sparks Travel Scam Fears

www.techrepublic.com · 3 months ago

Booking.com recently confirmed a data breach impacting an undisclosed number of customers. Hackers accessed personal information including names, email addresses, booking details, and notes shared with hotels, though financial data was not compromised. Cybersecurity experts warn that the context of travel plans obtained in the breach could be used to craft convincing scams. Users are advised to be wary of suspicious emails and messages and verify booking details directly through Booking.com’s official platform.

New Booking.com data breach forces reservation PIN resets

www.bleepingcomputer.com · 3 months ago

Booking.com recently confirmed a data breach impacting some users' reservation information. Compromised data includes full names, email addresses, postal addresses, phone numbers, and communications with property providers. The company has forced PIN resets for reservations and notified affected users via email, while advising caution regarding suspicious communications. Booking.com is currently unavailable to disclose the total number of impacted users.

Google Rolls Out End-to-End Encryption to Eligible Gmail Users on Mobile

www.techrepublic.com · 3 months ago

false

JanelaRAT Malware Targets Latin American Banks with 14,739 Attacks in Brazil in 2025

thehackernews.com · 3 months ago

Cybercriminals are actively targeting banks and financial institutions in Latin America with the JanelaRAT malware. This modified version of BX RAT steals financial data, tracks user activity, and has been linked to 14,739 attacks in Brazil and 11,695 in Mexico in 2025. The malware uses techniques like DLL side-loading, rogue MSI installers, and phishing emails to infect systems and employs custom scripts written in Go, PowerShell, and batch to install malicious browser extensions. JanelaRAT is designed to evade detection and can perform actions like displaying fake overlays to steal credentials and remotely control infected machines.

Unpatched RAGFlow Vulnerability Allows Post-Auth RCE

zeropath.com · 3 months ago

A critical vulnerability in RAGFlow allows authenticated users to execute arbitrary code. The Remote Code Execution flaw stems from the use of eval() when using the Infinity chunk storage backend. Attackers can inject malicious code through public API endpoints, potentially impacting the approximately 1,918 publicly accessible RAGFlow instances. A proof-of-concept demonstrating this vulnerability is available, and mitigation strategies include patching, limiting access, and monitoring.

On Anthropic’s Mythos Preview and Project Glasswing

www.schneier.com · 3 months ago

Anthropic has launched a new AI model, Claude Mythos Preview, and a related project, Glasswing, to proactively identify and fix software vulnerabilities. The model demonstrates advanced capabilities in writing exploits and identifying complex vulnerabilities, but a security firm replicated Anthropic’s findings using older models. Experts anticipate a shift where zero-day exploits become more common, requiring organizations to prepare for a future where attackers have greater offensive capabilities. The cybersecurity industry is reacting to the news, with OpenAI also emphasizing the potential risks of their AI models.

Coinbase AgentKit Prompt Injection: Wallet Drain, Infinite Approvals, and Agent-Level RCE (validated by Coinbase, on-chain PoC)

x402warden.com · 3 months ago

A prompt injection vulnerability was discovered in Coinbase's AgentKit, a tool for building AI agents with access to wallets and infrastructure. Attackers could use crafted prompts to trigger unauthorized actions, including transferring tokens, granting unlimited ERC20 approvals, and executing SSH commands without human confirmation. This vulnerability, demonstrated on the Base Sepolia test network, expanded the risk beyond wallet drains to agent-level execution control. Coinbase validated the finding, awarded a bounty, and classified it as a medium severity, though the researcher believed the impact was more significant. A CVE is pending assignment.

Stealthy RCE on Hardened Linux: noexec + Userland Execution PoC

hardenedlinux.org · 3 months ago

Researchers have demonstrated a technique called userland-exec that bypasses noexec restrictions on Linux systems to achieve remote code execution. This method avoids calling execve, sidestepping kernel-level checks and MAC hooks by parsing and executing ELF binaries entirely within user space. The process involves mapping program segments into memory, handling relocations, and directly jumping to the ELF's entry point, preserving the original process context. A demonstration utilizes a format string leak and stack buffer overflow to deliver a payload, with options for disk or stealthy memfd execution, and highlights the limitations of traditional security measures like noexec and SELinux.

Adobe rolls out emergency fix for Acrobat, Reader zero-day flaw

www.bleepingcomputer.com · 3 months ago

Adobe has released an emergency update to fix a zero-day vulnerability, CVE-2026-34621, impacting Acrobat Reader and Acrobat. Malicious PDF files can exploit this flaw to bypass security restrictions and potentially execute code, allowing attackers to read and steal files without user interaction. The vulnerability was discovered after a suspicious PDF sample was submitted for analysis and has been observed in attacks using Russian-language documents. Users are advised to update to the latest version of the software to mitigate the risk.

APT41 Delivers 'Zero-Detection' Backdoor to Harvest Cloud Credentials

www.darkreading.com · 3 months ago

The Chinese threat group APT41 is using a novel backdoor malware written in the ELF format to target cloud workloads on platforms like AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud. This backdoor uses SMTP port 25 for covert command and control, making it difficult to detect with standard scanning tools. The attackers are employing typosquatting and bulk domain registrations to further obscure their activities and harvest cloud credentials, which could allow them to act as legitimate users within a cloud environment. Security experts recommend monitoring outbound SMTP traffic, auditing cloud credential file access, and enabling cloud-native logging and security features to detect and prevent this activity.

FBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts

thehackernews.com · 3 months ago

Law enforcement agencies, including the FBI and Indonesian National Police, have dismantled a global phishing operation utilizing the W3LL toolkit. The toolkit allowed cybercriminals to mimic login pages and steal account credentials, resulting in attempted fraud exceeding $20 million. Authorities apprehended the alleged developer and seized related domains, disrupting a platform that offered various cybercrime tools and services, including stolen credentials and unauthorized system access. The W3LL platform, initially documented in 2023, employed adversary-in-the-middle techniques to bypass multi-factor authentication and impacted over 17,000 victims worldwide between 2023 and 2024.

Booking.com Says Hackers Accessed User Information

www.securityweek.com · 3 months ago

Booking.com has informed customers that unauthorized third parties may have accessed their booking information, including names, email addresses, phone numbers, and details shared with accommodations. The company states that customer accounts were not breached and that the suspicious activity has been contained by updating reservation PIN numbers. Booking.com is warning customers to be vigilant against potential phishing attacks and will not request credit card details through email or other messaging platforms. The number of affected users is currently unknown.

The silent “Storm”: New infostealer hijacks sessions, decrypts server-side

www.bleepingcomputer.com · 3 months ago

A new infostealer called Storm has emerged on underground cybercrime networks, offering credential theft capabilities for under $1,000 monthly. This tool bypasses traditional endpoint security by performing decryption and data processing on remote servers, harvesting data like browser credentials, session cookies, and crypto wallet information. Storm automates session restoration through a built-in panel, leveraging techniques previously seen in Cookie-Bite and SessionShark attacks to circumvent multi-factor authentication. The tool is priced in tiers, with a standard license costing $900 monthly, and builds continue operating even after subscription expiry.

BrowserGate: Claims of LinkedIn ‘Spying’ Clash With Security Research Findings

www.securityweek.com · 3 months ago

Concerns have emerged regarding LinkedIn's practices, with a group called BrowserGate alleging the platform is secretly scanning users’ computers to profile them. LinkedIn claims this scanning is for security purposes, specifically to identify browser extensions that violate their terms or impact site stability. Security research indicates LinkedIn is performing resource probing to detect installed browser extensions, but there’s no evidence of malicious code or fingerprinting. While LinkedIn’s actions may not be malicious, legal experts suggest that data collection without clear user consent could violate privacy regulations.

CVE-2026-22666: Dolibarr 23.0.0 dol_eval() whitelist bypass -> RCE (full write-up + PoC)

jivasecurity.com · 3 months ago

A critical zero-day vulnerability, CVE-2026-22666, has been identified in Dolibarr versions 23.0.0, impacting the ERP/CRM platform. The flaw in the doleval() and dolevalstandard() functions allows authenticated administrators to execute arbitrary PHP code, bypassing security measures like whitelists and blacklists. Attackers can leverage this to create files, access database information, and potentially gain control of the system through remote code execution. Dolibarr version 23.0.2 addresses this vulnerability with improved filtering and safer expression evaluation.

GitHub and Jira Alerts Hijacked for Trusted-SaaS Phishing

gbhackers.com · 3 months ago

Hackers are exploiting GitHub and Jira's notification systems to conduct phishing campaigns. These emails appear legitimate because they originate from the platforms’ own servers, bypassing standard security checks like SPF, DKIM, and DMARC. Attackers embed malicious content within commit notifications on GitHub and Jira invitations, often disguised as urgent billing or account issues. This "Platform-as-a-Proxy" technique leverages the trusted reputation of these services to deliver phishing links and harvest credentials, with one campaign accounting for nearly 3% of all GitHub emails. Security experts advise adopting a Zero-Trust approach and monitoring API logs to detect suspicious activity.

⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More

thehackernews.com · 3 months ago

Cybersecurity threats are escalating with reports of an actively exploited zero-day vulnerability in Adobe Reader (CVE-2026-34621) and ongoing attacks against critical infrastructure linked to Iran. A North Korean group recently stole $285 million in digital assets, while law enforcement disrupted a Russian botnet, APT28. The emergence of AI-powered vulnerability hunting tools and the proliferation of new Remote Access Trojans, like RetroRAT, pose significant risks, highlighting the need for vigilance and rapid security updates.

A Second Agent That Proves the First One Wrong

blog.tahr.one · 3 months ago

AI agents can quickly identify potential vulnerabilities, but often produce false positives, requiring significant manual review. To address this, a new agent, EVA, independently verifies findings from initial testing agents by attempting to reproduce vulnerabilities. EVA classifies findings as VERIFIED, POTENTIAL, or FALSEPOSITIVE, with only confirmed vulnerabilities making it into reports. The verification process involves statistical measurements, response analysis, and real-time browser execution to ensure accurate identification of exploitable vulnerabilities.

Critical flaw in Marimo Python notebook exploited within 10 hours of disclosure

www.csoonline.com · 3 months ago

A critical remote code execution vulnerability in the Marimo Python notebook platform, identified as CVE-2026-39987, was exploited within 10 hours of public disclosure. Attackers could gain complete control of exposed Marimo servers through a single, unauthenticated connection, bypassing authentication checks. Researchers observed attackers stealing credentials, including AWS access keys, within three minutes of exploiting a honeypot server. Organizations are urged to immediately update to version 0.23.0 or restrict external access to Marimo servers.

OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack

www.securityweek.com · 3 months ago

OpenAI has confirmed it was impacted by a recent supply chain attack targeting the widely used Axios JavaScript library. Hackers, believed to be linked to North Korea, compromised an Axios maintainer’s NPM account to distribute malicious packages containing a remote access Trojan. The compromised packages briefly affected OpenAI’s macOS app-signing process, potentially exposing a signing certificate, which the company has since revoked and rotated as a precaution. Cybersecurity firms have identified evidence of compromise on a number of systems, with the attackers primarily motivated by financial gain.

YARA-X now runs in the browser - official Playground

virustotal.github.io · 3 months ago

false

New Nginx 1.29.8 and FreeNginx Versions Patch Critical Security Flaws

gbhackers.com · 3 months ago

Nginx and FreeNginx have released new versions to address critical security vulnerabilities and introduce enhancements. Version 1.29.8 includes full compatibility with OpenSSL 4.0, improving encryption protocols and secure connections. New configuration tools, like the “maxheaders” directive, are being implemented to help mitigate denial-of-service attacks. Administrators are urged to update promptly and test in a staging environment to ensure compatibility.