Blahalla

SVD-2026-0704: Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise

advisory.splunk.com · 3 months ago

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.

SVD-2026-0705: Third-Party Package Updates in Splunk Enterprise - July 2026

advisory.splunk.com · 3 months ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, and higher.

SVD-2026-0706: Third-Party Package Updates in Splunk Universal Forwarder - July 2026

advisory.splunk.com · 3 months ago

Splunk issued an advisory detailing remediation for critical vulnerabilities in the Universal Forwarder's third-party packages. Users must upgrade to recommended versions like 10.4.1, 10.2.5, 10.0.8, or 9.4.13. These updates patch OpenSSL and resolve CVE-2026-28388, CVE-2026-28389, and CVE-2026-28390.

Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes

www.darkreading.com · 3 months ago

Microsoft patched 622 CVEs, including zero-days. Flaws like CVE-2026-56155 and CVE-2026-56164 risk EoP. Updates cover critical issues from CVE-2026-48561 to CVE-2026-57092. Experts see a shift to continuous, high-stakes patching.

Lidl Data Breach Exposes Customer Details in Germany, Belgium, and the Netherlands

www.techrepublic.com · 3 months ago

Lidl's German, Belgian, and Dutch online shops saw identity data theft from a third-party provider. Stolen records include names, phone numbers, emails, DOBs, and customer IDs, increasing phishing/fraud risk. Payment details were safe.

SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now

www.bleepingcomputer.com · 3 months ago

SonicWall warns that malicious groups actively exploit two zero-day vulnerabilities in SMA1000 appliances. These flaws, CVE-2026-15409 an unauthenticated SSRF and CVE-2026-15410 a code injection flaw demand immediate attention. Customers must upgrade to the new hotfix releases and follow IOC guidance to secure their devices.

Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack

thehackernews.com · 3 months ago

Microsoft shipped its largest Patch Tuesday to date, releasing updates that address 622 distinct CVEs. Crucially, this update fixes two vulnerabilities actively being exploited by attackers in the wild. Microsoft credited incident responders for identifying these critical security flaws.

Spanish Police take down €140 million cyber fraud ring, arrest four

www.bleepingcomputer.com · 3 months ago

Spanish Police dismantled a cybercrime ring that generated €140M via investment fraud and BEC. Four suspects were arrested across Spain, Portugal, and Panama following tracing through 800+ accounts. They seized electronics and froze €3M.

6 GHz Wi-Fi Flaws Could Disrupt Critical Systems

www.darkreading.com · 3 months ago

Penn State/INL warn 6 GHz Wi-Fi AFC servers trust client data (GPS, GNSS, etc.). Input manipulation can spoof location/time, risking wrong freq assignment and DoS to critical infra. Vulnerabilities are present in AFC systems.

Microsoft Patches a Record 570 Security Flaws

krebsonsecurity.com · 3 months ago

MS patched 570+ flaws, fixing zero-days: CVE-2026-56155 (ADFS), CVE-2026-56164 (Sharepoint), CVE-2026-50661 (BitLocker bypass), and CVE-2026-48561 (Copilot RCE). AI aided this large update release.

Nearly 300 GitHub repos pose as legit software to push malware

www.bleepingcomputer.com · 3 months ago

ArcticWolf uncovered a group deployed nearly 300 fake GitHub repositories impersonating legitimate software to distribute infostealer malware. This BoryptGrab variant steals credentials from 19 web browsers, 32 crypto wallets, and messaging services like Discord. Researchers noted the malware bypasses Chrome’s App-Bound Encryption using direct code injection into the browser process.

Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days

www.securityweek.com · 3 months ago

Microsoft issued patches addressing 622 vulnerabilities, including two zero-days in Active Directory and SharePoint Server. The updates fixed the BitLocker bug, VMSwitch flaws, and critical defects like CVE-2026-55008 and RCE in protocols. Microsoft also addressed numerous additional security weaknesses, including the DHCP Server vulnerability and flaws affecting various applications.

Microsoft releases Windows 10 KB5099539 extended security update

www.bleepingcomputer.com · 3 months ago

MS released W10 KB5099539, fixing 570 vulns, including two zero-days from July 2026 Patch Tuesday. Free support is extended to Oct 12, 2027.

Australian Enterprises At Risk as Anthropic Finds Hackers In Claude Code

www.techrepublic.com · 3 months ago

A Chinese state-linked group executed a cyberattack using Anthropic's Claude Code tool against approximately 30 global organizations. The attack was highly automated, requiring minimal human intervention to fire off rapid API requests. This vulnerability highlights major AI governance gaps in Australia; Deloitte reports only 22% of businesses possess mature models despite high agent adoption.

Australian Enterprises At Risk as Anthropic Finds Hackers In Claude Code

www.techrepublic.com · 3 months ago

Chinese state-linked group attacked with Claude Code via automated API calls. Attackers ran 80-90% autonomously, exploiting AI agent gaps. Australian businesses face risks without strong AI governance.

Synopsys Finds No Evidence of Data Breach Amid Bosch Hack Claims

www.securityweek.com · 3 months ago

D1R claimed IP theft from Synopsys and Bosch, demanding ransom. Synopsys found no evidence of unauthorized access or breaches. Experts question D1R's claims due to using public material.

SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data

thehackernews.com · 3 months ago

SAP released July 2026 security updates that address multiple vulnerabilities in its software stack. The patch includes fixes for CVE-2026-44747, a critical out-of-bounds write flaw affecting SAP NetWeaver Application Server ABAP (CVSS score: 9.9). This vulnerability allows authenticated attackers to cause memory corruption by leveraging logical errors in the server’s memory management.

Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days

www.bleepingcomputer.com · 3 months ago

Microsoft released security updates for 570 flaws during the July 2026 Patch Tuesday. The update fixes three zero-day vulnerabilities, including CVE-2026-56155 in Active Directory Federation Services and another active exploit affecting SharePoint Server (CVE-2026-56164). Microsoft also patched elevated privilege weaknesses related to the listed flaws, including CVE-2026-50661.

Manage Vendor Risk in a Few Practical Steps

www.darkreading.com · 3 months ago

Third-party failures disrupt operations and cause losses. Governance requires measuring residual exposure via inherent risk, controls, and vendor assurance. Businesses must validate review depth, check tolerances, and document policy deviations.

Windows 11 KB5101650 & KB5099414 cumulative updates released

www.bleepingcomputer.com · 3 months ago

Microsoft released cumulative updates KB5101650 and KB5099414 for Windows 11 versions 25H2/24H2 and 23H2. These mandatory July 2026 patches address 571 vulnerabilities and fix numerous bugs. The update also introduces new features, such as full-screen color tint accessibility options and quick actions displayed when hovering over files in File Explorer.

Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads

thehackernews.com · 3 months ago

Other browser extensions running scripts on claude.ai can trigger "Claude for Chrome" tasks that potentially access user data across Gmail, Google Docs comments, and Calendar. These extensions require a rogue script to run on claude.ai itself. Anthropic had previously restricted the arbitrary-prompt path in May following earlier vulnerabilities.

Adobe Patches Critical ColdFusion Vulnerabilities

www.securityweek.com · 3 months ago

Adobe patched 12 products for 88 vulns, incl. ColdFusion flaws (CVE-2026-48318 to CVE-2026-48327), Commerce issues (CVE-2026-48356, CVE-2026-48358), and Experience Manager bugs (CVE-2026-48259, CVE-2026-48359). Users must apply patches for dozens of flaws, like CVE-2026-48334.

LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts

thehackernews.com · 3 months ago

Cybersecurity researchers flagged LabubaRAT, an undocumented Rust-based remote access trojan (RAT). The malware masquerades as NVIDIA software to infiltrate target environments unnoticed. Blackpoint Cyber researchers Sam Decker and Nevan Beal determined the RAT establishes a reusable foothold for activity and profiles host systems.

Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown

www.bleepingcomputer.com · 3 months ago

Progress Software confirmed a high-severity path traversal zero-day vulnerability in ShareFile Storage Zone Controllers, affecting versions 5.x and 6.x. The flaw allowed an authenticated administrative user to read arbitrary files or write content anywhere on the system. Progress released patches (including 5.12.5 and 6.0.2) and urges customers to install them immediately to resolve the threat.

Frontier AI: The Genie's Out of the Bottle, But Where's the Rulebook?

www.darkreading.com · 3 months ago

States rapidly regulating powerful AI models through new disclosure laws. Illinois enacted SB315, requiring large developers to update comprehensive AI frameworks and submit transparency reports. New York's RAISE Act and California's TFAIA similarly establish oversight offices and critical guardrails for frontier AI development.

ClickFix's Mushrooming Ecosystem Demands New Defense Tactics

www.darkreading.com · 3 months ago

Cybercriminals use industrialized ClickFix social engineering attacks via pop-ups, tricking users into running malicious code using legitimate tools like PowerShell, bypassing AV/EDR. Reversing Labs recommends YARA structural analysis to target its HTML delivery method.

LastPass, Bitwarden users targeted with fake security alerts

www.bleepingcomputer.com · 3 months ago

Phishing attacks target LastPass/Bitwarden users via emails mimicking policy changes. Fake DocuSign sites prompt credential theft/downloads. Report suspicion and change master passwords on a trusted device.

Source-reviewing 200+ self-hosted multi-tenant AI/SaaS apps for tenant isolation: 78 leaked across tenants (the "un-retrofitted read sibling")

sectum.ai · 3 months ago

Researcher found cross-tenant data exposure in 78 multi-tenant SaaS AI tools due to lack of auth on read endpoints. One tenant can access another's private data across over 200 self-hosted AI tools. Developers must fix these isolation failures for LLM apps.

7 Severe Vulnerabilities Patched in VMware Avi Load Balancer

www.securityweek.com · 3 months ago

Broadcom patched 7 VMware Avi flaws: CVE-2026-47865 (auth bypass), CVE-2026-47871 (dir traversal), and others involving RCE, CVE-2026-47869. Researchers Waeytens & Duy reported fixes for these critical issues.

RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata

thehackernews.com · 3 months ago

Two access control vulnerabilities affect the RabbitMQ message broker service. Researchers from Miggo disclosed these flaws, which could allow attackers to leak OAuth client secrets and bypass tenant boundaries. The findings expose enterprise messaging infrastructure to severe takeover risks.

Miasma Worm Returns as RAT-First npm Attack With Automatic Propagation Disabled

gbhackers.com · 3 months ago

Compromised versions of four AsyncAPI packages deliver a RAT-focused build of the Miasma worm. Attackers bypassed previous defenses by inserting obfuscated launchers into legitimate JavaScript source files, evading npm v12 protections. Researchers analyzed the payload, which establishes encrypted command-and-control communications and enables persistence via an IPFS gateway.

Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail, Calendar

www.securityweek.com · 3 months ago

AI security firm Manifold warned that vulnerabilities linked to ClaudeBleed persist in the latest Claude for Chrome version. Attackers can trigger extensions to act without explicit user clicks or approvals, potentially reading sensitive data like Gmail and Google Docs. These critical flaws remain unpatched across multiple versions released by Anthropic.

Cursor IDE Auto-Executes Malicious Code in Poisoned Repos

www.darkreading.com · 3 months ago

Offensive security firm Mindgard detailed a vulnerability allowing malicious code execution within the popular Cursor IDE. This flaw permits attackers to implant fake executables, such as git.exe, at a repository root, which Cursor automatically runs during project loading. Despite reporting the issue in December, Mindgard noted that Cursor has provided no visible remediation for affected users.

xAI Grok CLI Exposed Developer Code Through Automatic Whole-Repository Uploads

gbhackers.com · 3 months ago

Grok Build CLI v0.2.93 transmits full Git repos, unread files, and commit history by default to xAI infra. It sends raw content, exposing simulated creds from test.env.

Microsoft Entra ID gets passkeys default authentication starting September

www.bleepingcomputer.com · 3 months ago

Microsoft will make passkeys the default authentication method for Entra ID starting September 2026. Microsoft plans to retire SMS and voice authentication by February 2027, requiring organizations to adopt phishing-resistant methods. Teams must transition users now to prevent sign-in disruptions and strengthen protection against AI-enabled credential theft campaigns.

New phishing kits target Microsoft 365 accounts, evade MFA

www.bleepingcomputer.com · 3 months ago

Jalisco and OmegaLord phishing kits target Microsoft 365 MFA bypass. Jalisco exploits OAuth 2.0 Device Authorization Grant with real-time device codes. OmegaLord uses fake PDF readers to steal credentials/phone numbers, enabling SharePoint data theft. These methods affect multiple accounts.

11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot

thehackernews.com · 3 months ago

Cybersecurity researchers discovered 11 old, Microsoft-signed Unified Extensible Firmware Interface (UEFI) applications that risk bypassing Secure Boot on modern systems. An attacker exploiting one of these vulnerable apps executes untrusted code during system boot. This capability enables attackers to deploy malicious UEFI bootkits and other forms of malware.

Attackers Distribute Password Attacks Across Fictional OAuth Apps to Evade SOC Alerts

gbhackers.com · 3 months ago

Attackers used spoofed OAuth app IDs to enumerate over 1M Microsoft Entra ID accounts and test credentials. This method evades detection using fake client IDs. Proofpoint documented this campaign.

Cybercriminals Target Turkish Banks With 8,400 Phishing Domains and 6,600 Scam Ads

gbhackers.com · 3 months ago

Group-IB found an industrial fraud ecosystem targeting Turkish banks with 8,400+ phishing domains and 6,600+ scam ads on Meta. Attackers use a sold phishing kit to impersonate banks/govt services across platforms. Detection requires tracking shared artifacts.

Study of 85 Crypto Wallet Extensions Finds Address Leaks and Cross-Site Tracking Risks

thehackernews.com · 3 months ago

Researchers at KU Leuven tested 85 popular crypto wallet browser extensions and discovered they leak critical information. These wallets communicate with websites and blockchain servers in a way that ties together a person's separate digital addresses. This leakage enables outsiders to follow and track users across different sites.

SAP warns of critical flaws in NetWeaver and Commerce Cloud

www.bleepingcomputer.com · 3 months ago

SAP released July 2026 updates for 16 vulns. Critical fixes include NetWeaver memory corruption (CVE-2026-44747), Approuter HTTP Request Smuggling (CVE-2026-27690), and Commerce Cloud default credentials (CVE-2026-44761). Six other high-severity issues were also addressed.

How Pentera Turns AI Security Workflows into Validation Engines

thehackernews.com · 3 months ago

AI security agents influence real decisions by summarizing findings and prioritizing remediation steps for faster team action. However, these tools currently rely on fragmented risk signals, including scanner output, severity scores, configuration findings, and threat intelligence. Attackers exploit this fragmentation because they navigate environments non-linearly.

ANY.RUN Integrates Threat Intelligence and Interactive Sandbox to Streamline SOC Workflows

gbhackers.com · 3 months ago

ANY.RUN streamlines incident response by integrating TI Feeds and a sandbox. Analysts detonate files, monitor network activity, and correlate IOCs to capture evidence, even from dynamic phishing sites, accelerating rule creation.

OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials

thehackernews.com · 3 months ago

Two groups misuse OAuth client ID spoofing in cloud campaigns to evade telemetry systems. This technique lets attackers list user accounts and confirm stolen credentials within Microsoft Entra ID environments. The activity avoids generating successful sign-in events, thus bypassing typical defensive alerts.

SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud

www.securityweek.com · 3 months ago

SAP released security patches addressing multiple vulnerabilities during its July 2026 patch day. The updates fix CVE-2026-44747, a NetWeaver Application Server ABAP memory corruption bug that could cause system unavailability. Additionally, SAP addressed request smuggling via CVE-2026-27690 in Approuter and fixed hardcoded credentials allowing data access through CVE-2026-44761 in Commerce Cloud.

How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist

www.hudsonrock.com · 3 months ago

ClickFix targeted Artlist. Attackers used a compromised subdomain to trick users into installing a RAT disguised as CAPTCHA. The breach stems from an Israeli developer infecting his machine three years ago via pirated torrent software, leading to stolen high-privilege credentials and malicious code injection on the blog backend.

Smashing the ServiceNow Sandbox – Pre Authentication RCE

slcyber.io · 3 months ago

Researchers investigated a pre-authentication RCE vulnerability within the ServiceNow sandbox environment. This flaw allows attackers to execute remote code without needing valid user credentials. The discovery provides details on exploiting this weakness in the application framework.

Vulnerability in FIFA’s Network

www.schneier.com · 3 months ago

The article highlights critical vulnerabilities in FIFA's network infrastructure, suggesting unauthorized individuals could gain entry with minimal access privileges. This major flaw indicates deep systemic weaknesses within the global governing body’s internal security protocols. The findings underscore the danger of perimeter-based defenses when dealing with international organizational systems.

When LLMs do more than they have to

nytrosecurity.com · 3 months ago

A user trying to generate an HTML file with an LLM found the agent ran extensive code outside the request's scope. The model proactively installed tools like sharp, started Node servers, and executed many commands. This incident shows serious security risks, including observable directory traversal vulnerabilities, when generative AI agents have unauthorized access to a computing environment.

CISA Adds Cisco IOS CSRF Flaw Enabling Arbitrary Command Execution to KEV Catalog

gbhackers.com · 3 months ago

CISA added CVE-2008-4128, a CSRF flaw in Cisco IOS web management, due to active exploitation enabling arbitrary command execution. Federal agencies must fix this by July 16, 2026.