Blahalla

Claude and ChatGPT Exploited in Sweeping Cyber Campaign Against Government Agencies

gbhackers.com · 3 months ago

A cyber campaign targeted nine Mexican government agencies between late 2025 and mid-2026, resulting in the theft of hundreds of millions of citizen records. The attacker used Anthropic’s Claude Code and OpenAI’s GPT-4.1 to automate reconnaissance and exploit generation, allowing a single operator to achieve results typically requiring a team. Forensic analysis revealed over 400 custom attack scripts and 20 tailored exploits targeting 20 Common Vulnerabilities and Exposures, including fundamental security gaps that standard security practices could have prevented. The incident underscores the escalating threat of AI-powered cyberattacks and the importance of addressing technical debt within organizations.

Artemis II splashes down safely after historic voyage around the moon

www.washingtonpost.com · 3 months ago

false

ChatGPT rolls out new $100 Pro subscription to challenge Claude

www.bleepingcomputer.com · 3 months ago

false

Claude + Humans vs nginx: CVE-2026-27654

blog.calif.io · 3 months ago

Researchers collaborated with an AI, Claude, to discover and analyze a vulnerability, CVE-2026-27654, in Nginx. The bug is a heap buffer overflow in the ngxhttpdavmodule, triggered by a specific configuration and an unsigned underflow. Initially, Claude produced an exploit involving arbitrary file writes, but human expertise refined it to a simpler, more practical exploit involving copying an existing file. The rapid reproduction of the exploit highlights how AI is shrinking the window between patch release and exploit availability.

Molotov Cocktail Is Hurled at Home of Sam Altman, OpenAI’s CEO

www.nytimes.com · 3 months ago

NULL

Google adds end-to-end Gmail encryption to Android, iOS devices for enterprises

www.csoonline.com · 3 months ago

false

Friday Squid Blogging: Squid Overfishing in the South Pacific

www.schneier.com · 3 months ago

false

Hims Breach Exposes the Most Sensitive Kinds of PHI

www.darkreading.com · 3 months ago

There was a breach of the telehealth company Hims where threat actors accessed a third party customer support platform and took customer support tickets, with unauthorized access occurring from February 4 to February 7 and the company first becoming aware on February 5. The compromised records included names, email addresses and potentially ultra sensitive personal health information related to erectile dysfunction, balding, obesity and mental health, which could enable targeted blackmail or other reputational and privacy harms, and a group calling itself ShinyHunters claimed responsibility though that claim was not verified. Hims is offering impacted customers a year of free credit monitoring and identity guidance, and security experts warn that fragmented customer service systems concentrate sensitive data and should be redesigned so data moves securely, remains within trusted environments and is retained only as long as necessary.

Your Next Breach Will Look Like Business as Usual

www.darkreading.com · 3 months ago

Business as usual logins are now a leading attack vector, with nearly one in three intrusions involving valid employee credentials as credential theft surges and AI makes large scale credential attacks faster and cheaper. Security teams should shift detection models by integrating Dark Web credential monitoring into automated response workflows, adopting phish resistant multifactor authentication such as FIDO2 hardware keys, and treating authentication as a continuous process that reevaluates trust based on behavioral signals. Organizations should also harden help desk verification against AI social engineering, audit identity sprawl and service accounts for static credentials, and treat any compromised credential as a high priority incident that triggers immediate rotation and retrospective access reviews.

Volkswagen to End E.V. Production at Tennessee Plant

www.nytimes.com · 3 months ago

false

Old Docker authorization bypass pops up despite previous patch

www.csoonline.com · 3 months ago

A newly discovered vulnerability, CVE-2026-34040, allows attackers to bypass authorization plug-ins in Docker Engine and potentially gain root-level access to host systems. This flaw stems from a long-standing issue dating back to 2016, where requests exceeding 1MB are silently dropped by Docker's middleware, preventing authorization checks. The vulnerability shares a root cause with a previous flaw patched in 2024, CVE-2024-41110, and has been resolved in Docker Engine 29.3.1 and Docker Desktop 4.66.1. As a temporary mitigation, organizations can limit request sizes to 512KB. Administrators should review logs and prioritize patching systems with production credentials.

Nmap triage without a backend: XSLT -> HTML report that highlights unusual hosts/services

xn--mbius-jua.band · 3 months ago

Content states it was a joke. It instructs making an HTTP POST to a cake endpoint and supplying a recipe.

Claude Code Audit: Confirmed RCE via Environment Variable Injection

audited.xyz · 3 months ago

On March 31, 2026, Anthropic leaked the Claude Code source and an audit found one confirmed low severity vulnerability that enabled remote worker remote code execution. Claude Code's structured input output layer accepted update environment variables transport messages and applied incoming key value pairs directly to the process environment with no allowlist, allowing injection of NODEOPTIONS to execute arbitrary code when child Node processes spawned. The same mechanism can redirect OAuth and API endpoints to attacker servers, force HTTPS traffic through a malicious proxy, or disable TLS verification, and the attack surface is limited to remote worker deployments while the local CLI uses a trusted parent. A one line fix was recommended to restrict environment mutations to CLAUDECODE prefixed keys, and the issue was disclosed to Anthropic on April 2, 2026 with confirmation on April 7, 2026.

Microsoft: Third-Party Android Vulnerability Leaves Over 50M Users Exposed

www.techrepublic.com · 3 months ago

A critical vulnerability was discovered in the EngageLab SDK, a popular tool used by Android apps for push notifications. This vulnerability, an "intent redirection vulnerability," allowed malicious apps to send crafted messages that the SDK would trust and execute, potentially exposing sensitive data and internal app functions. The flaw affected over 50 million users, with over 30 million installations of crypto wallet apps impacted. EngageLab released a patch in November 2025, and Android removed affected apps from the Google Play Store.

Have You Used A.I. Chatbots for Nutrition Advice?

www.nytimes.com · 3 months ago

false

Nearly 4,000 US industrial devices exposed to Iranian cyberattacks

www.bleepingcomputer.com · 3 months ago

Iranian-linked hacking groups are targeting U.S. industrial devices, specifically Rockwell Automation programmable logic controllers, resulting in data manipulation and operational disruptions. More than three thousand eight hundred of these devices are currently exposed online in the United States. Security experts advise disconnecting devices from the internet, implementing multifactor authentication, and regularly updating systems to mitigate risk. These attacks follow similar incidents, including those targeting Unitronics and Stryker, demonstrating an escalation of Iranian cyber activity.

FINRA Launches Financial Intelligence Fusion Center to Combat Cybersecurity and Fraud Threats

www.darkreading.com · 3 months ago

FINRA has launched the Financial Intelligence Fusion Center, a secure portal that enables FINRA and member firms to share timely intelligence on cybersecurity and fraud threats and to coordinate responses. The center will collect, analyze, and disseminate threat intelligence, leverage existing FINRA partnerships with government and private sector entities, and builds on a pilot program run last year that informed its functionality. FINRA is encouraging member firms to opt into the portal to access centralized intelligence sharing intended to bolster defenses, protect investors, and safeguard market integrity.

AI and cryptocurrency scams are costing Americans billions, FBI reports

www.fortra.com · 3 months ago

The FBI’s Internet Crime Complaint Center reports cybercrime complaints exceeded one million in 2025, resulting in over 21 billion US dollars in losses. Artificial intelligence and cryptocurrency are driving this surge, with AI-enabled cybercrime costing victims over 893 million US dollars. Cryptocurrency scams, particularly those using “romance baiting,” caused over 11.3 billion US dollars in losses, and AI is lowering the skill level required for Business Email Compromise schemes. The FBI’s Operation Level Up initiative is working to notify victims and mitigate further losses.

Orange Business Reimagines Enterprise Voice Communications With Trust and AI

www.darkreading.com · 3 months ago

false

In Other News: Cyberattack Stings Stryker, Windows Zero-Day, China Supercomputer Hack

www.securityweek.com · 3 months ago

Federal officials met to discuss the potential cyber risks posed by Anthropic’s new AI model, Mythos. A new macOS malware, NotnullOSX, is targeting cryptocurrency wallets, spreading through fake documents. Ten major Japanese corporations are forming a joint organization to share cyber threat intelligence and develop security talent, following a breach at Asahi. A researcher released a Windows zero-day exploit, BlueHammer, due to a dispute with Microsoft, and Microsoft has not yet assigned a CVE.

Hacker Unknown now known, named on Europol’s most-wanted list

www.csoonline.com · 3 months ago

German police have identified Danii Shchukin, previously known as UNKN or Unknown, as the leader of the GandCrab/Revi ransomware group. Shchukin and his accomplice, Anatoly Kravchuk, are now on Europol’s most wanted list and are accused of widespread extortion across Germany, resulting in approximately $2.2 million in ransom payments and $40 million in economic damage. Shchukin reportedly refused to work with English-speaking hackers and prohibited attacks against Russia and related nations. Authorities believe both suspects are currently in Russia.

Storm-2755 Uses AiTM Hijacking to Divert Employee Salaries

gbhackers.com · 3 months ago

Hackers are targeting Canadian employees through a new campaign called Storm-2755, diverting their salaries to attacker-controlled accounts. The group uses adversary-in-the-middle (AiTM) session hijacking to bypass multifactor authentication and modify payroll records, often employing malvertising and SEO poisoning to lure victims to a fake Microsoft 365 sign-in page. Attackers then replay stolen tokens to access services and change direct deposit information, sometimes altering passwords and MFA settings for persistence. Microsoft recommends token revocation, MFA resets, and adaptive session lifetimes to mitigate the threat.

Analysis of one billion CISA KEV remediation records exposes limits of human-scale security

www.bleepingcomputer.com · 3 months ago

A new analysis of over one billion CISA vulnerability remediation records reveals that current security practices are failing to keep pace with rapidly evolving threats. Despite increased effort, critical vulnerabilities remain open for longer periods, with remediation often slower than exploitation, as seen with Spring4Shell and Cisco IOS XE vulnerabilities. The data indicates a shift is needed from traditional reactive approaches to autonomous, closed-loop risk operations to address the widening gap between attacker and defender capabilities. Focusing on cumulative exposure, measured by Risk Mass and Average Window of Exposure (AWE), is more valuable than simply tracking CVE counts.

AI Expansion, Security Crises, and Workforce Upheaval Define This Week in Tech

www.techrepublic.com · 3 months ago

Several significant developments occurred this week in the tech industry. Google introduced Gemini Notebooks, while Meta unveiled Muse Spark, a new multimodal AI system. Several critical vulnerabilities were reported, including a zero-day in Adobe Acrobat Reader and a Windows exploit known as BlueHammer. Fortinet addressed a zero-day vulnerability, CVE-2026-35616, and Google Chrome patched CVE-2026-5281. Additionally, a widespread scam targeting Apple Pay users is currently underway.

EngageSDK Vulnerability puts millions of crypto wallets at risk

gbhackers.com · 3 months ago

A critical vulnerability has been identified in the EngageSDK, an Android library used by many applications, particularly cryptocurrency wallets. This “intent redirection” flaw allows malicious apps to bypass security protections and access sensitive data, potentially impacting over 30 million wallet installations and 50 million app installs. The vulnerability, discovered by Microsoft and fixed in version 5.2.1, involved a process where crafted intents were unknowingly redirected with excessive permissions. Google has removed affected apps and implemented additional protections, but users should update their apps to mitigate risk.

Juniper Networks Patches Dozens of Junos OS Vulnerabilities

www.securityweek.com · 3 months ago

Juniper Networks has released patches to address nearly three dozen vulnerabilities across its Junos OS and Junos OS Evolved platforms. The most critical issue, CVE-2026-33784, involves a default password in the Support Insights Virtual Lightweight Collector that could allow remote takeover. Another vulnerability, CVE-2026-33771, stems from a failure to enforce password complexity in CTP OS, potentially enabling attackers to use weak passwords. Several other flaws, including one in Juniper Networks Apstra allowing for machine-in-the-middle attacks, are also resolved in this update.

Industrial Controllers Still Vulnerable As Conflicts Move to Cyber

www.darkreading.com · 3 months ago

There are warnings from the US government dated April 7, 2026 that Iran-linked cyberattackers are targeting programmable logic controllers used in water, wastewater, and energy facilities. Researchers found at least 179 Modbus devices exposing the protocol on default port 502 with no authentication, including devices tied to a national railway and two national power grids. These Internet-exposed controllers allow anyone to read and potentially write to industrial devices, creating risks of serious physical consequences and indicating attackers are increasingly directly targeting operational technology in addition to pivoting from IT. Organizations are urged to scan internal and external assets, improve segmentation and credential security, and deploy ICS-aware monitoring because fewer than ten percent of OT networks have adequate visibility.

GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs

thehackernews.com · 3 months ago

Cybersecurity researchers have discovered a new tactic in the ongoing GlassWorm campaign, involving a compromised extension disguised as a developer tool. The malicious extension, originally "specstudio.code-wakatime-activity-tracker," uses a Zig-compiled native binary to stealthily infect multiple IDEs, including Visual Studio Code and its forks. It then downloads and installs a second-stage VS Code extension, "floktokbok.autoimport," which steals data and deploys a remote access trojan. Users who installed either extension should rotate their secrets, assuming a system compromise.

Hungarian government email passwords exposed ahead of election

www.csoonline.com · 3 months ago

Passwords for almost 800 Hungarian government email accounts, including some tied to national security, are circulating online ahead of the parliamentary election. The leaks affected 12 of 13 government departments and were caused mainly by poor email hygiene and weak passwords such as variations of the word password, simple number sequences like 1234567, and use of surnames. The disclosure exposes officials including an information security officer and a counter terrorism expert and highlights the need for password managers, passkeys, and stronger credential policies across government.

CPUID hacked to deliver malware via CPU-Z, HWMonitor downloads

www.bleepingcomputer.com · 3 months ago

Hackers gained access to an API for the CPUID project and changed the download links on the official website to serve malicious executables for the popular CPU-Z and HWMonitor tools.

Hackers Exploit GitHub Copilot Flaw to Exfiltrate Sensitive Data

gbhackers.com · 3 months ago

A high severity flaw in GitHub Copilot Chat allowed attackers to silently exfiltrate sensitive data such as API keys and private source code by embedding hidden prompts in pull requests and issues. Attackers used a prompt injection technique that leveraged GitHub’s Camo image proxy to encode secrets as sequences of tiny image requests, bypassing Content Security Policy and reconstructing data character by character. The researcher reported the proof of concept and GitHub disabled image rendering in Copilot Chat and rolled out mitigations in mid August 2025 to stop the Camo based exfiltration.

Can Anthropic Keep Its Exploit-Writing AI Out of the Wrong Hands?

www.darkreading.com · 3 months ago

Anthropic's Mythos Preview model can identify and exploit zero day vulnerabilities across major operating systems and web browsers, producing complex exploits such as a chained web browser exploit with a JIT heap spray, local privilege escalation via subtle race conditions and KASLR bypasses, and a remote code execution against FreeBSD's NFS server that split a 20 gadget ROP chain over multiple packets. The capability emerged as a downstream consequence of improving the model's code and reasoning for vulnerability detection, and the company says it has responsibly disclosed thousands of high and critical vulnerabilities, including a patched 27 year old OpenBSD flaw. The company launched Project Glasswing with partners including Apple, AWS, Microsoft, Palo Alto Networks, and CrowdStrike, granted Mythos Preview access to more than 40 organizations, and committed one hundred million dollars in usage credits plus four million dollars in donations to open source security groups. Security experts caution that controls cannot guarantee exclusivity, call for independent verification, and advise defenders to assume proliferation and invest in detection, zero trust, aggressive patching, and anomaly based monitoring.

Industry Reactions to Iran Hacking ICS in Critical Infrastructure: Feedback Friday

www.securityweek.com · 3 months ago

The US government warned that Iran linked hackers have targeted critical infrastructure by manipulating programmable logic controllers and supervisory control and data acquisition systems, causing operational disruption and financial loss. Attackers reportedly connected to internet exposed PLCs and abused legitimate engineering software such as Studio 5000 Logix Designer to extract controller logic and manipulate HMI and SCADA displays, with targets including government services, water, and energy. Indicators include traffic on ports 44818, 102, and 502 and vendor advisories from Rockwell and Siemens, and recommended mitigations include removing PLCs from public internet exposure, enforcing OT segmentation and access controls, rotating default credentials, securing engineering workstations, implementing multifactor authentication and zero trust access, and applying continuous monitoring and incident response playbooks.

Microsoft: Canadian employees targeted in payroll pirate attacks

www.bleepingcomputer.com · 3 months ago

There are payroll pirate attacks by a financially motivated threat actor tracked as Storm-2755 that hijack Canadian employees' Microsoft 365 accounts using malicious sign-in pages pushed by malvertising or SEO poisoning to capture authentication tokens and session cookies. By replaying these stolen session tokens in adversary in the middle attacks, attackers bypass multifactor authentication and gain access to Microsoft services without reauthenticating. After compromise, attackers create inbox rules to hide HR messages and either social‑engineer HR staff to change direct deposit details or log into HR platforms such as Workday to update payroll information and steal salary payments. Recommended defenses include blocking legacy authentication, implementing phishing resistant multifactor authentication, revoking compromised tokens and sessions, removing malicious inbox rules, and resetting credentials and MFA methods for affected accounts.

Orthanc DICOM Vulnerabilities Lead to Crashes, RCE

www.securityweek.com · 3 months ago

Nine vulnerabilities in the open source DICOM server Orthanc allow attackers to crash servers, cause information disclosure, and achieve remote code execution. The flaws, tracked as CVE-2026-5437 to CVE-2026-5445, include out-of-bounds reads, heap buffer overflows, a GZIP decompression bomb, ZIP metadata that can trigger memory exhaustion, and improper validation in Philips Compression, Palette Color, and PAM image decoding. Orthanc versions 1.12.10 and earlier are affected, and users are advised to update to version 1.12.11; the defects were reported by researchers at Machine Spirits and documented by CERT Coordination Center.

Claude uncovers a 13‑year‑old ActiveMQ RCE bug within minutes

www.csoonline.com · 3 months ago

Anthropic's Claude helped uncover a critical remote code execution vulnerability in Apache ActiveMQ Classic that had existed for about 13 years. The flaw abused the broker management plane by using the Jolokia management API endpoint and methods like addNetworkConnector to supply a crafted brokerConfig URL that forces ActiveMQ to fetch a remote Spring XML which can create and execute arbitrary Java code. The issue is tracked as CVE-2026-34197 with a CVSS of 8.8, affects ActiveMQ Classic versions prior to 5.19.4 and several 6.x releases and is fixed in versions 5.19.4 and 6.2.3, and while it requires authentication default credentials remain common and in some 6.x versions CVE-2024-32114 can expose the Jolokia API without authentication making exploitation effectively unauthenticated. ActiveMQ has a history of high impact management plane flaws including CVE-2016-3088 and CVE-2022-41678, and researchers at Horizon3.ai said Claude reduced exploit development from about a week to minutes.

Fake BTS Tour Ticket Scams Target Fans Worldwide

gbhackers.com · 3 months ago

Cybercriminals are exploiting hype around BTS returning to the global stage and the ARIRANG world tour by launching fake ticketing websites targeting fans in Argentina, Brazil, Chile, Colombia, France, Mexico, Peru, Portugal, and Spain. Researchers identified at least ten fraudulent domains that closely mimic official ticket portals, distribute links via social media, and use tactics like fake payment errors to push victims toward irreversible instant payments such as PIX in Brazil, with funds channeled to mule accounts. Fans are advised to use only official ticket sources, check domain names and site pages, understand local ticketing rules, avoid social media links, enable transaction alerts, and contact banks immediately if scammed.

Browser Extensions Are the New AI Consumption Channel That No One Is Talking About

thehackernews.com · 3 months ago

AI browser extensions create a broad, largely unmonitored attack surface by living inside browsers and accessing page content, user inputs, session data, and cookies while bypassing data loss prevention and SaaS logs. A LayerX report shows these extensions are widespread in enterprises, with 99 percent of users running at least one extension and about one in six using an AI extension, and finds AI extensions are 60 percent more likely to have a CVE than average and significantly more likely to access cookies, execute remote scripts, and manipulate tabs. Extensions can install in seconds, persist indefinitely, and are nearly six times more likely to change permissions over time, making static allowlists ineffective. Security recommendations include continuous organization wide extension inventories, targeted controls and behavior monitoring for AI extensions, and minimum trust and transparency criteria for installs.

Taiwanese Prosecutors Seize $6.6M in Assets from Incognito Market Admin "Pharoah" (Lin Rui-siang)

tordaily.com · 3 months ago

Researchers have identified three distinct methods attackers can exploit to bypass security measures in popular video conferencing platforms. These techniques involve manipulating meeting URLs, leveraging shared screen functionalities, and exploiting vulnerabilities in integrated chat applications. Attackers could potentially gain unauthorized access to meetings, share malicious content, or eavesdrop on conversations using these methods. The vulnerabilities addressed include CVE-2024-3094, CVE-2024-3096, and CVE-2024-3097.

Chrome 147 Patches 60 Vulnerabilities, Including Two Critical Flaws Worth $86,000

www.securityweek.com · 3 months ago

Google released Chrome 147 with fixes for 60 vulnerabilities, including two critical flaws in the WebML component: a heap buffer overflow CVE-2026-5858 and an integer overflow CVE-2026-5859, with the reporting researchers paid 43,000 dollars each. The update also patches 14 high severity issues and numerous medium and low severity defects across WebRTC, V8, WebAudio, Media, WebML, ANGLE, Skia and Blink, and Google paid additional bounties for CVE-2026-5860, CVE-2026-5861 and CVE-2026-5874. There is no mention of active exploitation of these vulnerabilities.

Google rolls out Gmail end-to-end encryption on mobile devices

www.bleepingcomputer.com · 3 months ago

false

Sen. Sanders Talks to Claude About AI and Privacy

www.schneier.com · 3 months ago

false

Static analysis of iOS App Store binaries: common vulnerabilities I keep finding after 15 years in mobile security

www.meetup.com · 3 months ago

Security assessors performing iOS application reviews report a pattern of recurring vulnerabilities in production App Store binaries. The most frequent findings are hardcoded secrets such as API keys and authentication tokens in plaintext, insecure local storage of sensitive data in user defaults and unprotected databases, and weak or misconfigured cryptography including reused or predictable initialization vectors and insecure modes. Network layer weaknesses are also common, including disabled App Transport Security exceptions, certificate pinning that can be trivially bypassed, and mixed use of HTTP and HTTPS, and many of these issues are discoverable through static analysis by unpacking the IPA, extracting strings, and inspecting the Mach O binary and plist configurations. Assessors have automated initial triage across about forty seven check categories and run a monthly live session called iOS App Autopsy to demonstrate the workflow on real applications.

Iranian APT alert: 5,219 Rockwell PLCs exposed online

gbhackers.com · 3 months ago

There are 5,219 internet exposed Rockwell Automation Allen Bradley programmable logic controllers, with roughly 74.6 percent located in the United States and many connected via consumer and cellular networks. Iranian affiliated APT actors linked to the IRGC Cyber Electronic Command and a group tracked as CyberAv3ngers are actively targeting these devices across U.S. critical infrastructure, with activity observed since at least March 2026 and a joint advisory AA26-097A issued on April 7, 2026. Operators are using legitimate Rockwell tooling such as Studio 5000 Logix Designer to connect to exposed PLCs, modify project files, and manipulate HMI and SCADA displays without exploiting zero day vulnerabilities. Confirmed targets include MicroLogix 1400 CompactLogix and Micro850 families, and many exposed hosts also run VNC Telnet Modbus and Red Lion Crimson services, so agencies recommend disconnecting PLCs from direct internet access routing remote access through secured monitored gateways enforcing strong authentication and maintaining offline tested backups.

Why most zero-trust architectures fail at the traffic layer

www.csoonline.com · 3 months ago

There are growing enforcement gaps at the traffic layer despite widespread adoption of zero trust, with strong identity systems and access policies failing to stop malicious or unintended traffic during incidents. Failures commonly stem from inconsistent ownership of ingress components, fragmented exposure through CDNs, load balancers, legacy endpoints and APIs, permissive edge TLS configurations, incomplete mutual TLS or re-termination of connections, and poor east to west visibility. Organizations that succeed treat the traffic layer as the primary enforcement point by standardizing ingress paths, enforcing strict TLS baselines, normalizing and validating requests before application logic, requiring continuous mutual TLS validation, and maintaining consistent telemetry to trace requests end to end.

MITRE Releases Fight Fraud Framework

www.securityweek.com · 3 months ago

MITRE released the Fight Fraud Framework, a behavior based knowledge base that models the tactics, techniques and procedures fraudsters use, informed by real world attacks. The framework adds two fraud specific tactics, positioning which covers post compromise actions to collect and manipulate data and prepare follow up execution, and monetization which covers converting compromised assets into usable value, and it revises definitions of tactics such as reconnaissance, resource development, initial access, defense evasion and execution. The resource is open and free, includes a website and a visual representation, documents design principles and methodology, and provides a GitHub repository for additional resources and collaboration.

Critical Marimo Flaw Exploited Hours After Public Disclosure

www.securityweek.com · 3 months ago

A critical unauthenticated remote code execution vulnerability in Marimo, tracked as CVE-2026-39987 with a CVSS score of 9.3, allowed attackers to obtain a full interactive shell via the terminal WebSocket endpoint because authentication validation was skipped. An attacker built a working exploit from the public advisory and began exploiting the flaw roughly nine hours and forty-one minutes after disclosure to connect to the unauthenticated endpoint, perform quick reconnaissance, and steal credential-containing files. Sysdig observed exploitation activity from a single IP with an additional 125 addresses conducting reconnaissance, and the attack captured by a honeypot lasted about three minutes during which the actor attempted to read every file in the targeted directory and search for SSH keys. All Marimo releases up to version 0.20.4 are affected and users are advised to update to version 0.23.0 or newer where the bug is fixed.

Middle East Espionage Attack Uses Fake Secure Messaging Apps to Deliver ProSpy

gbhackers.com · 3 months ago

Hackers impersonate popular secure messaging apps to deliver an Android spyware family called ProSpy against journalists, activists, and political figures across the Middle East in a hack for hire campaign linked to the BITTER APT group. The campaign has been active since at least 2022 and primarily targets civil society and potential government figures in countries including Egypt, Lebanon, Bahrain, the United Arab Emirates, Saudi Arabia, and the wider MENA region. Operators use social engineering on platforms such as LinkedIn, messaging apps, or email to lure victims to fake download pages that deliver malicious APKs outside official stores under names like ToTok Pro, Botim Pro, or Signal Encryption Plugin. Once installed, ProSpy gains broad permissions, uses a modular worker design to collect and exfiltrate contacts, SMS, call data, device information, documents, images, audio, video, archives and chat backups, and communicates with command and control servers to upload stolen content.

HPE Aruba Private 5G Vulnerability Opens Door to Credential Theft Attacks

gbhackers.com · 3 months ago

A newly disclosed security flaw in HPE Aruba Networking Private 5G Core On-Prem allows threat actors to silently harvest administrative login credentials through the platform graphical user interface. The defect is documented in security bulletin HPESBNW05032ENUS and tracked as CVE-2026-23818. Enterprises running the on-premises Private 5G Core face severe risk of credential theft and are advised to apply vendor mitigations and updates from the security bulletin promptly.

The cyber winners and losers in Trump’s 2027 budget

www.csoonline.com · 3 months ago

Federal civilian cybersecurity spending is proposed to decline from 12.455 billion dollars in 2026 to 12.228 billion dollars in 2027, a drop of about 227 million dollars, with uneven gains and losses across agencies. The biggest winners are the Department of Justice, which would gain 312 million dollars to reach 1.27 billion dollars, and the State Department, which would gain 174 million dollars to reach 809 million dollars. Largest cuts hit the Department of Homeland Security, down 222 million dollars to 3.05 billion dollars largely driven by a proposed 707 million dollar reduction at CISA, while the Department of Veterans Affairs, the National Science Foundation, the Department of Health and Human Services, and the Department of the Treasury face sizeable reductions and the Securities and Exchange Commission and the Federal Communications Commission are shown with zero cyber funding in the proposal. The CISA reductions would eliminate roughly 867 positions representing about 766 full time equivalents and slash stakeholder engagement staff and budget, and observers warn the cuts will weaken federal support for private sector cyber defense and urge organizations to audit CISA dependencies, expand private threat intelligence relationships, and revisit compliance assumptions.