Blahalla

Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns

thehackernews.com · 3 months ago

Researchers disclosed sustained cyber espionage activity targeting several Pakistani law enforcement organizations. Suspected China- and India-aligned groups executed these operations between February 2024 and April 2026. The group compromised assets at Balochistan Police, impacting servers hosting web applications that manage criminal and citizen data.

Ghost Accounts Abuse GitHub API in Mass Recon Campaign

www.securityweek.com · 3 months ago

Malicious groups use dormant "ghost accounts" and the public GitHub API for massive reconnaissance, mapping repos via publicly accessible and sometimes private commit paths. Datadog urges monitoring for anomalous user agents and data exfiltration to prevent breaches.

Scanning malicious websites with arbitrary number of VPN tunnels (Part 2)

discounttimu.substack.com · 3 months ago

An author developed a web scanner utilizing LLM agents and multiple VPN tunnels for simulating geo-specific security testing. The system uses isolated network namespaces to simulate access from various countries, including Taiwan and Singapore. It runs Playwright/Chromium within these namespaces to batch-scan URLs, comparing collected data using exact and fuzzy hashes.

Australia warns of global campaign targeting vulnerable CMS platforms

www.bleepingcomputer.com · 3 months ago

ACSC warns of global webshell exploitation on WordPress, Joomla, Craft CMS via CVE-2025-34085, CVE-2026-1969, & CVE-2026-3395. Attackers use AI; update plugins/themes and restrict web access now.

AWS GovCloud Credential Leak Leads CISA to Share Critical Cyber Incident Lessons

gbhackers.com · 3 months ago

CISA exposed AWS GovCloud credentials in a contractor's public GitHub repo ("Private-CISA"). Admin keys/passwords were leaked. CISA reset all affected credentials and tightened repository controls.

Hackers Infect C++ and C# Project Files to Spread Multi-Stage Windows Backdoor

gbhackers.com · 3 months ago

Researchers found a Windows Trojan compromising C++/C projects via supply chain means. It uses components like Trojan.DownLoader49 to persist by replacing DLLs (e.g., profapi.dll) and steals data like Discord tokens and passwords. The malware affects development projects.

'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets

www.bleepingcomputer.com · 3 months ago

Ghostcommit steals secrets by hiding prompt injection in PNGs. It bypasses AI reviewers ignoring images. An agent reads the image payload to exfiltrate.env content as integer constants.

Zimbra Releases Security Patch for Stored XSS Vulnerability in Classic Web Client

gbhackers.com · 3 months ago

Zimbra released the Daffodil v10.1.19 patch to address a stored Cross-Site Scripting (XSS) vulnerability in its Classic Web Client. This flaw permits an attacker to execute malicious JavaScript by delivering specially crafted emails into a logged-in user’s webmail session. Security teams must prioritize applying this update and review access logs for unusual client-side activity.

Dell BIOS Flaw Lets Attackers Extract Plaintext Passwords Without Brute Force

gbhackers.com · 3 months ago

Dell BIOS flaw (CVE-2026-40639) allows unauthenticated attackers with physical access to extract plaintext admin/user passwords from SPI flash dumps using weak encoding on the DVAR store.

Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

thehackernews.com · 3 months ago

Zimbra urges customers to apply updates following a critical vulnerability in the Classic Web Client. Researchers described the flaw as stored cross-site scripting (XSS), which permits arbitrary code execution within a user's session. Exploiting this could allow specially crafted emails to execute malicious scripts, although no CVE identifier has been assigned yet.

Meta Removes A.I. Feature on Instagram After Days of Backlash

www.nytimes.com · 3 months ago

Users and Hollywood agencies raised privacy and copyright concerns about the new tool, Muse Image.

Apple Sues OpenAI, Accusing It of Stealing Company Secrets

www.nytimes.com · 3 months ago

The two companies struck a deal in 2024 to offer A.I. services on Apple devices, but their partnership has soured.

No Manners Here: The Ruthless Rise of The Gentlemen Ransomware

unit42.paloaltonetworks.com · 3 months ago

Unit 42 explores The Gentlemen ransomware operations, revealing the affiliate model driving its rapid growth. Learn more here.

New U-Boot flaws could enable stealthy firmware attacks

www.bleepingcomputer.com · 3 months ago

Six vulnerabilities in the widely used U-Boot bootloader have been discovered that could allow attackers to execute malicious code during device boot, potentially enabling stealthy firmware attacks that compromise security protections and install persistent malware.

Exposed Server Reveals 25,000 Compromised WordPress Websites

www.techrepublic.com · 3 months ago

The exposed WP-SHELLSTORM server disclosed critical findings from a large website hacking campaign. Researchers retrieved thousands of webshells and operational logs used during the attack. Furthermore, the compromised server revealed valuable cloud credentials and various specialized tools employed by attackers.

Friday Squid Blogging: “Squidbleed” Vulnerability

www.schneier.com · 3 months ago

In a rare combined cybersecurity/squid post, a twenty-nine-year-old squid proxy bug can leak HTTP requests. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

Closing the Timing Gap: Defensive Temporal Observability

arxiv.org · 3 months ago

Lately I’ve been thinking about time. Uptime, pulse checks, execution time, response time. We’ve always treated these as health metrics. They tell us whether a system is alive, responsive, and performing as expected. But what if they’re also security metrics? That idea isn’t entirely new.

Jen Ellis: Connecting Cyber Community With Political Machinery

www.darkreading.com · 3 months ago

Security Pro File: On the heels of her recent honors as a Member of the Order of the British Empire (MBE), we take a look back at the events that shaped Jen Ellis' advocacy on behalf of security researchers.

Claude Code Espionage Campaign Exposes a New Enterprise AI Risk

www.techrepublic.com · 3 months ago

Anthropic’s AI-run espionage report shows why enterprises need stronger governance for AI agents, MCP connectors, and enterprise data access.

Ryuk ransomware member pleads guilty in the US, faces 15 years in prison

www.bleepingcomputer.com · 3 months ago

A 34-year-old Armenian man has pleaded guilty to hacking U.S. companies and deploying the infamous Ryuk ransomware to encrypt their systems.

Massive Telstra Outage Hits Mobile Networks, Rail, and Payments in Australia

www.techrepublic.com · 3 months ago

A Telstra software defect disrupted mobile services, rail communications, payments, and emergency calls across Australia, exposing infrastructure risks.

Chrome 150 Adds Android Back Button, Major Security Fixes

www.techrepublic.com · 3 months ago

Chrome 150 adds an in-menu back button to Android, reorganizes several controls, and delivers important browser security fixes.

Cybercriminals Flock to Healthcare Businesses as Attacks Surge

www.darkreading.com · 3 months ago

While cyberattacks against hospitals and clinics grew modestly in the first half of 2026, attacks on service providers and other healthcare businesses more than doubled.

Police suspects Dutch hackers were involved in Odido breach

www.bleepingcomputer.com · 3 months ago

The Dutch National Police (Politie) says it has found "strong indications" that Dutch hackers have been involved in a February breach at the telecommunications provider Odido.

URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat

thehackernews.com · 3 months ago

Progress Software has told ShareFile customers to shut down the Windows servers running their Storage Zone Controllers, confirming to The Hacker News that it is responding to a "credible external security threat.

Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

thehackernews.com · 3 months ago

Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases. The compromised version, @injectivelabs/[email protected], came embedded with fake telemetry functionality that exfiltrated data from cryptocurrency wallets.

Progress urges ShareFile customers to shut down servers over "credible" threat

www.bleepingcomputer.com · 3 months ago

Progress Software is emailing ShareFile customers who use Storage Zone Controllers to immediately shut down their servers after identifying what it describes as a "credible external security threat" targeting the on-premises secure file-sharing software.

Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative

www.microsoft.com · 3 months ago

Microsoft’s latest Secure Future Initiative report outlines progress on secure foundations, AI-powered defense, and future-ready cybersecurity.

Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot

thehackernews.com · 3 months ago

Researchers at firmware security firm Binarly have found six new flaws in U-Boot, the small program that starts up hardware as varied as home routers, smart cameras, and the management chips inside data-center servers. Four of the bugs can crash a device.

Hackers exploit critical auth bypass in Gitea Docker image

www.bleepingcomputer.com · 3 months ago

Hackers are actively exploiting a critical vulnerability in the official Docker image for the Gitea self-hosted Git service that allows attackers to impersonate any user, including administrators.

Top 10 Best Cloud Security Providers – 2026 Review

gbhackers.com · 3 months ago

As businesses continue to migrate critical applications and data to the cloud, the traditional security perimeter has dissolved. The responsibility for securing these dynamic, distributed environments now falls on a complex shared responsibility model between cloud service providers (CSPs) and the customer.

New York Bans Smart Glasses Across 1,240 Courts

www.techrepublic.com · 3 months ago

New York will ban Meta and other smart glasses from all 1,240 state courts starting July 20 over privacy and recording concerns.

Top 10 Best Social Engineering Testing Companies in 2026

gbhackers.com · 3 months ago

In the fast-evolving digital landscape of 2026, an organization’s most sophisticated technological defenses can be rendered useless by a single click from a well-intentioned but unsuspecting employee. Cybercriminals are increasingly bypassing firewalls and encryption by exploiting the most unpredictable and vulnerable component of any security system: the human element.

Money launderer accused of stealing seized crypto while in prison

www.bleepingcomputer.com · 3 months ago

A Bulgarian national has been charged with stealing $290,000 in government-seized cryptocurrency while serving 121 months in prison for helping launder millions stolen from American fraud victims.

In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops

www.securityweek.com · 3 months ago

Other noteworthy stories that might have slipped under the radar: Abnormal AI sued by Anthropic, AssuranceAmerica data breach affects 7 million people, NSA brings back TAO.

Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched

thehackernews.com · 3 months ago

Researchers at Ledger's Donjon security team have shown that a precisely timed laser pulse, aimed at the chip inside a Tangem crypto wallet card, can reset the card's password to anything the attacker picks. No old password. No backup card. Once it is reset, whoever did it controls the wallet and can move the coins out. This is not an emergency for most owners.

EU extends mass scanning of messages without a warrant

www.csoonline.com · 3 months ago

Members of the European Parliament (MEPs) have failed to block a proposal extending the mass scanning of private communications, a measure they have previously rejected twice. This time too, more votes were cast against the proposal than in favor, but due to the absence of numerous MEPs on the eve of the summer recess, the motion to reject did not attain the necessary absolute majority.

CrowdStrike identifies five new prompt injection threats to AI

www.csoonline.com · 3 months ago

Security company CrowdStrike has identified five new prompt injection techniques that could leave enterprises at risk. Prompt injections attacks exploit the growing use of AI within organizations. They work by tricking LLMs into accepting instructions that a human operator would recognize as dubious.

Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws

thehackernews.com · 3 months ago

Details have emerged about three now-patched security flaws in the OpenClaw personal artificial intelligence (AI) assistant that, if successfully exploited, could enable credential theft, privilege escalation, and arbitrary code execution on the host. A brief description of the high-severity vulnerabilities is as follows - GHSA-hjr6-g723-hmfm (CVSS score: 8.

The Replicant in Your Directory: AI Agents and the Identity Security Gap

www.bleepingcomputer.com · 3 months ago

AI agents are accelerating the growth of non-human identities, making it harder for organizations to understand what exists, who owns it, and what it can access. Netwrix explains why stronger visibility and identity governance are essential as AI expands the enterprise attack surface.

Fresh ATM Crypto Software Bugs: Jackpot or Bust?

www.darkreading.com · 3 months ago

Organizations, and possibly ATMs, are at risk of compromise, thanks to holes in a Microsoft BitLocker security wrapper.

More Countries Jump on the Social Media Ban Wagon

www.darkreading.com · 3 months ago

Age restrictions on accounts may be more of a ban(d) aid, because industry compliance is already falling short. Tech giants are struggling to follow the laws without affecting users.

281 Android VPN Apps Expose Users to Traffic Leaks, Tracking and Tunnel Hijacking

gbhackers.com · 3 months ago

A recent security analysis has revealed that a significant number of Android VPN applications, 281,281,281, expose users to serious privacy and security risks. These risks include traffic leaks, third-party tracking, weak encryption practices, and VPN tunnel hijacking.

New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic

thehackernews.com · 3 months ago

The China-linked cybercrime group known as Silver Fox has been attributed to a new Rust-based remote access trojan (RAR) called MODBEACON.

How Terrorist Groups Are Using A.I. to Gain an Edge in Battle

www.nytimes.com · 3 months ago

A.I. chatbots are not just a propaganda tool for violent extremists but are aiding in bomb construction and attack planning, new research finds.

AI Coding: Do Security Risks Outweigh Productivity Gains?

www.darkreading.com · 3 months ago

AI coding tools cost $19-$200/month/user, but security scanning, remediation, and false positives add hidden costs. Are the productivity gains worth it?

Third US Security Expert Sentenced to Prison for Helping Ransomware Gang

www.securityweek.com · 3 months ago

Angelo Martino, a former ransomware negotiator, was sentenced to 70 months for helping the BlackCat/Alphv group.

Forg365 PhaaS Uses Telegram and AI Lures to Hijack Microsoft 365 Accounts

gbhackers.com · 3 months ago

Forg365 is a commercial phishing-as-a-service (PhaaS) platform specifically targeting Microsoft 365 users. It employs methods such as device-code phishing, adversary-in-the-middle (AiTM) workflows, AI-assisted lure generation, and token persistence tools.

Hackers Exploit CitrixBleed 2 to Hijack MFA-Protected Sessions and Deploy DragonForce Ransomware

gbhackers.com · 3 months ago

Threat actors are exploiting the CitrixBleed 2 vulnerability, tracked as CVE-2025-5777, to hijack active NetScaler sessions protected by multi-factor authentication and gain a foothold in enterprise environments. The activity indicates a standardized operator playbook, potentially operated by an initial access broker or ransomware affiliate.

Linux FUSE Vulnerability Allows Unprivileged Users to Pop a Root Shell

gbhackers.com · 3 months ago

A newly disclosed Linux kernel vulnerability in the FUSE subsystem allows unprivileged local users to escalate privileges to root by corrupting the page cache and hijacking execution of a SUID binary such as /usr/bin/su on Ubuntu 26.04. Tracked as CVE-2026-31694, the flaw affects the FUSE directory-caching logic.