Blahalla

GitLab Addresses Multiple Vulnerabilities Linked to DoS and Code Injection

gbhackers.com · 3 months ago

GitLab has released security updates to address twelve vulnerabilities affecting Community and Enterprise Editions. These flaws include a high-severity exposed method vulnerability, tracked as CVE-2026-5173, which could allow unintended server-side execution. Additionally, vulnerabilities were found that could enable denial-of-service attacks through the Terraform state lock API, CVE-2026-1092, and repeated queries to the GraphQL API, CVE-2025-12664. Other fixed issues involve code injection potentially exposing user IP addresses, CVE-2026-1516, and cross-site scripting vulnerabilities. Customers using GitLab Dedicated or GitLab.com are already protected, while self-managed instances require immediate updates.

Meta Business Alerts Abused for Phishing Campaigns

gbhackers.com · 3 months ago

Hackers are exploiting Meta Business Manager notifications to conduct phishing campaigns, bypassing traditional security measures. Attackers create or compromise Facebook Business accounts and send partner requests with alarming language like "Account Restriction" to lure victims. These emails appear legitimate because they originate from real Meta domains, but redirect users to fake Facebook help pages designed to steal login credentials, business details, and even two-factor authentication codes. Security experts advise against resolving issues via email links and recommend verifying requests directly within the Facebook or Meta Business Manager platforms.

Microsoft Confirms Windows 11 Update Breaks Start Menu Search

gbhackers.com · 3 months ago

Microsoft recently resolved a server-side issue that disabled Start Menu search functionality for some Windows 11 23H2 users. The problem began around April 6, 2026, and was traced to a Bing update intended to improve search speeds, but instead broke the connection. Microsoft implemented a server-side rollback to fix the issue, which does not require user action. Users still experiencing problems are advised to check system services and re-register the Windows Search app package.

So geht Post-Incident Review

www.csoonline.com · 3 months ago

false

Shaky Ceasefire Unlikely to Stop Cyberattacks From Iran-Linked Hackers for Long

www.securityweek.com · 3 months ago

Hackers linked to Iran say a recent ceasefire between Iran, the United States, and Israel will not end cyberattacks, particularly targeting Israel, with potential future attacks against the U.S. The group Handala, which has previously disrupted operations at Stryker and accessed FBI Director Kash Patel’s email, vows to continue their cyber warfare efforts. U.S. authorities have warned of Iranian hackers infiltrating programmable logic controllers used in critical infrastructure sectors like ports and power plants. Cybersecurity experts predict an increase in cyberattacks against American organizations following the ceasefire, potentially targeting data centers, tech companies, and defense contractors.

Questions raised about how LinkedIn uses the petabytes of data it collects

www.csoonline.com · 3 months ago

A European company alleges LinkedIn is secretly collecting data from users' computers, including information about installed software, to identify religious and political beliefs, and sharing this data with third parties. LinkedIn acknowledges scanning for browser extensions but denies broader misuse of the data, stating it's for abuse detection and site stability. Concerns are raised about potential violations of European privacy rules and the potential for LinkedIn to map a company's technology stack. Experts advise CIOs to review data strategies and privacy policies, treating LinkedIn with more caution.

Russia's Forest Blizzard Nabs Rafts of Logins via SOHO Routers

www.darkreading.com · 3 months ago

A Russian cyber espionage group, APT28 (aka Fancy Bear or Forest Blizzard), has been intercepting internet traffic from targets worldwide since at least May 2024. The group exploited vulnerabilities in SOHO routers from vendors like MikroTik and TP-Link to redirect traffic through malicious servers, stealing credentials for email and web services. The U.S. Justice Department launched "Operation Masquerade" to disrupt the campaign, which has impacted organizations in North Africa, Central America, Southeast Asia, Europe, and 23 US states. Researchers noted the attackers used CVE-2023-50224, an information disclosure vulnerability in TP-Link routers, to remotely administer devices and modify DNS settings.

Federal Court Denies Anthropic’s Motion to Lift ‘Supply Chain Risk’ Label

www.nytimes.com · 3 months ago

false

Smashing Security podcast #462: LinkedIn is spying on you, and you agreed to nothing

grahamcluley.com · 3 months ago

LinkedIn is reportedly secretly scanning user browser extensions, collecting data about installed programs and user behavior. California cryptocurrency holders have been targeted in violent attacks, demonstrating that encryption alone cannot guarantee security. Russian hackers compromised thousands of home routers to steal passwords. A humorous incident involved Russians communicating through a cat feeder.

Hackers use pixel-large SVG trick to hide credit card stealer

www.bleepingcomputer.com · 3 months ago

Hackers are targeting online stores using the Magento e-commerce platform in a widespread campaign. The attackers hide credit card-stealing code within a tiny, pixel-sized Scalable Vector Graphics image to bypass security scanners. When customers proceed to checkout, a fake overlay captures their payment information, which is then sent to the attacker. The campaign exploits the PolyShell vulnerability, which allows unauthenticated code execution, and Adobe has not yet released a security update to address it.

Cracks in the Bedrock: Agent God Mode

unit42.paloaltonetworks.com · 3 months ago

Researchers have discovered a vulnerability within the Amazon Bedrock AgentCore starter toolkit, dubbed “Agent God Mode,” that grants excessive permissions to AI agents. The toolkit's default configuration automatically generates overly broad Identity and Access Management roles, allowing a compromised agent to exfiltrate code, access other agents' memories, invoke interpreters, and extract sensitive data. This widespread access bypasses intended security boundaries and creates a significant risk of privilege escalation and data compromise. AWS has updated its documentation to warn users and recommend creating custom, least-privilege IAM roles for production deployments.

Google: New UNC6783 hackers steal corporate Zendesk support tickets

www.bleepingcomputer.com · 3 months ago

A threat actor, known as UNC6783, is targeting business process outsourcing providers to gain access to sensitive data from multiple companies. The group uses social engineering, phishing campaigns, and fake security updates to compromise these providers, sometimes directly contacting employees for access. They impersonate legitimate login pages, including those associated with Zendesk, and have been linked to a persona called Mr. Raccoon, who claimed responsibility for a breach at Adobe. Google recommends using FIDO2 security keys, monitoring live chat, and regularly auditing MFA device enrollments to defend against these attacks.

Threat Actors Get Crafty With Emojis to Escape Detection

www.darkreading.com · 3 months ago

Threat actors are increasingly using emojis to communicate, obscure activities, and bypass security measures. These symbols are used to signal commands, exfiltrate data, and conceal malicious code, as seen in campaigns like UTA0137's use of "Disgomoji" malware. Emojis also help bypass keyword filters and facilitate communication in multilingual environments related to financial fraud and access to compromised systems. Analyzing emoji usage can help security teams identify and track threat actors by recognizing recurring patterns and associations.

dnsight - open source, config driven CLI DNS auditor

pypi.org · 3 months ago

false

AI-Led Remediation Crisis Prompts HackerOne to Pause Bug Bounties

www.darkreading.com · 3 months ago

HackerOne has paused new submissions to its Internet Bug Bounty program due to an imbalance between the increasing rate of AI-assisted vulnerability discoveries and the ability of open source maintainers to remediate them. The rise of AI is generating a large volume of low-quality findings, overwhelming maintainers and causing "triage fatigue." The industry now needs to focus on funding remediation efforts and incentives to align with the realities of AI-driven vulnerability discovery, shifting from rewarding simply finding vulnerabilities to rewarding those who provide fixes. This shift highlights a need for greater investment in remediation capacity.

New macOS stealer campaign uses Script Editor in ClickFix attack

www.bleepingcomputer.com · 3 months ago

Researchers have discovered three methods attackers can exploit to bypass Apple's Lockdown Mode, a security feature designed to limit device functionality. These methods involve exploiting flaws in the Universal Control, Screen Sharing, and AirDrop functionalities. Successful exploitation could allow unauthorized access and control of a device. The vulnerabilities are being tracked as CVE-2023-42052, CVE-2023-42053, and CVE-2023-42054.

CISA orders feds to patch exploited Ivanti EPMM flaw by Sunday

www.bleepingcomputer.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency has directed U.S. government agencies to patch a critical vulnerability in Ivanti Endpoint Manager Mobile by Saturday. This flaw, tracked as CVE-2026-1340, allows attackers to execute code remotely without privileges. Ivanti reported the vulnerability was actively exploited beginning in January and noted a limited number of customers have already been compromised. Shadowserver is monitoring nearly 950 exposed Ivanti EPMM appliances, and CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, alongside 32 other exploited Ivanti vulnerabilities and 12 tied to ransomware operations.

Arelion employs NETSCOUT Arbor DDoS protection products

www.csoonline.com · 3 months ago

false

CVE-2026-0233 Autonomous Digital Experience Manager: Improper validation of ADEM certificate (Severity: MEDIUM)

security.paloaltonetworks.com · 3 months ago

A certificate validation vulnerability exists in Palo Alto Networks Autonomous Digital Experience Manager for Windows. The vulnerability, identified as CVE-2026-0233, allows an unauthenticated attacker with adjacent network access to potentially execute code with elevated privileges. Versions 5.11.0 through 5.11.4 are affected, and users are advised to upgrade to version 5.11.4 or later. Palo Alto Networks is not currently aware of any malicious exploitation of this issue.

New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy

thehackernews.com · 3 months ago

A new variant of the Chaos malware is now targeting misconfigured cloud deployments, expanding beyond routers and edge devices. The malware, believed to be an evolution of Kaiji, has added a SOCKS proxy feature to conceal malicious activity and potentially monetize the botnet through additional services. Cybersecurity researchers observed the malware exploiting a deliberately misconfigured Hadoop instance, retrieving and executing a malicious binary from a server previously linked to a phishing campaign. This shift indicates cybercriminals are continually evolving their botnets to offer diverse illicit services.

Why Operationalizing AI Security Is the Next Great Enterprise Hurdle

www.techrepublic.com · 3 months ago

false

How botnet-driven DDoS attacks evolved in 2H 2025

www.csoonline.com · 3 months ago

Distributed denial-of-service attacks significantly evolved in the second half of 2025, with attack capacity reaching up to 30 terabits per second, largely driven by Internet of Things botnets like TurboMirai and Aisuru. Artificial intelligence, particularly through conversational interfaces and dark-web large language models, has lowered the barrier for even unskilled attackers to launch sophisticated campaigns. Key sectors targeted included government, finance, and telecommunications, with EMEA experiencing the highest volume of attacks at 3.3 million. The report highlights the increasing use of multivector attacks and the need for adaptive, intelligence-driven defense strategies.

The Gap Between “Thousands of Vulnerabilities” and Reality | by Manikandan Swaminathan | Apr, 2026

medium.com · 3 months ago

There are roughly a dozen confirmed vulnerabilities and several credible exploit demonstrations, but broader claims of thousands of validated critical findings and fully autonomous exploit chains lack publicly disclosed validation. Verified items include an OpenBSD SACK bug, FFmpeg H.264 fixes, a FreeBSD NFS remote kernel root exploit tracked as CVE-2026-4747, and earlier kernel work including CVE-2024-47711 and FFmpeg issues including CVE-2025-59734. Key assertions of large scale exploitability rely on tests against stripped-down harnesses without browser sandboxes, closed disclosures behind cryptographic commitments, and no published prompts or interaction logs, making autonomy and scale claims irreproducible. Security experts recommend publishing full validation funnels, exploit source code for complex chains, and independent third-party evaluations before treating the headline numbers as representative.

10 ChatGPT AI Prompts L1 SOC Analysts Can Use in Their Daily Work

www.techrepublic.com · 3 months ago

false

Offensive Fraud Prevention

securityautopsy.com · 3 months ago

Business logic flaws are increasingly enabling fraud, costing U.S. consumers billions annually. Traditional security measures like vulnerability scanners often miss these flaws, which occur when application workflows are weaponized. A new approach called Offensive Fraud Prevention is needed, applying penetration testing to fraud scenarios and measuring impact in dollars lost, rather than CVSS scores. Several examples include coupon abuse, loyalty program fraud, and data exfiltration through legitimate features, often exploiting vulnerabilities like those exposed in the Dell API breach of 2024, which resulted in 49 million customer records being exposed. The Mastodon CVE (GHSA-c2r5-cfqr-c553) highlighted rate limiting failures due to header spoofing.

13-year-old bug in ActiveMQ lets hackers remotely execute commands

www.bleepingcomputer.com · 3 months ago

A critical remote code execution vulnerability has been discovered in Apache ActiveMQ Classic, remaining undetected for 13 years. The flaw, tracked as CVE-2026-34197, allows attackers to execute arbitrary commands and affects versions prior to 5.19.4 and between 6.0.0 and 6.2.3. Researchers found the vulnerability using the Claude AI assistant by analyzing interactions between multiple components, including Jolokia and JMX. Due to a separate issue, CVE-2024-32114, the vulnerability is unauthenticated in some versions, and organizations are urged to prioritize patching. Experts note ActiveMQ has been a frequent target of real-world attacks and recommend monitoring logs for suspicious connections.

Meta Unveils New A.I. Model, Its First From the Superintelligence Lab

www.nytimes.com · 3 months ago

false

Masjesu Botnet Emerges as DDoS-for-Hire Service Targeting Global IoT Devices

thehackernews.com · 3 months ago

Security researchers have identified a new botnet called Masjesu, also known as XorBot, which offers distributed denial-of-service or DDoS attacks as a service on Telegram. The botnet targets a wide variety of IoT devices, including routers, cameras, and network video recorders from manufacturers like D-Link and NETGEAR. Masjesu avoids targeting critical organizations to maintain operational longevity and primarily originates attacks from Vietnam, Ukraine, and India. The malware establishes persistence on compromised devices and uses a hard-coded TCP port 55988 for communication.

PAN-SA-2026-0006 Informational Bulletin: Impact assessment of OSS CVEs in PAN-OS (Severity: INFORMATIONAL)

security.paloaltonetworks.com · 3 months ago

Palo Alto Networks has assessed several open source software vulnerabilities and determined that PAN-OS software is not affected. This is because the necessary conditions for exploitation do not exist within PAN-OS environments. The assessed CVEs include CVE-2023-2176, CVE-2023-5633, CVE-2023-28464, CVE-2024-0646, CVE-2024-36971, CVE-2024-36886, and CVE-2025-57052. Palo Alto Networks is not aware of any malicious exploitation related to these vulnerabilities.

PAN-SA-2026-0004 Chromium: Monthly Vulnerability Update (April 2026) (Severity: MEDIUM)

security.paloaltonetworks.com · 3 months ago

A security advisory details numerous vulnerabilities affecting the Prisma Browser. These issues include heap buffer overflows, integer overflows, out-of-bounds reads and writes, and inappropriate implementations across various components like PDFium, V8, Media, and WebCodecs. Several Common Vulnerabilities and Exposures, or CVEs, have been assigned, including CVE-2026-2648, CVE-2026-3538, and CVE-2026-3936, among others. Prisma Browser versions prior to 145.16.12.110 and 146.3.8.76 are affected, and no workarounds are currently available.

PAN-SA-2026-0005 Informational Bulletin: OSS CVEs Fixed in PAN-OS (Severity: INFORMATIONAL)

security.paloaltonetworks.com · 3 months ago

Palo Alto Networks has addressed several open source software vulnerabilities in PAN-OS as a precautionary measure. These include CVE-2022-32149, CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602, and CVE-2025-49844. Affected PAN-OS versions include 10.1.15, 10.2.15, 11.0.6, 11.1.8, 11.1.11, 11.1.14, 11.2.3-h2, 11.2.4, and 11.2.7, along with all later versions. Palo Alto Networks is not currently aware of any exploitation of these vulnerabilities.

CVE-2026-0232 Cortex XDR Agent: Local Administrator can disable the agent on Windows (Severity: MEDIUM)

security.paloaltonetworks.com · 3 months ago

A flaw in the Palo Alto Networks Cortex XDR agent for Windows allows a local administrator to disable the agent, potentially enabling malware to operate undetected. Versions 9.0, 8.9, and 8.7-CE are affected if they do not have Content Update 2120 applied. Palo Alto Networks is not aware of any current exploitation, and recommends updating to Content Update 2120 or a later software release to resolve the issue. This vulnerability is identified as CVE-2026-0232.

CVE-2026-0234 Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration (Severity: HIGH)

security.paloaltonetworks.com · 3 months ago

A vulnerability exists in Palo Alto Networks Cortex XSOAR and Cortex XSIAM platforms affecting the Microsoft Teams integration. This flaw, identified as CVE-2026-0234, allows unauthorized users to potentially access and modify protected resources due to improper verification of cryptographic signatures. Versions 1.5.0 through 1.5.51 of both platforms are impacted, and users are urged to upgrade to version 1.5.52 or later to resolve the issue. Palo Alto Networks is currently unaware of any active exploitation of this vulnerability.

The Revival of the Fashion-Tech Love Affair

www.nytimes.com · 3 months ago

false

Fraud Rockets Higher in Mobile-First Latin America

www.darkreading.com · 3 months ago

Fraudulent activity has significantly increased across Latin America, outpacing global averages, driven by social engineering, account takeovers, and mobile-based attacks. The region has seen a 155% surge in social engineering scams and a quadrupling of account takeover attempts in Mexico. Threat actors, including Vixen Panda, Aquatic Panda, Liminal Panda, and ToxicPanda, are actively targeting financial institutions and consumers, exploiting the prevalence of mobile devices and rapid digital adoption. Argentina's success in reducing mule activity through intelligence sharing highlights the potential of coordinated defenses.

Common Entra ID Security Assessment Findings – Part 3: Weak Privileged Identity Management Configuration

blog.compass-security.com · 3 months ago

Security assessments have revealed common misconfigurations in Microsoft Entra ID’s Privileged Identity Management, potentially allowing attackers to gain privileged access. Exploits can involve leveraging stolen tokens, bypassing MFA, and abusing role activation processes. The EntraFalcon PowerShell tool is available to help identify these weak PIM configurations. To mitigate these risks, organizations should enforce strict settings for high-privilege roles, including shorter activation durations and phishing-resistant MFA.

Data Leakage Vulnerability Patched in OpenSSL

www.securityweek.com · 3 months ago

A data leakage vulnerability, identified as CVE-2026-31790, has been resolved in OpenSSL. This flaw can allow attackers to obtain sensitive data from uninitialized memory buffers in applications utilizing RSASVE key encapsulation. The vulnerability impacts versions 3.0 through 3.6, while versions 1.0.2 and 1.1.1 are unaffected. Other, lower-severity vulnerabilities addressed in the update primarily involve potential application crashes and denial-of-service conditions.

A new initiative that brings together Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks in an effort to secure the world’s most critical software.

www.anthropic.com · 3 months ago

false

Full Sail University to Open IBM Cyber Defense Range Powered by AWS and Cloud Range on Campus

www.darkreading.com · 3 months ago

false

RCE Bug Lurked in Apache ActiveMQ Classic for 13 Years

www.securityweek.com · 3 months ago

A remote code execution vulnerability has been discovered in Apache ActiveMQ Classic, impacting versions prior to 5.19.4 and 6.2.3. The vulnerability, tracked as CVE-2026-34197, allows attackers to execute operating system commands by exploiting a flaw in the Jolokia API and retrieving remote configuration files. This issue can be chained with CVE-2022-41678 and, in some cases, exploited without authentication due to CVE-2024-32114, which exposes the Jolokia API. Users are urged to promptly update their ActiveMQ Classic installations to mitigate the risk.

Russian GRU Exploiting Vulnerable Routers to Steal Sensitive Information 07 April 2026

www.ic3.gov · 3 months ago

Russian cyber actors linked to the GRU have been exploiting vulnerable routers worldwide to steal sensitive information from military, government, and critical infrastructure entities. These actors compromised routers, including TP-Link devices using CVE-2023-50224, to redirect internet traffic through their own servers, enabling them to intercept usernames, passwords, and other sensitive data. Federal agencies and international partners are warning the public to update router firmware, change default passwords, and be cautious of certificate warnings. Individuals and organizations are urged to report any suspected intrusions to the FBI or the Internet Crime Complaint Center.

Niobium Introduces The Fog

www.darkreading.com · 3 months ago

false

Pluralsight Launches SecureReady to Help Organizations Build Job-Ready Cybersecurity Teams

www.darkreading.com · 3 months ago

false

Is a $30,000 GPU Good at Password Cracking?

www.bleepingcomputer.com · 3 months ago

Recent testing compared the password-cracking abilities of high-end AI accelerators, the Nvidia H200 and AMD MI300X, against a consumer GPU, the RTX 5090. Surprisingly, the RTX 5090 outperformed both AI accelerators in raw hash generation speed across multiple algorithms. A password using numbers, upper and lowercase letters, and symbols could be cracked in just 21 hours with powerful GPU hardware. The greatest risk to organizations is the reuse of compromised passwords obtained from data breaches, making strong password policies and multi-factor authentication crucial for security.

APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies

thehackernews.com · 3 months ago

The threat actor APT28, also known as Forest Blizzard and Pawn Storm, is conducting a spear-phishing campaign targeting Ukraine and its NATO allies. The campaign, active since September 2025, utilizes a new malware suite called PRISMEX, which combines steganography, COM hijacking, and cloud service abuse for command and control. Attackers rapidly weaponized newly disclosed vulnerabilities, including CVE-2026-21509 and CVE-2026-21513, potentially chaining them together to bypass security features. The malware deployed includes PrismexSheet, PrismexDrop, PrismexLoader, and PrismexStager, along with MiniDoor and NotDoor, demonstrating a shift towards operational disruption and potential sabotage.

Iranian Threat Actors Disrupt US Critical Infrastructure via Exposed PLCs

www.darkreading.com · 3 months ago

Iranian-linked threat actors are targeting programmable logic controllers, or PLCs, within US critical infrastructure sectors like energy, water, and government facilities. Attackers are manipulating PLC project files and SCADA displays, causing operational disruptions and financial losses. The intrusions involve accessing internet-facing Rockwell Automation/Allen-Bradley devices using tools like Studio 5000 Logix Designer and Dropbear SSH, often through ports 44818, 2222, 102, 22, 502, and T0885. US agencies are urging organizations to remove PLCs from direct internet exposure and implement security measures.

FBI: Cybercrime Losses Neared $21 Billion in 2025

www.securityweek.com · 3 months ago

Cybercrime losses reached nearly 21 billion dollars in 2025, a 26 percent increase from the previous year. The FBI’s Internet Crime Complaint Center received over one million complaints, with investment crimes causing the most significant losses, exceeding eight and a half billion dollars. Cryptocurrency investment fraud was particularly damaging, resulting in over seven billion dollars in losses. Ransomware attacks, including variants like Akira, Lockbit, and Medusa, impacted critical sectors and resulted in over 32 million dollars in losses.

Broken by Default: I formally proved that LLM-generated C/C++ code is broken by default — 55.8% vulnerable, 97.8% invisible to existing tools

arxiv.org · 3 months ago

A recent study evaluated the security of code generated by leading AI coding assistants, finding a significant 55.8% vulnerability rate. Integer overflow issues, particularly in memory allocation, were a primary cause of these vulnerabilities. The models demonstrated an ability to recognize vulnerabilities when reviewing their own code, but fail to avoid them during generation. Formal verification methods are proving to be the only reliable way to identify these flaws, and current security tools are largely ineffective.

Why i think Mythos is gonna be game changing after using Opus for a CTF

www.techupkeep.dev · 3 months ago

false

New Scam Alert: QR Codes Replace Links in Traffic Ticket Phishing

www.techrepublic.com · 3 months ago

Scammers are now using QR codes in fake traffic violation texts to steal personal and financial data, mimicking state courts and government agencies. These messages pressure recipients to scan the code to resolve alleged violations, leading them to phishing websites that request personal and financial information. Security experts advise caution with unsolicited QR codes, urging users to verify any violations directly through official government websites and to be wary of urgent payment demands. Legitimate agencies do not request payments or sensitive information via text message.