Blahalla

Iran-Linked Hackers Disrupt U.S. Critical Infrastructure by Targeting Internet-Exposed PLCs

thehackernews.com · 3 months ago

Iran-affiliated cyber actors are targeting internet-facing programmable logic controllers, or PLCs, across critical infrastructure sectors in the U.S., leading to disruptions and financial losses. These attacks involve manipulating project files, data on displays, and utilizing tools like Rockwell Automation’s Studio 5000 Logix Designer software and Dropbear SSH software. Security agencies recommend avoiding internet exposure, implementing multi-factor authentication, and keeping PLC devices up-to-date. The activity is part of an escalation of cyberattacks linked to the ongoing conflict between Iran, the U.S., and Israel.

Tipps für CISOs, die die Branche wechseln wollen

www.csoonline.com · 3 months ago

false

We found a path traversal in an MCP server with 7,700 stars that lets AI agents read your SSH keys. Fix merged.

spiderrating.com · 3 months ago

A path traversal vulnerability, classified as a CWE-22, was discovered in the context7 project, allowing connected AI agents to read sensitive files from the host machine. Attackers can craft malicious prompts to trick agents into executing commands that access files like SSH private keys, environment variables, and AWS credentials. Researchers found the vulnerability using an open-source security scanner and developed a fix involving path boundary validation which was quickly merged. The discovery highlights a broader issue, with scans revealing credential leakage on 757 MCP servers and 36% receiving failing grades.

Iran-Linked Hackers Disrupt US Critical Infrastructure via PLC Attacks

www.securityweek.com · 3 months ago

Federal agencies are warning of recent cyberattacks targeting critical infrastructure organizations in the U.S. Iran-linked threat actors are exploiting internet-exposed programmable logic controllers, particularly those from Rockwell Automation/Allen-Bradley, causing disruptions to operational technology devices. The attacks resemble previous operations by groups like CyberAv3ngers, which used tools like OpenAI's ChatGPT for reconnaissance and exploitation. Authorities are urging organizations to proactively assess their systems for vulnerabilities and have released indicators of compromise in XML and JSON formats.

Strengthen Linux Security: CIS Hardening Guide (2026)

nexobits.net · 3 months ago

false

From UART to Root: Vendor Shell Escape on a Uniview IP Camera

ygashu.dev · 3 months ago

Security researchers have demonstrated a method for gaining root access to a Uniview security camera. The process began by identifying a UART connection, then exploiting a bootloader vulnerability to achieve a restricted shell. Modifying a system script enabled a full root shell, allowing for firmware analysis and potential modification. This unauthorized access demonstrates vulnerabilities in the camera's boot and initialization procedures.

What Anthropic Glasswing reveals about the future of vulnerability discovery

www.csoonline.com · 3 months ago

Anthropic has launched Project Glasswing, a cybersecurity initiative utilizing the Claude Mythos Preview model to autonomously discover software vulnerabilities at a large scale. The model is currently accessible to a limited consortium of technology and security companies including Amazon, Microsoft, and Cisco. Early testing identified thousands of vulnerabilities, some previously undetected despite extensive reviews, suggesting a shift in vulnerability discovery from human-driven efforts to automated processes. This development raises questions about the future of bug bounty programs and emphasizes the need for organizations to prioritize reducing exposure windows rather than solely focusing on vulnerability prioritization.

Hackers exploit critical flaw in Ninja Forms WordPress plugin

www.bleepingcomputer.com · 3 months ago

A critical vulnerability, CVE-2026-0740, has been identified in the Ninja Forms File Uploads WordPress plugin, allowing attackers to upload files without authentication and potentially execute code remotely. The flaw, caused by inadequate file type validation, has already been exploited in thousands of attacks, according to security firm Wordfence. The vulnerability affects versions up to 3.3.26 and poses a significant risk of website takeover. A patch, version 3.3.27, was released on March 19 and users are strongly advised to update immediately.

Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox

unit42.paloaltonetworks.com · 3 months ago

Researchers identified vulnerabilities in Amazon Bedrock AgentCore, allowing data exfiltration through DNS tunneling and exposure of internal AWS infrastructure details. The flaws included bypassing the intended sandbox isolation and gaining access to sensitive metadata like S3 URLs and AWS account IDs. Amazon Web Services has responded with mitigations including VPC mode recommendations and deployment of MMDSv2. Palo Alto Networks recommends security assessments and tools to prevent credential theft and establish covert communication channels.

FBI: Americans lost a record $21 billion to cybercrime last year

www.bleepingcomputer.com · 3 months ago

Americans lost a record $21 billion to cybercrime last year, a 26% increase from 2024. Investment scams and cryptocurrency fraud were major drivers of these losses, with the latter exceeding $11 billion. The Internet Crime Complaint Center received over 1 million complaints, and individuals over 60 experienced the most significant losses. New to the report are AI-related scams, which resulted in nearly $900 million in losses and attacks on dams and nuclear facilities were reported as data breaches. The FBI intervened in thousands of cases, freezing over $679 million in fraudulent transactions.

Fortinet releases emergency hotfix for FortiClient EMS zero-day flaw

www.csoonline.com · 3 months ago

A critical vulnerability, CVE-2026-35616, has been exploited in FortiClient Endpoint Management Server, allowing attackers to remotely execute code without authentication. Fortinet released an emergency hotfix for versions 7.4.5 and 7.4.6, with a full patch planned for version 7.4.7. The flaw is an authentication bypass issue affecting on-premises deployments, and security experts suggest reviewing logs and rebuilding instances if compromise is suspected. This incident follows a similar vulnerability patched earlier this year, CVE-2026-21643.

CVE-2026-34197: ActiveMQ RCE via Jolokia API

horizon3.ai · 3 months ago

A remote code execution vulnerability, CVE-2026-34197, has been identified in Apache ActiveMQ Classic. Attackers can exploit this vulnerability by invoking a management operation through ActiveMQ’s Jolokia API to execute arbitrary operating system commands. Versions 6.0.0 through 6.1.1 are particularly vulnerable because a separate flaw, CVE-2024-32114, allows unauthenticated access to the Jolokia endpoint. Patches are available in ActiveMQ Classic versions 5.19.4 and 6.2.3, and organizations are urged to update promptly, as ActiveMQ has been previously targeted by attackers. The vulnerability involves a chain of components: Jolokia, JMX, network connectors, and VM transports.

Assessing Claude Mythos Preview’s capabilities

red.anthropic.com · 3 months ago

false

Storm-1175 Deploys Medusa Ransomware at 'High Velocity'

www.darkreading.com · 3 months ago

The cybercrime group Storm-1175 is rapidly deploying Medusa ransomware, exploiting vulnerabilities with increasing speed, often within 24 hours of patch release. They target organizations in healthcare, education, finance, and professional services across multiple countries. Exploited vulnerabilities include CVE-2026-1731, CVE-2025-31161, CVE-2024-27198, CVE-2023-21529, CVE-2026-23760, and CVE-2025-10035, with the group also tampering with security solutions like Microsoft Defender Antivirus to evade detection. Microsoft advises prioritizing immediate patching and implementing security measures such as Windows Defender tamper protection and Credential Guard.

Grafana Patches AI Bug That Could Have Leaked User Data

www.darkreading.com · 3 months ago

A vulnerability dubbed "GrafanaGhost" has been addressed in the Grafana observability platform. Researchers discovered an indirect prompt injection attack where malicious instructions hidden within images could trick Grafana’s AI into sending sensitive data to an attacker. The attack bypassed security protections using protocol-relative URLs and keywords to manipulate the AI's behavior. Grafana disputes the "zero-click" description, stating user interaction was needed for execution and confirms no data was leaked.

Snowflake customers hit in data theft attacks after SaaS integrator breach

www.bleepingcomputer.com · 3 months ago

Multiple companies have experienced data theft attacks following a breach at a SaaS integration provider, Anodot. Attackers stole authentication tokens and targeted Snowflake customers, with a small number of accounts impacted. The threat actor, ShinyHunters, claims responsibility for the attacks and attempted to steal data from Salesforce, but were blocked. Several organizations are now reportedly being extorted by ShinyHunters, who claim to have accessed Anodot's systems for some time.

5 practical steps to strengthen attack resilience with attack surface management

www.csoonline.com · 3 months ago

false

5 steps to strengthen supply chain security and improve cyber resilience

www.csoonline.com · 3 months ago

Supply chain attacks are a growing threat, bypassing traditional defenses and impacting organizations and MSPs. To strengthen security, it’s critical to map and prioritize supply chain dependencies, continuously evaluate vendor security posture, and implement strong access controls like multi-factor authentication. Early detection is essential, requiring unified telemetry across systems and automated responses. Finally, organizations should build recovery capabilities with immutable backups and tested restore processes to minimize business disruption.

5 ways to strengthen identity security and improve attack resilience

www.csoonline.com · 3 months ago

Attackers are increasingly exploiting valid credentials to infiltrate systems, making traditional security measures like firewalls insufficient. Organizations should enforce multi-factor authentication everywhere, particularly for privileged accounts, and implement Privileged Access Management to control administrative permissions and reduce privilege creep. A comprehensive inventory of all identities, including human, machine, and workload accounts, is essential for identifying and eliminating unnecessary access points. Continuous validation of identity behavior helps detect compromise early, and building Zero Trust foundations across identity, devices, networks, applications, and data strengthens overall attack resilience.

The Race to Ship AI Tools Left Security Behind. Part 1: Sandbox Escape

cymulate.com · 3 months ago

Researchers have identified a critical vulnerability class, termed Configuration-Based Sandbox Escape, impacting AI coding tools like Claude Code, Gemini CLI, and Codex CLI. These flaws allow attackers to bypass the intended sandbox isolation and execute arbitrary code, potentially leading to credential theft and system compromise. Claude Code has been patched, resolving CVE-2026-25725, while vulnerabilities in Gemini CLI and Codex CLI remain unaddressed. Experts recommend disabling sandbox features and employing robust security measures to mitigate this emerging threat.

How Accurate Are Google’s A.I. Overviews?

www.nytimes.com · 3 months ago

false

Anthropic Unveils ‘Claude Mythos’ – A Cybersecurity Breakthrough That Could Also Supercharge Attacks

www.securityweek.com · 3 months ago

Anthropic has unveiled a new AI model called Claude Mythos, which demonstrates significantly enhanced coding and reasoning capabilities. The model has identified thousands of vulnerabilities, including some dating back 27 years, and autonomously chained Linux kernel vulnerabilities to achieve full system control. Anthropic is concerned about the potential for misuse and has launched Project Glasswing, a collaboration with companies like Microsoft, Cisco, and CrowdStrike, to proactively secure critical software. The firm is also extending access to select organizations to scan and secure systems, but does not plan to broadly release the Mythos Preview version.

A.I. Is on Its Way to Upending Cybersecurity

www.nytimes.com · 3 months ago

NULL

Trump’s Proposed CISA Cuts Spark Alarm Among Cybersecurity Experts

www.techrepublic.com · 3 months ago

A proposed federal budget would significantly reduce funding for the Cybersecurity and Infrastructure Security Agency, potentially impacting U.S. cyber defense efforts. The cuts, estimated between $361 million and $707 million, would refocus CISA on federal network defense and critical infrastructure protection while scaling back external engagement and international partnerships. Experts warn this reduction in collaboration and threat intelligence sharing could weaken the nation's cyber resilience, emphasizing the need for organizations to strengthen their own security measures and rely on private information-sharing organizations. The final budget is subject to change as Congress considers the proposal.

US warns of Iranian hackers targeting critical infrastructure

www.bleepingcomputer.com · 3 months ago

U.S. authorities are warning that Iranian-linked hackers are targeting internet-exposed Rockwell/Allen-Bradley programmable logic controllers, impacting critical infrastructure sectors like government facilities, water systems, and energy. These attacks, which began in 2026, have caused financial losses and operational disruptions, involving manipulation of data and extraction of device files. The activity is believed to be a response to ongoing tensions between Iran, the United States, and Israel. Security measures recommended include disconnecting PLCs from the internet, implementing multifactor authentication, and updating firmware.

Anthropic Claims Its New A.I. Model, Mythos, Is a Cybersecurity ‘Reckoning’

www.nytimes.com · 3 months ago

NULL

The Future of Addictive Design + Going Deep at DeepMind + HatGPT

www.nytimes.com · 3 months ago

false

Anthropic Opus 4.6 is less good at finding vulns than you might think

zeropath.com · 3 months ago

A recent study explored the use of the Opus 4.6 AI model to identify software vulnerabilities in C code. The model demonstrated the ability to detect around 25 percent of known vulnerabilities, exceeding human review rates, but also generated a significant number of false positives and inconsistent results. Researchers found that prompting strategies influence the model’s performance, highlighting the need for careful design when implementing such tools. While showing promise, the study concludes that Opus 4.6 requires more sophisticated integration for practical enterprise use.

Cybersecurity in the Age of Instant Software

www.schneier.com · 3 months ago

Artificial intelligence is rapidly changing software development and cybersecurity. AI systems are increasingly capable of automatically finding and exploiting vulnerabilities, impacting both attackers and defenders. While AI can also be used to automate patch creation and improve software security, legacy systems and instant software present unique challenges. The future may involve self-healing networks and a market for shared vulnerability information, but attackers will likely shift focus to users and manipulate AI systems themselves.

Russia Hacked Routers to Steal Microsoft Office Tokens

krebsonsecurity.com · 3 months ago

Russian state-backed hackers, known as Forest Blizzard or APT28, have been exploiting vulnerabilities in older routers to steal authentication tokens from Microsoft Office users. The hackers redirected targeted DNS requests through compromised routers, primarily impacting government agencies and consumer devices across more than 18,000 networks. This technique, known as DNS hijacking, allows attackers to intercept user login credentials without installing malware or phishing individuals. Microsoft has identified over 200 organizations and 5,000 consumer devices affected by this widespread surveillance operation.

Max severity Flowise RCE vulnerability now exploited in attacks

www.bleepingcomputer.com · 3 months ago

Hackers are actively exploiting a critical vulnerability, CVE-2025-59528, in the Flowise platform, allowing them to execute arbitrary code. The flaw stems from a lack of security checks when handling user input in the CustomMCP node. Researchers at VulnCheck have detected exploitation originating from a single Starlink IP address, while noting that thousands of Flowise instances are exposed online. Users are urged to upgrade to version 3.1.1 or at least 3.0.6 and consider restricting public access to their Flowise servers.

Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign

thehackernews.com · 3 months ago

A Russia-linked threat actor, APT28, conducted a widespread cyber espionage campaign, codenamed FrostArmada, that compromised SOHO routers to hijack DNS traffic and steal network data. The operation, which began in May 2025, targeted government agencies and organizations across multiple countries, impacting over 200 organizations and 5,000 consumer devices. Attackers modified DNS settings to redirect traffic through malicious servers, enabling them to steal credentials and conduct man-in-the-middle attacks, with some domains related to Microsoft Outlook being targeted. The attackers exploited CVE-2023-50224 in TP-Link routers to gain access and modify configurations.

The New Rules of Engagement: Matching Agentic Attack Speed

www.securityweek.com · 3 months ago

AI-enabled cyberattacks are now a reality, with one documented instance involving a Chinese state-sponsored threat actor, GTG-1002, using Claude Code to autonomously attack networks. IT decision-makers are increasingly concerned, with 92% worried about cyberwarfare's impact and 64% already experiencing AI-generated attacks. Experts emphasize that legacy systems and known vulnerabilities remain significant risks, and the cybersecurity industry must adopt “hive mind” architectures, collective, agentic defense mechanisms, to match the speed and scale of these evolving threats. Another Chinese state-sponsored group, Salt Typhoon, continues to target telecommunications providers, highlighting the ongoing nature of these risks.

Trent AI Emerges From Stealth With $13 Million in Funding

www.securityweek.com · 3 months ago

false

[Webinar] How to Close Identity Gaps in 2026 Before AI Exploits Enterprise Risk

thehackernews.com · 3 months ago

New research indicates a growing risk for organizations despite maturing identity programs. Hundreds of applications within enterprises remain disconnected from centralized identity systems, creating unmanaged attack surfaces. The rise of artificial intelligence is amplifying this risk, as AI agents exploit these gaps and reuse stale tokens. Experts recommend addressing these identity gaps to regain control and protect against increasingly targeted attacks.

New FBI Warning: Chinese Apps Could Expose User Data

www.techrepublic.com · 3 months ago

The FBI is warning Americans to be cautious about downloading foreign applications, particularly those developed in China. Concerns arise from China’s national security laws, which could compel companies to share user data with the government. There are three potential risks: apps may store user data on servers in China, the “invite friends” feature could expose contact information, and malware could be present. Users are advised to download apps only from official stores, review data-sharing practices, and follow standard online safety practices.

Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins

www.bleepingcomputer.com · 3 months ago

Law enforcement and private companies have disrupted FrostArmada, a campaign linked to the Russian threat group APT28, which hijacked DNS settings on compromised routers to steal Microsoft 365 logins. The attackers targeted MikroTik and TP-Link routers, redirecting users to malicious servers and intercepting authentication traffic. The operation impacted approximately 18,000 devices across 120 countries, primarily targeting government agencies and IT providers. Authorities have taken down the infrastructure used in the attacks, but defenders are advised to implement certificate pinning and prioritize patching to prevent future incidents.

JavaScript runtime instrumentation via Chrome DevTools Protocol

fcavallarin.github.io · 3 months ago

A new debugging approach is emerging for JavaScript applications, shifting away from traditional breakpoint methods. This system uses the Chrome DevTools Protocol to instrument code, enabling automated inspection and modification of execution. A key feature, "followReturn," allows developers to track values after asynchronous functions complete. This event-driven model provides a more dynamic and powerful way to understand and control program behavior.

Critical Flowise Vulnerability in Attacker Crosshairs

www.securityweek.com · 3 months ago

A critical vulnerability has been identified in the Flowise development platform, allowing for remote code execution. The flaw, tracked as CVE-2025-59528 and carrying a CVSS score of 10, stems from a lack of validation of user-supplied JavaScript code. Attackers can exploit this to gain control of vulnerable systems and access sensitive data, requiring only an API token for access. Vulnerability intelligence firm VulnCheck has observed active exploitation attempts targeting this publicly known vulnerability, which was patched in version 3.0.6.

‘Stop Texting’: FBI Warning Drives Apple’s iPhone Messaging Update

www.techrepublic.com · 3 months ago

Apple is updating how iPhones handle text messages, particularly when communicating with Android devices. The change comes after a warning from the FBI about the security risks of standard text messaging. The update involves adopting a more secure version of Rich Communication Services, or RCS, to enable encrypted cross-platform messaging. The rollout will be gradual, dependent on cooperation between Apple, Google, and mobile carriers.

Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access

thehackernews.com · 3 months ago

A high-severity vulnerability, CVE-2026-34040, has been identified in Docker Engine, stemming from an incomplete fix of a previous vulnerability, CVE-2024-41110. Attackers can bypass authorization plugins by crafting API requests that omit the request body, allowing them to create privileged containers with host file system access. The vulnerability also poses a risk when AI coding agents are involved, potentially generating malicious requests autonomously. Users are advised to avoid plugins relying on request body inspection, limit API access, or utilize rootless mode to mitigate the risk.

RSAC 2026: How AI Is Reshaping Cybersecurity Faster Than Ever

www.darkreading.com · 3 months ago

false

Human vs. AI: Debates Shape RSAC 2026 Cybersecurity Trends

www.darkreading.com · 3 months ago

false

Lies, Damned Lies, and Cybersecurity Metrics

www.darkreading.com · 3 months ago

false

Severe StrongBox Vulnerability Patched in Android

www.securityweek.com · 3 months ago

Android’s latest security update addresses two vulnerabilities. One is a critical denial-of-service issue affecting the Framework component, tracked as CVE-2026-0049, which can be exploited by a local attacker. The other is a high-severity flaw in StrongBox, Android's secure keystore, identified as CVE-2025-48651, impacting implementations from Google, NXP, STMicroelectronics, and Thales. Details regarding the StrongBox vulnerability’s impact are currently unknown, but potential exploitation could involve key extraction, privilege escalation, or denial of service. Neither vulnerability appears to have been actively exploited.

Why Your Automated Pentesting Tool Just Hit a Wall

www.bleepingcomputer.com · 3 months ago

Automated penetration testing tools initially provide valuable insights, but their effectiveness diminishes after a few runs due to a phenomenon called the Proof-of-Concept Cliff, where they exhaust known attack paths. This limits the scope of validation and creates a "Validation Gap," leaving many areas of the attack surface untested. Breach and Attack Simulation offers a different approach, independently testing numerous attack techniques to validate the effectiveness of security controls like firewalls and EDRs. Organizations need to assess their validation coverage across six key surfaces, network, detection, infrastructure, identity, cloud, and AI, to ensure a comprehensive security posture.

SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

www.microsoft.com · 3 months ago

A threat group linked to the Russian military, known as Forest Blizzard, is exploiting vulnerabilities in home and small-office routers to hijack DNS settings. This allows them to intercept network traffic and potentially steal sensitive data through adversary-in-the-middle attacks. The campaign has affected numerous organizations and consumer devices, impacting those with remote workers and exposed routers. Microsoft recommends enhanced authentication, risk-based policies, proactive monitoring, and leveraging artificial intelligence to defend against this threat.

GrafanaGhost: Attackers Can Abuse Grafana to Leak Enterprise Data

www.securityweek.com · 3 months ago

Researchers have discovered a vulnerability, dubbed GrafanaGhost, that allows attackers to leak enterprise data from Grafana installations. This vulnerability bypasses client-side security measures by exploiting the application’s AI capabilities to send sensitive data, such as financial metrics and customer information, to external servers without user interaction. Attackers can craft malicious prompts that trick Grafana's AI companion into rendering external images, unknowingly transmitting data as URL parameters. The exploitability of this vulnerability depends on specific deployment configurations and AI feature enablement.

CUPS Vulnerabilities Could Allow Remote Attackers to Achieve Root-Level Code Execution

gbhackers.com · 3 months ago

Security researchers have discovered two critical vulnerabilities in the CUPS printing system, potentially impacting Linux and Unix-like operating systems. CVE-2026-34980 allows unauthenticated attackers to execute code remotely by exploiting a parsing error in PostScript queues, enabling remote code execution. CVE-2026-34990 allows local users to escalate privileges to root by creating fake printers and overwriting system files. System administrators are advised to disable network exposure, enforce authentication, and implement security modules like AppArmor or SELinux to mitigate these risks.

Focusing on the People in Cybersecurity at RSAC 2026 Conference

www.darkreading.com · 3 months ago

false