Blahalla

Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws

thehackernews.com · 11 days ago

Details have emerged about three now-patched security flaws in the OpenClaw personal artificial intelligence (AI) assistant that, if successfully exploited, could enable credential theft, privilege escalation, and arbitrary code execution on the host. A brief description of the high-severity vulnerabilities is as follows - GHSA-hjr6-g723-hmfm (CVSS score: 8.

The Replicant in Your Directory: AI Agents and the Identity Security Gap

www.bleepingcomputer.com · 11 days ago

AI agents are accelerating the growth of non-human identities, making it harder for organizations to understand what exists, who owns it, and what it can access. Netwrix explains why stronger visibility and identity governance are essential as AI expands the enterprise attack surface.

Fresh ATM Crypto Software Bugs: Jackpot or Bust?

www.darkreading.com · 11 days ago

Organizations, and possibly ATMs, are at risk of compromise, thanks to holes in a Microsoft BitLocker security wrapper.

More Countries Jump on the Social Media Ban Wagon

www.darkreading.com · 11 days ago

Age restrictions on accounts may be more of a ban(d) aid, because industry compliance is already falling short. Tech giants are struggling to follow the laws without affecting users.

281 Android VPN Apps Expose Users to Traffic Leaks, Tracking and Tunnel Hijacking

gbhackers.com · 11 days ago

A recent security analysis has revealed that a significant number of Android VPN applications, 281,281,281, expose users to serious privacy and security risks. These risks include traffic leaks, third-party tracking, weak encryption practices, and VPN tunnel hijacking.

New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic

thehackernews.com · 11 days ago

The China-linked cybercrime group known as Silver Fox has been attributed to a new Rust-based remote access trojan (RAR) called MODBEACON.

How Terrorist Groups Are Using A.I. to Gain an Edge in Battle

www.nytimes.com · 11 days ago

A.I. chatbots are not just a propaganda tool for violent extremists but are aiding in bomb construction and attack planning, new research finds.

AI Coding: Do Security Risks Outweigh Productivity Gains?

www.darkreading.com · 11 days ago

AI coding tools cost $19-$200/month/user, but security scanning, remediation, and false positives add hidden costs. Are the productivity gains worth it?

Third US Security Expert Sentenced to Prison for Helping Ransomware Gang

www.securityweek.com · 11 days ago

Angelo Martino, a former ransomware negotiator, was sentenced to 70 months for helping the BlackCat/Alphv group.

Forg365 PhaaS Uses Telegram and AI Lures to Hijack Microsoft 365 Accounts

gbhackers.com · 11 days ago

Forg365 is a commercial phishing-as-a-service (PhaaS) platform specifically targeting Microsoft 365 users. It employs methods such as device-code phishing, adversary-in-the-middle (AiTM) workflows, AI-assisted lure generation, and token persistence tools.

Hackers Exploit CitrixBleed 2 to Hijack MFA-Protected Sessions and Deploy DragonForce Ransomware

gbhackers.com · 11 days ago

Threat actors are exploiting the CitrixBleed 2 vulnerability, tracked as CVE-2025-5777, to hijack active NetScaler sessions protected by multi-factor authentication and gain a foothold in enterprise environments. The activity indicates a standardized operator playbook, potentially operated by an initial access broker or ransomware affiliate.

Linux FUSE Vulnerability Allows Unprivileged Users to Pop a Root Shell

gbhackers.com · 11 days ago

A newly disclosed Linux kernel vulnerability in the FUSE subsystem allows unprivileged local users to escalate privileges to root by corrupting the page cache and hijacking execution of a SUID binary such as /usr/bin/su on Ubuntu 26.04. Tracked as CVE-2026-31694, the flaw affects the FUSE directory-caching logic.

GNU Guix Vulnerabilities Let Attackers Overwrite Arbitrary Files and Escalate Privileges

gbhackers.com · 11 days ago

Security researcher Caleb Ristvedt disclosed the issues on July 222, 202620262026, warning that all GNU Guix installations are affected. Systems running guix-daemon as root face the highest risk because a malicious substitute server or a man-in-the-middle attacker could write files in root-accessible locations, including /etc/passwd.

China, India-Linked Hackers Both Targeted Same Pakistani Police Force

www.securityweek.com · 11 days ago

Both foes and allies have targeted the Balochistan Police force in Pakistan for at least two years, according to SentinelOne.

Can AI-generated adversaries break TTP-based attribution? (arXiv 2026)

arxiv.org · 11 days ago

Cyber Threat Intelligence (CTI) has traditionally attributed attacks through Tactics, Techniques and Procedures (TTPs). In this paper we evaluate whether that assumption still holds when AI agents are explicitly configured to emulate known threat groups. We configured AI agents to reproduce the behavior of APT28, APT29, APT41, APT44 and Lazarus inside enterprise and military cyber ranges.

Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers

thehackernews.com · 11 days ago

A single wrong variable on one line in XQUIC, Alibaba's QUIC and HTTP/3 library, lets any remote client crash the server with a short burst of completely legal traffic. There is no patch. FoxIO researcher Sébastien Féry disclosed the flaw on July 8 and nicknamed it XRING.

Zimbra urges customers to patch critical web client XSS flaw

www.bleepingcomputer.com · 11 days ago

The Zimbra security team urged customers to patch a critical vulnerability affecting the Classic Web Client used to access the Zimbra Collaboration suite.

From 17,000 to 1.1 Million Assets: How Lumen Technologies Rebuilt Exposure Management at Scale

thehackernews.com · 11 days ago

Most enterprises assume their asset inventory is close enough to accurate. The evidence suggests otherwise. According to a survey of over 600 security leaders in the 2026 Axonius Actionability Report, only 45% of organizations consolidate their asset and exposure data into a single view, and every downstream security program inherits whatever the inventory gets wrong.

FastNetMon Launches Netomics, a Self-Hosted Routing Intelligence Platform

gbhackers.com · 11 days ago

London, United Kingdom, July 10th, 2026, CyberNewswire New platform gives network operators complete visibility into Internet routing while keeping all routing intelligence inside their own infrastructure.

Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites

thehackernews.com · 11 days ago

A cybercrime crew left one of its own servers wide open on the internet for three weeks, and it exposed the operation's inner workings: the hacking tools, the activity logs, and target lists naming more than 1.4 million websites. Far fewer were actually broken into, but the exposed files showed researchers how a mass site-hacking operation runs from the inside.

Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers

www.securityweek.com · 11 days ago

The attackers call victims to direct them to phishing websites mirroring Microsoft Entra ID login pages.

AI Surveillance and Social Progress

www.schneier.com · 11 days ago

In the near future, AI -powered surveillance systems will be able to track everything we do in public, and much of what we do in private.

Do Social Media Bans Work? + A Conversation About A.I. Consciousness + Tool Time

www.nytimes.com · 11 days ago

“If the net result is that all the teens in Australia are still using social media, even after they’re technically banned from doing it, why are we doing any of this?”

Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking

thehackernews.com · 11 days ago

Researchers ran 281 of the most popular free VPN apps on the Google Play Store through a new testing system and found that many fail at the basics people install a VPN for, i.e., keeping their traffic private and secure. The apps flagged with at least one problem have been installed more than 2.4 billion times. The problems are basic, not sophisticated.

Wireshark 4.6.7 Released to Patch 12 Vulnerabilities in SSH, TLS, Wi-Fi and pcapng

gbhackers.com · 11 days ago

Wireshark has released version 4.6.74.6.74.6.7, addressing 121212 security flaws across protocol dissectors, capture-file parsers, and its external capture interface. The update resolves issues affecting SSH, TLS Encrypted Client Hello (ECH), IEEE 802.11802.11802.11 Wi-Fi traffic, and pcapng capture files, among other protocols and formats.

New Multi-Stage LNK Attack Targets Hospitality Firms With Node.js Backdoor

gbhackers.com · 11 days ago

Hospitality firms are being targeted in an active phishing campaign that uses fake booking-related emails to deliver a multi-stage Node.js backdoor. The attack chain abuses Google Share links, malicious ZIP archives, Windows shortcut files, PowerShell, and the TON blockchain to evade security controls and maintain resilient command-and-control communications.

NetScaler MCP Gateway Secures LLM and Agentic AI Traffic From a Single Platform

gbhackers.com · 11 days ago

Citrix, a Cloud Software Group company, announced major updates to its NetScaler® platform on July 9, 2026, introducing MCP Gateway functionality designed to secure and govern the explosive growth of AI agent traffic across enterprise environments.

Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access

thehackernews.com · 11 days ago

A threat actor has been targeting organizations spanning multiple sectors with voice-based fake security requests that prompt Microsoft 365 users to enroll a new Entra passkey with an aim to carry out data extortion attacks. The threat actor, tracked by Okta under the moniker O-UNC-066, has deployed a panel-controlled phishing kit that's capable of targeting the passkey enrollment process.

Meta Ordered by E.U. to Alter ‘Addictive Design’ of Instagram and Facebook

www.nytimes.com · 11 days ago

European Union authorities said the company’s use of “addictive design” violated a digital safety law.

Towards CSI: What's the best harness? (arXiv 2026)

arxiv.org · 11 days ago

We studied a question that receives surprisingly little attention: Does the agent harness matter as much as the underlying LLM? We benchmarked five different cybersecurity scaffolds while keeping the model fixed (alias2-mini) across all 33 CyBench challenges. Key findings: No single scaffold performs best across every challenge. Combining heterogeneous scaffolds consistently improves coverage.

Process Parameter Poisoning Technique Hides Shellcode Inside Windows Startup Data

gbhackers.com · 11 days ago

A newly documented Windows injection approach, dubbed Process Parameter Poisoning or P³, uses process startup parameters as an unconventional staging area for shellcode. Implemented in the P³-Shellcode Loader proof of concept, the technique can reduce exposure to telemetry that endpoint detection and response products commonly associate with conventional remote-process injection.

GigaWiper Combines Multiple Malware for System-Level Sabotage

www.securityweek.com · 11 days ago

The backdoor’s destructive capabilities include a standalone wiper, ransomware encryption, and a multi-pass wiping command.

Attackers Exploit 'Ill Bloom' Vulnerability to Drain $3.1 Million From Cryptocurrency Wallets

thehackernews.com · 11 days ago

Security firm Coinspect has disclosed a crypto wallet flaw it calls Ill Bloom, and attackers are already using it. The flaw is in how some wallet software generated its recovery phrase, the words that control the money. When that phrase is made with weak randomness, an attacker can work it out and take everything it controls.

The business case for burning down security debt: A practical approach for CISOs

www.csoonline.com · 11 days ago

Security leaders have made strong progress in visibility. Most organizations can now identify vulnerabilities across their applications, dependencies and development pipelines with far more consistency than in the past. Yet a fundamental imbalance remains: Vulnerabilities are being discovered faster than they can be remediated. That imbalance is growing.

Microsoft uncovers GigaWiper, a backdoor designed for destruction on demand

www.csoonline.com · 11 days ago

Microsoft is warning defenders about a new backdoor that blurs the line between espionage malware and wipers. In a technical analysis published on Thursday, Microsoft Threat Intelligence detailed GigaWiper, a Golang-based implant first observed in October 2025 intrusions that combines remote administration capabilities with multiple disk-wiping and ransomware routines.

Odyssey Stealer Attacks Macs Worldwide and Replaces Crypto Wallet Apps With Drainers

gbhackers.com · 11 days ago

Odyssey Stealer is driving a large-scale macOS infostealer campaign that now spans more than 100 countries, with operators systematically hijacking cryptocurrency ecosystems by replacing legitimate wallet apps with drainer trojans.

‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism

www.securityweek.com · 11 days ago

Researchers demonstrate adversarial hallucination squatting against popular AI assistants to achieve remote code execution.

Former ransomware negotiator gets 4 years for BlackCat attacks

www.bleepingcomputer.com · 11 days ago

A former employee of cybersecurity incident response company DigitalMint was sentenced to 70 months in prison for targeting U.S. companies in BlackCat (ALPHV) ransomware attacks.

Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks

thehackernews.com · 11 days ago

A 41-year-old former ransomware negotiator has been sentenced to nearly six years (i.e., 70 months) in prison in the U.S. for their role in conspiring with the now-defunct BlackCat ransomware operators to extort multiple victims and working with two other cybersecurity professionals to target additional victims in 2023. In a sentencing memorandum, federal prosecutors described Martino as a "

Network of 200 GitHub Repositories Used for Malware Infection

www.securityweek.com · 11 days ago

A Go module is used to load PowerShell code that fetches a resolver from public dead drops to execute Windows malware.

Fake Robinhood Sign-In Alerts Trick Users Into Calling Hacker-Controlled Phone Numbers

gbhackers.com · 11 days ago

A sophisticated callback phishing campaign impersonating Robinhood is coercing victims into dialing attacker-controlled phone numbers by exploiting fear of account compromise. The campaign begins with an unsolicited email or SMS posing as a Robinhood security alert, warning recipients of “unusual sign-in activity” or “potential theft” on their brokerage account.

Check Point CTO Jonathan Zanger sees AI elevating the value of cyber

www.csoonline.com · 11 days ago

Check Point Software CTO Jonathan Zanger met with CSO Spain during the software company’s Engage 2026 user conference last week in Paris. At the event, Check Point executives and representatives discussed how the company is dealing with various types of threats, how it is adopting AI securely, and how Check Point and others can leverage AI for their own benefit.

GigaWiper Uses OneDrive Update Scheduled Task for Persistent Destructive Access

gbhackers.com · 11 days ago

A sophisticated Golang-based backdoor family now tracked as GigaWiper that fuses extensive C2 controls with multiple destructive payloads. What makes GigaWiper noteworthy is not merely its destructive capacity but how it packages several formerly separate wipers and extortion tools into a single modular implant.

Hackers Compromise AWS AI Gateway Connected to Amazon Bedrock to Deploy XMRig Cryptominer

gbhackers.com · 11 days ago

A compromise of an AI gateway linked to Amazon Bedrock, highlighting how generative AI infrastructure has become a new target within the enterprise attack landscape.

Ransomware Negotiator Jailed for Leaking Victim Secrets to BlackCat Hackers

gbhackers.com · 11 days ago

Angelo Martino, a former ransomware negotiator from Florida, has been sentenced to 70,707 months in federal prison for conspiring with ALPHV/BlackCat ransomware operators to extort victims whom he was supposed to help during incident-response engagements. The U.S.

OpenAI Launches GPT-5.6 With Multi-Agent Cybersecurity and Vulnerability-Exploitation Capabilities

gbhackers.com · 12 days ago

OpenAI has introduced the GPT-5.6 family, comprising Sol, Terra, and Luna, positioning it as a multi-agent platform tailored for advanced cybersecurity workflows, vulnerability research, and exploit development. The company claims that these models offer better performance per dollar compared to previous frontier models. The flagship model, GPT-5.

Malicious Braintree.Net Typosquat Steals PAN, CVV, and Payment Gateway Credentials

gbhackers.com · 12 days ago

A malicious NuGet package masquerading as the official Braintree.NET client on July 3, 2026 and Socket’s automation labeled it potential malware within ten minutes. The package, published under the misleading name Braintree.Net, is a carefully crafted typosquat that mirrors PayPal Braintree’s legitimate SDK API while containing a multi-stage.

Multiple U-Boot Vulnerabilities Enable Pre-Authentication Code Execution and Device DoS Attacks

gbhackers.com · 12 days ago

Six critical vulnerabilities in the widely used U-Boot bootloader, which can be exploited through malicious Flattened Image Tree (FIT) images, allowing attackers to achieve pre-authentication arbitrary code execution or crash devices during the early boot process.

Microsoft Uses AI-Powered Agentic Scanning to Find Windows Security Flaws and Accelerate Patching

gbhackers.com · 12 days ago

Microsoft is expanding its AI-driven vulnerability discovery across Windows, introducing a multi-model “agentic” scanning system designed to identify security flaws earlier and accelerate global patch deployment.

Roundcube Webmail Security Update Patches Critical Zero-Click XSS and SSRF Bypass Flaws

gbhackers.com · 12 days ago

Roundcube has released version 1.7.2, a security-focused update that addresses multiple high-impact vulnerabilities, including a zero-click stored cross-site scripting (XSS) flaw and a server-side request forgery (SSRF) bypass. This update follows responsible disclosures from various security researchers and is strongly recommended for all production deployments.