Blahalla

Critical Vulnerability in Claude Code Emerges Days After Source Leak

www.securityweek.com · 3 months ago

Anthropic mistakenly published a debugging JavaScript sourcemap for Claude Code version 2.1.88 to npm on March 31, 2026, enabling researchers to reconstruct roughly 512,000 lines of TypeScript across 1,900 files. Adversa AI's Red Team discovered a critical flaw in Claude Code's permission system where a performance cap that limits analysis to fifty subcommands causes enforcement to fall back to an ask mode that silently bypasses deny rules and per command validation. An attacker can exploit this by embedding prompt injection in a CLAUDE.md that causes the agent to generate a pipeline exceeding fifty subcommands, which could be used to exfiltrate SSH private keys, cloud credentials, GitHub tokens, npm tokens and environment secrets, potentially leading to credential theft, supply chain compromise, cloud infrastructure breach and CI CD pipeline poisoning. The source leak did not include model weights, training data, customer data, APIs or credentials, so it is not identical to losing the model itself, but security experts warn the combination of the leak and the permission bypass presents meaningful operational risk.
US Bans All Foreign-Made Consumer Routers

www.schneier.com · 3 months ago

The United States will require Federal Communications Commission approval for any new consumer router manufactured outside the United States before it can be imported, marketed, or sold. The approval process requires manufacturers to disclose foreign investors or influence and to present a plan to bring manufacturing to the United States, and the Department of Defense or Department of Homeland Security may exempt specific models though neither agency has named any exceptions. Existing routers are not affected, and observers expect some US companies may begin domestic production but at higher cost than routers made in China or Taiwan.
SHA Pinning Is Not Enough

rosesecurity.dev · 3 months ago

There are limits to SHA pinning as a sole mitigation for supply chain attacks; attackers can create orphaned commits in forks that are reachable by SHA and appear legitimate to GitHub Actions. On March 4 2026 a malicious orphaned commit replaced a GitHub Action SHA used in Trivy's release workflow, caused CI to download poisoned Go source while GoReleaser validation was skipped, and resulted in compromised Trivy binaries being published. Recommended defenses include verifying SHA pins point to commits on official repository branches or tags, automating branch membership checks via the GitHub API, requiring signed commits for workflow changes, allowlisting and mirroring actions, and using artifact attestations to verify build provenance.
Hasbro Cyberattack Knocks Systems Offline, Recovery Could Take Weeks

www.techrepublic.com · 3 months ago

Hasbro is investigating a cyberattack that forced parts of its systems offline after an intrusion first detected on March 28, 2026. The company said in a Securities and Exchange Commission filing that it shut down parts of its networks, took its corporate website offline for maintenance, and warned that containment and recovery could take weeks. Hasbro is working with external cybersecurity professionals, cannot yet determine whether data was affected, and so far there have been no public ransom demands while users and vendors are advised to monitor for possible phishing and data theft.
Apple Issues Rare Patch: Up to 270M iPhones Could Be Vulnerable to ‘DarkSword’ Exploit

www.techrepublic.com · 3 months ago

Apple issued a rare security patch for iOS 18 to block DarkSword, a sophisticated exploit that can silently compromise iPhones via malicious websites and give attackers access to passwords, messages, contacts, and photos. Researchers estimate between 221 million and 270 million devices remain vulnerable, prompting Apple to backport fixes instead of forcing users to upgrade to iOS 26. The exploit has spread across multiple regions and hacker groups and its code reportedly appeared publicly, raising concerns that it may be adopted by a wider range of cybercriminals.
Turning a Raspberry Pi into a "Poor Man's" Enterprise IDS/NSM using Zeek and Suricata

hookprobe.com · 3 months ago

A guide explains how to deploy Zeek and Suricata on a Raspberry Pi 4 or 5 to create a low cost enterprise style intrusion detection and network security monitoring node at the network edge. It recommends using Suricata for signature based detection and Zeek for high level metadata and context, and describes optimizations such as pinning network interrupts to specific CPU cores and increasing ring buffer sizes to avoid packet loss on 1 gigabit links. The walkthrough covers configuration file changes and suggests connecting the device to a mirror or SPAN port to monitor IoT and guest networks and feed structured logs into ELK or Grafana.
red team sandbox with real detection

www.shieldnet.app · 3 months ago

There is a free red team arena for testing real attack paths against a live defense system for ShieldNet DLX7. There are interactive scenarios including prompt injection bypass, DOM tamper with honeytrap detection, JWT forging involving algorithm confusion and role escalation, API exfiltration via debug routes and traversal, and indirect injection through markdown, SVG, and base64 payloads. All activity runs in a sandbox with no production targets and novel attacks generate detection rules that are reviewed and pushed into the system to evaluate modern defenses.
Apple Rolls Out DarkSword Exploit Protection to More Devices

www.securityweek.com · 3 months ago

Apple is rolling out iOS and iPadOS updates to older devices to protect them against the DarkSword exploit kit, which targets six iOS vulnerabilities and can fully compromise devices with minimal user interaction and has been used by state sponsored groups and commercial spyware vendors. Patches for the exploited vulnerabilities were released in 2025 and Apple enabled availability of iOS 18.7.7 for more devices on April 1, 2026 so users with Automatic Updates turned on can automatically receive the protections. The 18.7.7 updates address about two dozen security flaws including kernel code execution, keychain access, activation lock bypass, and web browsing risks, and are now available for a range of iPhone and iPad models from XR through 16e and multiple iPad Air and Pro models. When DarkSword emerged in March 2026, iVerify estimated roughly 200 million devices running iOS versions between 18.4 and 18.6.2 may have been vulnerable.
Threat actor abuse of AI accelerates from tool to cyberattack surface

www.microsoft.com · 3 months ago

Threat actors are embedding generative AI across the full cyberattack lifecycle, accelerating reconnaissance, refining social engineering and malware development, automating post compromise tasks, and generally reducing the friction for human operators rather than running fully autonomous campaigns. Email phishing effectiveness has surged, with AI-enabled campaigns reaching a fifty four percent click through rate compared to roughly twelve percent for traditional campaigns, a four hundred fifty percent increase, and industrialized MFA bypass has emerged through subscription platforms such as Tycoon2FA that generated tens of millions of phishing messages, were linked to nearly one hundred thousand compromised organizations since 2023, and at peak accounted for roughly sixty two percent of phishing attempts blocked by Microsoft. Microsoft’s Digital Crimes Unit disrupted the operation by seizing three hundred thirty domains, and defenders are urged to prioritize agent governance, software supply chain visibility, identity protection, and new security operations roles focused on orchestrating and auditing agentic systems.
RSAC 2026: AI Dominates, But Community Remains Key to Security

www.darkreading.com · 3 months ago

false
Cookie-controlled PHP webshells: A stealthy tradecraft in Linux hosting environments

www.microsoft.com · 3 months ago

Threat actors are exploiting HTTP cookies as a stealthy control channel for PHP webshells in Linux hosting environments so malicious code remains dormant until specific cookie values trigger execution. Attackers combine layered obfuscation, runtime reconstruction of function names, and encoded payloads that can be staged to disk, and they leverage php fpm processes and cron jobs registered through hosting control panels to achieve persistence while reducing logging and inspection visibility. Observed variants include loaders with execution gating, direct cookie driven payload stagers, and single cookie interactive webshells that enable command execution and file upload. Recommended mitigations include enabling cloud delivered and real time protection, behavior monitoring to detect anomalous PHP execution and suspicious cron activity, and hunting detections for base64 decoding writing PHP files unexpected shells spawned by web servers and hosting control panel abuse.
Residential proxies evaded IP reputation checks in 78% of 4B sessions

www.bleepingcomputer.com · 3 months ago

Researchers analyzed a dataset of four billion malicious sessions over three months and found residential proxies accounted for about thirty nine percent of sessions while evading IP reputation checks in seventy eight percent of cases. Most residential IPs are short lived with about eighty nine point seven percent active in malicious operations for under one month and only a small fraction persisting beyond two or three months, and the majority of activity is network scanning and reconnaissance rather than direct exploits. The recommended response is to abandon IP reputation as a primary signal and instead focus on behavioral detection such as identifying sequential probing from rotating residential IPs, blocking clearly illegitimate protocols in ISP space, and tracking device fingerprints that survive IP rotation.
Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise

thehackernews.com · 3 months ago

Cisco released updates to address a critical flaw in its Integrated Management Controller that could allow an unauthenticated remote attacker to bypass authentication and gain elevated privileges. The vulnerability is tracked as CVE-2026-20093 and carries a CVSS score of 9.8 out of 10. Administrators are advised to apply the vendor updates promptly.
The [LinkedIn browsergate] Attack: How it works

browsergate.eu · 3 months ago

LinkedIn's JavaScript silently scans Chromium based browsers for installed extensions by attempting to fetch known extension resource URLs and by walking the page DOM for chrome extension references, detecting thousands of specific extensions without consent. Detected extension IDs and a broader 48 point device fingerprint are encrypted with an RSA public key and transmitted to LinkedIn telemetry endpoints where events are batched, compressed, retried, and the encrypted fingerprint is injected into subsequent API requests for the duration of the session. The hardcoded extension list grew from about 5,459 entries in December 2025 to over 6,100 by February 2026, and the system uses staggered scans, request idle callbacks, and throttling to reduce visibility and avoid noticeable performance impact.
Cybersecurity M&A Roundup: 38 Deals Announced in March 2026

www.securityweek.com · 3 months ago

false
Your terminal is lying to you: escape sequence attacks from the 90s that still work.

www.credrelay.com · 3 months ago

false
Adversaries Exploit Vacant Homes to Intercept Mail in Hybrid Cybercrime

www.bleepingcomputer.com · 3 months ago

Threat actors are exploiting vacant residential properties as drop addresses to intercept mail and enable identity theft and financial fraud. They identify recently listed or long vacant homes via real estate platforms, register or hijack digital postal preview services to monitor incoming mail, and use change of address and mail forwarding requests coupled with fake identities or forged documents. After establishing forwarding or mailbox accounts, attackers gain persistent access that facilitates account takeover, credit fraud and refund scams while outsourcing physical collection to recruited individuals. The technique leverages weak identity verification and legitimate postal features and has coincided with a sharp rise in mail theft and change of address fraud according to postal inspection data.
Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices

www.evilsocket.net · 3 months ago

There are three independently exploitable vulnerabilities affecting Mongoose versions 7.0 through 7.20, identified as CVE-2026-5246, CVE-2026-5244 and CVE-2026-5245. CVE-2026-5246 causes complete mTLS authentication bypass when a P-384 certificate authority is used because the verification function returns success without checking the signature, CVE-2026-5244 is a heap-based overflow during TLS certificate parsing that can yield preauthentication remote code execution as root, and CVE-2026-5245 is a stack-based overflow in mDNS that can be triggered by a single UDP packet to achieve preauthentication remote code execution on common embedded targets. These issues can expose hundreds of millions of devices and are fixed in Mongoose 7.21, with recommended mitigations including updating to 7.21, switching the built-in TLS to OpenSSL or mbedTLS if unable to update, disabling mDNS when unused and avoiding P-384 CA certificates on affected versions.
New Progress ShareFile flaws can be chained in pre-auth RCE attacks

www.bleepingcomputer.com · 3 months ago

Two vulnerabilities in Progress ShareFile Storage Zones Controller can be chained to enable unauthenticated file exfiltration and pre-auth remote code execution, tracked as CVE-2026-2699 and CVE-2026-2701. CVE-2026-2699 is an authentication bypass due to improper handling of HTTP redirects that grants access to the ShareFile admin interface, and CVE-2026-2701 allows attackers to abuse file upload and extraction to place ASPX webshells in the application webroot. watchTowr reported the flaws in February and Progress addressed them in ShareFile version 5.12.4 released on March 10, while scans estimate tens of thousands of Storage Zone Controller instances are internet-exposed and ShadowServer currently observes around seven hundred. Although no active exploitation was observed as of the report, systems running vulnerable SZC versions should be patched immediately.
Medtech giant Stryker fully operational after data-wiping attack

www.bleepingcomputer.com · 3 months ago

Stryker Corporation says it is fully operational across its global manufacturing network three weeks after many of its systems were wiped in a cyberattack that began on March 11, 2026. Attackers claimed to have stolen 50 terabytes of data and wiped nearly 80,000 devices after creating a new Global Administrator account following compromise of a Windows domain admin account, and investigators found a malicious file used to hide activity. CISA and Microsoft issued guidance on securing Intune and hardening Windows domains, the FBI seized two websites used by the Handala hacktivist group, and Handala has been linked to Iran and to previous Windows and Linux data wiper operations.
Akira-Style Ransomware Campaign Hits Windows Users Across South America

gbhackers.com · 3 months ago

A newly identified ransomware campaign is targeting Windows users across South America and is impersonating the Akira group by copying its branding, ransom notes, and Tor-based infrastructure to intimidate victims. Technical analysis shows the malware uses a Babuk-derived encryptor that appends the.akira extension to encrypted files and drops Akira-style ransom notes, while researchers say it is not directly linked to the original Akira group. Security responders recommend thorough technical investigations, timely patching, strong endpoint protection, user phishing awareness, and regular offline backups to mitigate the threat.
Bank Trojan 'Casbaneiro' Worms Through Latin America

www.darkreading.com · 3 months ago

There are multipronged campaigns by a Brazil-linked cybercrime group known as Water Saci or Augmented Marauder that are delivering the Casbaneiro banking Trojan across Latin America and Spain via WhatsApp and email. These campaigns use judicial-summons lures with randomized, password-protected zip attachments to evade secure email gateways, and deploy a Horabot script that hijacks victims' email contacts to self-propagate phishing messages. Casbaneiro uses web overlays and keystroke logging to harvest credentials from major regional banks and payment and cryptocurrency platforms including Santander, Banco do Brasil and Binance, and its wormable, trusted-contact propagation reduces detection and complicates incident response.
ThreatsDay Bulletin: Pre-Auth Chains, Android Rootkits, CloudTrail Evasion & 10 More Stories

thehackernews.com · 3 months ago

There are two Progress ShareFile vulnerabilities CVE-2026-2699 and CVE-2026-2701 that can be chained to achieve preauthenticated remote code execution, allowing attackers to bypass authentication and upload web shells; fixes were issued in Storage Zone Controller 5.12.4 on March 10, 2026 and roughly 30,000 internet facing instances require patching. A new Android rootkit named NoVoice has been distributed through more than 50 apps with at least 2.3 million downloads, leveraging exploits for 22 Android flaws patched between 2016 and 2021 to gain root, inject attacker controlled code into apps, and persist, with highest concentrations in Nigeria Ethiopia Algeria India and Kenya. Adversaries are chaining lesser known AWS APIs to silently disable CloudTrail detections and erase forensic visibility, using calls such as PutEventSelectors StopEventDataStoreIngestion and DeleteEventDataStore to create invisible activity zones. Researchers also reported unpatched ImageMagick zero days that can be chained to enable remote code execution via a single image or PDF upload, and open source malware advisories have increased roughly 13.6 times since January 2024 highlighting escalating supply chain risk.
EvilTokens abuses Microsoft device code flow for account takeovers

www.csoonline.com · 3 months ago

A phishing as a service toolkit called EvilTokens is abusing Microsoft device code authorization flow to trick users into entering legitimate device codes on Microsoft login pages, allowing attackers to capture and use access tokens to take over Microsoft 365 accounts. Observed since at least mid February and distributed via Telegram bots and channels, the toolkit provides affiliates AI driven modules for access weaponization, email harvesting, reconnaissance, and a webmail interface, using lures such as fake SharePoint notifications, DocuSign requests, and account alerts. Captured tokens provide up to 60 minutes of direct access to Exchange Online, SharePoint, OneDrive, and Teams and can be redeemed to obtain new tokens for a rolling 90 day persistence, and researchers published phishing domain patterns, affiliate and admin domains, and a YARA rule to help detection.
Cisco Patches Critical and High-Severity Vulnerabilities

www.securityweek.com · 3 months ago

Cisco released fixes for two critical and six high severity vulnerabilities that could be exploited for authentication bypass, remote code execution, information disclosure, and privilege escalation. The critical flaws include CVE-2026-20160 in Smart Software Manager On-Prem which can be abused to execute arbitrary commands on the underlying operating system with root privileges, and CVE-2026-20093 which allows authentication bypass by sending crafted HTTP requests to modify user passwords including administrator accounts. Additional patches address a high severity defect in Evolved Programmable Network Manager, a privilege escalation issue in SSM On-Prem, and four Integrated Management Controller flaws impacting more than two dozen enterprise products including UCS C series and E series servers, and Cisco says it is not aware of exploitation in the wild.
Iranian Hacker Group Handal Claims Breach of Israeli Defense Firm

gbhackers.com · 3 months ago

Handala, an Iranian nation state threat actor, claims to have breached PSK Wind Technologies, a contractor that builds and delivers military command and control centers for the Israel Defense Forces. The breach resulted in publication of highly classified operational data including photographs of active command and control centers, internal documents, engineering schematics, product manuals, and photographs of communications equipment. By targeting a third party vendor in the defense supply chain, the actors bypassed military defenses and created immediate physical and operational security risks, giving rival intelligence detailed insight into how systems are built and operated. Cybersecurity researchers describe the volume of stolen data as massive and analysts are actively monitoring and assessing the long term impact on regional security.
250,000 Affected by Data Breach at Nacogdoches Memorial Hospital

www.securityweek.com · 3 months ago

About 250,000 people were notified that their personal and health information was compromised after a threat actor hacked Nacogdoches Memorial Hospital's internal network on January 31, 2026; the hospital told the Maine Attorney General that the hackers likely accessed information for 257,073 individuals. The potentially compromised data includes names, addresses, phone numbers, email addresses, Social Security numbers, dates of birth, medical record numbers, account numbers, health plan beneficiary numbers, and photographs. The hospital says it resecured its computer network, hardened security, notified law enforcement, is urging affected people to monitor their accounts, is not offering free identity or credit monitoring, and currently has no evidence that the stolen information has been misused.
Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners

thehackernews.com · 3 months ago

A financially motivated operation codenamed REF1695 has been using fake installers in ISO files since November 2023 to deploy remote access trojans and cryptocurrency miners, including a previously undocumented.NET implant called CNB Bot. The campaign uses a.NET Reactor protected loader that invokes PowerShell to configure Microsoft Defender exclusions and displays a bogus error while running payloads in the background, and operators have delivered PureRAT, PureMiner, a bespoke XMRig loader, and SilentCryptoMiner that persist via scheduled tasks and disable sleep and hibernate. The threat actor also monetizes infections through cost per action fraud with content locker pages, abuses GitHub to host staged payloads to reduce detection friction, employs a watchdog to restore removed artifacts, and is estimated to have accrued about 27 point 88 XMR across tracked wallets.
The State of Trusted Open Source Report

thehackernews.com · 3 months ago

There are insights from an analysis of over 2,200 unique container image projects, 33,931 vulnerability fix instances, and 377 unique CVEs covering December 1, 2025 through February 28, 2026. AI-driven development is expanding Python use to 72.1 percent of customers and drove a 73 percent quarter-over-quarter increase in PostgreSQL usage, while language ecosystems account for more than half of the top 25 images. Most vulnerabilities live in the long tail, with 96.2 percent of CVE instances occurring outside the top 20 images, yet median remediation time remained about 2.0 days and 97.9 percent of high severity issues were fixed within one week.
Fake CERT-UA Site Spreads Go-Based RAT in Phishing Campaign

gbhackers.com · 3 months ago

Hackers launched a targeted phishing campaign that cloned Ukraine's CERT-UA website and distributed a password-protected ZIP archive named CERTUAprotectiontool.zip or protectiontool.zip via Files.fm, delivering a Go-based remote access trojan called AGEWHEEZE. AGEWHEEZE provides extensive remote control including command execution, file and process management, screenshot capture, input simulation, clipboard access, persistence by installing into AppData directories and creating scheduled tasks named SvcHelper and CoreService, and communicates with its command and control server over WebSockets. CERT-UA linked the operation to threat actor UAC-0255 after a Telegram channel claimed responsibility, reported limited infections mostly on personal devices of education sector employees, and recommended enforcing application control policies, verifying email and download authenticity, blocking suspicious domains, monitoring outbound connections, and using endpoint protection.
You’re Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701) - watchTowr Labs

labs.watchtowr.com · 3 months ago

There are two vulnerabilities in Progress ShareFile Storage Zone Controller tracked as CVE-2026-2699 and CVE-2026-2701 that can be chained to achieve pre authenticated remote code execution. CVE-2026-2699 is an authentication bypass caused by the application issuing a redirect without terminating execution which exposes the administrative configuration page, and CVE-2026-2701 allows an attacker to repoint a storage zone to the webroot and abuse file upload endpoints to place and execute a webshell. The flaws affected StorageCenter version 5.12.3, were fixed in version 5.12.4 released March 10, 2026, roughly 30,000 internet facing instances may be exposed, and a simple detection looks for the Admin endpoint returning a 302 response while delivering a response body larger than ten thousand characters.
Critical Cisco IMC auth bypass gives attackers Admin access

www.bleepingcomputer.com · 3 months ago

Cisco released security updates to address several critical and high severity vulnerabilities, including an Integrated Management Controller authentication bypass that enables unauthenticated attackers to gain Admin access. The IMC flaw tracked as CVE-2026-20093 is caused by incorrect handling of password change requests and can be exploited by sending a crafted HTTP request to alter any user password and obtain Admin privileges, and Cisco says there are no workarounds so customers are strongly advised to upgrade. Cisco also patched CVE-2026-20160, a critical Smart Software Manager On-Prem vulnerability that can lead to unauthenticated remote code execution as root, and previously fixed CVE-2026-20131 which has been observed exploited in the wild.
4 unpatched CVEs in CrewAI chain prompt injection → sandbox bypass → RCE on host

kb.cert.org · 3 months ago

A researcher disclosed a vulnerability chain in CrewAI's Python multi-agent framework that allows prompt injection against agents with the Code Interpreter tool enabled. The chain includes CVE-2026-2275 where Code Interpreter silently falls back to SandboxPython allowing arbitrary C function calls and remote code execution, CVE-2026-2287 where Docker availability is not continuously verified enabling attackers to trigger the fallback mid-execution, CVE-2026-2285 where a JSON loader reads files without path validation enabling arbitrary local file read, and CVE-2026-2286 where RAG search tools do not validate runtime URLs enabling server side request forgery to internal services and cloud metadata endpoints. Any CrewAI deployment running the Code Interpreter tool where Docker is not guaranteed to be available or using the default unsafe configuration is at risk, and maintainers are working on mitigations including failing closed, blocking C modules, and clearer warnings but no full patch or CVSSv3 scores have been released yet.
Mercor Hit by LiteLLM Supply Chain Attack

www.securityweek.com · 3 months ago

AI recruiting firm Mercor disclosed it was impacted by the LiteLLM supply chain attack that originated from a Trivy compromise on March 27, 2026. Attackers using a maintainer’s compromised credentials published malicious LiteLLM PyPI package versions 1.82.7 and 1.82.8 that were available for roughly 40 minutes and were likely automatically downloaded by thousands of environments, with LiteLLM estimated to be present in 36 percent of cloud environments. Mercor said it is investigating with third party forensics while extortion group Lapsus$ has claimed and listed the theft of over four terabytes of data and is auctioning candidate profiles, personally identifiable information, user credentials, video interviews, source code, keys, and TailScale VPN data, though Mercor has not independently confirmed those claims.
RFQ Malware Campaign Uses DOCX, RTF, JS, and Python

gbhackers.com · 3 months ago

Hackers are abusing DOCX, RTF, JavaScript, PowerShell, and Python to deliver an in memory Cobalt Strike beacon through a six stage spear phishing campaign that impersonates Boeing procurement under the tag NKFZ5966PURCHASE. The chain uses Word aFChunk to embed large RTFs containing hex encoded OOXML that unwraps OLE objects with obfuscated JavaScript droppers which spawn PowerShell, disable TLS certificate validation, and download a ZIP from Filemail that unpacks a full Python 3.12 runtime and an encrypted DLL loaded reflectively. All analyzed samples reuse identical AES and XOR keys and share unsanitized document metadata and an old RFQ template, while persistence is achieved by adding a Realtek like Run key that launches the loader via the signed SyncAppvPublishingServer.vbs script. Defensive actions include detecting aFChunk embedded RTFs and large RTFs with hidden hex blobs, monitoring for unexpected Python runtimes in user profiles, and hunting for suspicious Run keys chained to SyncAppvPublishingServer.vbs.
Possible US Government iPhone Hacking Tool Leaked

www.schneier.com · 3 months ago

There is a powerful iPhone exploit toolkit called Coruna that contains five complete exploit chains and 23 distinct vulnerabilities capable of bypassing iOS defenses to silently install malware via malicious web content. The toolkit appears to have moved from a surveillance vendor customer to state linked actors and financially motivated criminals, suggesting a well resourced origin and a leak that put advanced tooling into wider circulation. Affected iOS versions include 13.0 through 17.2.1 and notable tracked CVEs include CVE-2021-30952, CVE-2023-41974, CVE-2023-43000, CVE-2024-23222 and CVE-2023-43010. Updating to the latest iOS releases and enabling Apple Lockdown Mode are effective mitigations against these exploit chains.
Sophisticated CrystalX RAT Emerges

www.securityweek.com · 3 months ago

There is a new malware as a service called CrystalX RAT that combines spyware, stealer, and remote access capabilities and was promoted on Telegram after emerging in January under the name Webcrystal RAT. It is written in Go, uses a WebSocket to connect to its command and control server, harvests system information and credentials from Discord, Steam, Telegram, and Chrome based browsers, and includes a keylogger, clipboard access, and clipper injection for Chrome and Edge. The control panel offers an auto builder with geo blocking and anti analysis, can generate compressed and encrypted implants, and provides operators with commands to upload files, browse and execute commands, remotely control the screen via an integrated VCN, and capture audio and video while blocking user input. The malware has infected dozens of individuals so far mainly in Russia, but it has no regional restrictions, is actively being developed with new implant versions, and a growing promotion campaign could expand its victim count globally.
WhatsApp Alerts 200 Users After Fake iOS App Installed Spyware; Italian Firm Faces Action

thehackernews.com · 3 months ago

WhatsApp alerted about 200 users after a fake iOS app infected with spyware was installed, with the vast majority of targets located in Italy. Threat actors used social engineering to trick users into installing a counterfeit WhatsApp app; affected accounts were logged out and users were advised to uninstall the malicious app and download the official WhatsApp app. WhatsApp said it is taking action against Asigint, an Italian subsidiary of spyware firm SIO accused of creating the counterfeit, and SIO has previously marketed surveillance tools to law enforcement and been linked to Android apps deploying a spyware family known as Spyrtacus.
NoVoice on Google Play Exploits 22 Flaws to Hit Millions of Android Users

gbhackers.com · 3 months ago

NoVoice is an Android rootkit campaign that hid in more than 50 Google Play apps and accumulated at least 2.3 million downloads before removal. It exploits 22 vulnerabilities patched between 2016 and 2021 to gain root on older and unpatched devices, uses polyglot images to hide encrypted APK payloads, and installs a system partition rootkit that replaces critical libraries to inject code into every app. Operators used 22 exploit binaries including IPv6 use after free and Mali GPU driver flaws to disable SELinux, enable silent app installation and data theft, and exfiltrate WhatsApp encrypted databases and identity keys to clone sessions; McAfee reported the campaign and Google removed the apps.
CISA Issues Alert on Chrome Zero-Day Under Active Exploitation

gbhackers.com · 3 months ago

There is a critical zero-day vulnerability affecting Google Chrome and other Chromium-based web browsers, tracked as CVE-2026-5281. The U.S. Cybersecurity and Infrastructure Security Agency issued an urgent warning and added the flaw to its Known Exploited Vulnerabilities catalog because attackers are actively exploiting it in real-world attacks.
Microsoft links Classic Outlook issue to email delivery problems

www.bleepingcomputer.com · 3 months ago

Microsoft is investigating a known issue that prevents some Classic Outlook users from sending emails via Outlook.com, with affected users receiving a non delivery report that reads you do not have the permission to send the message on behalf of the specified user and shows error code 0x80070005-0x0004dc-0x000524. The issue occurs more often when the Outlook.com account is an Outlook profile linked to another Exchange account and may also be triggered if the sender account has an Exchange Online mail contact with the same SMTP address. Microsoft recommends temporary workarounds including removing the Microsoft 365 account address book so the Outlook client does not check it when sending mail, hiding the Outlook.com contact from the tenant global address list, creating a new classic Outlook profile that only includes the affected account, or using the New Outlook client or Outlook on the web while a fix is sought.
Europe Pushes for a Gentler Internet for Children

www.nytimes.com · 3 months ago

false
Apple Releases iOS 18.7.7 Update to Defend Against DarkSword Exploit

gbhackers.com · 3 months ago

Apple expanded the rollout of iOS 18.7.7 and iPadOS 18.7.7 to defend users against a critical web based threat called the DarkSword exploit, originally released on March 24, 2026, and aggressively pushed to more devices via Automatic Updates on April 1, 2026. The update delivers mandatory web attack protections and patches over 15 significant security flaws across devices back to the iPhone XR and multiple iPad generations. Notable fixes include CVE-2026-20687, CVE-2026-20643, CVE-2026-28864, CVE-2026-28866, CVE-2026-28865, CVE-2025-43376, CVE-2026-28880 and CVE-2026-28878 addressing kernel use after free, WebKit cross origin and DNS leak issues, keychain and clipboard access problems, network authentication flaws, and permission errors that could let rogue apps enumerate installed software. Users are strongly advised to install the update immediately via Settings General Software Update or to allow the automatic installation.
Worried About A.I. Taking Your Job? That’s Not Very ‘Agentic’ of You.

www.nytimes.com · 3 months ago

false
Axios npm Supply Chain Breach: Microsoft Shares Mitigation Steps

gbhackers.com · 3 months ago

On March 31, 2026 two malicious Axios npm releases, versions 1.14.1 and 0.30.4, included a hidden dependency that executed at install time and has been attributed to the North Korean actor Sapphire Sleet. The installer contacted attacker command and control infrastructure on port 8000 at IP 142.11.206.73 and fetched platform specific remote access payloads, dropping a native macOS binary, a Windows PowerShell RAT that persists via a hidden Run registry key, and a Python loader for Linux. Recommended mitigations include rotating exposed secrets and credentials, downgrading to safe Axios versions 1.14.0 or 0.30.3 and removing malicious artifacts, pinning exact dependency versions and disabling automatic upgrades, reviewing CI CD install logs for the compromised versions or the rogue dependency plain crypto js, monitoring outbound connections to the identified C2 infrastructure, and adopting trusted publishing with OIDC to remove long lived npm tokens.
A.I. Could Change the World. But First It Is Changing Silicon Valley.

www.nytimes.com · 3 months ago

false
Cybersecurity in the age of instant software

www.csoonline.com · 3 months ago

AI is rapidly changing how software is written, deployed, and used, creating a future of ephemeral instant software that can be generated on demand and may coexist with traditional long lived applications. These AI capabilities are accelerating vulnerability discovery and exploitation, especially against open source libraries and low quality IoT and industrial software, while defenders can also use AI to find and patch flaws. Significant uncertainties remain about how well AIs will write secure code, how reliably they can create and deploy patches for legacy systems, and whether organizations will be able to install updates fast enough to close attack windows. If defenders can coordinate and automate patching and detection, networks could trend toward self healing, but attackers will shift to social engineering, credential theft, and manipulating defensive AIs through poisoning and prompt attacks.
Over 14,000 F5 BIG-IP APM instances still exposed to RCE attacks

www.bleepingcomputer.com · 3 months ago

Shadowserver reports that more than 14,000 F5 BIG-IP Access Policy Manager instances remain exposed online while attackers exploit a critical remote code execution vulnerability. The flaw was reclassified in March 2026 from a denial of service to remote code execution and is tracked as CVE-2025-53521. F5 warns that unauthenticated attackers can gain remote code execution on unpatched systems with access policies on a virtual server and has published indicators of compromise and guidance to check logs, disks, and terminal history and to rebuild affected devices from known good sources. The U S Cybersecurity and Infrastructure Security Agency added the vulnerability to its actively exploited list and ordered federal agencies to secure BIG-IP APM systems by the agency deadline.
FBI Warns Chinese Mobile Apps Could Expose User Data to Cyberattacks

gbhackers.com · 3 months ago

There is a public warning that foreign-developed mobile applications, particularly those from companies based in China, can expose user data because such apps may operate under national security laws that permit government access to data. Many apps request broad permissions that, once granted, can continuously collect sensitive personal information including contact lists and may store that data on servers in China for indefinite or unspecified periods. Some apps may embed malicious code capable of exploiting mobile operating system vulnerabilities to install backdoors, escalate privileges, and download additional malicious components, and apps from unofficial third-party stores carry significantly higher risk. To reduce exposure, users are advised to disable unnecessary permissions, download apps only from official stores, use strong authentication, keep devices updated with the latest patches, review privacy policies, and report suspected compromises to the Internet Crime Complaint Center.
New ZAP PTK Add-On Converts Browser Security Findings Into Native ZAP Alerts

gbhackers.com · 3 months ago

A new ZAP PTK Add-on 0.3.0, used with OWASP PenTest Kit 9.8.0, converts browser based security findings into native ZAP alerts and adds 142 PTK tagged alert types to the ZAP dashboard. There are three major features: native ZAP alerts for client side findings, custom rule selection between SAST, IAST, and DAST engines, and optional auto start scanning when the ZAP browser launches. The add on runs inside browsers launched by ZAP to monitor runtime signals and client side code, enabling detection of DOM based Cross Site Scripting, tainted inputs reaching sensitive DOM operations, unsafe innerHTML usage, and dangerous third party scripts that standard proxy scans miss.