Blahalla

ClawHavoc Attack Hits ClawHub With 1,184 Malicious Skills and 247,000 Installations

gbhackers.com · 3 months ago

The AI-agent ecosystem experienced its largest supply-chain compromise to date when ClawHavoc detonated across ClawHub, the official skill marketplace for OpenClaw. Our full AIG-powered scan of nearly 50,000 ClawHub Skills found 1,184 clearly malicious packages tied to 12 compromised publisher accounts and confirmed 247,693 installations.

OpenAI and Anthropic Limit New AI Models to Trump-Approved Customers During Cybersecurity Review

www.securityweek.com · 3 months ago

ChatGPT maker OpenAI said Friday it is restricting the release of its new artificial intelligence model at the request of President Donald Trump’s administration.

Langflow RCE Vulnerability Exploited to Deploy Monero Cryptominer on Exposed AI Servers

gbhackers.com · 3 months ago

Threat actors are actively exploiting CVE-2026-33017, a critical unauthenticated remote code execution (RCE) vulnerability in Langflow, to compromise internet-exposed AI application servers and silently deploy a customized Monero (XMR) cryptominer.

US Offers $10 Million Bounty for Russian State Hackers as Messaging App Attacks Evolve

www.securityweek.com · 3 months ago

UNC5792 and UNC4221 have been targeting US government officials, military leaders, and allied personnel.

New Windows Injection Technique Hijacks Win32k Callback Dispatch to Execute Shellcode

gbhackers.com · 3 months ago

A newly documented injection technique abuses the kernel-to-user callback dispatch path used by the Windows graphical subsystem (win32k.sys) to achieve remote code execution while leaving the KernelCallbackTable structurally intact.

Critical Dell Wyse Management Suite Vulnerabilities Let Attackers Execute Remote Code

gbhackers.com · 3 months ago

Dell Technologies has disclosed several critical vulnerabilities in its Wyse Management Suite (WMS) that could enable remote attackers to execute arbitrary code and fully compromise affected systems. Identified under advisory DSA-2026-225, these flaws affect WMS versions prior to 5.

A.I. ‘Employees’ Might Disrupt Work in Unexpected Ways

www.nytimes.com · 3 months ago

Scholars say the “unknown unknowns” of using artificial intelligence in the workplace may be undermining the technology’s advertised benefits.

FBI and CISA Warn Russian Hackers Stealing Verification Codes and Account PINs From Signal Users

gbhackers.com · 3 months ago

U.S. cybersecurity authorities have issued a new warning about Russian intelligence-linked threat actors targeting secure messaging platforms, specifically highlighting the increased risk for Signal users. These threat actors are employing sophisticated phishing campaigns designed to steal verification codes and account PINs.

AI-Generated Mythic Agents Challenge Static Signatures and Traditional Implant Detection

gbhackers.com · 3 months ago

The emergence of LLM-driven “disposable tooling” is reshaping offensive tradecraft and forcing defenders to rethink detection models that rely on static signatures and known implant behaviors.

Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts

thehackernews.com · 3 months ago

Microsoft has shut down a long-running malicious extension operation on the Edge Add-ons store that hid its payloads inside ordinary image and font files, then woke up days after install to steal credentials and run ad fraud. The company calls it StegoAd, a mash-up of steganography and adware, and ties 119 extensions to a single threat actor it says has been active since at least 2021.

Critical Google Gemini CLI Flaw Lets Attackers Execute Code on Headless CI Platforms

gbhackers.com · 3 months ago

A critical vulnerability has been identified in Google’s Gemini CLI and the associated run-gemini-cli GitHub Action. This flaw exposes headless continuous integration (CI) platforms to potential host-level code execution when processing untrusted workspaces. It is tracked as CVE-2026-12537, with the advisory identifying it as GHSA-wpqr-6v78-jr5g.

OpenAI Unveils GPT-5.6 Sol as Its Most Advanced Cybersecurity AI

www.securityweek.com · 3 months ago

The company says Sol matches competing systems like Mythos Preview while using only a third of the output tokens.

Microsoft 365 Apps RCE Vulnerability Lets Attackers Execute Code via Malicious Excel Files

gbhackers.com · 3 months ago

A newly disclosed remote code execution (RCE) vulnerability in Microsoft 365 Apps is raising concerns in enterprise environments. Attackers can exploit malicious Excel documents to execute arbitrary code on target systems.

Ghostwriter Hackers Use Real-Time WebSocket Relay to Bypass SMS and OTP MFA

gbhackers.com · 3 months ago

UNC1151 tracked by many as Ghostwriter or FrostyNeighbor has advanced a credential-phishing technique that uses a real-time WebSocket relay to defeat SMS and OTP-based multi-factor authentication (MFA).

Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw

thehackernews.com · 3 months ago

A public proof-of-concept is now out for CVE-2026-55200, a critical flaw in libssh2 that lets a malicious or compromised SSH server trigger memory corruption on a connecting client, with possible code execution. No credentials, no user interaction. The bug affects every release up to and including 1.11.1 and carries a CVSS 4.0 score of 9.2. libssh2 is a client-side SSH library, not a server.

DOJ Seizes Nearly 400 Domains Used for Illegal World Cup Streaming and Malware Threats

gbhackers.com · 3 months ago

The U.S. Department of Justice (DOJ) has announced the seizure of nearly 400 internet domains used to stream FIFA World Cup 2026 matches illegally. This operation represents one of the largest coordinated anti-piracy enforcement actions related to a global sporting event.

Millenium RAT Uses Base64 and XOR Configuration to Hide Telegram C2 Settings

gbhackers.com · 3 months ago

Millenium RAT version 4. exposes a compact but potent evolution: the malware has migrated from.NET to native C++, while retaining a stealthy Telegram-based command-and-control (C2) model that requires no bespoke server infrastructure.

DCloud Uni-App Framework Powers 236,000+ Scam Domains Across Global Fraud Economy

gbhackers.com · 3 months ago

DCloud Uni-App has become a mass-production layer for fraud, with more than 236,000 distinct scam domains tied to a sprawling ecosystem of fake exchanges, wallet drainers, phishing portals, and investment schemes.

Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer

thehackernews.com · 3 months ago

Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts.

China’s Zhipu AI Model GLM-5.2 Detects Software Vulnerabilities Like Claude Mythos

gbhackers.com · 3 months ago

Zhipu AI’s newly released GLM-5.2 model is attracting significant attention from the cybersecurity community due to its vulnerability detection capabilities, which are comparable to those of Anthropic’s restricted Claude Mythos system. This development raises new concerns about the effectiveness of U.S. export control policies on advanced artificial intelligence.

OpenAI Launches GPT-5.6 Sol AI Model With Advanced Cyber Capabilities And Layered Safeguards

gbhackers.com · 3 months ago

OpenAI has announced the limited preview of its next-generation AI model family, GPT‑5.6, headlined by the flagship “Sol” model, which introduces significant advancements in cybersecurity capabilities alongside a newly engineered layered safeguard architecture. The release, disclosed on June 26, 2026, positions GPT‑5.

Rokarolla Uses Fake Google Play Protect App to Target Banking and Cryptocurrency Users

gbhackers.com · 3 months ago

Rokarolla, a sophisticated Android banking trojan distributed via malicious websites that masquerade as trusted applications such as TikTok, Google Chrome and even Google Play Protect.

WinPE as a stateless harness for Windows driver testing and fuzzing

bednars.me · 3 months ago

Eliminate the overhead and lack of idempotency of a full Windows system in automated testing. A practical guide to configuring WinPE and QEMU for lightning-fast boot, automating kernel debugging, and avoiding KDNET pitfalls.

Data breach exposes up to 14.2 million email logins at six ISPs

www.bleepingcomputer.com · 3 months ago

Japanese telecommunications operator KDDI Corporation disclosed a data breach where threat actors gained access to one of its email systems used by five other internet service providers (ISPs) in the country.

50 Chrome extensions. One codebase. One backend. One API key.

malext.io · 3 months ago

I reverse engineered a white-label WhatsApp CRM platform distributed across 50 Chrome Web Store extensions (~15,500 installs at the time of analysis). Every analyzed extension shares the same codebase, backend infrastructure, Firebase project, and hardcoded API key.

Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials

thehackernews.com · 3 months ago

The Security Service of Ukraine (SSU) said it, together with the U.S. Federal Bureau of Investigation (FBI), uncovered a long-running campaign orchestrated by Russian intelligence services to break into the messaging accounts of government officials, military personnel, politicians, and activists in Ukraine, Europe, and the U.S.

Clean GitHub repo tricks AI coding agents into running malware

www.bleepingcomputer.com · 3 months ago

An agentic coding tool tasked with running a seemingly benign GitHub repository could execute a malicious payload that is invisible to both security agents and human reviewers.

OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards

thehackernews.com · 3 months ago

OpenAI released three versions of GPT-5.6 Sol, Terra, and Luna to select companies as part of an ongoing U.S. government engagement. Sol serves as the flagship model, representing the most powerful capability. Terra balances efficiency with raw power, while Luna fine-tunes for optimal speed and affordability.

Chinese Framework Powers 200,000 Scam Sites

www.securityweek.com · 3 months ago

Infoblox found over 236k scam Uni-App websites using a Chinese framework for phishing/gambling. These domains show coordinated, centralized management since mid-2022.

Third-Party Breaches Teach Education Sector a Costly Lesson in Vendor Risk

www.darkreading.com · 3 months ago

Rising threats from third-party actors are forcing institutions to play defense to protect student data from ransomware and other attacks.

Slow JSON Stream: 64 connections at 1 B/s takes down PHP/Laravel in under 2 minutes

blog.cr0hn.com · 3 months ago

Researchers detailed Slow JSON Stream, a low-bandwidth DoS attack targeting HTTP JSON readers. It uses Transfer-Encoding: chunked to exhaust resources by streaming valid JSON prefixes without closing tokens, bypassing header timeouts. No CVE or victim counts were provided in this summary. The attack forces server threads to wait indefinitely while parsing incomplete requests.

Claude Mythos 5 Redeployed to Help U.S. Organizations Strengthen Cyber Defense

gbhackers.com · 3 months ago

Anthropic restored access to Claude Mythos 5 for U.S. organizations defending critical national infrastructure. This reinstatement ends a two-week suspension that began June 12, 2026, following high-level engagement with federal authorities. The LLM assists CISA sectors by detecting emerging network threats and accelerating incident response workflows.

Critical Linux Kernel Flaw Allows Unprivileged Users to Gain Full Root Access

gbhackers.com · 3 months ago

Pedit COW (CVE-2026-46331) lets unprivileged users get root via Linux kernel Copy-on-Write error in traffic control. The exploit corrupts page-cache to overwrite binaries, bypassing integrity tools on kernels v5.18 thru v7.1-rc7. Attackers can gain full root access.

Cloud Bucket Hijacking Lets Attackers Silently Exfiltrate AWS, Google Cloud Data

gbhackers.com · 3 months ago

Palo Alto Networks Unit 42 found cloud bucket hijacking across AWS, GCP, Azure. Attackers compromise a bucket then reclaim its global name in another account, silently rerouting data, including audit logs, to attackers.

Linux Kernel DirtyClone Vulnerability Lets Local Attackers Gain Root Privileges

gbhackers.com · 3 months ago

A critical Local Privilege Escalation flaw, designated CVE-2026-43503, affects the Linux kernel’s XFRM/IPsec subsystem. This vulnerability exploits the packet-processing path, enabling unprivileged local users to gain root access. The flaw successfully bypasses earlier system mitigations.

Amazon Q Developer Vulnerability Allows Code Execution via Malicious Repositories

gbhackers.com · 3 months ago

Wiz found Amazon Q Developer Extension flaws in VS Code allowing arbitrary code execution/credential theft. Malicious files exploit this for AWS key theft across CVE-2026-12957, CVE-2026-12958, and CVE-2025-54136.

U.S. Loosens Restrictions on Anthropic’s Mythos A.I. Model

www.nytimes.com · 3 months ago

The move de-escalates a clash between the Trump administration and the company over its cutting-edge artificial intelligence systems.

Hackers exploit critical PTC Windchill PLM software flaw

www.csoonline.com · 3 months ago

Hackers are exploiting a critical vulnerability recently patched in PTC Windchill and FlexPLM, two product lifecycle management solutions used by organizations across a range of industries, including defense, aerospace, automotive, medical, electronics, industrial machinery, and consumer goods.

FBI: Russian hackers now target Signal backup recovery keys

www.bleepingcomputer.com · 3 months ago

The FBI and CISA are warning that a phishing campaign targeting Signal users tied to Russian intelligence services has evolved to steal Signal Backup Recovery Keys, allowing attackers to access victims' historical messages.

The Chinese Control the Majority of Argentina’s Squid Fleet

www.schneier.com · 3 months ago

Chinese companies control nearly two-thirds of Argentina’s own squid fleet.

Mark Zuckerberg Urges Meta to Explore Working With Polymarket and Kalshi

www.nytimes.com · 3 months ago

Mr. Zuckerberg’s plans for Arena, a prediction markets app that Meta is building, also include appealing to 18- to 34-year-old users.

CISA sets urgent deadline to fix Cisco flaw exploited in attacks

www.bleepingcomputer.com · 3 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is giving federal agencies until Sunday to patch a vulnerability in Cisco Unified Communications Manager Server that is being actively exploited.

FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys

thehackernews.com · 3 months ago

The FBI and CISA have updated their March warning about Russian intelligence phishing Signal accounts, and the operators have added a step: they now coax targets into handing over their Signal Backup Recovery Key. Hand it over once, and the attacker can restore the account's backup, read the private and group message history, and take over the account. Worse, the key keeps working.

AI Decline? Confidence in Autonomous Penetration Testing Falls

www.darkreading.com · 3 months ago

Companies are still experimenting with automated AI systems to find security weaknesses, but fewer are relying on the technology.

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

thehackernews.com · 3 months ago

A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.

Polymarket customers lose $3 million in supply-chain attack

www.bleepingcomputer.com · 3 months ago

Polymarket says it will fully reimburse customers who lost an estimated $3 million after hackers injected a malicious script into the platform's frontend following a breach at a third-party vendor.

Cybersecurity firms targeted by fraudulent OpenAI organization invites

www.bleepingcomputer.com · 3 months ago

Threat actors are creating OpenAI tenants that impersonate legitimate companies and inviting employees to join them, in what appears to be a ploy to trick targets into submitting sensitive company information in chats and projects.

Cisco Adds NHI to Security Stack With Astrix, WideField Acquisitions

www.darkreading.com · 3 months ago

Cisco joins a growing list of security platform providers who are betting that securing the agentic workforce means turning identity into the primary control plane.

Hackers Claim French Employment Leak Exposes Over 1M Records, Health Data

www.techrepublic.com · 3 months ago

Hackers claim 1M+ records tied to French employment apps were exposed, including HR files, health data, worker details, and plaintext passwords.

New License Plate Reader Tech Could Track Phones, AirPods, and Smartwatches

www.techrepublic.com · 3 months ago

Leonardo’s SignalTrace adds wireless device detection to ALPR systems, raising new questions about roadside surveillance, privacy, and security.