Blahalla

Backdoored Telnyx PyPI package pushes malware hidden in WAV audio

www.bleepingcomputer.com · 4 months ago

Hackers attributed to the TeamPCP group have compromised the Telnyx package on the Python Package Index, distributing malicious versions 4.87.1 and 4.87.2. The malware steals sensitive information like SSH keys, credentials, and cryptocurrency wallets, and it persists across reboots on Windows systems. The attackers hid malicious code inside WAV audio files using steganography to avoid detection. Users are advised to revert to version 4.87.0 and rotate any potentially compromised secrets.

European Commission data stolen in a cyberattack on the infrastructure hosting its web sites

www.csoonline.com · 4 months ago

The European Commission experienced a cyberattack resulting in the theft of over 350 gigabytes of data from its cloud infrastructure. While the Commission states its internal IT systems were unaffected and services remain available, a threat actor claims responsibility and intends to release the stolen data to cause reputational damage. Security experts suggest the incident highlights the complexities of identity and access management and the increasing risk of politically motivated cyberattacks. The incident follows a previous cyberattack impacting the Commission’s mobile device infrastructure earlier this year.

In ‘The AI Doc,’ Sam Altman and Dario Amodei Go on the Record

www.nytimes.com · 4 months ago

There are reports that The AI Doc Or How I Became an Apocaloptimist attempts to survey the full spectrum of the AI debate by positioning its director as a proxy for the public and embracing a middle ground the filmmakers call apocaloptimism. Critics say the film tries to cover so much that it becomes confusing and at times toothless, even as select interviews and visual sequences remain fascinating. The documentary features interviews with industry leaders including OpenAI CEO Sam Altman, Google DeepMind CEO Demis Hassabis and Anthropic co founder Dario Amodei, premiered at Sundance and is scheduled for theatrical release on March 27, 2026.

Friday Squid Blogging: Bioluminescent Bacteria in Squid

www.schneier.com · 4 months ago

false

How Microsoft Defender protects high-value assets in real-world attack scenarios

www.microsoft.com · 4 months ago

false

Elon Musk Joins in Phone Call Between Donald Trump and Narendra Modi

www.nytimes.com · 4 months ago

false

Lloyds Bank reveals how IT bug exposed transaction data

www.csoonline.com · 4 months ago

Lloyds Bank recently experienced a technical glitch within its mobile banking application. An overnight IT change resulted in some customers briefly seeing transaction details of other customers, affecting approximately 447,936 users and potentially exposing details to 114,182 customers. The bank attributes the problem to a design defect in the Application Programme Interface used by the app. Lloyds states that no customer experienced full account access and no financial loss was identified, and relevant authorities have been notified.

Apple Sends Lock Screen Alerts to Outdated iPhones Over Active Web-Based Exploits

thehackernews.com · 4 months ago

Apple is now alerting users with lock screen notifications about active web-based attacks targeting older iPhone and iPad software. These attacks utilize exploit kits like Coruna, which targets iOS versions 13.0 to 17.2.1, and DarkSword, which targets iOS versions 18.4 to 18.7. These kits are linked to previous sophisticated campaigns and raise concerns about the accessibility of exploits, potentially increasing the attack surface of Apple devices. Users unable to update are advised to enable Lockdown Mode, introduced in iOS 16.

TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files

thehackernews.com · 4 months ago

The threat actor TeamPCP has compromised the telnyx Python package, pushing malicious versions 4.87.1 and 4.87.2 to PyPI. These versions conceal credential harvesting capabilities within WAV files, targeting Windows, Linux, and macOS systems. On Windows, a malicious executable is dropped into the Startup folder for persistence, while Linux and macOS versions employ a "smash-and-grab" approach to quickly collect and exfiltrate data. The attack utilizes audio steganography to hide the payload and demonstrates a broader trend of threat actors targeting open-source tools with elevated access for supply chain attacks.

Fake VS Code alerts on GitHub spread malware to developers

www.bleepingcomputer.com · 4 months ago

A widespread campaign is targeting developers on GitHub by posting fake Visual Studio Code security alerts in project discussions. These alerts, often including false CVE IDs, are designed to trick developers into downloading malware from external links, such as Google Drive. Clicking these links initiates a process that gathers information about the victim's system before delivering a second-stage payload. Researchers advise developers to verify alerts with official sources and be wary of suspicious links and mass tagging.

China Upgrades the Backdoor It Uses to Spy on Telcos Globally

www.darkreading.com · 4 months ago

Chinese threat actors linked to the Red Menshen group have upgraded a sophisticated backdoor called BPFdoor, which infiltrates telecommunications systems and other critical infrastructure networks globally. The malware now hides trigger phrases within seemingly harmless HTTPS requests to evade detection by firewalls and inspection tools. Attackers are also using ICMP pings to send targeted commands between infected machines, allowing precise control over compromised systems and minimizing detection. Researchers advise organizations to actively hunt for the malware, as many remain unaware of the threat.

Pro-Iranian Hacking Group Claims Credit for Hack of FBI Director Kash Patel’s Personal Account

www.securityweek.com · 4 months ago

A pro-Iranian hacking group called Handala has claimed responsibility for compromising the personal account of FBI Director Kash Patel. The group posted photographs and documents, some dating back over a decade, including a resume and travel records. The FBI confirmed a breach of Patel’s personal email account, and this incident follows a pattern of Handala targeting organizations as retaliation for perceived U.S. actions. The Justice Department recently seized web domains linked to Iranian hacking schemes, including those associated with Handala.

U.S. Accuses NewYork-Presbyterian of Reaching Deals That Kept Costs High

www.nytimes.com · 4 months ago

The Department of Justice sued NewYork-Presbyterian, accusing the health system of using contract restraints that blocked insurers from steering patients to lower cost plans and thereby kept hospital prices elevated. The complaint alleges the system required insurers to include all NewYork-Presbyterian facilities across every product and limited price transparency, practices referred to as all products clauses and anti steering restraints. Federal lawyers say those restrictions harmed competition and drove up costs for employers, unions, and patients and seek court orders to halt the practices and restore competitive choices. The legal action follows prior investigations and private lawsuits over similar conduct and could lead to court orders or settlements that reshape hospital contracting in New York.

Wartime Usage of Compromised IP Cameras Highlight Their Danger

www.darkreading.com · 4 months ago

Recent conflicts have seen a significant shift in how compromised IP cameras are utilized, moving beyond botnets and privacy breaches to become critical tools for intelligence gathering and targeted attacks. Joint US-Israeli forces reportedly used hacked Iranian traffic cameras to track and ultimately target a leader, prompting Iran to expand its efforts to compromise devices in neighboring countries. Cybersecurity experts warn that organizations must prioritize patching vulnerabilities and securing default credentials to prevent exploitation, as opportunistic attacks targeting exposed devices are becoming increasingly common. Legacy devices and those inadvertently connected to the internet pose a significant risk, requiring proactive scanning and robust security measures.

Judge Stays Pentagon’s Labeling of Anthropic as ‘Supply Chain Risk’

www.nytimes.com · 4 months ago

false

In Other News: Palo Alto Recruiter Scam, Anti-Deepfake Chip, Google Sets 2029 Quantum Deadline

www.securityweek.com · 4 months ago

Several cybersecurity incidents have recently occurred. Los Angeles Metro systems experienced a disruption with unauthorized access, though no data compromise was reported, and a ransomware group claimed responsibility. A phishing campaign targeting Signal and WhatsApp accounts, potentially linked to Russian intelligence, has compromised thousands of accounts. Additionally, Intoxalock, a breathalyzer firm, suffered a cyberattack impacting vehicle operation, while Heritage Bank disclosed a data breach involving employee and customer information. Researchers at ETH Zurich have developed a chip to verify media authenticity, and Google is accelerating its transition to quantum-safe encryption by 2029. Finally, scammers are impersonating Palo Alto Networks recruiters to solicit funds from job applicants.

AI Upgrades, Security Breaches, and Industry Shifts Define This Week in Tech

www.techrepublic.com · 4 months ago

This week in tech saw significant advancements in artificial intelligence alongside growing security concerns. Google introduced Gemini 3.1 Flash Live and is testing AI-generated search headlines, while Microsoft launched MAI-Image-2 and Apple released iOS 26.4, which includes updates and patches 76 security vulnerabilities. Several data breaches occurred, including incidents affecting Crunchyroll and Navia Benefit Solutions, and a leaked exploit kit, DarkSword, puts older iPhones at risk, advising users to update to iOS 26.3.1 or 18.7.3. TP-Link patched a critical authentication bypass flaw, CVE-2025-15517, in its Archer routers.

Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

thehackernews.com · 4 months ago

Researchers discovered a vulnerability, nicknamed Open Sesame, in Open VSX, a service used for VS Code extensions, allowing malicious extensions to bypass security checks. The flaw stemmed from a design issue where scan failures were misinterpreted as a lack of scanner configuration, permitting extensions to be published without proper vetting. Attackers could exploit this by overwhelming the system, triggering scan job failures and ultimately bypassing the entire scanning process. The vulnerability has been patched in version 0.32.0, and highlights the importance of explicitly distinguishing between successful and failed scan states.

OpenAI Launches Bug Bounty Program for Abuse and Safety Risks

www.securityweek.com · 4 months ago

OpenAI has launched a public safety bug bounty program to address AI-specific abuse and safety risks. The program complements their existing security program and covers areas like prompt injection, data exfiltration, and harmful actions by AI products. Researchers can be rewarded up to $7,500 for reports detailing high-severity, reproducible issues with recommended mitigations, though reward amounts are at OpenAI’s discretion. The program encourages scrutiny of tools like Atlas Browser, Codex, and Connectors, among others.

Infrastructure Attacks With Physical Consequences Down 25%

www.darkreading.com · 4 months ago

A new report indicates a 25% decrease in operational technology cyberattacks causing physical consequences in 2025, marking the first decline in seven years. Experts suggest this may be due to improved cybersecurity defenses, reduced reporting of breaches, or a lull in ransomware attacks resulting from law enforcement actions. While attacks were less frequent and less technically sophisticated, those that occurred often resulted in significant financial losses, such as the Jaguar Land Rover incident, estimated at a billion dollars. Nation-state and hacktivist attacks without physical consequences doubled last year, primarily targeting critical infrastructure.

Safety Experts Considered LaGuardia Challenging but Not an Outlier

www.nytimes.com · 4 months ago

false

Google Issues High-Risk Security Patch for 3.5 Billion Chrome Users: What You Need to Know

www.techrepublic.com · 4 months ago

Google has released a security update for its Chrome browser to address eight high-severity vulnerabilities. The update affects approximately 3.5 billion users globally and resolves issues related to audio, graphics, fonts, and memory management. Patched vulnerabilities include CVE-2026-4673, CVE-2026-4674, CVE-2026-4675, CVE-2026-4676, CVE-2026-4677, CVE-2026-4678, CVE-2026-4679, and CVE-2026-4680. Users are urged to manually update and relaunch their browser to ensure the security fixes are active.

Google Sets 2029 Deadline for Quantum-Safe Cryptography

www.darkreading.com · 4 months ago

Google announced a plan to integrate post-quantum cryptography into its systems by 2029, prioritizing authentication services to protect against future quantum computer attacks. The company’s migration strategy focuses on crypto agility, securing infrastructure, and facilitating ecosystem shifts, aligning with guidelines from the National Institute of Standards & Technology. Google is integrating the Module-Lattice-Based Digital Signature Algorithm into Android 17, building upon previous post-quantum support in Chrome and Cloud. Experts recommend organizations prioritize awareness, inventory their cryptographic usage, and engage with service providers to ensure future interoperability.

BIND 9 Security Flaws Allow Attackers to Bypass Security Controls and Crash Servers

gbhackers.com · 4 months ago

The Internet Systems Consortium has released security advisories for BIND 9 DNS software, addressing three vulnerabilities. CVE-2026-1519 can cause a denial-of-service condition due to excessive CPU usage during DNSSEC validation. CVE-2026-3119 leads to unexpected server crashes when processing signed queries, and CVE-2026-3591 allows attackers to bypass access control lists. Network administrators should immediately apply available patches, versions 9.18.47, 9.20.21, or 9.21.20, to mitigate these risks.

TeamPCP strikes again - telnyx popular PyPI library compromised

research.jfrog.com · 4 months ago

The Python library "telnyx" has been compromised by a threat group. Malicious code was injected into versions 4.87.1 and 4.87.2, concealed within WAV audio files. The code is designed to download and execute a payload for persistence and data theft, using tactics similar to recent attacks. Users should uninstall the affected versions and review their systems for potential compromise.

European Commission investigating breach after Amazon cloud account hack

www.bleepingcomputer.com · 4 months ago

The European Commission is investigating a security breach impacting its Amazon cloud infrastructure. A threat actor claims to have stolen over 350 gigabytes of data, including employee information and email server data, and intends to release it publicly. The incident follows a February breach involving a mobile device management platform and is potentially linked to vulnerabilities in Ivanti Endpoint Manager Mobile, CVE-2023-42079. The Commission recently proposed cybersecurity legislation to enhance defenses against cyberattacks.

European Commission investigating breach after Amazon cloud hack

www.bleepingcomputer.com · 4 months ago

The European Commission is investigating a security breach after a threat actor accessed its Amazon cloud infrastructure. The attacker claims to have stolen over 350 gigabytes of data, including employee information and email server details. They state they will release the stolen data online but will not seek a ransom. This incident follows a February data breach involving a mobile device management platform and is linked to vulnerabilities in Ivanti Endpoint Manager Mobile, CVE-2023-45089, CVE-2023-45090, CVE-2023-45091, CVE-2023-45092, and CVE-2023-45093.

[ Removed by Reddit ]

www.reddit.com · 4 months ago

false

ІТ блог про кібербезпеку, сервери та реальні технології

kaljan747.pp.ua · 4 months ago

This IT blog focuses on cybersecurity, server infrastructure, and web technologies, providing practical insights for administrators, developers, and website owners. Content includes vulnerability analysis, server protection strategies, and troubleshooting guides for platforms like WordPress and phpBB. The blog aims to offer technical, honest, and in-depth explanations, sharing real-world experiences and analyses of incidents, including CVEs. It’s geared towards IT professionals and enthusiasts seeking a deeper understanding of technology and security.

Attackers exploit critical Langflow RCE within hours as CISA sounds alarm

www.csoonline.com · 4 months ago

Attackers have rapidly exploited a critical remote code execution vulnerability in the Langflow open-source AI platform, with exploitation occurring within 20 hours of public disclosure. The vulnerability, CVE-2026-33017, stems from an unauthenticated API endpoint allowing malicious code injection and was exploitable based on the advisory description alone. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and set a patch deadline of April 8, 2026. Researchers observed attackers exfiltrating sensitive information, highlighting the need for immediate patching and runtime detection measures.

AitM Phishing Targets TikTok Business Accounts Using Cloudflare Turnstile Evasion

thehackernews.com · 4 months ago

Threat actors are targeting TikTok for Business accounts with adversary-in-the-middle phishing pages, designed to steal credentials after bypassing bot detection with Cloudflare Turnstile checks. These phishing pages are hosted on multiple domains including welcome.careerscrews[.]com and welcome.careerstaffer[.]com. Separately, a phishing campaign is using malicious Scalable Vector Graphics files to deliver malware, utilizing URL shortening services like ja.cat. This malware shares similarities with the BianLian ransomware, documented by SecurityScorecard in January 2024.

Almost half a million Lloyds customers had personal data exposed in IT glitch

www.theguardian.com · 4 months ago

A recent IT glitch at Lloyds Banking Group exposed the personal data of nearly 500,000 customers. The error, stemming from a software defect during an app update on March 12th, allowed some users to potentially view the account details, national insurance numbers, and payment references of others. Lloyds has compensated over three thousand customers for distress and is urging those who may have captured sensitive information to delete it. The bank reports no evidence of fraud or malicious activity resulting from the incident but is continuing to monitor for potential risks.

TP-Link Patches High-Severity Router Vulnerabilities

www.securityweek.com · 4 months ago

TP-Link has released firmware updates to address four high-severity vulnerabilities affecting Archer NX router models. These vulnerabilities, including CVE-2025-15517, CVE-2025-15518, CVE-2025-15519, and CVE-2025-15605, could allow attackers to bypass authentication, execute commands, tamper with configuration files, or compromise devices. Security researchers also reported ten vulnerabilities in TP-Link Archer AX53 routers and nineteen flaws in the Canva Affinity tool, alongside a vulnerability in Hikvision equipment. These newly disclosed vulnerabilities could enable remote code execution or information leakage.

Testing AprielGuard Against 1,500 Adversarial Attacks

www.lasso.security · 4 months ago

A recent evaluation by Lasso Security found that ServiceNow’s open-source AI guardrail model, AprielGuard, has significant vulnerabilities. Testing against 1,500 adversarial attacks revealed a 42.2% bypass rate, demonstrating weaknesses in detecting prompt injection, jailbreaking, and prompt-based manipulation. The model struggled with more complex obfuscation techniques like Base32 and ASCII85 encoding, and showed vulnerabilities in handling hate speech and enforcing custom policy rules. Researchers emphasized the need for continuous adversarial testing and multiple layers of defense rather than relying on a single guardrail model.

The Ezra Klein Show: How Fast Will A.I. Agents Rip Through the Economy?

www.nytimes.com · 4 months ago

false

We Are At War

thehackernews.com · 4 months ago

Cyberattacks are rapidly increasing, especially against critical infrastructure, fueled by geopolitical tensions and pro-Russian hacktivist groups. Ransomware attacks are a dominant threat, with a significant year-over-year increase, and new variants like IRIS ransomware are emerging. These attacks are impacting diverse sectors, including aerospace and finance, and governments are coordinating responses. Law enforcement operations, such as Endgame, are targeting ransomware groups like Blacksuit Royal.

Cyberangriff auf die Linke

www.csoonline.com · 4 months ago

The Left party in Germany has reported a significant cyberattack, suspected to be carried out by a Russian-speaking hacking group. The attackers targeted sensitive data and personal information of party employees, though the members’ database was not compromised. Authorities were warned prior to the attack, and a criminal complaint has been filed. The group, known as Qilin, is suspected of being involved and may be motivated by financial or political factors, potentially as part of hybrid warfare tactics.

RSAC 2026 Conference Announcements Summary (Days 3-4)

www.securityweek.com · 4 months ago

false

Anti-piracy coalition takes down AnimePlay app with 5 million users

www.bleepingcomputer.com · 4 months ago

false

Coruna iOS Exploit Kit Likely an Update to Operation Triangulation

www.securityweek.com · 4 months ago

Security researchers have discovered that the Coruna iOS exploit kit is likely an updated version of tools used in Operation Triangulation, which compromised devices over three years ago. The kit targets 23 vulnerabilities in iOS, including CVE-2023-32434 and CVE-2023-38606, and was used by a Russian state-sponsored group. Kaspersky reports that the exploits share a common framework and code, and the leak of a related exploit kit, DarkSword, now puts millions of devices at risk. The framework was originally designed for cyber-espionage but is now being adopted by cybercriminals.

DVRTC: intentionally vulnerable VoIP/WebRTC lab with SIP enumeration, RTP bleed, TURN abuse, and credential cracking exercises

www.enablesecurity.com · 4 months ago

Enable Security has released DVRTC, a new, intentionally vulnerable lab environment for Real-Time Communications security training. This platform provides a hands-on experience with VoIP and WebRTC security concepts, including SIP enumeration, RTP bleed, and TURN abuse. Users can interact with a public deployment at pbx1.dvrtc.net or deploy the environment locally using Docker. The initial scenario includes a full VoIP stack with Kamailio, Asterisk, and other components, offering 12 attack paths across 7 guided exercises.

Bearlyfy Hits Russian Firms with Custom GenieLocker Ransomware

thehackernews.com · 4 months ago

A pro-Ukrainian group known as Bearlyfy, also called Labubu, has conducted over 70 cyber attacks against Russian companies since January 2025. The group uses a dual approach, seeking both financial gain through extortion and causing sabotage. They’ve employed various ransomware, including GenieLocker, which draws inspiration from Venus/Trinity ransomware families, along with tools like PolyVice and MeshAgent. Bearlyfy’s attacks are characterized by rapid encryption and customized ransom notes, and the group has collaborated with PhantomCore and Head Mare.

8 steps CISOs can take to empower their teams

www.csoonline.com · 4 months ago

false

CISA Adds Critical Aquasecurity Trivy Scanner Vulnerability to KEV Catalog

gbhackers.com · 4 months ago

The Cybersecurity and Infrastructure Security Agency has added a critical vulnerability, CVE-2026-33634, to its catalog of actively exploited flaws. This vulnerability involves malicious code embedded within the Aquasecurity Trivy scanner, posing a significant supply chain risk to organizations using it in their CI/CD pipelines. Successful exploitation allows attackers to access sensitive development tokens, cloud infrastructure credentials, and other critical secrets. Federal agencies must remediate the vulnerability by April 9, 2026, and may need to discontinue Trivy use if patches aren't immediately available.

Abusing Modern Browser Features for Phishing

certitude.consulting · 4 months ago

Researchers have discovered a sophisticated phishing technique exploiting browser features to mimic login screens and steal credentials. Attackers use the Element.requestFullscreen API to create a full-screen overlay, freezing the GPU with WebGL shaders to mask the fullscreen notification. They then display a fake Windows login screen, potentially incorporating information from Google One Tap iframes through CSS manipulation, making it appear legitimate. To further deceive users, the Keyboard Lock API can be used to prevent easy escape from the fullscreen phishing screen. Researchers reported these vulnerabilities to Chromium and Mozilla in May 2024, but no resolution timeline was provided.

CISA Flags Critical PTC Vulnerability That Had German Police Mobilized

www.securityweek.com · 4 months ago

A critical vulnerability, CVE-2026-4681, has been identified in PTC’s Windchill and FlexPLM software. The flaw allows for unauthorized code execution through the deserialization of untrusted data and currently lacks a vendor patch. CISA and German authorities have issued advisories, with German police taking the unusual step of visiting companies to alert them to the risk. While no exploitation has been confirmed, security experts warn that advanced threat actors are likely to target this vulnerability.

Windows 11 KB5079391 update rolls out Smart App Control improvements

www.bleepingcomputer.com · 4 months ago

false

Silver Fox Cyberattack Targets Japanese Businesses with Tax-Themed Phishing Scams

gbhackers.com · 4 months ago

A threat actor known as Silver Fox is targeting Japanese organizations with spearphishing emails disguised as legitimate financial and HR communications. These emails, timed with Japan’s tax season, impersonate company personnel and often contain malicious attachments or links that deploy the ValleyRAT trojan. This malware allows attackers to gain remote control, steal data, and move laterally within networks. The group has expanded its operations from China to Southeast Asia, Japan, and North America, and previously conducted similar campaigns last year.

Musk has a plan to make human labor obsolete. Billionaires are joining in.

www.washingtonpost.com · 4 months ago

false

TeamPCP Hackers Focus on AI Developers, Planting Malicious Code to Disrupt Projects

gbhackers.com · 4 months ago

The FBI Cyber Division has issued a warning about a supply chain attack by the threat actor group TeamPCP, which targeted developers of artificial intelligence software. Hackers compromised two widely used developer tools, Trivy and LiteLLM, exploiting weak credential management and using AI-assisted coding to distribute malicious updates to millions of developers. TeamPCP leveraged Anthropic’s Claude to automate malware creation and lateral movement, and they operate as an initial access broker. Cybersecurity experts emphasize the need for enhanced security practices, including strict secrets management and thorough verification of third-party software.