Blahalla

WhatsApp rolls out more AI features, iOS multi-account support

www.bleepingcomputer.com · 4 months ago

false
Inside a Modern Fraud Attack: From Bot Signups to Account Takeovers

www.bleepingcomputer.com · 4 months ago

Modern fraud attacks operate as a multi stage chain that starts with automated bot signups using aged or compromised emails and residential proxies to appear legitimate, then shifts to slower human driven sessions, mobile device emulators, and handoffs to actors who carry out account takeover and monetization via malware links, phishing, and credential stuffing. Relying on single signals like IP reputation, email blocking, or device checks produces false positives and blind spots because attackers rotate infrastructure and mix tools across stages to evade point in time defenses. Correlating IP, device fingerprint, identity, and behavioral signals into a unified risk scoring model enables platforms to group coordinated abuse clusters, apply targeted challenges only to high risk activity, reduce friction for legitimate users, and force attackers to spend more effort for less return.
VoidLink Rootkit Leverages eBPF and Kernel Modules to Stealthily Infiltrate Linux Systems

gbhackers.com · 4 months ago

VoidLink is a new Linux rootkit family that combines loadable kernel modules with eBPF to hide processes and network activity in cloud environments and targets distributions from CentOS 7 through Ubuntu 22.04. The rootkit is delivered as kernel modules masquerading under names such as vlstealth or a fake AMD driver and uses ftrace hooks to intercept key system paths to hide processes, scrub logs, and protect selected process IDs while attached eBPF programs rewrite Netlink responses so common tools do not see hidden TCP ports. Command and control operates over covert ICMP echo packets decrypted with a rotating single byte XOR key, and later variants add delayed initialization, recurring kernel timers that detect forensic tools, and anti forensics logic to pause hiding or self destruct. Detection relies on cross checking process listings, network socket listings, and module lists against proc filesystem and system module state, and recommended mitigations include enforcing Secure Boot with signed modules, monitoring audit logs for module load system calls, restricting eBPF capabilities, and performing integrity checks from a trusted environment.
BIND Updates Patch High-Severity Vulnerabilities

www.securityweek.com · 4 months ago

There are four vulnerabilities patched in the latest BIND 9 updates, including two high severity flaws that can cause memory leaks and excessive CPU consumption during DNSSEC processing. The high severity issues are tracked as CVE-2026-3104, which can prevent named from recovering memory and lead to unbounded Resident Set Size growth and out-of-memory conditions, and CVE-2026-1519, which can trigger high CPU usage when a resolver encounters a maliciously crafted zone; two medium severity fixes address CVE-2026-3119, which may cause unexpected named termination when processing TKEY records, and CVE-2026-3591, a use after return bug in SIG0 handling that could allow ACL bypass, and disabling DNSSEC would prevent exploitation but is not recommended. Patches are included in BIND versions 9.18.47, 9.20.21, 9.21.20 and corresponding Supported Preview Edition releases, vendors warn exploitation can cause denial of service, and ISC reports no known active exploitation.
[Webinar] Stop Guessing. Learn to Validate Your Defenses Against Real Attacks

thehackernews.com · 4 months ago

There is a webinar called Exposure-Driven Resilience that shows how to continuously validate security posture using real attacker behavior instead of relying on assumed controls or occasional testing. It explains how to pressure-test controls and processes, use threat intelligence to prioritize tests, and integrate automated validation into SOC and incident response workflows, and includes a live demonstration by Jermain Njemanze and Sebastien Miguel. Teams are encouraged to register to obtain practical proof that defenses work rather than just signals that they exist.
Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website

thehackernews.com · 4 months ago

Cybersecurity researchers disclosed a flaw in Anthropic's Claude Chrome extension that allowed any website to silently inject prompts into the assistant simply by visiting a page, enabling zero click prompt injection. The issue chained an overly permissive origin allowlist in the extension with a document object model based cross site scripting vulnerability in an Arkose Labs CAPTCHA component hosted on Anthropic's content delivery network, allowing attackers to execute JavaScript in the CAPTCHA context and have the extension treat the injected prompts as legitimate user requests. Successful exploitation could let attackers steal sensitive data such as access tokens, read conversation history, and perform actions on behalf of users including sending impersonated emails. Following responsible disclosure on December 27, 2025 Anthropic patched the extension to enforce exact origin checks and Arkose Labs fixed the XSS vulnerability on February 19, 2026.
Coruna iOS exploit framework linked to Triangulation attacks

www.bleepingcomputer.com · 4 months ago

Coruna is an evolved iOS exploit framework linked to Operation Triangulation and contains five full exploit chains leveraging 23 vulnerabilities, including CVE-2023-32434 and CVE-2023-38606. The framework has been expanded to target modern hardware such as Apple A17 and M3 family chips and iOS versions up to 17.2, and analysis shows the kernel exploit for those CVEs is an updated version of the Triangulation exploit. Attacks begin with a Safari stager that fingerprints devices, selects suitable RCE and PAC exploits, downloads encrypted components decrypted with ChaCha20 and decompressed with LZMA, and then executes architecture specific kernel exploits and loaders for ARM64 and ARM64E. Coruna has been used in both espionage and financially motivated campaigns to steal cryptocurrency via fake exchange sites, and security updates have been released to address the flaws.
Chinese Hackers Caught Deep Within Telecom Backbone Infrastructure

www.securityweek.com · 4 months ago

Security researchers uncovered that a China linked state sponsored threat actor deployed kernel implants and passive backdoors deep inside global telecommunications backbone infrastructure to establish long term persistence and enable high level espionage. The intrusions combined a Linux kernel backdoor called BPFdoor that uses Berkeley Packet Filter for in kernel packet inspection and triggers on a specific magic byte sequence with cross platform beacon frameworks including CrossC2, the open source TinyShell passive backdoor, SSH brute forcers, custom keyloggers, credential harvesters, and brute force utilities pre populated with telecom tailored credentials. Operators abused public facing applications and valid accounts on appliances from Ivanti, Cisco, Fortinet, VMware and Palo Alto Networks and on web platforms such as Apache Struts, and newer BPFdoor variants hide triggers inside encrypted HTTPS traffic with precise padding to evade detection while mimicking bare metal and container components, and defenders were provided with a scanner to help identify potential infections.
GhostClaw AI Malware Targets macOS Users with Credential-Stealing Payloads

gbhackers.com · 4 months ago

GhostClaw is a multi stage macOS infostealer that abuses GitHub and AI assisted development workflows to harvest credentials and deploy secondary payloads, with researchers finding multiple samples impersonating trading bots, SDKs, and developer tools. Attackers build trust by shipping benign or partially functional code and accumulating stars before introducing malicious install scripts and JavaScript loaders, and they include SKILL manifests that let autonomous AI agents discover and install the malicious components. Infection starts when an install script runs, profiles the host, installs Node.js, downloads components while bypassing TLS validation, launches obfuscated JavaScript that prompts for account passwords and requests full disk access, then retrieves and executes an encrypted secondary payload that persists under npm like paths. Defenders are advised to treat copy pasted install commands and AI suggested shell steps as untrusted, validate repository history and maintainers, block unknown scripts and curl usage that disables TLS, and enable advanced threat prevention on macOS fleets.
Making NTLM-Relaying Relevant Again by Attacking Web Servers with WebRelayX

seccore.at · 4 months ago

NTLM relaying remains a viable internal attack path in 2026 against many web servers that do not enforce Extended Protection for Authentication, with attackers able to trigger NTLM authentications via LLMNR and NetBIOS poisoning, IPv6 spoofing, RPC endpoint abuse, or DNS manipulation. Captured NTLM authentications can be relayed to SMB, LDAP, HTTP and HTTPS targets to access files, query or modify Active Directory, or escalate to domain compromise through AD CS relay scenarios, and a tool called WebRelayX was developed to relay NTLM to web applications and harvest session cookies. Recommended mitigations include enabling SMB signing, LDAP signing and channel binding, disabling NTLMv1, enforcing HTTPS and Extended Protection for Authentication, and noting that some relay paths require a MIC bypass tied to CVE-2019-1040 if systems are unpatched.
Russia arrests suspected owner of LeakBase cybercrime forum

www.bleepingcomputer.com · 4 months ago

Russian police in the Rostov region arrested a Taganrog resident believed to be the owner and administrator of LeakBase, an online forum used by cybercriminals to buy and sell stolen data, exploits, and hacking tools. LeakBase surfaced in 2021, grew to more than one hundred forty two thousand members after another major hacker forum shut down in March 2023, and hosted sections for programming, hacking tips, social engineering, cryptography, and operational security guidance. In March 2026, a coordinated international operation led by Europol and the Federal Bureau of Investigation disrupted the forum with around one hundred enforcement actions across multiple countries, seized the site and its databases, and stated that private messages and IP logs will be used as evidence in ongoing investigations.
Databricks pitches Lakewatch as a cheaper SIEM — but is it really?

www.csoonline.com · 4 months ago

Databricks previewed a new open agentic security information and event management product called Lakewatch and is pitching it as a lower cost alternative to traditional SIEMs by charging for compute rather than for data ingestion or storage. Databricks says this model can reduce total cost of ownership by up to eighty percent while maintaining years of hot, queryable data, and Lakewatch stitches together Unity Catalog for governance, Lakeflow Connect for ingest and streaming, and the Open Cybersecurity Schema Framework to standardize logs into a centralized lakehouse security record. Analysts caution that costs may shift to compute and data processing rather than disappear, that Lakewatch is more likely to complement existing SIEMs than replace them with early adoption coming from large enterprises already committed to Databricks, and that recent acquisitions of Antimatter and SiftD.ai point to a broader long term security roadmap.
Cisco Patches Multiple Vulnerabilities in IOS Software

www.securityweek.com · 4 months ago

Cisco released patches addressing a dozen high and medium severity flaws in IOS and IOS XE that could lead to denial of service, secure boot bypass, information disclosure, and privilege escalation. Four medium severity defects affecting Catalyst 9300 Series switches were publicly disclosed and tracked as CVE-2026-20110, CVE-2026-20112, CVE-2026-20113, and CVE-2026-20114. OPSWAT reported that chaining CVE-2026-20114 and CVE-2026-20110 can escalate privileges and trigger a persistent denial of service that in validated cases required physical access to restore functionality. The updates also remedied six high severity bugs, five of which could cause denial of service and one that could bypass secure boot, plus additional medium issues that may disclose information or cause service disruption.
CISA Issues Urgent Warning on Langflow Code Injection Vulnerability Actively Exploited in Attacks

gbhackers.com · 4 months ago

CISA has issued an urgent warning about a critical code injection vulnerability in Langflow, tracked as CVE-2026-33017, and confirmed active exploitation in the wild. The flaw allows unauthenticated users to execute arbitrary code by creating public flows and is rooted in improper code generation and evaluation along with missing authentication controls. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on March 25, 2026 and mandated federal civilian executive branch agencies to apply mitigations by April 8, 2026. Network defenders and organizations using Langflow are strongly urged to implement vendor mitigations or discontinue use until effective fixes are applied.
Intermediaries Driving Global Spyware Market Expansion

www.darkreading.com · 4 months ago

There are third party intermediaries including resellers, exploit brokers, contractors, and partners that muddy supply chains, foil transparency efforts, and allow spyware to spread across borders despite export controls and government restrictions. These intermediaries lower barriers to entry by bundling exploit engineering, training, deployment infrastructure, and legal paper trails that obscure origins and enable sanctioned or diplomatically sensitive sales, with documented examples involving a South African intermediary for Dante and a third party assisting sales of Passitora technology into Bangladesh. The ecosystem is expanding, with commercial surveillance vendors linked to a growing share of zero day exploit activity in 2025, and recommended policy responses include Know Your Vendor requirements, certification and registries for brokers and resellers, and continued multilateral efforts such as the Pall Mall Process to increase market visibility.
Masters of Imitation: How Hackers and Art Forgers Perfect the Art of Deception

thehackernews.com · 4 months ago

Defenders face an Age of Imitation as attackers use AI and living off the land tactics to mimic trusted users and legitimate tools, with industry reporting that roughly eight in ten detected attacks are now malware free. Threat actors employ autonomous AI agents to mass produce fake identities and exploit software supply chains, cloud services, cloaked tunnels, and lookalike infrastructure and homograph domains to harvest credentials and persist undetected. Behavioral network detection and response that flags anomalies, protocol and metadata inconsistencies, and enriched contextual signals is recommended to expose these impostors early and limit lateral movement.
Critical Ivanti EPMM Vulnerabilities Expose Systems to Arbitrary Code Execution Attacks

gbhackers.com · 4 months ago

There are two critical remote code execution vulnerabilities in Ivanti Endpoint Manager Mobile that were actively exploited by threat actors in February 2026. WithSecure STINGR Group's incident response investigation found attackers used highly automated methods to compromise servers, execute arbitrary code without authentication, and exfiltrate sensitive data from affected systems within seconds. These zero day flaws permit unauthenticated arbitrary code execution on vulnerable EPMM installations.
Suspected RedLine infostealer malware admin extradited to US

www.bleepingcomputer.com · 4 months ago

An Armenian suspect, Hambardzum Minasyan, was extradited to the United States after being arrested on March 23, 2026, and appeared in federal court in Austin on March 24, 2026, accused of registering virtual private servers and web domains used by the RedLine infostealer. Prosecutors say he created a cryptocurrency account in November 2021 used to receive affiliate payments, maintained online file-sharing repositories to distribute RedLine, and administered administrative panels and command and control servers that supported affiliates deploying the malware. He faces charges including access device fraud, violations of the Computer Fraud and Abuse Act, and money laundering conspiracy carrying a potential maximum sentence of 30 years, and the RedLine infrastructure was previously seized by Dutch police in October 2024 while the United States has separately charged a suspected RedLine developer, Maxim Alexandrovich Rudometov.
ThreatsDay Bulletin: PQC Push, AI Vuln Hunting, Pirated Traps, Phishing Kits & 20 More Stories

thehackernews.com · 4 months ago

Google has accelerated a post quantum cryptography migration timeline to 2029 and plans to integrate module lattice based digital signature protection into Android Verified Boot and Android Keystore to mitigate future signature and store now decrypt later risks. AI powered hybrid detections are being introduced into developer workflows to surface hidden vulnerabilities that traditional static analysis misses, with GitHub Code Security slated for public preview in early second quarter 2026. Active threat campaigns include Sandworm using pirated software to drop backdoors such as Tambur Sumbur Kalambur and DemiMur, a fraudulent ShieldGuard browser extension designed to drain cryptocurrency wallets, and a firmware backdoor called Keenadu infecting hundreds of Android devices across many models and countries. Phishing and phishing as a service operations remain resilient, with Tycoon2FA quickly recovering after domain seizures and attackers leveraging fake meeting invites and malicious forms to deliver remote access tools and remote access trojans.
Critical NVIDIA Vulnerabilities Risk Remote Code Execution and Denial-of-Service Attacks

gbhackers.com · 4 months ago

NVIDIA published March 2026 security bulletins that address a wave of vulnerabilities across its hardware and software ecosystems that could enable remote code execution or trigger denial of service. The most severe issue affects NVIDIA Apex under bulletin 5782 and several high severity flaws impact Triton Inference Server, Model Optimizer, NeMo Framework, and Megatron LM, while medium severity fixes cover VIRTIO-Net, SNAP4, and the B300 MCU. Organizations are urged to immediately evaluate their environments and apply the specified driver and software updates, and NVIDIA is distributing advisories via its product security site and a dedicated GitHub repository in both human readable and machine readable formats. Documented CVEs published March 24, 2026 include CVE-2025-33215, CVE-2025-33216, CVE-2025-33244, CVE-2025-33242, CVE-2025-33238, CVE-2025-33254, CVE-2026-24158, CVE-2026-24141, CVE-2026-24157, CVE-2026-24159, CVE-2025-33247, CVE-2025-33248, CVE-2026-24152, CVE-2026-24151, and CVE-2026-24150.
Silver Fox Tax Audit Phishing Campaign Shifts from RATs to Python Stealers

gbhackers.com · 4 months ago

There are tracked operations by Silver Fox, also known as Void Arachne, a China-based intrusion set that blends financially motivated cybercrime with APT-style espionage, and monitoring from 2025 through early 2026 shows a three-wave evolution tied to tax-themed phishing across South Asia. There are details that the first wave used malicious PDFs to deliver ValleyRAT via a ZIP from Tencent Cloud containing a python311.dll loader and a decoy JPG for configuration, while a mid-December 2025 pivot abused a legitimately signed Chinese RMM installer from SyncFutureTec with an IP-embedded filename to pass command-and-control, expanding targeting across several Southeast Asian countries. There are reports that the latest wave observed in February 2026 replaced the RMM payload with a compiled Python stealer disguised as a WhatsApp backup utility that collected browser and application artefacts and uploaded them to a C2 at xqwmwru.top using the User-Agent string WhatsAppBackup/1.0, and defenders are advised to treat tax-season lures tied to remote tools or WhatsApp backup utilities as key early warning indicators of Silver Fox activity.
GitHub phishers use fake OpenClaw tokens to drain crypto wallets

www.csoonline.com · 4 months ago

There is an active phishing campaign exploiting OpenClaw's viral popularity to target GitHub developers with fake CLAW token airdrops that promise thousands of dollars in rewards. Attackers create or hijack repositories, open issues and tag developers to boost visibility, then redirect victims to a near-identical cloned site that prompts users to connect crypto wallets. Highly obfuscated JavaScript in the malicious repositories harvests wallet addresses, transaction values and approvals, communicates with a command and control server, and includes a nuke function to erase local evidence, with stolen funds sent to the attacker wallet 0x6981E9EA7023a8407E4B08ad97f186A5CBDaFCf5. Mitigations include blocking the phishing domain, never connecting wallets to untrusted websites, and reviewing and revoking any recent wallet approvals.
Smashing Security podcast #460: Never knock on the door of a nuclear submarine base and ask for a selfie

grahamcluley.com · 4 months ago

A disgruntled data analyst stole a company payroll database and demanded 2.5 million dollars in Bitcoin, signing extortion emails from an entity called Loot. Two people drove to the entrance of the United Kingdom's Faslane nuclear submarine base and asked to look around, prompting questions about whether they were tourists, spies, or something in between. The episode also covers a female Muslim punk rock group and a book on fighting disinformation and protecting democracy, and features guest Jenny Radcliffe.
Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in Recent Mass Attacks

thehackernews.com · 4 months ago

A recently uncovered iOS exploit kit called Coruna reuses and continuously evolves kernel exploit code first seen in Operation Triangulation in 2023, adding checks for newer processors and iOS builds that indicate active maintenance. The kit contains five full iOS exploit chains and a total of 23 exploits, including CVE-2023-32434 and CVE-2023-38606, and incorporates four additional kernel exploits built on the same framework. Threat actors have used Coruna in watering hole operations and a mass campaign that directed victims to fake gambling and cryptocurrency sites to deliver a data stealing loader known as PlasmaLoader. The attack flow begins when a compromised site fingerprints Safari to serve the appropriate exploit, after which a launcher executes kernel exploits, drops implants, and cleans up artifacts, raising concerns that modular reuse will expand the threat to millions of unpatched devices.
As the US Midterms Approach, AI Is Going to Emerge as a Key Issue Concerning Voters

www.schneier.com · 4 months ago

false
Alleged RedLine Malware Administrator Extradited to US

www.securityweek.com · 4 months ago

Hambardzum Minasyan of Armenia was extradited to the United States and made a first appearance in a Texas court, according to the US Department of Justice. Authorities allege he maintained RedLine infrastructure including command and control servers and administration panels, registered virtual private servers and domains, created file repositories to distribute RedLine, and received cryptocurrency payments from affiliates. He is charged with conspiracy to commit access device fraud, conspiracy to commit money laundering, and conspiracy to violate the Computer Fraud and Abuse Act, facing up to ten years in prison for access device fraud and up to twenty years for the other counts. RedLine is a malware as a service information stealer that emerged in 2020, survived a multinational disruption in October 2024, and was linked to a ten million dollar reward announced by the US Department of State in mid 2025 for a suspected principal operator.
Torg Grabber Malware Shifts from Telegram Exfiltration to Encrypted REST API for C2

gbhackers.com · 4 months ago

There is a fast‑evolving information‑stealing malware named Torg Grabber that has moved from simple Telegram‑based exfiltration to a hardened, encrypted HTTPS REST API command‑and‑control channel fronted by Cloudflare and using ChaCha20 encryption with HMAC‑SHA256 authentication. Telemetry shows three rapid development phases: December 9, 11, 2025 used Telegram Bot API sendDocument dead drops; December 17, 20 experimented with a ChaCha20‑Poly1305 encrypted TCP protocol to a.tara.net.bd host on port 50443 before abandoning it; and from December 18 onward the family standardized on HTTPS REST API endpoints such as apiauth and apiuploadchunk for chunked, encrypted exfiltration. The malware is deployed via a multi‑stage, in‑memory loader chain that injects a 683 KB reflective PE stealer and uses environment‑variable configuration to support multiple customers, enumerates and steals from at least 25 Chromium and 8 Firefox browsers plus 30 desktop crypto wallets, and includes hardcoded support for about 850 browser extensions, including roughly 728 crypto wallet extensions and 103 password or two‑factor extensions while using a ChaCha20‑encrypted reflective DLL to bypass browser application encryption and recover AES‑256 master keys. Operators run Torg Grabber as a Malware‑as‑a‑Service with at least 18 Cloudflare‑fronted C2 domains and many operator tags, and defenders are advised to focus on TLS inspection, REST API pattern detection for apiauth and apiuploadchunk paths, and environment‑variable based indicators rather than simple domain blocklisting.
Fake Screenshot Lures Target Web3 Support Staff with Multi-Stage Malware Attack

gbhackers.com · 4 months ago

A campaign assessed as linked to the financially motivated group APT Q 27 uses fake screenshot links in live Web3 support chats to deploy a multi stage loader that ultimately delivers a memory resident Farfli backdoor. The lure appears as a Google looking image link that actually delivers a hidden.pif executable which displays a fake error image or opens in Microsoft Paint while silently launching a signed.NET downloader that fetches a dead drop manifest from AWS S3 and stages components under AppData with an at 27 tag and a Run registry entry named SystemUpdats. The chain abuses a legitimate signed updat.exe for DLL sideloading by dropping malicious vcruntime140.dll and msvcp140.dll that lead to crashreport.dll decrypting an encrypted log and loading shellcode which unpacks a Farfli DLL in memory, which then contacts dozens of hard coded command and control servers over TCP port 15628 and establishes persistence as a Windows service named Windows Eventn while suppressing user account control prompts. Defensive recommendations include monitoring for staging folders named with at 27 markers, Run entries called SystemUpdats, new services named Windows Eventn, sudden changes to user account control settings, blocking outbound traffic on TCP port 15628, and hardening support workflows by enforcing visible file extensions, sandboxing file handling for agents, strict endpoint detection and response coverage, and least privilege access.
Magento PolyShell – Unauthenticated File Upload to RCE in Magento (APSB25-94)

slcyber.io · 4 months ago

On March 17, 2026 Sansec released research named PolyShell APSB25-94 describing an unauthenticated unrestricted file upload vulnerability that affects all production versions of Magento Open Source and Adobe Commerce up to 2.4.9-alpha2 and can, under certain conditions, lead to unauthenticated remote code execution. The vulnerability arises from Magento's REST API handling of cart item custom options where a fileinfo object provides base64 encoded data, a MIME type, and a filename which is processed by ImageProcessor and ImageContentValidator and saved to the pub media custom options quote directory on the server. The validator only checks that the data decodes to an image via getimagesizefromstring and that MIME and name checks are satisfied, and the processor allows control over extensions so an attacker controlled file can be persistently written to disk. Exploitability requires only a generated guest cart identifier and a product SKU, both easily obtained via the guest cart API and GraphQL, making exploitation straightforward where server configuration permits execution of uploaded files.
Common Entra ID Security Assessment Findings – Part 1: Foreign Enterprise Applications With Privileged API Permissions

blog.compass-security.com · 4 months ago

Security assessments found many tenants host foreign enterprise applications that hold application only API permissions managed from external publisher tenants, placing operational control and credentials outside the consumer organization. Because credentials live in the publisher tenant and Conditional Access does not apply to foreign enterprise application sign ins, a compromised publisher or stolen credential can let an attacker authenticate across consumer tenants and access sensitive resources via Microsoft Graph. Demonstrated abuse includes dumping SharePoint content and using an application with Application.ReadWrite.All to add credentials to privileged internal applications, then creating a user and assigning the Global Administrator role. Recommended mitigations include regular review and least privilege for foreign applications, custom monitoring for suspicious app sign ins, a strict onboarding process that evaluates required permissions, and using EntraFalcon to discover and report risky enterprise applications.
IDrive for Windows Vulnerability Allows Attackers to Escalate Privileges and Gain Unauthorized Access

gbhackers.com · 4 months ago

A critical security flaw in the IDrive Cloud Backup Client for Windows, tracked as CVE-2026-1995, allows authenticated low privilege users to execute arbitrary code with system level permissions. The vulnerability affects client versions 7.0.0.63 and earlier because the IDrive background service runs as the SYSTEM account and loads files from the ProgramData IDrive folder whose weak permissions allow standard users to overwrite or add files. Successful exploitation can yield full device compromise including access to encrypted backups, disabling security controls, and persistent malware, and while a patch is being developed administrators should restrict write permissions on the ProgramData IDrive folder, monitor vendor updates, deploy endpoint detection and response, and use group policies to block untrusted script execution.
AI is just another technology Americans don’t like but can’t stop using

www.washingtonpost.com · 4 months ago

false
Dell and HP Roll Out Quantum-Resistant Device Security

www.securityweek.com · 4 months ago

false
Kiss Loader Malware Targets with Early Bird APC Injection in New Attack Campaign

gbhackers.com · 4 months ago

There is a newly identified malware loader called Kiss Loader that is actively being developed and combines stealthy, modular staging with experimental features that could enable future escalation. It begins with Windows Internet Shortcut files masquerading as PDFs to retrieve components from an exposed WebDAV repository served via a TryCloudflare tunnel, then launches Windows Script Host and JScript stages that fetch batch scripts which display decoys, create persistence, and download additional payloads. A Python-based loader uses JSON configuration files for runtime decryption, employs Donut to generate in-memory.NET shellcode, and delivers decrypted payloads resembling RAT variants and a.NET protected utility. Execution relies on Early Bird APC injection by creating a suspended legitimate process, writing decrypted shellcode into its memory, and queuing an APC to run the code under a trusted process context, and analysts observed live interaction with the developer during testing confirming active refinement of the loader.
Preventing Account Takeovers: A Practical Guide to Detection and Response

gbhackers.com · 4 months ago

Account takeover attacks surged 354 percent in 2023 as bots replay stolen credentials and infostealer malware sidesteps multi factor prompts, producing billions in fraud losses and eroding customer trust. Defenses should be layered: strengthen authentication with passkeys or app based and hardware multi factor methods, monitor user behavior and device fingerprints, deploy bot management and adaptive web application firewalls, and harden account recovery and support processes. When a takeover is detected, force password resets, revoke active sessions, quarantine or wipe infected devices, remove unauthorized recovery options and tokens, communicate quickly with affected users, and run blameless reviews to close gaps.
Synology DiskStation Manager Vulnerability Puts Users at Risk of Remote Command Execution Attacks

gbhackers.com · 4 months ago

An urgent security update was issued for Synology DiskStation Manager to fix a critical vulnerability that can allow unauthenticated remote attackers to execute arbitrary commands on affected network attached storage devices. The flaw is tracked under security advisory Synology SA 26 03 and administrators are urged to apply the patch immediately to prevent remote command execution and potential device compromise.
Meta and YouTube Found Negligent in Landmark Social Media Addiction Trial

www.nytimes.com · 4 months ago

NULL
Fake npm Install Messages Conceal RAT Malware in New Open Source Supply Chain Attack

gbhackers.com · 4 months ago

Attackers are abusing npm post install scripts to display realistic but fake npm install logs that lure developers, prompt for sudo credentials, and then silently deploy a crypto stealing remote access trojan that harvests wallets and maintains remote access. ReversingLabs first observed the Ghost campaign in early February 2026 across packages published by a user named mikilanjillo, with examples including react state optimizer core and others that fetch a final payload and part of its decryption key from an attacker controlled Telegram channel or a web3 post. Defenders are advised to treat any npm package that requests sudo during installation or downloads external content post install as suspicious and to use automated supply chain security tooling to flag anomalous behavior.
LeakBase Forum Admin Arrested by Russian Authorities in Global Cybercrime Operation

gbhackers.com · 4 months ago

Russian authorities have apprehended the suspected administrator of LeakBase in Taganrog following a targeted operation by the Ministry of Internal Affairs and regional security services in Rostov. The forum reportedly hosted hundreds of millions of stolen records, including user credentials, banking details, and proprietary corporate documents, and had more than 147,000 registered members who traded and monetized compromised data. Officers seized extensive technical equipment during a search of the suspect’s residence, opened a criminal case under Article 272.1 Parts 3 and 6 of the Russian Criminal Code, and remanded the defendant in custody while forensic analysis and investigations continue. The takedown significantly disrupts an established marketplace for stolen data, though investigators and threat intelligence analysts expect displaced actors to attempt rebuilding on alternative underground channels.
WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites

thehackernews.com · 4 months ago

A new payment skimmer uses WebRTC data channels to load payloads and exfiltrate payment information, effectively bypassing Content Security Policy protections. The campaign exploited a vulnerability named PolyShell in Magento Open Source and Adobe Commerce that allows unauthenticated attackers to upload arbitrary executables via the REST API and achieve code execution, and it targeted a car maker's e commerce site. Researchers observed mass exploitation beginning March 19, 2026 with more than 50 IP addresses scanning and the skimmer establishing a WebRTC peer connection to the hard coded IP 202.181.177.177 over UDP port 3479 to retrieve malicious JavaScript and inject it into checkout pages, and WebRTC DataChannels run over DTLS encrypted UDP so HTTP inspection and strict CSP do not see the stolen data. Adobe released a fix in version 2.4.9 beta on March 10, 2026 but production patches were not yet available and recommended mitigations include blocking access to pub slash media slash custom underscore options and scanning stores for web shells backdoors and other malware.
Microsoft Unveils New Guidance to Detect and Defend Against Trivy Supply Chain Attack

gbhackers.com · 4 months ago

Aqua Security's vulnerability scanner Trivy was compromised in a sophisticated CI CD supply chain attack attributed to TeamPCP that injected credential stealing malware into official releases, tracked as CVE-2026-33634. Attackers abused mutable Git tags and force pushed malicious commits across most trivy-action and setup-trivy tags and published an infected Trivy binary so downstream CI workflows executed attacker controlled code while scans completed successfully to mask the breach. The Python based payload harvested cloud credentials, Kubernetes secrets, application tokens, and infrastructure access, encrypted stolen data, and exfiltrated it to a typosquatted domain, with related activity observed in Checkmarx KICS and LiteLLM. Microsoft says Defender XDR can identify secret reconnaissance, malicious metadata access, and suspicious DNS queries, and organizations should update to verified safe Trivy binary versions 0.69.2 and 0.69.3, pin third party GitHub Actions to immutable commit SHAs, minimize GitHub token permissions, use secret managers, and rotate credentials.
Fake VS Code Security Alerts on GitHub Spread Malware in Massive Phishing Attack

gbhackers.com · 4 months ago

There is a large scale phishing campaign targeting developers on GitHub by abusing the Discussions feature to distribute fake Visual Studio Code security alerts. The campaign is highly coordinated with thousands of near identical posts published by newly created or low activity accounts that tag developers and trigger GitHub notification emails to increase visibility and urgency. Messages often include fabricated CVE references and direct users to unofficial downloads that redirect through Google hosted links to attacker controlled domains where obfuscated JavaScript fingerprints victims and uses a traffic distribution system to selectively deliver malware. Developers are urged to avoid downloading software from unofficial links and to verify security alerts through trusted vendor channels.
Cisco Secure Firewall Vulnerability Exposes Systems to Remote Code Execution by Attackers

gbhackers.com · 4 months ago

A critical vulnerability has been identified in Cisco Secure Firewall Management Center software, allowing attackers to remotely execute code. The flaw, tracked as CVE-2026-20131, has a maximum severity score of 10.0 and requires no authentication. Threat actors are actively exploiting the vulnerability, which stems from insecure Java deserialization. Cisco urges users to immediately update their software or confirms that those using the SaaS-based Cisco Security Cloud Control platform have already received the fix.
Node.js Releases Urgent Patches for Multiple Vulnerabilities Exposing Systems to DoS and Crashes

gbhackers.com · 4 months ago

A critical security update is available for Node.js versions 20.20.2, 22.22.2, 24.14.1, and 25.8.2 to address seven vulnerabilities. One high-severity flaw, CVE-2026-21637, involves a TLS crash triggered by unexpected servername values, requiring no authentication. Other issues include a denial-of-service risk in HTTP/2 flow control, CVE-2026-21714, and a hash denial-of-service vulnerability in the V8 engine, CVE-2026-21717. Administrators are strongly urged to upgrade immediately, prioritizing servers using TLS.
10 essenzielle Maßnahmen für physische Sicherheit

www.csoonline.com · 4 months ago

Wenn physische Security nur immer so simpel umzusetzen wäre… Foto: Leremy | shutterstock.com Obwohl CISOs im Allgemeinen eher selten mit dem gesamten Spektrum der Gesundheits- und Arbeitssicherheitsbelange betraut sind, spielen sie diesbezüglich doch eine wichtige, strategische Rolle, insbesondere, wenn es um physische Sicherheitssysteme mit IT-Anbindung und den direkten Zugang zu IT-Assets geht. Die wesentlichen limitierenden Faktoren für CISOs sind dabei in aller Regel: das Budget sowie nicht eindeutige Verantwortlichkeiten. In diesem Artikel stellen wir Ihnen zehn essenzielle Maßnahmen für (mehr) physische Sicherheit vor, die CISOs auf dem Zettel haben sollten. Zunächst werfen wir jedoch einen kurzen Blick darauf, wie sich physische Security definiert, und warum sie von entscheidender Bedeutung für Unternehmen ist. Warum physische Security wichtig ist Der Begriff der physischen Sicherheit umfasst per Definition den Schutz von Personen, Eigentum und physischen Assets vor unberechtigtem Zugriff, Diebstahl und sonstigen Handlungen die zu Schaden oder Verlust führen. Dieser Bereich wird allzu oft zugunsten der Cybersicherheit vernachlässigt. Für CISOs ist der Bereich vor allem deshalb so wichtig, weil die allermeisten modernen, physischen Sicherheitssysteme respektive -kontrollen auf irgendeine Art und Weise mit der IT verknüpft sind, von Badges und Keycards bis hin zur Videoüberwachung. Kommt es zu einem unberechtigten (physischen) Zugriff, können daraus in der Folge zudem auch Cyberangriffe und Data Breaches erwachsen. Es sollte deshalb im Interesse eines jeden Sicherheitsentscheiders liegen, entsprechende Vorkehrungen zu treffen, um den Zugriff auf diese Assets zu kontrollieren. Das soll (und kann) nicht heißen, CISOs mit sämtlichen Tasks physischer Security zu betrauen. Zwar funktioniert es im Fall einiger kleinerer Unternehmen, die Rolle des CISO und des CSO zusammenzulegen, für viele große Unternehmen ist das jedoch keine Option, wie Max Shier, CISO beim Cyberrisk-Spezialisten Optiv, erklärt: “Wenn behördliche Auflagen bestehen oder es um größere Unternehmen geht, ergibt es unter Umständen keinen Sinn, die Bereiche Cybersecurity und physische Sicherheit zusammenzulegen. Die resultierenden Verantwortlichkeiten, etwa, sich um einen Wachdienst für Produktionsanlagen oder Bodyguards für Führungskräfte zu kümmern -, könnten Cybersecurity-Teams je nach Auslastung und Kapazität schnell überfordern.” Sollte diese Option auch für Sie entfallen, weiß Howard Taylor, CISO beim Security-Dienstleister Radware, was zu tun ist: “Dann ist die Kommunikation und Koordination mit den physischen Sicherheitsteams für CISOs entscheidend, um ihre Ziele zu erreichen. Diese sollten in die Planungsprozesse für Business Continuity, Disaster Recovery sowie physische Anlagen und Einrichtungen einbezogen werden. Zusätzlich muss auch sichergestellt sein, dass die resultierenden, physischen Maßnahmen aus rechtlicher Sicht einwandfrei sind, etwa, dass Aufnahmen von Überwachungskameras keine Datenschutzregularien verletzen.” Die Top Ten physischer Sicherheitsmaßnahmen Ganz unabhängig von der jeweiligen Organisationsstruktur sollten CISOs mit allen Stakeholdern im Bereich physische Sicherheit kollaborieren. Folgende zehn Maßnahmen sollten Sie diesbezüglich vor allem auf dem Schirm haben. 1. IT-Einrichtungen und Rechenzentren härten Rechenzentren, sensible IT-Einrichtungen und Computerräume in Mehrzweckbüros sind offensichtliche Bereiche, auf die CISOs ihr Augenmerk legen sollten, um die Kontrolle über den physischen Zugang zu gewährleisten. David Ortiz, CISO beim Konsumgüter-Unternehmen Church & Dwight, spezifiziert: “Sicherheitsentscheider sollten dafür Sorge tragen, dass der Zugang zu sämtlichen Räumen mit technischem Equipment auf die Personen beschränkt wird, die ihn benötigen. Zudem sollten Auftragnehmer ausschließlich in Begleitung Zugang zu solchen Räumlichkeiten erhalten. Idealerweise wird der Zugang protokolliert und täglich überprüft.” Natürlich sollten die zu ergreifenden Maßnahmen je nach Einrichtung und ihrer Risikolage variiert und angepasst werden, empfiehlt Justin Fier, Senior Vice President of Red Team Operations beim Sicherheitsanbieter Darktrace: “Sämtliche Einrichtungen, die kritische Informationen beherbergen, sollten strengere Sicherheitskontrollen aufweisen, als solche die für weniger sensible Assets genutzt werden. CISOs müssen deshalb in erster Linie wissen, welche Daten und Ressourcen wo gespeichert und genutzt werden, das Risiko bestimmen, das im Fall eines unberechtigten Eindringens ensteht, und anschließend die physischen Sicherheitsmaßnahmen bei Bedarf entsprechend verstärken.” 2. Risiken im Büroalltag erkennen Um sich Zugang zu Unternehmensnetzwerken zu verschaffen, nehmen kriminelle Angreifer auch ganz alltägliche Office-Settings ins Visier. Jeder Netzwerkanschluss könne so zu einem potenziellen Einfallstor in die IT-Umgebung werden, warnt Will Bass, Vice President Cybersecurity beim Rechenzentrumsspezialisten Flexential. Sein Rat an CISOs: “Setzen Sie sich intensiv mit der physischen Sicherheitsarchitektur und den Standards für alle Einrichtungen auseinander, unabhängig davon, ob es sich um sensible Facilities handelt oder nicht. Nur so können Sie sicherstellen, die richtigen Defense-in-Depth-Maßnahmen einzusetzen und unbefugten, physischen Zugriff zu verhindern.” Optiv-CISO Shier ergänzt, dass das auch in Zeiten von Remote- und Hybrid Work relevant sei: “Trotzdem die Büros in vielen Fällen inzwischen weniger frequentiert sind, müssen Sicherheitsentscheider gewährleisten, dass Bürogebäude mit angemessenen physischen Sicherheitskontrollen ausgestattet sind. Drahtlose Zugangspunkte, Zugangskontrollen mit Ausweisen und Videoüberwachung sind weiterhin relevant und sollten keinesfalls unter den Tisch fallen.” 3. Laterale Bewegungen in physischen Räumen ausschließen Wenn es darum geht, den Zugang zu Unternehmen physisch abzusichern, sollten CISOs außerdem ein Augenmerk darauf legen, ob sich Angreifer lateral durch physische Sperrzonen bewegen können. Alethe Denis, Senior Security Consultant beim Sicherheitsanbieter Bishop Fox, erklärt: “Hat sich ein Angreifer erst einmal Zugang zu Sperrbereichen verschafft, sinkt die Wahrscheinlichkeit aufzufliegen, drastisch. Schließlich gehen die allermeisten Menschen davon aus, dass Personen, die sich in Sperrbereichen aufhalten, zuvor eine Zugangskontrolle durchlaufen und bestanden haben.” Ebenso wie Unternehmen Netzwerksegmentierung und Zero-Trust-Prinzipien einsetzten, um Netzwerkressourcen zu schützen, sollten sie auch im Bereich physische Security vorgehen, fordert die Sicherheitsexpertin: “Im Idealfall verhindern Treppenhäuser und Aufzüge mit Authentifizierungserfordernis sowie aufmerksame Mitarbeiter, dass es zu ‘Tailgaiting’ und einem möglichen Schaden für das Unternehmen kommt.” 4. Assets in Colocation- und Cloud-Umgebungen schützen Das Adlerauge der Sicherheitsentscheider ist aber nicht nur gefragt, wenn es um unternehmenseigene Lokalitäten geht. Auch Colocation-Facilities oder -Rechenzentren sollten diesbezüglich berücksichtigt werden, fordert Shier: “Sollten Sie zum Beispiel ein Rechenzentrum mit anderen Unternehmen teilen, tun Sie gut daran, auch einzelne Serverracks abzusichern, etwa mit integrierten Ausweislesegeräten. Zudem ist es essenziell, Rechenzentren mit Kameras, Wachpersonal und weiteren Kontrollmaßnahmen auszustatten.” Selbst wenn die physische Handhabung von Systemen vollständig von der Organisation abstrahiert sei, wie bei Public-Cloud- oder SaaS-Ressourcen, müssten CISOs dennoch darauf achten, wie diese Systeme physisch kontrolliert werden, ist Mike Pedrick, Vice President of Cybersecurity Consulting beim Managed-Service-Provider Nuspire, überzeugt: “Solche Offerings entbinden CISOs nicht von ihrer Verantwortung. Wenn überhaupt, setzt es sie zusätzlich unter Druck, die Bedeutung von Verträgen und Service Level Agreements sowie den Wert eines erfolgreichen Audits durch Dritte zu schätzen.” 5. Physische Cyber-Verbindungen analysieren CISOs, die in Kritis-Organisationen tätig sind, sollten sich nicht nur Gedanken darüber machen, wie sich physische Handlungen auf die Cyberumgebung auswirken können. Sie müssen auch dazu in der Lage sein, einzuschätzen, wie sich Aktivitäten im Cyberraum auf physische Umgebungen auswirken könnten. “Cyberangriffe auf industrielle Umgebungen können eine erhebliche Bedrohung für die physische Sicherheit darstellen”, konstatiert Almog Apirion, Mitbegründer des Remote-Access-Anbieters Cyolo. Angesichts der heutigen Konvergenz von IT- und OT-Umgebungen sollten CISOs jedoch generell, also auch wenn sie nicht im Kritis-Bereich tätig sind, sämtliche Verbindungspunkte zwischen dem physischen und dem Cyberraum im Blick haben. So fielen zum Beispiel auch physische Industrieanlagen in den Bereich des CISO, wenn diese remote gesteuert respektive gemanagt werden könnten, gibt Apirion zu bedenken. 6. IoT-Gerätschaften berücksichtigen Ein weiterer Aspekt der physischen Security steht mit IoT-Devices in Zusammenhang. Flexential-Manager Bass erklärt: “IoT-Geräte befinden sich oft in frei zugänglichen Bereichen, wie etwa Überwachungskameras an der Außenseite eines Gebäudes. Der physische Zugang zu einem solchen Device ist ein potenzieller Einstiegspunkt. Zu verhindern, dass es dazu kommt, erfordert spezifische Schutzmaßnahmen und kann zur Herausforderung gereichen.” Radware-CISO Taylor weist darauf hin, dass IoT-Gerätschaften wie OT-Systeme unter Umständen essenzielle Funktionen im physischen Raum steuern: “IoT-Systeme stellen eine Brücke zwischen Information und Aktion dar. Das macht sie im Rahmen physischer Angriffe zu einem attraktiven Ziel.” Der Sicherheitsentscheider appelliert deshalb, bei solchen Devices auf integrierte Monitoring-Funktionalitäten zu achten, um unbefugte Manipulationen von Software oder Malware-Befall zu verhindern. Er ergänzt: “Für den Fall, dass jemand das IoT-Gerät zerstört, sollte zudem ein Notfallplan existieren.” 7. Remote-Devices sperren Der Netzwerkrand hat sich im Laufe der Zeit verändert. Für CISOs bedeutet das: Sie müssen auf Bedrohungsmodelle und Kontrollmaßnahmen setzen, die im jeweiligen Kontext ihres Unternehmens Sinn ergeben und ein akzeptables Risikolevel realisieren. Dazu sollten Security Stakeholder und Supply-Chain-Partner zusammenarbeiten, um die Integrität der Hardware sicherzustellen und der Belegschaft Security Best Practices an die Hand zu geben. Die neue Arbeitswelt hat dabei das Problem der verteilten Gerätschaften weiter verstärkt, wie Darktrace-Sicherheitsexperte Fier erklärt: “Wegen der Popularität von Remote und Hybrid Work wird es für CISOs zunehmend herausfordernder, physische IT-Ressourcen abzusichern. Schließlich nutzen die Mitarbeiter ihre Geräte an vielen verschiedenen Orten, was grundsätzlich das Risiko von Verlust, Diebstahl und Missbrauch erhöht. Das Homeoffice hilft an dieser Stelle auch nicht, in diesem Fall müssen CISOs sich auch damit befassen, wie etwa Router im Homeoffice abgesichert sind.” Laut Fier nehmen kriminelle Hacker zunehmend solche Devices ins Visier. Sein Tipp, um Abhilfe zu schaffen: “Erwägen Sie, Personen, die für Angreifer von besonderem Interesse sein könnten, etwa Führungskräfte und Administratoren, mit speziell abgesicherter Hardware auszustatten.” 8. Auf integrierte Access Control setzen Facility Teams sind für die alltäglichen Administrationsaufgaben in Zusammenhang mit physischen Zugangskontrollen, und der Gebäudesicherheit im Allgemeinen, zuständig. Diesbezüglich empfiehlt es sich allerdings, Sicherheitsentscheider einzubeziehen, wie Church & Dwight CISO Ortiz vorschlägt: “Ein CISO sollte mit den Teams für physische Sicherheit zusammenarbeiten, um die Risikolage physischer Zugangskontrollen zu durchdringen. Das beinhaltet zum Beispiel zu wissen, ob der Zugang zu einer Einrichtung durch einen Empfangsbereich gesichert wird, per Badge erfolgt oder ob Videoüberwachungssysteme im Einsatz sind. Zudem sollten die Zugangssysteme auf verdächtige Aktivitäten überprüft werden.” Der Manager ist davon überzeugt, dass CISOs auch einen Beitrag dazu leisten sollten, die Access-Control-Maßnahmen mitzugestalten und in logische Zugangskontrollen zu integrieren. “Physische und logische Zugangskontrollen müssen Hand in Hand gehen. Das gilt insbesondere, wenn Zugangsdaten verlorengehen oder Mitarbeiter entlassen werden”, hält Ortiz fest. 9. Überwachungssysteme (und deren Daten) absichern Videoüberwachungssysteme zu monitoren, fällt ebenfalls nicht ins native Zuständigkeitsgebiet von CISOs. Trotzdem sollten Sicherheitsentscheider ein Interesse daran haben, mitzureden, wenn es darum geht, diese Systeme zu designen und abzusichern. Schließlich sind sie in der Regel die Spezialisten, wenn es um Datenschutz und Compliance geht. “In Anbetracht der unterschiedlichen Datenschutzbedenken, der gesetzlichen Verpflichtungen und anderer Aspekte, die mit einer Videoüberwachung einhergehen, sollten CISOs eine tragende Rolle einnehmen, wenn es darum geht, diese Systeme zu managen”, bestätigt Darktrace-Manager Fier und fügt hinzu: “Dazu müssen sie eng mit den relevanten Teams, beispielsweise der Rechtsabteilung, zusammenarbeiten und sicherstellen, dass die jeweils geltenden Gesetze und Datenschutzvorschriften eingehalten werden.” Davon abgesehen seien moderne CCTV-Systeme auch Teil der IT-Umgebung, vergrößerten also die Cyberangriffsfläche von Unternehmen, erklärt Jonathan Sword, Director der Security-Beratung Agility Cyber: “Es ist üblich, dass die Überwachungskameras von Bürogebäuden mit dem Hauptnetzwerk des Unternehmens verbunden sind. Sie sind also für andere Benutzer im Netzwerk einsehbar, und damit potenziell auch für Bedrohungsakteurre, die sich Zugang verschafft haben.” 10. Überwachungsdaten bereithalten Essenziell ist für CISOs und ihre Incident-Response -Teams schließlich auch, jederzeit auf den Output dieser Überwachungssysteme zugreifen zu können. Das Ziel ist dabei, mit Hilfe der Überwachungsaufnahmen Aktivitäten in physischen Räumen schnell und einfach mit Aktionen logischer Systeme zu verknüpfen. Bishop-Fox-Security-Expertin Denis erklärt: “Wenn es zu einem Angriff kommt, bei dem Daten gefährdet sein könnten und das Überwachungsmaterial Erkenntnisse zum Status der Attacke geben kann, sollte das IT-Sicherheitsteam auch auf diese Daten zugreifen können.” (fm) Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.
Dangerous by Default: What OpenClaw CVE Record Tells Us About Agentic AI

secdim.com · 4 months ago

OpenClaw, a rapidly growing AI agent, has faced an unprecedented number of vulnerabilities, totaling 104 in just 18 days, resulting in 28 CVEs. These vulnerabilities include OS command injection (CWE-78), path traversal (CWE-22), and prompt injection, often stemming from insecure design and a lack of input validation. The agent’s dynamic, AI-generated code and unrestricted shell execution significantly expand its attack surface, making patching unreliable. Compared to established frameworks like LangChain and Ollama, which have far fewer vulnerabilities, OpenClaw highlights the need for secure-by-design principles, including least privilege and sandboxed execution. CVE-2026-27001 exemplifies prompt injection risks caused by embedding untrusted data directly into system prompts.
LiteLLM malware supply chain attack analysis (pt-BR only, sorry)

gutem.github.io · 4 months ago

A serious supply chain attack has targeted the LiteLLM Python package, specifically versions 1.82.7 and 1.82.8. The attackers injected malicious code that delivers a persistent backdoor, named sysmon, which establishes command and control communication via https://checkmarx.zone/raw. The malware collects sensitive data like SSH keys, AWS credentials, and crypto wallets, and can propagate across Kubernetes clusters. Remediation steps include version rollback, credential rotation, and rebuilding environments.
New critical Citrix NetScaler hole of similar severity to CitrixBleed2, says expert

www.csoonline.com · 4 months ago

A critical vulnerability, CVE-2026-3055, has been identified in Citrix NetScaler ADC and NetScaler Gateway devices. This out-of-bounds read vulnerability allows an unauthenticated attacker to potentially leak sensitive information from the appliance’s memory, similar to previous CitrixBleed incidents. Security experts warn that threat actors are likely developing exploits for this flaw, and immediate patching is strongly recommended. Citrix has also advised users of CVE-2026-4368, a race condition vulnerability, affecting certain NetScaler versions. NetScaler devices, being internet-facing, are attractive targets for attackers.
GitHub adds AI-powered bug detection to expand security coverage

www.bleepingcomputer.com · 4 months ago

GitHub is integrating AI-powered scanning into its Code Security tool to expand vulnerability detection capabilities. This hybrid approach combines CodeQL’s deep semantic analysis with broader AI coverage for languages like Shell/Bash, Dockerfiles, and Terraform. The new system, expected in public preview early in Q2 2026, aims to identify security issues previously difficult to detect. GitHub’s internal testing showed positive developer feedback and faster resolution times with AI-powered remediation suggestions like Copilot Autofix.
China bars executives at Meta-owned AI company from leaving country

www.washingtonpost.com · 4 months ago

false