Blahalla

Water utilities strengthen cybersecurity through cooperation

www.csoonline.com · 4 months ago

Water utilities, many running aging systems with minimal IT or cybersecurity staff, are strengthening defenses by sharing information and coordinating responses. A two year pilot involving two hundred small and medium utilities showed improved security when cybersecurity training was paired with adequate technical and organizational support. There were reported attacks in 2024, including an October incident that disrupted American Water billing, other attacks against a Texas water company, and incidents reported in Norway and Poland. There are four recommended steps to improve security: avoid relying on free tools, expand hands on technical assistance for implementation, incorporate cybersecurity training into operator licensing, and strengthen ties between utilities and water sector associations to shift from information distribution to capacity building and build resilient infrastructure.
Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets

thehackernews.com · 4 months ago

Trivy, the open source vulnerability scanner maintained by Aqua Security, was compromised again within a month when attackers force pushed 75 version tags in the aquasecurity trivy action repository and seven tags in the aquasecurity setup trivy repository to distribute a malicious payload. The payload executes inside GitHub Actions runners to harvest environment variables and credentials including SSH keys, cloud provider and database credentials, Git and Docker configurations, Kubernetes tokens, and cryptocurrency wallets, then encrypts and exfiltrates the data. The incident follows a prior breach in which an autonomous bot exploited a pull request target workflow to steal a personal access token that was then used to seize repository control, and the malware contains strings and tooling that point to the threat actor known as TeamPCP while a false flag remains possible. Users are advised to treat pipeline secrets as compromised and rotate them immediately, pin GitHub Actions to full commit hashes rather than version tags, upgrade to the safe versions trivy 0.69.3, trivy action 0.35.0 and setup trivy 0.2.6, and block known exfiltration channels and check for public repositories used to stage stolen data.
Claude Code workspace trust dialog bypass via repository settings loading order [CVE-2026-33068, CVSS 7.7]. Settings resolved before trust dialog shown.

raxe.ai · 4 months ago

There is a configuration loading order defect in Anthropic's Claude Code CLI tool versions prior to 2.1.53 that can allow a malicious repository level settings file to bypass the workspace trust confirmation, tracked as CVE-2026-33068. A repository level settings file named dot claude slash settings dot json containing the documented bypassPermissions field is resolved before the trust dialog is presented, causing elevated permissions to be applied without user approval and representing CWE 807 reliance on untrusted inputs in a security decision. Claude Code 2.1.53 fixes the issue by changing the loading order so the workspace trust dialog is shown before repository settings are resolved.
Fake ‘Trusted Sender’ Labels Misused in New Apple Mail Phishing Scheme

www.techrepublic.com · 4 months ago

Apple Mail's trusted sender label can be misleading because the mail app assigns it based on familiarity such as saved contacts or prior replies rather than any verification of message authenticity. Scammers are exploiting that behavior by spoofing addresses so malicious messages still display the trusted sender banner, creating a false sense of safety that encourages users to click phishing links. Security guidance calls for users not to rely on app visual cues, to verify account messages independently, to enable two factor authentication, and to watch for subtle branding or wording errors.
Police take down 373,000 fake CSAM sites in Operation Alice

www.bleepingcomputer.com · 4 months ago

Operation Alice, an international law enforcement action led by Germany with support from Europol, shut down more than 373,000 dark web sites that advertised fake child sexual abuse material packages and offered cybercrime as a service. The platform called Alice with Violence CP, run by a 35 year old suspect based in China, used previews to trick roughly 10,000 users into paying between EUR 17 and EUR 250 in Bitcoin, collecting about four hundred thousand dollars, and authorities have identified 440 users in 23 countries and are investigating 100 of them. Investigators seized 287 servers including 105 in Germany, issued an international arrest warrant for the operator, and highlighted victim support and investigative initiatives such as Europol's Help4U platform and the Trace an Object campaign.
White House Unveils A.I. Policy Aimed at Blocking State Laws

www.nytimes.com · 4 months ago

The White House unveiled a four page legislative framework urging Congress to create a national AI law and to preempt state AI laws it views as unduly burdensome. The framework outlines priorities including protections for children, measures to prevent electricity cost spikes from AI infrastructure, respect for intellectual property, safeguards for free speech, and education for Americans on using the technology. House Republican leaders praised the plan, but analysts and state officials warn that federal preemption would set up a clash with states and that passing a unified federal bill will be difficult without bipartisan agreement.
Stop using AI to submit bug reports, says Google

www.csoonline.com · 4 months ago

Google will stop accepting AI generated bug submissions to its open source software vulnerability reward program and will require higher quality proof for certain reward tiers such as OSS Fuzz reproduction or a merged patch so triage teams can focus on real world impact. The change follows concern that many AI generated reports contain hallucinations about exploitability or report bugs with little security impact. Major technology and AI companies including Google, Anthropic, AWS, Microsoft, and OpenAI are contributing twelve point five million dollars to a fund managed by Alpha Omega and the Open Source Security Foundation to provide AI tools and maintainer support for handling the surge in machine generated security reports.
Cyber OpSec Fail: Beast Gang Exposes Ransomware Server

www.darkreading.com · 4 months ago

An open server hosted on a German cloud provider was discovered containing a Beast ransomware operator's full toolset, exposing the group's tactics, techniques, and procedures and showing significant overlap with other ransomware gangs. The toolset includes utilities for reconnaissance, network mapping, credential theft, exfiltration, and persistence, plus scripts such as a disablebackup.bat that deletes Volume Shadow Copy Service backups and a CleanExit executable likely used to wipe logs. Beast, which emerged from the Monster family and began operating as a ransomware as a service in 2025, commonly uses dual use tools like AnyDesk and Mega, complicating attribution unless the ransomware binary is recovered. Recommended defenses are resilient off site backups and logging, endpoint detection and response or managed detection services, and application allow listing to block high risk dual use tools.
CTI-REALM: A new benchmark for end-to-end detection rule generation with AI agents

www.microsoft.com · 4 months ago

false
Secure agentic AI end-to-end

www.microsoft.com · 4 months ago

There are new purpose-built capabilities to secure agentic AI end-to-end, including Agent 365, which will be generally available on May 1 and is included in Microsoft 365 E7 The Frontier Suite. There are expanded visibility and governance features such as Security Dashboard for AI now generally available, Entra Internet Access Shadow AI Detection generally available on March 31, and an enhanced Intune app inventory becoming generally available in May, while Entra Backup and Recovery and Entra Tenant Governance are available in preview. There are identity and access enhancements including synced passkeys now generally available, passkey integration into Windows Hello in preview, Entra external multi factor authentication generally available, and Entra adaptive risk remediation becoming generally available in April. There are claims that these capabilities leverage more than 100 trillion daily signals to help protect 1.6 million customers, one billion identities, and 24 billion Copilot interactions.
In Other News: New Android Safeguards, Operation Alice, UK Toughens Cyber Reporting

www.securityweek.com · 4 months ago

Researchers found nine vulnerabilities across four budget IP KVM vendors, with the most severe flaw in the Angeet Yeeso ES3 allowing remote arbitrary file writes and OS command execution without credentials, enabling attackers to inject keystrokes, boot from removable media, disable Secure Boot, and bypass OS protections, while some vendors have issued patches and others have not committed fixes. A chained exploit named Claudy Day combines three vulnerabilities to silently hijack Claude chat sessions via crafted claude.ai URLs wrapped in open redirects and delivered through ads, with Anthropic patching the prompt injection element while fixes for the remaining two issues are still in progress. A roughly 20-member ransomware group called The Gentlemen primarily exploits CVE-2024-55591, a critical FortiOS and FortiProxy authentication bypass, to gain access to networks, use bring-your-own-vulnerable-driver techniques to disable security tools, and maintain a database of about 14,700 compromised FortiGate devices. An international 10-day operation led by German authorities took down more than 373,000 dark web domains tied to a single operator who allegedly collected about 345,000 euros from roughly 10,000 victims, while additional developments include Sears Home Services exposing nearly 3.7 million customer service records, Google planning an advanced Android sideloading flow to roll out in August 2026 to add deliberate friction against social engineering, and the UK Financial Conduct Authority finalizing rules that require certain financial firms to report serious cyber incidents within specified windows with the rules taking effect in March 2027.
Denver’s crosswalks hacked to broadcast anti-Trump messages

www.bitdefender.com · 4 months ago

Two newly installed crosswalk audio units on East Colfax Avenue in Denver began broadcasting a profane anti-Trump message alongside their normal walk instructions, according to a March 20, 2026 report. The devices were reportedly turned on while still using factory-default credentials, allowing access; passwords have since been changed and police are investigating. Officials warned the tampering endangered people with visual impairments who rely on audio signals and said the incident highlights how default passwords create preventable hazards for roadside infrastructure.
Critical Langflow Flaw CVE-2026-33017 Triggers Attacks within 20 Hours of Disclosure

thehackernews.com · 4 months ago

There is a critical unauthenticated code injection vulnerability in the open source AI workflow tool Langflow tracked as CVE 2026 33017 with a CVSS score of 9.3 that allows remote code execution by passing attacker supplied Python code to the public build endpoint where it is executed with zero sandboxing. The flaw affects all versions prior to and including 1.8.1 and was addressed in development version 1.9.0.dev8, and exploitation was observed within 20 hours of disclosure with attackers using a single HTTP POST to achieve code execution and exfiltrate keys and credentials. The bug reuses the same exec call pattern as a previous critical Langflow vulnerability CVE 2025 3248 and defenders are advised to update to the patched release, rotate secrets, audit environment variables, monitor outbound connections, and restrict network access to public instances.
CISA orders feds to patch max-severity Cisco flaw by Sunday

www.bleepingcomputer.com · 4 months ago

CISA ordered federal civilian agencies to patch a maximum severity vulnerability in Cisco Secure Firewall Management Center by Sunday, March 22, 2026, identifying it as CVE-2026-20131. The vulnerability is caused by insecure deserialization of a user supplied Java byte stream in the web based management interface and can allow an unauthenticated remote attacker to execute arbitrary Java code as root by sending a specially crafted serialized Java object. Cisco published a security bulletin on March 4 and updated it on March 18 to warn of active exploitation, with Amazon threat intelligence confirming that the Interlock ransomware gang has been exploiting CVE-2026-20131 since late January. CISA added the flaw to its Known Exploited Vulnerabilities catalog, labeled it as used in ransomware campaigns, and gave agencies subject to Binding Operational Directive 22-01 until March 22, 2026, to apply updates or stop using the product while recommending that other organizations also act.
3 Men Charged With Conspiring to Smuggle US Artificial Intelligence to China

www.securityweek.com · 4 months ago

Three men were charged with conspiring to smuggle billions of dollars worth of United States assembled high performance servers containing advanced Nvidia chips to China in violation of United States export control laws. Prosecutors say that between 2024 and 2025 the defendants directed orders totaling 2.5 billion dollars and diverted at least 510 million dollars worth of servers after assembly by using fabricated documents, staged bogus equipment to pass inventory audits, and a pass through company to conceal customers. Yih Shyan Liaw, a 71 year old senior vice president and board member of Super Micro Computer, and Ting Wei Sun, a 44 year old contractor, were arrested while Ruei Tsang Chang, a sales manager in Taiwan, remains a fugitive, and the companies said they are cooperating with investigators and emphasizing compliance.
Lookout's LLM-assistance findings in DarkSword iOS exploit kit: a source-by-source breakdown of what each research team actually said

blog.barrack.ai · 4 months ago

DarkSword is a JavaScript based iOS exploit kit that chains six vulnerabilities, CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520, including three zero days, to achieve full device compromise on iPhones running iOS 18.4 through 18.7. Approximately 270 million devices running iOS 18 are potentially affected, with about 221 million devices running iOS 18.4 through 18.6.2 estimated vulnerable, and three operator groups called UNC6353, UNC6748, and PARS Defense deployed the kit with payloads named GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER respectively. Indicators consistent with LLM assistance were identified, including a folder emoji and a checkmark symbol in server headings, numerous comments and verbose logging in unobfuscated JavaScript, and pattern analysis suggesting some code may have been generated or modified with AI, though researchers emphasized these indicators are circumstantial and offered alternative explanations.
How CISOs Can Survive the Era of Geopolitical Cyberattacks

www.bleepingcomputer.com · 4 months ago

Geopolitical tensions are driving destructive cyberattacks that aim to disrupt operations rather than collect ransom, with nation state and politically aligned groups deploying wipers against organizations in critical supply chains and infrastructure. A March 2026 Iran-linked Handala campaign reportedly wiped tens of thousands of devices at a major medical technology manufacturer, disrupting operations across 79 countries and slowing manufacturing, order processing, and logistics. Attackers commonly use stolen credentials, hands-on activity, and legitimate administrative tools such as RDP, PowerShell remoting, WMI, SMB, and SSH, and may maintain covert persistence via tunneling tools, so detection alone is insufficient. A five-step containment playbook calls for identity-aware access and MFA for administrative services, default-deny administrative ports, strict privileged account segmentation, monitoring for unauthorized tunnels and east west connectivity, and rapid automated isolation to ring fence affected hosts and limit the blast radius.
AI Factories, Security Flaws, and Workforce Shifts Define This Week in Tech

www.techrepublic.com · 4 months ago

Nvidia outlined a vision for trillion dollar AI factories and unveiled new hardware and software including the Vera Rubin seven chip stack that it says can boost inference throughput up to 35 times per megawatt, radiation hardened GPUs for orbital data centers, and robotics and simulation tools to accelerate synthetic data and agent development. Major security incidents and patches were reported, including the DarkSword iOS exploit affecting iOS 18.4 to 18.7, a MediaTek secure boot chain flaw tracked as CVE-2026-20435 affecting roughly 875 million devices, a Microsoft Authenticator flaw CVE-2026-26123, three critical Windows 11 Routing and Remote Access Service remote code execution flaws CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111 patched via an out of band hotpatch, and a Microsoft Copilot cross-prompt injection vulnerability CVE-2026-26133. Industry moves included large scale AI infrastructure deals and acquisitions, companies cutting staff to redirect spending toward AI, and a campaign by pro Iran affiliated hackers that abused Microsoft Intune to wipe nearly 80,000 Stryker devices, prompting federal alerts and calls for tighter access controls.
Eclypsium Raises $25 Million for Device Supply Chain Security

www.securityweek.com · 4 months ago

false
Interlock Ransomware Targets Cisco Enterprise Firewalls

www.darkreading.com · 4 months ago

There is an Interlock ransomware campaign targeting Cisco Secure Firewall Management Center that exploits CVE-2026-20131, a critical CVSS 10 vulnerability allowing an unauthenticated remote attacker to execute arbitrary Java code as root through insecure deserialization of a Java byte stream. Cisco disclosed the flaw on March 4, 2026, but Amazon researchers say Interlock exploited it as early as January 26, 2026 and a misconfigured infrastructure server exposed the group’s full operational toolkit including custom backdoors reconnaissance scripts and evasion tooling. Organizations running unpatched FMC should upgrade to the fixed release immediately and follow Amazon’s advisory for indicators of compromise and detection recommendations.
US Confirms Handala Link to Iran Government Amid Takedown of Hackers’ Sites

www.securityweek.com · 4 months ago

The United States has for the first time publicly linked the Handala hacking group to Iran's Ministry of Intelligence and Security and seized multiple domains used in the group's cyber-enabled psychological operations. Handala is accused of a range of disruptive actions including wiping systems at a U.S. medical technology company, hijacking camera feeds, exfiltrating and deleting corporate data, exposing intelligence personnel, and carrying out attacks against Israeli targets, and security researchers widely regard the group as a cover for the Iran-aligned Void Manticore actor. Authorities said the seized sites were used to claim credit for hacks, publish stolen material, and call for violence, an associated social media account was suspended, and the U.S. State Department is offering up to ten million dollars for information on foreign hackers who target critical infrastructure.
6 Best Open Source Password Managers for Windows in 2026

www.techrepublic.com · 4 months ago

false
Chrome Security Update Fixes 26 Vulnerabilities Enabling Remote Malicious Code Execution

gbhackers.com · 4 months ago

There are 26 vulnerabilities in Google Chrome that could enable remote malicious code execution, and Stable channel updates 146.0.7680.153 and 146.0.7680.154 for Windows and macOS and 146.0.7680.153 for Linux are rolling out to address them. The fixes cover three Critical, 22 High, and one Medium severity bugs including out of bounds memory access and use after free in components such as WebGL, Base, V8, ANGLE, Blink, WebRTC, WebAudio, PDFium, and Skia, and users are advised to restart browsers after the update. The patched CVE identifiers include CVE-2026-4439 through CVE-2026-4464.
Critical UNISOC T612 Modem Flaw Enables Remote Code Execution via Cellular Calls

gbhackers.com · 4 months ago

There is a severe vulnerability in UNISOC modem firmware that enables remote code execution over cellular calls by sending specially crafted Session Description Protocol messages during SIP signaling, exploiting uncontrolled recursion in the SDPDEC AcapDecoder function to trigger a stack overflow and memory corruption, classified as CWE-674. The flaw impacts UNISOC T612, T616, T606, and T7250 chipsets and was demonstrated by researcher 0x50594d working with SSD Secure Disclosure using a Dockerized Open5GS setup, Kamailio, a LimeSDR, and a Realme C33 running the July 2025 Android security update and specific modem firmware to produce a working remote code execution exploit. Because UNISOC has not released a firmware update, millions of devices from manufacturers that use these chipsets remain exposed to unauthenticated remote compromise, especially during video calls when IMS data fragmentation activates the vulnerable task.
DDoS-Attacken: Schlag gegen internationale Cyberkriminelle

www.csoonline.com · 4 months ago

There was a large scale law enforcement operation in North America and Germany that dismantled the infrastructures of the two largest botnets, Aisuru and Kimwolf, which were used to carry out denial of service attacks that recently disrupted services including Deutsche Bahn and the DB Navigator app. Aisuru infected poorly secured Internet of Things devices such as routers and surveillance cameras and is linked to the largest known DDoS of 31.4 terabits per second that was mitigated by Cloudflare, while Kimwolf focused more on Android and consumer devices including TV boxes. Investigators including Germany's ZAC NRW and the BKA together with partners in Canada and the United States identified two suspected administrators and seized extensive evidence and cryptocurrencies in the five figure range during searches of residences in Germany and Canada, but the criminal network was not fully dismantled and no arrests have been reported.
Cape Raises $100 Million for Protection Against Cellular Security Threats

www.securityweek.com · 4 months ago

Cape raised $100 million in Series C funding, bringing the company’s total investment to $191 million, to expand a privacy first mobile virtual network operator service. The round was co led by Bain Capital Ventures and IVP, with participation from 01 Advisors, 137 Ventures, Definition and Fifth Down Capital. Cape uses eSIM technology and operates its own mobile core while leasing towers to embed network layer protections such as daily rotation of SIM identifiers to prevent persistent tracking, network protections that block SS7 attacks targeting location monitoring and call interception, end to end encryption for certain messaging functions, user controlled SIM swap safeguards, minimal data retention, support for multiple secondary phone numbers on a single SIM for compartmentalized use, and encrypted voicemail for consumers, enterprises and governments.
Proton Mail Shared User Information with the Police

www.schneier.com · 4 months ago

Proton Mail provided subscriber metadata, specifically payment information tied to a particular account, to Swiss authorities, who then passed the information to the FBI. This disclosure highlights that even privacy focused services can be compelled to hand over metadata that may de anonymize users.
Navia Data Breach Impacts 2.7 Million

www.securityweek.com · 4 months ago

Between December 22, 2025 and January 15, 2026, hackers accessed Navia Benefit Solutions systems and likely exfiltrated personal and health plan information for about 2,697,540 individuals. Compromised data included names, dates of birth, Social Security numbers, phone numbers, email addresses, and health plan details, and the incident was discovered on January 23, 2026. Navia, a Renton Washington based third party benefits administrator, notified impacted people by mail where addresses were available and is providing twelve months of free identity theft and credit monitoring while urging vigilance for identity theft and fraud.
‘A.I.-Washing’ Layoffs? + Why L.L.M.s Can’t Write Well + Tokenmaxxing

www.nytimes.com · 4 months ago

false
Google Adds 24-Hour Wait for Unverified App Sideloading to Reduce Malware and Scams

thehackernews.com · 4 months ago

false
Thousands of Magento Sites Hit in Ongoing Defacement Campaign

www.securityweek.com · 4 months ago

There are over 7,500 Magento sites reported defaced in a mass campaign that began on February 27, 2026, with plaintext defacement files found across more than 15,000 hostnames and political messages observed on March 7, 2026. The attacker appears to be exploiting an unauthenticated file upload vulnerability affecting Magento Open Source, Adobe Commerce, and Adobe Commerce with B2B, and analysts noted similarities to the October 2025 SessionReaper incidents. Researchers at Sansec disclosed a new REST API flaw named PolyShell that can allow unauthenticated upload of executables to stores running versions up to 2.4.9-alpha2, which Adobe addressed only in a 2.4.9 pre-release as part of APSB25-94, and Sansec says active exploitation has not been observed yet though exploit methods are circulating and automated attacks are expected.
LeakNet ransomware: what you need to know

www.fortra.com · 4 months ago

LeakNet is a ransomware operation active since late 2024 that encrypts, exfiltrates, and leaks data from compromised organizations. The group presents itself as a digital watchdog but uses ClickFix social engineering, often fake CAPTCHA or error pages, to trick employees into pasting and running malicious commands that grant attackers access. It appears to operate as a tighter knit criminal operation rather than a traditional affiliate ransomware programme and claims victims including Banco Vimenca in the Dominican Republic and SWAN General in Mauritius, with no publicly confirmed ransom payments. Recommended defenses include enforcing multi factor authentication, keeping security solutions and software patched, blocking newly registered domains, maintaining secure off site backups, disabling unnecessary tools such as PsExec, and training staff to recognize social engineering tactics.
The Importance of Behavioral Analytics in AI-Enabled Cyber Attacks

thehackernews.com · 4 months ago

AI is changing how cybercriminals conduct attacks by generating personalized phishing emails, deepfakes and adaptive malware that mimic normal user behavior and evade traditional signature and rule based detection. AI enables automated credential abuse and account takeovers by mimicking human timing and staying within thresholds, and it allows malware to automatically modify code and behavior so static signatures and perimeter trust models fail. Organizations must adopt dynamic, context aware identity based behavioral analytics that establish baselines across users, devices and sessions in real time, extend visibility across privileged access, cloud infrastructure and endpoints, and enforce zero trust with just in time access and session monitoring to reduce the impact of compromised human and non human identities.
Musician admits to $10M streaming royalty fraud using AI bots

www.bleepingcomputer.com · 4 months ago

A North Carolina musician pleaded guilty to collecting over ten million dollars in royalty payments through a massive streaming fraud scheme on Spotify, Apple Music, Amazon Music and YouTube Music. He purchased hundreds of thousands of songs generated with artificial intelligence, uploaded them to streaming platforms, and used automated bots and virtual private networks to stream those tracks billions of times between 2017 and 2024. Prosecutors say the fraud produced billions of fake streams and more than ten million dollars in royalties, and court emails show he boasted of over four billion streams and twelve million dollars in royalties since 2019. He agreed to forfeit eight million ninety one thousand eight hundred forty three dollars and sixty four cents and faces a maximum of five years in prison after pleading guilty to conspiracy to commit wire fraud.
Magento PolyShell Flaw Enables Unauthenticated Uploads, RCE and Account Takeover

thehackernews.com · 4 months ago

A critical flaw in Magento's REST API, dubbed PolyShell, allows unauthenticated attackers to upload arbitrary executables disguised as images, enabling possible remote code execution or account takeover depending on web server configuration. The flaw affects all Magento Open Source and Adobe Commerce versions up to 2.4.9-alpha2, was fixed only in the 2.4.9 pre-release branch as part of APSB25-94, and currently has no isolated backported patch for production releases. Sansec recommends restricting access to the pub/media/customoptions upload directory, verifying nginx or Apache rules, scanning stores for web shells and backdoors, and deploying real-time protections while awaiting an official production patch, and notes it has not observed active exploitation yet but expects automated attacks soon.
Thousands have swooned over this MAGA dream girl. She’s made with AI.

www.washingtonpost.com · 4 months ago

A viral Instagram persona called Jessica Foster is presented as a patriotic Army woman who appears beside fighter jets, world leaders and President Donald Trump and has gained more than a million followers since the account began posting four months ago. Experts say the account is almost certainly AI generated, citing the lack of public military records, inconsistent and muddled uniform insignia, visible visual glitches and other giveaways, and the profile was linked to paid subscription platforms after being removed from a mainstream site for failing human verification. Researchers warn the case exemplifies a growing tactic of using AI-generated women to harvest attention, convert followers into paying customers and potentially be used as a tool for propaganda or information warfare.
I built a time-based encryption algorithm where the key changes every second — try it live

piyush-mishra-00.github.io · 4 months ago

There is a time keyed encryption system called Kaalka Encryption version 5.0.0 that derives keys from clock angles, trigonometric transformations, and timestamps so that every second produces a different encrypted output. The scheme causes the same input encrypted at different times to yield completely different ciphertexts, provides replay protection and time window validation, and supports text, files, and chunked encryption across Python, JavaScript, Java, Kotlin, and Dart. The design uses no external cryptographic primitives and includes a live demo for experimentation, and feedback is invited on whether time based encryption is viable for real world systems.
Critical Langflow Vulnerability Exploited Hours After Public Disclosure

www.securityweek.com · 4 months ago

A critical vulnerability in the Langflow open source AI workflow framework allowed unauthenticated remote code execution and was exploited roughly 20 hours after public disclosure. The bug was fixed in Langflow version 1.8.1 released on March 17 and is tracked as CVE-2026-33017 with a CVSS score of 9.3; it affects a POST endpoint that allows creating public flows without authentication. When an attacker supplies the optional data parameter, flow node definitions can contain Python code that is executed without sandboxing, enabling RCE with a single HTTP request. Observers reported exploitation attempts from multiple IPs within 48 hours that led to theft of keys and credentials and data exfiltration to a common command and control server, raising supply chain attack concerns.
CISA Warns Cisco Secure Firewall Management Center 0-Day Is Being Exploited in Ransomware Attacks

gbhackers.com · 4 months ago

There is a critical zero day vulnerability in Cisco Secure Firewall Management Center and Cisco Security Cloud Control that stems from insecure Java deserialization and allows unauthenticated remote execution of arbitrary Java code as root, tracked as CVE-2026-20131. The flaw is being actively exploited in targeted ransomware campaigns, with security telemetry linking exploitation to the Interlock ransomware group and evidence of attacks before the public disclosure. Organizations must immediately apply Cisco security updates, remove or restrict public access to management interfaces, and follow vendor and national guidance to isolate or discontinue affected deployments until patched.
International joint action disrupts world’s largest DDoS botnets

www.bleepingcomputer.com · 4 months ago

Authorities from the United States, Germany, and Canada have taken down command and control infrastructure, virtual servers, internet domains, and other resources used by the Aisuru, KimWolf, JackSkid, and Mossad botnets to infect Internet of Things devices. The botnets collectively issued hundreds of thousands of distributed denial of service commands, with Aisuru issuing more than two hundred thousand, KimWolf more than twenty five thousand, JackSkid more than ninety thousand, and Mossad more than one thousand. They have infected over three million IoT devices such as web cameras, digital video recorders, and WiFi routers, were used to extort victims, and were behind record setting DDoS attacks that peaked at thirty one point four terabits per second and two hundred million requests per second, including incidents that targeted Department of Defense network addresses.
Bamboo Data Center and Server Vulnerability Enables Remote Code Execution

gbhackers.com · 4 months ago

A high severity remote code execution vulnerability in Atlassian Bamboo Data Center and Server, tracked as CVE-2026-21570, has been resolved by Atlassian. The flaw carries a CVSS 4.0 score of 8.6, can be exploited remotely over the network but requires an attacker to have authenticated administrative or elevated privileges, and successful exploitation permits execution of arbitrary code and full compromise of the host. Multiple Bamboo release lines are affected including versions 9.6.0 through 9.6.23, 10.0.0, 10.1.0, 10.2.0 and select 11.x and 12.x releases, and administrators are urged to apply the provided patches by upgrading to 9.6.24, 10.2.16, or 12.1.3 or later immediately.
Microsoft: March Windows updates break Teams, OneDrive sign-ins

www.bleepingcomputer.com · 4 months ago

There are sign in failures after installing the March Windows 11 cumulative update KB5079473 that prevent Microsoft account sign ins in apps including Teams, OneDrive, Edge, Excel, Word, and Microsoft 365 Copilot, showing an error that incorrectly reports no internet connectivity. The problem affects Microsoft accounts commonly used for Teams Free but does not impact organizations that use Entra ID formerly known as Azure Active Directory. Microsoft says the issue may resolve on its own and advises restarting the device while it is connected to the internet to repair the device connectivity state, and it has issued out of band updates for other unrelated Windows issues.
Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation

www.securityweek.com · 4 months ago

Authorities announced an international operation that disrupted the Aisuru, Kimwolf, JackSkid, and Mossad IoT botnets and seized domains, virtual servers, and other infrastructure. The botnets had compromised more than 3 million devices as of March 2026, including DVRs, cameras, and Wi Fi routers, with Aisuru and its Android focused successor Kimwolf linked to record DDoS attacks that peaked at 31.4 terabits per second in February 2026. According to authorities, Aisuru issued over 200,000 DDoS commands, Kimwolf 25,000, JackSkid 90,000, and Mossad 1,000, and law enforcement in Canada and Germany conducted related operations though no arrest details were released.
The espionage reality: Your infrastructure is already in the collection path

www.csoonline.com · 4 months ago

Enterprises now sit directly in adversaries’ collection path because shared services, identity layers, and connectivity providers centralize access, allowing different actors to exploit the same dependencies without directly targeting organizations. Commercial espionage platforms such as Predator are being used to compromise high value individuals and their devices, creating upstream surveillance that intersects enterprise authentication, networks, and service providers. State aligned campaigns have also operated upstream; in February 2026 Singapore disclosed that UNC3886 had compromised all four major telcos using zero days, rootkits, and long term persistence, turning backbone infrastructure into real time collection points. CISOs should treat upstream providers as part of their attack surface, demand attestation from telecom and cloud vendors, harden session and authentication layers assuming token theft and impersonation, shift detection toward low noise persistent access patterns, and anticipate materially tighter cyber insurance terms due to the risk of permanent APT residency.
Ex-data analyst stole company data in $2.5M extortion scheme

www.bleepingcomputer.com · 4 months ago

A North Carolina man, 27 year old Cameron Curry, also known as Loot, was found guilty of extorting Brightly Software while employed as a data analyst contractor. He used access to payroll and corporate records to steal sensitive documents between August and December 2023 after learning his six month contract would not be extended, and beginning December 11, 2023 he sent more than 60 extortion emails demanding 2.5 million dollars, threatening to leak personal data and to report the company to the U.S. Securities and Exchange Commission, and attaching screenshots showing employee names, dates of birth, home addresses, and compensation. Brightly paid 7,540 dollars in Bitcoin, the FBI executed a search of his residence on January 24, 2024 and seized electronic devices, and Curry was released on bond in January 2024 and faces up to 12 years in prison on six extortion counts. Separately, Brightly disclosed an unrelated April 20, 2023 breach of its SchoolDude platform that exposed credentials and personal data of nearly 3 million users.
DoJ Disrupts 3 Million-Device IoT Botnets Behind Record 31.4 Tbps Global DDoS Attacks

thehackernews.com · 4 months ago

The U.S. Department of Justice announced a court authorized disruption of command and control infrastructure used by several Internet of Things botnets including AISURU, Kimwolf, JackSkid and Mossad, with law enforcement partners in Canada and Germany assisting. Private sector firms including major cloud and security companies assisted the operation, which targeted botnets that conscripted an estimated three million devices worldwide, including more than two million Android devices primarily off brand Android televisions and hundreds of thousands located in the United States. The botnets launched record breaking distributed denial of service attacks, with one November 2025 incident attributed to AISURU and Kimwolf measuring about 31.4 terabits per second and other hyper volumetric attacks reaching multiple terabits and billions of packets per second. Court documents allege the Mirai variants issued hundreds of thousands of DDoS commands and that operators used a cybercrime as a service model to sell access to infected devices, while investigators have identified suspected administrators but no arrests have been announced.
New Critical Jenkins Vulnerabilities Put CI/CD Servers at Risk of RCE Exploits

gbhackers.com · 4 months ago

There are multiple critical vulnerabilities in Jenkins core and the LoadNinja plugin that expose continuous integration and continuous deployment controllers to arbitrary file creation, credential exposure, and remote code execution. The most severe issues are CVE-2026-33001, an arbitrary file creation flaw in archive extraction and symbolic link handling affecting Jenkins core up to weekly 2.554 and LTS 2.541.2, and CVE-2026-33002, a DNS rebinding vulnerability in the CLI WebSocket endpoint that bypasses origin validation and can allow administrative command execution. The LoadNinja plugin contains two medium severity flaws tracked as CVE-2026-33003 and CVE-2026-33004 that store API keys unencrypted in job configuration files and fail to mask them in the graphical interface. Administrators are advised to upgrade to Jenkins weekly version 2.555 or LTS version 2.541.3 and LoadNinja version 2.2, and if immediate updates are not possible enforce authentication, revoke anonymous permissions, and ensure Jenkins is accessible only via HTTPS.
Navia Confirms Data Breach Exposing Sensitive Information of 2.7 Million Users

gbhackers.com · 4 months ago

There are nearly 2.7 million individuals impacted after unauthorized access to Navia Benefit Solutions systems exposed sensitive personal and health plan information. There are reports that the breach stemmed from an API vulnerability that allowed read-only access to participant records dating back to 2018, including full names, dates of birth, addresses, contact details, Social Security numbers, Navia ID numbers, and health plan participation and termination data. There are actions taken by Navia to patch the API, temporarily disable participant registration, notify employers and authorities, and offer affected users 12 months of identity protection and credit monitoring through Kroll while advising fraud alerts and credit monitoring.
Microsoft Introduces Teams Upgrades to Improve Windows App Performance on ioS and Android

gbhackers.com · 4 months ago

false
Apple Warns Older iPhones Vulnerable to Coruna, DarkSword Exploit Kit Attacks

thehackernews.com · 4 months ago

Apple is urging users running outdated iOS to update after web based attacks using the Coruna and DarkSword exploit kits delivered malicious web content that can trigger an infection chain and steal sensitive data. Devices on the latest iPhone software including iOS versions 15 through 26 are said to include fixes and were not at risk, while older devices are being provided updates such as iOS 15.8.7 and iOS 16.7.15 and users who cannot update are advised to enable Lockdown Mode. The attacks are being carried out via watering hole campaigns and researchers warn the exploit kits have been widely adopted by multiple threat actors, raising the risk of mass scale infections.