Blahalla

UK cyber agency unveils AI-powered Cyber Shield to counter attacks at machine speed

www.csoonline.com · 12 days ago

The UK’s National Cyber Security Centre (NCSC) wants to deploy autonomous AI agents capable of finding and neutralizing cyberattacks on national networks in real time, marking Britain’s push toward a sovereign, machine-speed cyber defense system. The blueprint, called Cyber Shield, was developed jointly with the Department for Science, Innovation and Technology (DSIT).

AI Attacks Move in Minutes. Join This Webinar on Building a Defense That Keeps Up

thehackernews.com · 12 days ago

AI has changed how fast attacks move. Work that once took an attacker days now takes minutes. Using models like Mythos, attackers write tailored bait, pick targets, test what lands, and jump to the next host before your team clears the first alert. That is the gap, and it is not your fault. The tools and runbooks most teams run on were built for attackers who work at human speed.

12 Million Impacted by Data Breach at Japanese Telco KDDI

www.securityweek.com · 12 days ago

Hackers exploited a zero-day vulnerability in a third-party system to access a KDDI email system for ISPs.

Attackers Exploit WordPress Plugin Vulnerabilities for Remote Code Execution and Webshell Access

gbhackers.com · 12 days ago

A large-scale exploitation campaign is actively weaponising known vulnerabilities across multiple content management systems, with WordPress plugins forming the primary attack surface.

15-Year-Old Linux Vulnerability ‘GhostLock’ Earns Researchers $92k From Google

www.securityweek.com · 12 days ago

Affecting every major distribution since 2011, the Linux kernel vulnerability allows attackers to gain root access.

HP Linux Imaging and Printing Software Flaw Enables Privilege Escalation Attacks

gbhackers.com · 12 days ago

A critical vulnerability has been discovered in HP Linux Imaging and Printing Software (HPLIP), which exposes Linux systems to potential privilege escalation and remote code execution attacks. This vulnerability, tracked as CVE-2026-14544, has a CVSS v3 score of 9.

AssuranceAmerica Confirms Massive Data Breach Exposing Driver’s License and Insurance Data

gbhackers.com · 12 days ago

AssuranceAmerica, a U.S. provider of auto and renters insurance, has confirmed a significant data breach that exposed the personal information and driver’s license data of approximately 6.99 million people. This incident marks the largest known leak of Americans’ driver’s license information this year.

RedHook Abuses Accessibility Service to Enable Developer Options and Wireless Debugging

gbhackers.com · 12 days ago

RedHook, an Android Remote Access Trojan (RAT) first profiled in July 2025, has resurfaced with a markedly more dangerous capability: autonomous abuse of Android’s ADB Wireless Debugging to acquire shell-level privileges (uid 2000).

The Language of AI Could Change How Humans Speak

www.schneier.com · 12 days ago

Last week, national security agencies from the Five Eyes, that’s the rich, English-language-speaking countries club, jointly released a statement warning of the increasing cyber risks of AI models: in particular, their ability to autonomously hack into systems and networks.

Microsoft to retire the OWA Light client in Exchange Server

www.bleepingcomputer.com · 12 days ago

Microsoft has announced plans to disable Outlook Web Access (OWA) Light, the lightweight version of the Outlook Web App email client, in a future Exchange Server update.

Summer of Clearinghouses

thehackernews.com · 12 days ago

Everyone seems to have announced a clearinghouse over the past few weeks. We did too. Ours is called Athena, and the main thing that sets it apart is that it was already real and running when we announced it, built quietly months earlier, heads down, taking findings and shipping fixes, because customers kept asking us to.

GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses

thehackernews.com · 12 days ago

Cybersecurity researchers have flagged a new ransomware family called GodDamn that employs the PoisonX kernel driver to neutralize security software as part of its defense evasion strategy. According to a new report published by the Threat Hunter Team from Symantec, the ransomware was first publicly spotted in the wild on May 21, 2026.

GhostApproval Attack Impacts Amazon Q, Claude Code, Cursor, Google Antigravity, and Windsurf

gbhackers.com · 12 days ago

A newly disclosed vulnerability pattern known as “GhostApproval” is exposing significant flaws in the trust boundary of leading AI coding assistants, including Amazon Q Developer, Anthropic Claude Code, Cursor, Google Antigravity, Augment, and Windsurf.

Microsoft Patches Defender ‘RoguePlanet’ Vulnerability

www.securityweek.com · 12 days ago

The privilege escalation vulnerability tracked as CVE-2026-50656 has been patched with a Microsoft Malware Protection Engine update.

Foxit Patches Multiple Use-After-Free Flaws Leading to Remote Code Execution

gbhackers.com · 12 days ago

Foxit has released critical security updates to address multiple use-after-free vulnerabilities that could lead to remote code execution (RCE) in its widely used PDF Reader and PDF Editor products.

Microsoft Entra Passkey Enrollment Abused in Operator-Controlled Vishing Campaign

gbhackers.com · 12 days ago

A focused vishing campaign that weaponizes Microsoft Entra passkey enrollment as a social-engineering vector to enable account takeover and downstream data extortion. The threat actor begins by registering domains that include the term “passkey” (for example, assignpasskey[.]com, deploypasskey[.]com, passkeydeploy[.]com, passkeyadd[.]com, setpasskey[.]com) and creating per-target subdomains.

Mount Royal University Confirms Data Stolen in Ransomware Attack

www.securityweek.com · 12 days ago

Hackers accessed the institution’s internal network and deleted two drives containing employee, student, and university data.

Agentic AI identity: A 6-stage maturity model for non-human identities

www.csoonline.com · 12 days ago

In a client engagement last year, an LLM-based deployment agent with standing access to a production Kubernetes cluster triggered a four-hour outage through a malformed configuration push. In the IAM, the agent appeared as a service account with a long-lived API key, no MFA, no scoped revocation path.

'GodDamn' Ransomware Uses BYOVD to Smite US Companies

www.darkreading.com · 12 days ago

Microsoft co-signed a malicious kernel driver, and now it's being used to kill security software in ransomware attacks.

Nike Alleged Breach: Threat Actors Claim Leak of Millions of Customer Records

gbhackers.com · 12 days ago

A threat actor on a prominent cybercrime forum has claimed responsibility for leaking data allegedly belonging to Nike and Alcon, posting the purported datasets for download. The claims, currently unverified, suggest a significant breach affecting millions of records across both organizations.

Police arrests 5,800 suspects in global anti-fraud crackdown

www.bleepingcomputer.com · 12 days ago

Law enforcement agencies have arrested 5,811 suspects and seized $293 million in illicit assets in a global anti-fraud operation spanning 97 countries.

GitLab Patches 8 Vulnerabilities Affecting CE and EE Installations

gbhackers.com · 12 days ago

GitLab has released critical security updates to address eight vulnerabilities in its Community Edition (CE) and Enterprise Edition (EE). Administrators are urged to upgrade immediately to versions 19.1.2, 19.0.4, or 18.11.7.

Google Chrome Update Patches 27 Security Vulnerabilities Including Critical Use-After-Free Flaws

gbhackers.com · 12 days ago

Google has released a critical security update for Chrome, upgrading the Stable channel to version 150.0.7871.114/.115 on Windows and macOS, and to version 150.0.7871.114 on Linux. This update addresses 27 vulnerabilities, including several critical use-after-free flaws that could potentially enable remote code execution.

HalluSquatting Attack Lets Hackers Turn AI Coding Assistants Into Botnet Installers

gbhackers.com · 12 days ago

A newly disclosed attack technique called “HalluSquatting” is raising serious concerns in the AI security landscape. This technique demonstrates how attackers can exploit large language model (LLM) hallucinations to covertly compromise systems and potentially create botnets on a large scale.

GitHub Copilot IDE Coding Agents Vulnerable to Workflow-Level Jailbreak Attacks

gbhackers.com · 12 days ago

GitHub Copilot’s new coding agents, which are integrated into IDEs, are susceptible to a specific type of “workflow-level” jailbreak attacks. These attacks can bypass chat refusals, allowing agents to generate harmful code while performing standard software development tasks unwittingly.

How to Turn Your Phone Into a Personal Health Dashboard

www.nytimes.com · 12 days ago

Free apps from Google, Samsung and Apple can help you track your diet, exercise and well-being, and provide vital information during emergencies.

Why fixing your data architecture matters more than upgrading your detection models

www.csoonline.com · 12 days ago

Security leaders have been on a spending sprint. The global AI in cybersecurity market is valued at $44 billion in 2026 and is projected to reach $213 billion by 2034, a trajectory that reflects genuine belief that machine learning will close the gap between the volume of threats and the capacity of human analysts. That belief is not wrong.

AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique

www.securityweek.com · 12 days ago

Wiz has disclosed the details of a new AI coding assistant attack method it has dubbed GhostApproval.

Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges

thehackernews.com · 12 days ago

Microsoft has released security updates for a Defender vulnerability known as RoguePlanet, nearly a month after details of the flaw became public. The vulnerability, tracked as CVE-2026-50656 (CVSS score: 7.8), is a privilege escalation issue in the Microsoft Malware Protection Engine ("mpengine.

npm and PyPI Malware Campaign Exfiltrates CI/CD Secrets Through Fake Payment SDKs

gbhackers.com · 12 days ago

A coordinated supply-chain campaign that pushed 17 malicious packages across npm and PyPI, masquerading as SDKs for well-known payment services including PaySafe, Skrill and Neteller.

European Organizations Have a Collaboration Security Confidence Gap

www.darkreading.com · 13 days ago

A new survey shows security leaders have an inflated sense of safety regarding their collaboration tools and platforms.

AssuranceAmerica data breach exposes records of 6.9 million drivers

www.bleepingcomputer.com · 13 days ago

American insurance company AssuranceAmerica has disclosed a data breach impacting nearly 7 million drivers after attackers gained access to its systems earlier this year.

Chrome 150 Update Patches 27 Vulnerabilities

www.securityweek.com · 13 days ago

The security refresh resolves 13 use-after-free bugs, including two critical-severity flaws found by Google.

Meta's New AI Image Tool Lets Others Use Your Public Instagram Photos in AI Images

thehackernews.com · 13 days ago

Meta has announced that its new artificial intelligence (AI) model Muse Image lets people use public Instagram posts and reels to generate AI content, and it's enabled by default. "You can also @-mention Instagram accounts in the Meta AI app to bring specific Instagram profiles right into your images," the social media giant said in a post.

SNOW Malware Ecosystem Uses Teams Phishing, WebSocket Tunnels, and Browser Extensions

gbhackers.com · 13 days ago

Threat actors are increasingly chaining classic phishing with collaboration platforms and covert tunneling to create highly believable intrusion paths.

Lateral movement risk rises as enterprises emphasize convenience over containment

www.csoonline.com · 13 days ago

Poorly segmented networks and weak security controls continue to undercut security organizations’ ability to identify and contain attacks, giving attackers free rein after initial compromise, according to a recent study based on real-world enterprise security telemetry.

8Layers Raises $2.9 Million for Identity Security Platform

www.securityweek.com · 13 days ago

The Spanish startup has closed an extended pre-seed funding round two months after launching its digital identity protection platform.

Everest Ransomware Encryptor Uses ConfuserEx-Protected .NET Binary With Wake-on-LAN Capability

gbhackers.com · 13 days ago

A recent technical analysis of an Everest ransomware encryptor reveals a purpose-built, ConfuserEx-protected.NET 4.0 binary that combines heavy obfuscation, misleading cryptographic declarations, and uncommon network tactics to maximize impact and impede response. The analyzed sample (hlntqyun.exe, SHA-256 1df92b…) is a 114 KB C assembly compiled for.NET Framework 4.

Umbrij Malware Lets ToddyCat Hackers Hijack Gmail Accounts Through Google API Abuse

gbhackers.com · 13 days ago

A targeted campaign in which the ToddyCat (aka APT-style) group leverages a previously observed loader family, Umbrij, to hijack Gmail accounts by abusing Google APIs. Chaining that capability to broad remote access achieved through a malicious MSI installer masquerading as the Kuailian/LetsVPN client.

Microsoft patches RoguePlanet Defender zero-day vulnerability

www.bleepingcomputer.com · 13 days ago

Microsoft has released a security patch to address a Defender zero-day vulnerability known as "RoguePlanet," disclosed after the June 2026 Patch Tuesday.

Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It

thehackernews.com · 13 days ago

Ask an AI coding agent to scan open-source code for security holes, and it might run the attacker's code on your own machine instead. That is the finding in a proof-of-concept published Wednesday by the AI Now Institute, an attack it calls "Friendly Fire.

New Helix Extortion Group Targets Enterprises With MFA Abuse and SharePoint Exfiltration

gbhackers.com · 13 days ago

A previously unreported data extortion operation dubbed “Helix” that targets enterprises using identity-focused entry techniques and automated SharePoint exfiltration.

Unpatched Backdoor in Tenda Firmware Grants Admin Access to Devices

www.securityweek.com · 13 days ago

Tracked as CVE-2026-11405, the vulnerability allows unauthenticated attackers to access a device's web management interface.

GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents

thehackernews.com · 13 days ago

Researchers at Wiz found that a flaw in six popular AI coding assistants lets a booby-trapped code project quietly take control of a developer's computer. The assistant asks permission to edit one harmless-looking file, but the write lands on a sensitive one instead. The affected tools are Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf.

Claude AI Prompt Injection Attack Turns Chatbot Into Stealthy C2 Agent to Achieve Remote Code Execution

gbhackers.com · 13 days ago

Claude Desktop’s synced Personal Preferences feature can be exploited as a covert prompt-injection vector, transforming the AI assistant into a de facto command-and-control (C2) agent. This method allows for remote code execution on a compromised user workstation without the need for phishing emails or traditional malware delivery.

Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes

thehackernews.com · 13 days ago

Cybersecurity researchers have disclosed details of a new threat actor dubbed Lurking Lizard that has been operating an end-to-end malicious residential proxy business using an infrastructure comprising more than 230 lookalike domains. The activity dates back to at least August 2022, according to DNS threat intelligence firm Infoblox.

DuckDuckGo Browser Blocks YouTube Ads Using uBlock Origin Filter Lists

gbhackers.com · 13 days ago

DuckDuckGo has quietly expanded its privacy-first browser capabilities by introducing a YouTube ad-blocking feature. This feature uses community-driven uBlock Origin filter lists to detect and remove video ads.

Smashing Security podcast #475: JadePuffer – the AI that ran a ransomware attack all by itself

grahamcluley.com · 13 days ago

A 15-year-old boy asked a chatbot for help - and cancelled nearly 47,000 anime streaming subscriptions in under four hours. Meanwhile, researchers have documented the first fully autonomous, agentic AI-driven ransomware attack, "JadePuffer".

GitHub’s public APIs are becoming an enterprise reconnaissance tool

www.csoonline.com · 13 days ago

GitHub continues to be a scintillating target for attackers because it sits in the middle of the software supply chain and gives threat actors three things they crave: source code, secrets, and automated pipelines to run amok in.

Mexico's New Cyber Plan Faces Its First Real Test

www.darkreading.com · 13 days ago

The Latin American nation's cybersecurity plan, still in the expansion phase, has to survive its own knockout round during the FIFA World Cup.