Blahalla

International joint action disrupts world’s largest DDoS botnets

www.bleepingcomputer.com · 4 months ago

Authorities from the United States, Germany, and Canada have taken down command and control infrastructure, virtual servers, internet domains, and other resources used by the Aisuru, KimWolf, JackSkid, and Mossad botnets to infect Internet of Things devices. The botnets collectively issued hundreds of thousands of distributed denial of service commands, with Aisuru issuing more than two hundred thousand, KimWolf more than twenty five thousand, JackSkid more than ninety thousand, and Mossad more than one thousand. They have infected over three million IoT devices such as web cameras, digital video recorders, and WiFi routers, were used to extort victims, and were behind record setting DDoS attacks that peaked at thirty one point four terabits per second and two hundred million requests per second, including incidents that targeted Department of Defense network addresses.
Bamboo Data Center and Server Vulnerability Enables Remote Code Execution

gbhackers.com · 4 months ago

A high severity remote code execution vulnerability in Atlassian Bamboo Data Center and Server, tracked as CVE-2026-21570, has been resolved by Atlassian. The flaw carries a CVSS 4.0 score of 8.6, can be exploited remotely over the network but requires an attacker to have authenticated administrative or elevated privileges, and successful exploitation permits execution of arbitrary code and full compromise of the host. Multiple Bamboo release lines are affected including versions 9.6.0 through 9.6.23, 10.0.0, 10.1.0, 10.2.0 and select 11.x and 12.x releases, and administrators are urged to apply the provided patches by upgrading to 9.6.24, 10.2.16, or 12.1.3 or later immediately.
Microsoft: March Windows updates break Teams, OneDrive sign-ins

www.bleepingcomputer.com · 4 months ago

There are sign in failures after installing the March Windows 11 cumulative update KB5079473 that prevent Microsoft account sign ins in apps including Teams, OneDrive, Edge, Excel, Word, and Microsoft 365 Copilot, showing an error that incorrectly reports no internet connectivity. The problem affects Microsoft accounts commonly used for Teams Free but does not impact organizations that use Entra ID formerly known as Azure Active Directory. Microsoft says the issue may resolve on its own and advises restarting the device while it is connected to the internet to repair the device connectivity state, and it has issued out of band updates for other unrelated Windows issues.
Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation

www.securityweek.com · 4 months ago

Authorities announced an international operation that disrupted the Aisuru, Kimwolf, JackSkid, and Mossad IoT botnets and seized domains, virtual servers, and other infrastructure. The botnets had compromised more than 3 million devices as of March 2026, including DVRs, cameras, and Wi Fi routers, with Aisuru and its Android focused successor Kimwolf linked to record DDoS attacks that peaked at 31.4 terabits per second in February 2026. According to authorities, Aisuru issued over 200,000 DDoS commands, Kimwolf 25,000, JackSkid 90,000, and Mossad 1,000, and law enforcement in Canada and Germany conducted related operations though no arrest details were released.
The espionage reality: Your infrastructure is already in the collection path

www.csoonline.com · 4 months ago

Enterprises now sit directly in adversaries’ collection path because shared services, identity layers, and connectivity providers centralize access, allowing different actors to exploit the same dependencies without directly targeting organizations. Commercial espionage platforms such as Predator are being used to compromise high value individuals and their devices, creating upstream surveillance that intersects enterprise authentication, networks, and service providers. State aligned campaigns have also operated upstream; in February 2026 Singapore disclosed that UNC3886 had compromised all four major telcos using zero days, rootkits, and long term persistence, turning backbone infrastructure into real time collection points. CISOs should treat upstream providers as part of their attack surface, demand attestation from telecom and cloud vendors, harden session and authentication layers assuming token theft and impersonation, shift detection toward low noise persistent access patterns, and anticipate materially tighter cyber insurance terms due to the risk of permanent APT residency.
Ex-data analyst stole company data in $2.5M extortion scheme

www.bleepingcomputer.com · 4 months ago

A North Carolina man, 27 year old Cameron Curry, also known as Loot, was found guilty of extorting Brightly Software while employed as a data analyst contractor. He used access to payroll and corporate records to steal sensitive documents between August and December 2023 after learning his six month contract would not be extended, and beginning December 11, 2023 he sent more than 60 extortion emails demanding 2.5 million dollars, threatening to leak personal data and to report the company to the U.S. Securities and Exchange Commission, and attaching screenshots showing employee names, dates of birth, home addresses, and compensation. Brightly paid 7,540 dollars in Bitcoin, the FBI executed a search of his residence on January 24, 2024 and seized electronic devices, and Curry was released on bond in January 2024 and faces up to 12 years in prison on six extortion counts. Separately, Brightly disclosed an unrelated April 20, 2023 breach of its SchoolDude platform that exposed credentials and personal data of nearly 3 million users.
DoJ Disrupts 3 Million-Device IoT Botnets Behind Record 31.4 Tbps Global DDoS Attacks

thehackernews.com · 4 months ago

The U.S. Department of Justice announced a court authorized disruption of command and control infrastructure used by several Internet of Things botnets including AISURU, Kimwolf, JackSkid and Mossad, with law enforcement partners in Canada and Germany assisting. Private sector firms including major cloud and security companies assisted the operation, which targeted botnets that conscripted an estimated three million devices worldwide, including more than two million Android devices primarily off brand Android televisions and hundreds of thousands located in the United States. The botnets launched record breaking distributed denial of service attacks, with one November 2025 incident attributed to AISURU and Kimwolf measuring about 31.4 terabits per second and other hyper volumetric attacks reaching multiple terabits and billions of packets per second. Court documents allege the Mirai variants issued hundreds of thousands of DDoS commands and that operators used a cybercrime as a service model to sell access to infected devices, while investigators have identified suspected administrators but no arrests have been announced.
New Critical Jenkins Vulnerabilities Put CI/CD Servers at Risk of RCE Exploits

gbhackers.com · 4 months ago

There are multiple critical vulnerabilities in Jenkins core and the LoadNinja plugin that expose continuous integration and continuous deployment controllers to arbitrary file creation, credential exposure, and remote code execution. The most severe issues are CVE-2026-33001, an arbitrary file creation flaw in archive extraction and symbolic link handling affecting Jenkins core up to weekly 2.554 and LTS 2.541.2, and CVE-2026-33002, a DNS rebinding vulnerability in the CLI WebSocket endpoint that bypasses origin validation and can allow administrative command execution. The LoadNinja plugin contains two medium severity flaws tracked as CVE-2026-33003 and CVE-2026-33004 that store API keys unencrypted in job configuration files and fail to mask them in the graphical interface. Administrators are advised to upgrade to Jenkins weekly version 2.555 or LTS version 2.541.3 and LoadNinja version 2.2, and if immediate updates are not possible enforce authentication, revoke anonymous permissions, and ensure Jenkins is accessible only via HTTPS.
Navia Confirms Data Breach Exposing Sensitive Information of 2.7 Million Users

gbhackers.com · 4 months ago

There are nearly 2.7 million individuals impacted after unauthorized access to Navia Benefit Solutions systems exposed sensitive personal and health plan information. There are reports that the breach stemmed from an API vulnerability that allowed read-only access to participant records dating back to 2018, including full names, dates of birth, addresses, contact details, Social Security numbers, Navia ID numbers, and health plan participation and termination data. There are actions taken by Navia to patch the API, temporarily disable participant registration, notify employers and authorities, and offer affected users 12 months of identity protection and credit monitoring through Kroll while advising fraud alerts and credit monitoring.
Microsoft Introduces Teams Upgrades to Improve Windows App Performance on ioS and Android

gbhackers.com · 4 months ago

false
Apple Warns Older iPhones Vulnerable to Coruna, DarkSword Exploit Kit Attacks

thehackernews.com · 4 months ago

Apple is urging users running outdated iOS to update after web based attacks using the Coruna and DarkSword exploit kits delivered malicious web content that can trigger an infection chain and steal sensitive data. Devices on the latest iPhone software including iOS versions 15 through 26 are said to include fixes and were not at risk, while older devices are being provided updates such as iOS 15.8.7 and iOS 16.7.15 and users who cannot update are advised to enable Lockdown Mode. The attacks are being carried out via watering hole campaigns and researchers warn the exploit kits have been widely adopted by multiple threat actors, raising the risk of mass scale infections.
Authorities Dismantle IoT Botnet Linked to Record-Shattering 30 Tbps DDoS Campaigns

gbhackers.com · 4 months ago

A massive international law enforcement operation dismantled the command and control infrastructure behind four Internet of Things botnets named Aisuru, KimWolf, JackSkid, and Mossad that launched record-breaking distributed denial of service attacks with traffic floods up to 30 terabits per second. By March 2026 the networks had enslaved more than three million devices worldwide, including hundreds of thousands in the United States, and operators leased access to the botnets under a cybercrime as a service model to execute targeted extortion attacks that affected servers including addresses managed by the United States Department of Defense Information Network. The takedown involved coordinated seizure warrants and operations in the United States, Germany, and Canada, with assistance from major technology companies and threat intelligence groups to seize command servers and sever the attackers' connection to the infected devices.
Building a simple GRC tool for startups — what I learned so far

thehgtech.com · 4 months ago

A lightweight assessment tool maps to ISO 27001 with NIST and CIS mapping, provides a maturity view, and recommends which controls to fix first. Everything runs locally with no login and no data storage. The project is based on the idea that the frameworks themselves are not the problem but the way they are consumed, and that most small teams need clarity, prioritization, and direction rather than one hundred controls. The builder requests feedback on how teams approach security early on and whether frameworks are useful or overkill.
Non-programmer accidentally builds LLM-augmented CIB infrastructure in 12 hours — responsible disclosure writeup

jamesjernigan.com · 4 months ago

There is a demonstration that a nonprogrammer built a functional multi account Reddit manipulation framework in roughly twelve hours using public AI assistants. The system uses modular layers including a scheduler, an LLM driven content generator with rotating personas and validation gates, a resource routing engine, and a warmup protocol to evade stylometric, temporal, and network graph detection. Remaining detectable signals include account creation date cohorts, shared affiliate domains, developer credential clustering, karma trajectory shapes, and warmup behavior, and defenders are advised to prioritize behavioral graph analysis, account lifecycle monitoring, semantic similarity detection, and coordination with LLM providers to detect API abuse. The accessibility finding is that the technical barrier to large scale coordinated inauthentic behavior has effectively disappeared, raising risks from affiliate spam to influence operations and calling for cross industry collaboration on detection and governance.
U.S. Says 3 Tied to Silicon Valley Server Maker Broke Export Laws

www.nytimes.com · 4 months ago

NULL
Feds Disrupt IoT Botnets Behind Huge DDoS Attacks

krebsonsecurity.com · 4 months ago

The U.S. Justice Department, working with Canadian and German authorities, dismantled the online infrastructure behind four IoT botnets named Aisuru, Kimwolf, JackSkid and Mossad that had compromised more than three million routers, cameras and other Internet of Things devices. Those botnets were tied to record-smashing distributed denial of service attacks and extortion campaigns, with Aisuru issuing over 200,000 attack commands, JackSkid at least 90,000, Kimwolf more than 25,000 and Mossad roughly 1,000, and victims reported tens of thousands of dollars in losses and remediation costs. The Defense Criminal Investigative Service executed seizure warrants against U.S.-registered domains, virtual servers and other infrastructure with assistance from the FBI and nearly two dozen technology companies to prevent further infections and limit future attacks. Security firm Synthient publicly disclosed on January 2, 2026 the vulnerability Kimwolf used to spread inside internal networks, a disclosure that helped slow its spread even as other botnets copied its methods, and investigators have identified a 22-year-old Canadian and a 15-year-old in Germany as core suspects.
Jeff Bezos in Talks to Raise $100 Billion Fund to Transform Companies With A.I.

www.nytimes.com · 4 months ago

false
CISA urges IT to harden endpoint management systems after cyberattack by pro-Iranian group

www.csoonline.com · 4 months ago

CISA is urging organizations to harden endpoint management system configurations after the March 11 attack on medical supplier Stryker by pro Iranian group Handala, noting the guidance targets Microsoft Intune while stressing the defensive principles apply to any endpoint management product. Recommended measures include enforcing least privilege role based access for administrators, requiring phishing resistant multi factor authentication and privileged access hygiene, implementing multi admin approval for destructive actions, limiting enrollment to company owned devices, and continuously monitoring privileged administrative activity. Stryker reported disruption to order processing, manufacturing and shipping and said on March 15 that customer facing technologies remained safe, while security firms say the attackers abused Intune to remotely wipe large numbers of devices and investigators have seized two Handala domains.
That cheap KVM device could expose your network to remote compromise

www.csoonline.com · 4 months ago

Researchers found nine vulnerabilities in four popular low cost KVM over IP devices used for remote control, including unauthenticated command injection, weak authentication, exposed debugging interfaces, and insecure firmware update mechanisms that can grant BIOS level access. The most severe flaw, rated CVSS 9.8 in the Angeet Yeeso ES3, permits unauthenticated arbitrary file uploads that chained with command injection yields preauthentication remote code execution as root; other findings include GL iNet Comet RM 1 using MD5 and lacking firmware signing plus unauthenticated UART root access, JetKVM relying on unsigned OTA updates and no brute force protections, and Sipeed NanoKVM exposing an unauthenticated WiFi configuration endpoint. Eclypsium found more than sixteen hundred of these devices exposed on the internet, warned that a compromised KVM provides attackers physical equivalent access below the operating system and endpoint defenses, and advised isolating KVMs on dedicated management VLANs, never exposing them to the internet, enabling two factor authentication or VPN access, auditing deployments, and applying firmware updates.
AI Conundrum: Why MCP Security Can't Be Patched Away

www.darkreading.com · 4 months ago

MCP, the Model Context Protocol used to connect large language models to external data and services, creates architectural attack surfaces that cannot be addressed through simple patches or configuration changes, according to Gianpietro Cutolo, cloud threat researcher at Netskope speaking at the RSAC 2026 Conference. Because LLMs ingest fetched content as part of their context and cannot reliably distinguish content from instructions, adversaries can embed malicious instructions in emails, documents, or tool metadata accessible via MCP connectors to trigger actions such as data exfiltration, sending messages, or coordinated workflows across multiple services. Recommended defenses include separating MCP servers for private and public data, scanning fetched content and tool metadata for instruction like patterns, enforcing least privilege on connectors, inventorying and vetting MCP servers, logging MCP traffic, building behavioral baselines to spot anomalous agent activity, and keeping humans in the loop for sensitive actions.
Navia discloses data breach impacting 2.7 million people

www.bleepingcomputer.com · 4 months ago

Navia Benefit Solutions experienced a data breach that exposed sensitive information for nearly 2.7 million people after an unauthorized actor accessed its systems between December 22, 2025 and January 15, 2026, with the activity discovered on January 23, 2026. Exposed data included full names, dates of birth, Social Security numbers, phone numbers, email addresses, and participation details for HRA and FSA programs and COBRA enrollment, while claims and financial information were not exposed. Navia notified federal law enforcement, said it is reviewing security and data retention practices, and is offering affected individuals 12 months of identity protection and credit monitoring through Kroll while advising them to consider fraud alerts and credit freezes. No ransomware group had claimed the incident at the time of the notice.
With Government's Role Uncertain, Businesses Unite to Combat Fraud

www.darkreading.com · 4 months ago

false
A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746) - watchTowr Labs

labs.watchtowr.com · 4 months ago

There is a 32-year-old pre-authentication buffer overflow in GNU inetutils telnetd tracked as CVE-2026-32746 that stems from missing bounds checking in the LINEMODE SLC negotiation and can corrupt roughly 400 bytes of adjacent variables. The vulnerability, discovered by the DREAM Security Research Team, impacts inetutils-telnetd and many downstream implementations and distributions including Ubuntu, Debian, FreeBSD, NetBSD, Citrix NetScaler, Apple Mac Tahoe and TrueNAS Core, and a patch has been applied to inetutils-telnetd. Exploitability is nuanced because SLC triplets are constrained by protocol checks and 0xff byte escaping, which complicates reliable code execution despite a high severity rating, and related identifiers mentioned include CVE-2005-0469 and CVE-2026-24061.
New ‘PolyShell’ flaw allows unauthenticated RCE on Magento e-stores

www.bleepingcomputer.com · 4 months ago

There is a newly disclosed vulnerability named PolyShell that affects all Magento Open Source and Adobe Commerce stable version 2 installations and allows unauthenticated code execution and account takeover. Sansec warns the exploit method is already circulating and expects automated attacks to start soon while there are no signs of active exploitation yet. The flaw arises because Magento REST API accepts file uploads for custom product options and writes base64 encoded file data to an upload directory where a polyglot file can be treated as both an image and a script, enabling remote code execution or stored cross site scripting depending on web server configuration. Adobe published a fix only in the second alpha release for version 2.4.9 leaving production versions vulnerable, so administrators are advised to restrict access to the upload directory, verify nginx or Apache rules, and scan stores for uploaded shells and backdoors.
22 security advisories covering AI/ML infrastructure: 40 CVEs, 94 Sigma detection rules (MLflow, vLLM, PyTorch, Flowise, MCP servers, LangGraph, HuggingFace tooling)

raxe.ai · 4 months ago

There are 22 security advisories covering four research streams, Adversarial ML, Agent Security, Supply Chain, and Prompt Injection, compiling 40 CVEs and 94 Sigma detection rules. Critical findings include a universal blocklist bypass in the model scanner relied on by the Hub with a reported CVSS 10.0 rating, a Flowise six vulnerability cluster spanning CVE-2026-30820 through CVE-2026-31829, and chained MLflow authentication bypasses leading to remote code execution via CVE-2026-2635 and CVE-2026-2033. High severity issues also include vLLM remote code execution via CVE-2026-22778, Agenta LLMOps sandbox escape and SSTI in CVE-2026-27952 and CVE-2026-27961, and triple command injection bugs in Claude Code UI CVE-2026-31975, CVE-2026-31862, and CVE-2026-31861. Additional notable advisories detail unsafe deserialization in LangGraph CVE-2026-28277 and Redis query injection CVE-2026-27022, a PyTorch weightsonly unpickler memory corruption CVE-2026-24747, and include full attack chain analysis, MITRE ATLAS mappings, and deployable detection signatures.
Have You Turned to A.I. For Advice on a Romantic Relationship?

www.nytimes.com · 4 months ago

false
Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers

thehackernews.com · 4 months ago

Speagle malware hijacks Cobra DocGuard by using compromised Cobra DocGuard servers for command and control and to mask data exfiltration as legitimate client server traffic. The 32 bit.NET executable targets systems with Cobra DocGuard installed, checks the installation folder, harvests system details and files from folders such as browser history and autofill data, and invokes the program's driver to delete itself on compromised hosts. One variant can toggle types of data collection and searches for files related to Chinese ballistic missiles such as Dongfeng 27 also called DF 27; researchers are tracking the activity as Runningcrab, attribute it to unknown actors, and suspect either state sponsored operators or private contractors and a likely supply chain delivery based on prior trojanized updates.
New tools and guidance: Announcing Zero Trust for AI

www.microsoft.com · 4 months ago

Zero Trust for AI brings Zero Trust principles to the full AI lifecycle by promoting continuous verification of AI agents, enforcing least privilege for models and data, and assuming breach to mitigate prompt injection, data poisoning, and lateral movement. A new AI pillar in the Zero Trust Workshop covers seven hundred security controls across one hundred sixteen logical groups and evaluates AI access and agent identities, protection of sensitive data, monitoring of AI behavior, and governance aligned with risk and compliance objectives. The Zero Trust Assessment tool adds Data and Network pillars today, an AI assessment pillar is planned for summer 2026, and a new Zero Trust for AI reference architecture plus practical patterns for threat modeling and observability are provided to help organizations operationalize AI security at scale.
54 EDR Killers Use BYOVD to Exploit 35 Signed Vulnerable Drivers and Disable Security

thehackernews.com · 4 months ago

Fifty four EDR killer tools were found to leverage the bring your own vulnerable driver technique by abusing thirty four signed vulnerable drivers to gain kernel mode privileges and disable endpoint protections. These tools are commonly used in ransomware intrusions to neutralize security software immediately before deploying file encryptors, and operators include closed ransomware groups, attackers who fork proof of concept code, and criminals selling the utilities on underground marketplaces. Recommended defenses include blocking commonly misused drivers, implementing layered detection and response, and proactively monitoring to flag, contain, and remediate attempts to disable security controls.
Ransomware group exploited Cisco firewall vulnerability as a zero day, weeks before a patch appeared

www.csoonline.com · 4 months ago

Interlock began exploiting a critical Cisco Secure Firewall Management Center deserialization flaw CVE-2026-20131 on January 26, 2026, roughly 38 days before Cisco released a patch on March 4, 2026. CVE-2026-20131 carries a maximum CVSS score of 10, and Cisco also patched a separate FMC authentication bypass vulnerability CVE-2026-20079 in the same update. AWS honeypots captured the attack chain, including a malicious ELF binary and a single poorly secured staging server, enabling attribution to the Interlock ransomware family based on embedded ransom notes and TOR negotiation infrastructure. Organizations using affected FMC versions are likely at risk and are advised to apply the March 4, 2026 updates appropriate to their software version and to employ defense in depth controls.
A.I. Bots Can Act as Personal Digital Assistants, but There Are Serious Risks

www.nytimes.com · 4 months ago

New A.I. bots can do more than just chat. They can edit files, send emails and book trips for users, and those capabilities can also enable harmful or unintended actions when agents are misused or make mistakes.
Post-Quantum Web Could be Safer, Faster

www.darkreading.com · 4 months ago

NULL
1stProtect Emerges From Stealth With $20 Million in Funding

www.securityweek.com · 4 months ago

false
we found a memory exhaustion CVE in a library downloaded 29 million times a month. AWS, DataHub, and Lightning AI are in the blast radius.

www.periphery.security · 4 months ago

A memory exhaustion vulnerability in DeepDiff allows a 42-byte pickle payload to trigger multi-gigabyte allocations during deserialisation, crashing processes and enabling persistent crash loops via queues or uploaded artifacts. This issue is tracked as CVE-2026-33155 and follows a prior fix for CVE-2025-58367 that hardened the restricted unpickler but did not validate constructor arguments, creating a false sense of security for teams that believed they were protected. Immediate remediation is to update DeepDiff to version 8.6.2 or later, pin downstream packages, and ensure no untrusted data can reach pickleload or the Delta constructor.
Critical ScreenConnect Vulnerability Exposes Machine Keys

www.securityweek.com · 4 months ago

There is a critical vulnerability identified as CVE-2026-3564 with a CVSS score of 9.0 that could allow attackers to access cryptographic material used for session authentication. Previously, unique ScreenConnect machine keys were stored in server configuration files and could be exfiltrated, and ScreenConnect version 26.1 adds encrypted storage and management of machine key material to prevent unauthorized access and reduce the risk of server compromise. Users are advised to update to version 26.1 immediately, review and restrict access to configuration files and backups, and monitor logs for unusual activity; ConnectWise says it has no evidence to validate claims that the flaw was exploited by Chinese state-sponsored actors.
Privacy Platform Cloaked Raises $375M to Expand Enterprise Reach

www.securityweek.com · 4 months ago

Cloaked raised 375 million dollars in a Series B and growth financing to accelerate its product roadmap and scale for consumers and businesses, bringing total funding to more than 400 million dollars. The platform generates unlimited unique virtual identities such as phone numbers, email addresses, and passwords, runs an automated data removal tool that continuously scans and deletes personal information from data brokers and people search sites, and offers an AI powered Call Guard that screens incoming calls to block spam, scams, and fraud. The company plans to use the capital to introduce AI driven personal agents that act on users' behalf to monitor, manage, and enforce privacy preferences and security posture, and to expand Cloaked Enterprise, a Digital Workforce Protection program for identifying and mitigating cybersecurity risks from employees' personal digital exposure. Cloaked said it has disguised more than 10 million identities, removed over a billion records from data broker sites, and screened more than 40 million calls.
Bitrefill blames North Korean Lazarus group for cyberattack

www.bleepingcomputer.com · 4 months ago

Bitrefill says the cyberattack at the start of March, with technical issues first reported on March 1, 2026, was likely carried out by North Korean Lazarus group operators associated with the Bluenoroff cluster. Attackers compromised an employee laptop, stole legacy credentials, accessed a snapshot containing production secrets, escalated to parts of the database and some cryptocurrency wallets, and exploited supplier purchasing and gift card supply lines. About 18,500 purchase records containing customer email addresses, IP addresses, and cryptocurrency payment addresses were exposed and about 1,000 purchases also included customer names, and Bitrefill warns attackers may have obtained decryption keys. Bitrefill says losses were minimal and will be covered from its capital, that attackers appear to have been after crypto and gift card inventory rather than customer data, and that it is expanding security reviews, pen testing, access controls, logging, monitoring, and automated shutdown mechanisms while most services have returned to normal and customers should treat incoming communications with extra caution.
Sandboxing AI coding agents with kernel-level enforcement: built-in profiles for Claude Code, Codex, and OpenCode

nono.sh · 4 months ago

A new open source sandbox called nono enforces kernel level filesystem and command policies for AI coding agents using Landlock on Linux and Seatbelt on macOS so the agent process cannot bypass protections at the application layer. It includes ready to use profiles for Claude Code, Codex, and OpenCode and applies a default policy that blocks common credential stores such as SSH credentials, AWS credentials, and Kubernetes config, along with browser cookies, shell history, and destructive commands like rm, dd, sudo, and shutdown. A learn mode traces an agent's actual file and command accesses and generates a tailored policy profile listing the exact paths to permit.
Beijing wants its own quantum-resistant encryption standards rather than adopt NIST’s

www.csoonline.com · 4 months ago

China plans to develop national post-quantum cryptography standards within the next three years, prioritizing finance and energy, and favors structureless lattice algorithms over the algebraic lattice designs adopted by most other countries. Leading cryptographer Wang Xiaoyun and other experts warn that algebraic or structured lattices may contain exploitable patterns, and China launched a global call for post quantum algorithm proposals in February 2025. The United States and partners published NIST post quantum standards in 2024 and selected a code based backup algorithm in March 2025, with migration timelines set between 2030 and 2035. Experts say the resulting five year gap creates a difficult compliance choice for organizations operating in China and advise immediate hybrid deployments that layer NIST approved post quantum algorithms alongside existing cryptography to reduce harvest now decrypt later risk and preserve the ability to swap algorithms as standards evolve.
FBI seizes Handala data leak site after Stryker cyberattack

www.bleepingcomputer.com · 4 months ago

Federal authorities seized two websites used by the Handala hacktivist group after a destructive cyberattack on medical technology giant Stryker that wiped approximately 80,000 devices. Handala is Iranian linked and reportedly tied to Iran's Ministry of Intelligence and Security, and investigators say the group compromised a Windows domain administrator account, created a new global administrator account, and issued a Microsoft Intune wipe command that factory reset company devices and some employees' personal devices. Handala acknowledged the seizures and said it will rebuild infrastructure while Microsoft and the United States Cybersecurity and Infrastructure Security Agency released guidance on hardening Windows domains and securing Intune to prevent similar attacks.
Exploiting a PHP Object Injection in Profile Builder Pro in the era of AI

blog.sicuranext.com · 4 months ago

There is an unauthenticated PHP Object Injection in Profile Builder Pro affecting versions 3.14.5 and below that accepts attacker-controlled serialized data in the args POST parameter for the wppbrequestuserspins AJAX action and was fixed in version 3.14.6. Researchers chained available gadgets to exploit the flaw, using a novel Monolog POP chain in The Events Calendar plugin and a Guzzle file-write primitive in another plugin to deploy a web shell and achieve remote code execution. AI assistance, specifically Claude Code with Opus 4.6, was used to triage exposed hooks and help identify usable gadget chains, accelerating the vulnerability analysis. Scanning of roughly 11,700 reachable sites found about 1,590 vulnerable instances and the report notes a related Monolog gadget case tracked as CVE-2024-8016.
Iran Readied Cyberattack Capabilities for Response Prior to Epic Fury

www.securityweek.com · 4 months ago

There was a six month buildup of Iran linked cyber infrastructure, including US based shell companies and multi tier hosting arrangements designed to weather kinetic strikes and sustain global hacking operations. Multiple Iran linked APTs showed increased infrastructure activity in the six months before the February 28, 2026 US and Israeli strikes, and around sixty Iran linked hacktivist groups established coordinated operations within 24 hours to target US, Israeli, and Gulf entities. Examples of the staged infrastructure include bulletproof hosts and shell firms such as RouterHosting LLC, Cloudblast and UltaHost, ICANN issued a breach notice against UltaHost Inc on February 5, 2025, and MuddyWater had multiple CIDRs flagged in mid September 2025 consistent with pre operational staging.
The Long Farewell to Mark Zuckerberg’s Metaverse

www.nytimes.com · 4 months ago

false
The Long Farewell to Mark Zuckerberg’s Metaverse

www.nytimes.com · 4 months ago

false
Marquis Data Breach Affects 672,000 Individuals

www.securityweek.com · 4 months ago

There are roughly 672,000 individuals affected by a Marquis data breach after the Texas based marketing and compliance provider discovered in August 2025 that attackers had accessed its systems. Personal information stolen included names, addresses, Social Security numbers, dates of birth, taxpayer identification numbers, and financial information including payment card numbers that Marquis stored on behalf of dozens of the roughly 700 banks and credit unions it serves. Earlier estimates based on state filings and disclosures by affected financial institutions ranged from at least 780,000 to as many as 1.6 million potentially impacted people, and some reported counts may overlap when customers hold accounts at multiple institutions. The company reported the attackers exploited a SonicWall firewall vulnerability, a timeline that matched increased exploitation by the Akira ransomware group, and there are unconfirmed reports that Marquis paid a ransom.
[Virtual Event] Shields Up: Key Technologies Reshaping Cybersecurity Defenses

www.darkreading.com · 4 months ago

false
When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures

www.microsoft.com · 4 months ago

There is an observable uptick in tax themed phishing and malware campaigns as the United States tax filing deadline approaches, with attackers using W‑2 and Form 1099 lures, refund notices, CPA impersonations, and other tax related messages to trick individuals and accounting professionals into opening malicious attachments, scanning QR codes, or following multi step link chains. Threat actors are using phishing as a service platforms such as Energy365 and SneakyLog to harvest credentials and bypass multifactor authentication, and some campaigns deliver remote monitoring and management tools including ScreenConnect to maintain persistence or enable hands on keyboard activity. Observed campaigns in January and February 2026 used personalized Excel and OneNote attachments hosted on legitimate services like OneDrive, QR codes that embed recipient specific URLs, and sets of tax themed domains registered to impersonate firms and agencies. Defensive guidance emphasizes user education, configuring email security controls, and hunting for indicators of compromise related to these tax themed lures.
Russian hackers exploit Zimbra flaw in Ukrainian govt attacks

www.bleepingcomputer.com · 4 months ago

APT28, a threat group linked to Russia's GRU, is exploiting a Zimbra Collaboration Suite stored cross site scripting vulnerability tracked as CVE-2025-66376 that can lead to remote code execution and full compromise of Zimbra servers and user mailboxes. The campaign, named Operation GhostMail, used phishing emails with no malicious attachments or links but with obfuscated JavaScript embedded in the HTML body that runs in vulnerable Zimbra webmail sessions to harvest credentials, session tokens, backup two factor codes, browser saved passwords, and up to 90 days of mailbox contents for exfiltration over DNS and HTTPS. CISA added CVE-2025-66376 to its catalog of known exploited vulnerabilities and ordered federal agencies to secure affected servers within two weeks, while researchers reported the attacks targeted Ukrainian government entities including the State Hydrology Agency.
Telnet vulnerability opens door to remote code execution as root

www.csoonline.com · 4 months ago

A critical Telnet vulnerability with a CVSS score of 9.8 allows unauthenticated remote code execution as root against systems running GNU inetutils telnetd and is tracked as CVE-2026-32746. The flaw stems from an out of bounds write caused by a buffer overflow in the telnetd LINEMODE Set Local Characters handler and can be triggered during protocol negotiation before authentication, enabling arbitrary code execution after a connection to TCP port 23 is established. Affected deployments include legacy infrastructure, networking equipment, embedded and IoT devices, and Linux distributions that ship inetutils or enable telnetd; vendors were notified on March 11, 2026 and a patch was planned for release by April 1, 2026. Immediate mitigations include disabling telnetd, migrating to SSH, running telnetd without root privileges where possible, and blocking or restricting access to port 23 at the network perimeter.
ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More

thehackernews.com · 4 months ago

An emerging Ransomware-as-a-Service operation called The Gentlemen is exploiting a critical FortiOS authentication bypass tracked as CVE-2024-55591 to control roughly 14,700 exploited FortiGate devices and nearly 969 validated brute-forced VPN credentials while using bring your own vulnerable driver techniques to evade defenses. Security researchers reported a pre authentication remote code execution chain in BMC FootPrints involving CVE-2025-71257 CVE-2025-71258 CVE-2025-71259 and CVE-2025-71260, and noted a surge of Citrix NetScaler exploit attempts targeting CVE-2025-5777 and CVE-2023-4966. Meanwhile malware loaders such as Hijack Loader are deploying new C2 frameworks and updated stealers, and phishing campaigns via Microsoft Teams and LiveChat are increasingly used to gain remote access or harvest credentials and payment data.