Blahalla

Russian hackers exploit Zimbra flaw in Ukrainian govt attacks

www.bleepingcomputer.com · 4 months ago

APT28, a threat group linked to Russia's GRU, is exploiting a Zimbra Collaboration Suite stored cross site scripting vulnerability tracked as CVE-2025-66376 that can lead to remote code execution and full compromise of Zimbra servers and user mailboxes. The campaign, named Operation GhostMail, used phishing emails with no malicious attachments or links but with obfuscated JavaScript embedded in the HTML body that runs in vulnerable Zimbra webmail sessions to harvest credentials, session tokens, backup two factor codes, browser saved passwords, and up to 90 days of mailbox contents for exfiltration over DNS and HTTPS. CISA added CVE-2025-66376 to its catalog of known exploited vulnerabilities and ordered federal agencies to secure affected servers within two weeks, while researchers reported the attacks targeted Ukrainian government entities including the State Hydrology Agency.
Telnet vulnerability opens door to remote code execution as root

www.csoonline.com · 4 months ago

A critical Telnet vulnerability with a CVSS score of 9.8 allows unauthenticated remote code execution as root against systems running GNU inetutils telnetd and is tracked as CVE-2026-32746. The flaw stems from an out of bounds write caused by a buffer overflow in the telnetd LINEMODE Set Local Characters handler and can be triggered during protocol negotiation before authentication, enabling arbitrary code execution after a connection to TCP port 23 is established. Affected deployments include legacy infrastructure, networking equipment, embedded and IoT devices, and Linux distributions that ship inetutils or enable telnetd; vendors were notified on March 11, 2026 and a patch was planned for release by April 1, 2026. Immediate mitigations include disabling telnetd, migrating to SSH, running telnetd without root privileges where possible, and blocking or restricting access to port 23 at the network perimeter.
ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More

thehackernews.com · 4 months ago

An emerging Ransomware-as-a-Service operation called The Gentlemen is exploiting a critical FortiOS authentication bypass tracked as CVE-2024-55591 to control roughly 14,700 exploited FortiGate devices and nearly 969 validated brute-forced VPN credentials while using bring your own vulnerable driver techniques to evade defenses. Security researchers reported a pre authentication remote code execution chain in BMC FootPrints involving CVE-2025-71257 CVE-2025-71258 CVE-2025-71259 and CVE-2025-71260, and noted a surge of Citrix NetScaler exploit attempts targeting CVE-2025-5777 and CVE-2023-4966. Meanwhile malware loaders such as Hijack Loader are deploying new C2 frameworks and updated stealers, and phishing campaigns via Microsoft Teams and LiveChat are increasingly used to gain remote access or harvest credentials and payment data.
Security Firm Aura Discloses Data Breach Impacting 900,000 Records

www.securityweek.com · 4 months ago

Online safety platform Aura experienced a data breach after an employee fell for a targeted phone phishing attack that gave attackers access to the employee's account for about an hour. Attackers accessed roughly 900,000 records stored in a marketing tool acquired in 2021, mostly names and email addresses, and the compromised data includes names, email addresses, addresses, and phone numbers for about 20,000 current and 15,000 former customers. No Social Security numbers, passwords, or financial information were exposed, and sensitive customer information is stored encrypted and protected by restricted access. Aura terminated the account access, activated its incident response plan, engaged external cybersecurity and legal experts, notified law enforcement, and began notifying impacted customers while assessing risk.
CISO Whisperer Names 11 Vendors Leading the Shift from Tools to Outcomes at RSA Conference 2026

gbhackers.com · 4 months ago

There is a move toward continuous intelligence driven operations at RSA Conference 2026, with CISOs prioritizing outcome based security, AI driven automation, and integrated platforms as attack surfaces expand. Eleven vendors were highlighted for exemplifying this shift, including Daylight Security with outcomes as a service and agentic AI, Reclaim Security with an AI Security Engineer that remediates vulnerabilities, and CyCognito for attacker centric external asset discovery. Established vendors including Cisco, Splunk, Palo Alto Networks, Fortinet, Nokia, Zscaler, CrowdStrike, and Check Point are emphasizing platform consolidation, identity first models, agentic SOC workflows, and hands on demonstrations to help organizations separate signal from noise.
7 Ways to Prevent Privilege Escalation via Password Resets

www.bleepingcomputer.com · 4 months ago

There is a high risk of privilege escalation when password reset workflows are weaker than login controls, because attackers who compromise low-privilege accounts, intercept reset tokens, or socially engineer helpdesk staff can reset credentials for higher-value accounts. There are seven recommended mitigations: require multi-factor authentication with phishing-resistant methods for high-value accounts, limit resets to trusted managed devices and apply device posture checks, enforce strong password policies and block breached passwords, educate users and helpdesk teams on identity verification, audit and monitor reset activity, implement least privilege and time-bound access, and avoid knowledge-based authentication in favor of possession-based checks. Organizations should scope who can reset others' passwords, log and alert on unusual reset patterns such as repeated or out-of-hours requests, and remove overly broad reset permissions that enable lateral movement. The guidance stresses strengthening the full account recovery lifecycle to reduce escalation risk while preserving user experience.
A Copy-Paste Bug That Broke PSpice® AES-256 Encryption

jtsylve.blog · 4 months ago

There is a copy-paste bug in PSpice mode four key derivation that causes the short derived key to be passed to the AES engine instead of the intended extended key, so 28 of the 32 AES-256 key bytes are known or zero. This reduces the effective keyspace to two to the thirty-second power, about 4.3 billion candidates, enabling brute-force recovery in seconds on modern hardware with AES-NI or a GPU. A fixed header prefix provides a known-plaintext crib to validate keys, and recovering the four-byte portion allows reconstruction of the full user key and decryption of all files protected with that key. The weakness likely dates to the April 2014 introduction of AES-256 support and fixing it now would break compatibility with many years of encrypted models.
OpenSIPS SQL Injection to Authentication Bypass (CVE-2026-25554)

aisle.com · 4 months ago

There is a high severity SQL injection vulnerability in OpenSIPS authjwt that enables a full authentication bypass and is tracked as CVE-2026-25554 with a severity score of 8.3. The flaw occurs because the JWT tag claim is decoded without verification and interpolated into a raw SQL query without escaping, allowing an attacker to inject a UNION SELECT that returns attacker-controlled secrets so the server will validate forged JWTs and impersonate arbitrary SIP users. All OpenSIPS versions 3.1 and later using authjwt with database mode enabled are affected, exposing risks including unauthorized registration, call placement, toll fraud, and wiretapping, and an upstream fix implemented on February 2, 2026 escapes the tag value to prevent injection.
Hacker Conversations: Ben Harris, From Unintentional Young Hacker to Intentional Adult CEO

www.securityweek.com · 4 months ago

Ben Harris is a British security practitioner who moved from youthful school network tinkering to a professional pentester and security executive, holding roles at Portcullis, MWR Infosecurity, and F-Secure before founding and becoming CEO of WatchTowr in August 2021. His hacking was driven by curiosity about how computers communicate rather than malice, and he says he has a moral boundary against causing damage or selling discovered weaknesses to criminals or foreign governments. WatchTowr provides a platform that builds a real time attack view of customers environments and continuously identifies and validates exploitable vulnerabilities so they can be addressed before being leveraged.
New Apple Hack: Up to 270M iPhones Vulnerable to ‘DarkSword’ Exploit

www.techrepublic.com · 4 months ago

Researchers uncovered DarkSword, a powerful iPhone exploit kit hosted on compromised websites that can silently compromise unpatched devices running iOS 18.4 through 18.6.2. The fileless attack hijacks iOS system processes to steal iCloud Keychain passwords, messages from iMessage, WhatsApp and Telegram, browser history, photos, calendar entries, notes, health data, email contents and data from cryptocurrency wallet apps, then deletes logs and temporary files so a reboot clears the active implant while the stolen data remains compromised. The tool has been observed in campaigns across Ukraine, Saudi Arabia, Turkey and Malaysia, researchers estimate roughly 221 million to 270 million iPhones remain vulnerable, and immediate protections include updating to iOS 26.3.1 or iOS 18.7.6, enabling Lockdown Mode for high risk users and avoiding untrusted sites.
BYOUD - Bring Your Own Unwind Data - By KlezVirus

klezvirus.github.io · 4 months ago

BYOUD is a framework that spoofs Windows call stacks by tampering with unwind metadata rather than altering return addresses, enabling believable stack reconstruction while remaining compatible with Intel Control Flow Enforcement Technology and Hardware Stack Protection. The technique locates and edits UNWINDINFO and runtime function table entries in process memory so crafted frame sizes and proxy functions cause stack walkers and debuggers to reconstruct a different, legitimate looking call chain while the shadow stack and return flow remain intact. There are three main variants plus a JIT specific approach that demonstrate scanning the stack to calculate concealment distances and abusing proxy calls such as NdrServerCall2 to present fully unwindable fake subtrees without touching the shadow stack.
Russian APT Exploits Zimbra Vulnerability Against Ukraine

www.securityweek.com · 4 months ago

A Russian state sponsored threat actor has exploited a high severity stored cross site scripting vulnerability in Zimbra Collaboration’s Classic UI tracked as CVE-2025-66376 with a CVSS score of 7.2, which was fixed in November 2025 in Zimbra versions 10.1.13 and 10.0.18. Insufficient sanitization of CSS content in HTML email allowed attackers to abuse CSS import directives to reference external resources or inject inline scripts that execute when a message is opened in a browser, enabling theft of credentials, session tokens, backup two factor authentication codes, saved passwords, and mailbox contents going back 90 days and facilitating remote code execution. CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities catalog and urged federal agencies to patch within two weeks, while Seqrite Labs linked exploitation in attacks against Ukrainian targets to APT28 in a campaign named Operation GhostMail.
I built a zero-knowledge CLI password manager from scratch. AES-256-GCM, Argon2id, 22 secret types, MCP support....

aaravmaloo.github.io · 4 months ago

APM is a zero-knowledge command-line password manager written in Go that provides encrypted-at-rest vaults, multi-cloud synchronization, AI-agent integration via an MCP server, a Windows autofill daemon, a manifest-based plugin system, and a Team Edition with role-based access controls. Its encryption stack uses Argon2id for key derivation with memory-hard defaults and support up to 512 megabytes, AES-256-GCM for authenticated encryption, and HMAC-SHA256 integrity signatures, and the master password is never stored. APM supports more than twenty five structured secret types including passwords, TOTP, SSH keys, API keys, certificates, and documents, offers a YAML policy engine and shell-scoped sessions with inactivity timeouts, and exposes a security contact for alerts.
AI Replica of Val Kilmer to Appear in ‘As Deep as the Grave’

www.nytimes.com · 4 months ago

false
CISA Calls on Organizations to Strengthen Microsoft Intune Security After Stryker Incident

gbhackers.com · 4 months ago

There is an urgent CISA alert dated March 18, 2026, calling on organizations to harden Microsoft Intune and other endpoint management configurations after a March 11, 2026 cyberattack against Stryker that abused Intune to issue mass device wipe commands and disrupted the companys Microsoft environment. CISA recommends applying least privilege to administrative roles, enforcing multi factor authentication and privileged access hygiene, requiring multi administrator approval for high risk actions, restricting and monitoring service principals and app permissions, rotating and revoking stale credentials and tokens, and increasing audit logging and threat detection across endpoint management systems. Organizations are urged to implement Microsoft and CISA hardening guidance immediately to reduce the risk of similar operationally destructive attacks.
Max severity Ubiquiti UniFi flaw may allow account takeover

www.bleepingcomputer.com · 4 months ago

Ubiquiti patched two vulnerabilities in the UniFi Network Application, including a maximum-severity path traversal flaw tracked as CVE-2026-22557 that affects UniFi Network versions 10.1.85 and earlier and is fixed in versions 10.1.89 or later. Successful exploitation can allow low-privilege or network-accessible attackers to access files on underlying systems and potentially hijack user accounts in low-complexity attacks that do not require user interaction. Ubiquiti also fixed an authenticated NoSQL injection vulnerability that could let an authenticated low-privilege actor escalate privileges.
SpyCloud’s 2026 Identity Exposure Report Reveals Explosion of Non-Human Identity Theft

www.csoonline.com · 4 months ago

SpyCloud's 2026 Identity Exposure Report shows a 23 percent expansion in its recaptured identity datalake to 65.7 billion distinct identity records and a sharp rise in non human identity exposure, including 18.1 million exposed API keys and tokens and 6.2 million credentials or authentication cookies tied to AI tools. There are 28.6 million phished identity records from 2025 with nearly half belonging to corporate users, and modern phishing datasets increasingly include session cookies, authentication tokens, and MFA workflow data that enable session takeover. Session theft and MFA bypass remain widespread, with 8.6 billion stolen cookies and session artifacts recaptured and a 51 percent overlap between combolists and infostealer logs, and authorities executed a coordinated disruption of the Tycoon 2FA phishing infrastructure on March 4, 2026. Credential exposure remains severe with 5.3 billion credential pairs recaptured, 80 percent of exposed corporate credentials containing plaintext passwords, 1.1 million password manager master passwords circulating, and over 642.4 million exposed credentials recovered from 13.2 million infostealer infections.
A timeline of MCP security breaches: Tool poisoning, RCE via mcp-remote, sandbox escapes, and 7,000+ exposed servers

brightbean.xyz · 4 months ago

There are nearly 7,000 exposed Model Context Protocol servers on the open internet and the protocol commonly ships without built in authentication, least privilege controls, or audit trails, creating a blind spot for zero trust architectures. There have been documented incidents including WhatsApp data exfiltration, GitHub repository leaks, a command injection disclosed as CVE-2025-6514 in the mcp-remote package, and two critical Anthropic filesystem flaws CVE-2025-53109 and CVE-2025-53110 that allowed sandbox escape and symlink containment bypass. Recommended mitigations include treating MCP connections as privileged access, sanitizing natural language context before models process it, enforcing least privilege with short lived tokens, sandboxing MCP runtimes, monitoring for tool mutation, and requiring human approval for sensitive operations.
New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data

thehackernews.com · 4 months ago

A new Android malware family called Perseus is being actively distributed via dropper apps on phishing sites to conduct device takeover and financial fraud. Built on the Cerberus and Phoenix codebases, Perseus leverages Accessibility based remote sessions to run overlay attacks, capture keystrokes, and monitor note taking apps for high value personal and financial information. Operators can issue commands to scan notes, start near real time visual streams, interact programmatically with user interface elements, force installation from unknown sources, mute audio, and display black screen overlays while the malware performs checks for debuggers and emulators and reports a suspicion score to its command and control server.
CVE-2026-22729: JSONPath Injection in Spring AI’s PgVectorStore

blog.securelayer7.net · 4 months ago

A JSONPath injection vulnerability in Spring AI's PgVectorStore can allow attackers to craft malicious filter expressions that bypass metadata filtering and access controls, tracked as CVE-2026-22729. The flaw stems from unsafe handling of JSONPath filter expressions when converting filter expressions into PostgreSQL JSON path queries, enabling unauthorized retrieval or deletion of vector store records via specially crafted queries.
Deep dive into how OS-level age verification systems can be bypassed

thecybersecguru.com · 4 months ago

Recent laws in California and Brazil now require strict age verification and privacy defaults at the operating system and platform level, prompting companies to block access rather than implement costly compliance measures. Open source projects and smaller vendors are being region blocked, and communities are responding with network obfuscation such as privacy focused VPNs, peer to peer distribution of operating system images, and protest modifications like Ageless Linux that disable or stub age verification APIs. Users are also turning to radical self hosting and local AI workflows using tools like Docker, SearXNG, LM Studio, and Ollama to avoid centralized age and identity checks, widening a divide between regulated platforms and technically literate users.
Claude Vulnerabilities Allow Data Exfiltration and Malicious Redirect Attacks

gbhackers.com · 4 months ago

Security researchers uncovered a critical attack chain within Anthropic's Claude.ai platform named Claudy Day that enables silent extraction of sensitive user data through prompt manipulation and malicious redirects. The chain combines three flaws: invisible prompt injection using hidden HTML in prefilled chat prompts, data exfiltration by forcing the model to search chat history and upload files using an attacker controlled API key, and open redirect vulnerabilities on the main domain that can be abused via advertising to deliver malicious links. The exploit operates within a default Claude session without external tools and can escalate if users connect Model Context Protocol servers, third party APIs, or corporate files, allowing the AI to access internal resources. Organizations should audit AI integrations, restrict unnecessary MCP servers and API access, apply prompt injection fixes, and train users to avoid clicking shared links and prefilled prompts.
Fake Tools and CDNs Power New “Vibe-Coded” Malware Campaign

gbhackers.com · 4 months ago

Vibe coding has moved from buzzword to battleground as attackers use AI-assisted development to produce and distribute more than 440 malicious ZIP archives in January 2026 that masquerade as AI tools, game mods, drivers, VPNs, and utilities hosted on content delivery and file-sharing platforms. Each ZIP bundles a clean-looking executable that sideloads a malicious WinUpdateHelper.dll which executes verbose PowerShell payloads in memory, creates a persistent service named Microsoft Console Host, generates time-based command and control domains that rotate roughly every 58 days, and downloads miner binaries that impersonate legitimate Windows processes while disabling defenses and adding Windows Defender exclusions. Operators mine privacy coins and Ravencoin via mining pools, have processed visible Bitcoin inflows of about eleven thousand five hundred dollars, and sometimes swap miners for stealers and remote access tools; users and organizations are advised to install software only from official vendor sites, monitor for unusual miner traffic and time-based xyz domains, and watch for changes to Defender exclusions and suspicious services masquerading as native components.
CISA urges US orgs to secure Microsoft Intune systems after Stryker breach

www.bleepingcomputer.com · 4 months ago

There are warnings from CISA urging U.S. organizations to harden Microsoft Intune after a March 11, 2026 cyberattack on Stryker in which attackers allegedly created a new Global Administrator from a compromised admin account, stole about 50 terabytes of data, and used Intune's built in wipe command to erase nearly 80,000 devices. There are Microsoft guidance recommendations to apply least privilege using role based access control, enforce multi factor authentication and Microsoft Entra conditional access and risk signals, practice privileged access hygiene, and require multi admin approval for sensitive actions such as device wipes and RBAC changes. There are reports that the attack was claimed by Handala, a hacktivist group linked to Iran's Ministry of Intelligence and Security that has a history of stealing and leaking data.
How Ceros Gives Security Teams Visibility and Control in Claude Code

thehackernews.com · 4 months ago

false
Raven Emerges From Stealth With $20 Million in Funding

www.securityweek.com · 4 months ago

Raven, a Palo Alto California based cybersecurity startup founded in 2023 by Israeli cyber intelligence veterans, emerged from stealth with twenty million dollars in combined seed and post seed funding led by Norwest and Elron Ventures with additional investors including SentinelOne and others. The company has built a runtime platform that observes applications to detect anomalous behavior, uncover and monitor AI agents in production, and block unsafe actions and malicious code in real time even when no known vulnerabilities exist. Raven will use the funding to accelerate product development, expand its research and engineering teams, and scale go to market efforts.
New ‘Perseus’ Android malware checks user notes for secrets

www.bleepingcomputer.com · 4 months ago

There is a new Android malware called Perseus that checks user curated notes to steal sensitive information such as passwords recovery phrases and financial data. Perseus is distributed via sideloaded APKs disguised as IPTV apps and can bypass Android 13 and later sideloading restrictions to gain a foothold on devices. By abusing Android Accessibility Services operators can take full remote control to capture continuous screenshots stream device displays perform overlay attacks simulate user input and keylog to steal credentials. The malware performs extensive anti analysis and evasion checks including device fingerprints and SIM and hardware data sends a suspicion score to a command and control panel before data theft and users are advised to avoid sideloading install apps from the official store and enable Play Protect.
Pyronut Package Backdoors Telegram Bots With RCE

gbhackers.com · 4 months ago

A trojanized Python package named Pyronut backdoors Telegram bots and userbots, giving attackers remote code execution in both the Telegram session and the underlying host system. Pyronut impersonated the pyrogram framework on PyPI and shipped three malicious releases numbered 2.0.184, 2.0.185, and 2.0.186 that were detected and quarantined on March 18, 2026. At runtime it modifies the Client.start method to import a hidden module that registers handlers for the commands /e and /shell, enabling remote evaluation of Python code via the meval library and arbitrary shell execution by invoking /bin/bash -c with results exfiltrated over Telegram. Detection and response guidance includes searching dependency manifests for pyronut versions, flagging unexpected use of meval, inspecting for Python spawned shell processes and unusual file or network activity, revoking affected Telegram sessions and tokens, rebuilding environments from known good baselines, and rotating exposed credentials.
Critical Microsoft SharePoint flaw now exploited in attacks

www.bleepingcomputer.com · 4 months ago

A critical Microsoft SharePoint vulnerability patched in January is now being exploited in attacks, affecting SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Successful exploitation allows unauthenticated attackers to achieve remote code execution by exploiting a deserialization of untrusted data weakness; the issue is tracked as CVE-2026-20963 and was addressed in Microsofts January 2026 Patch Tuesday. The Cybersecurity and Infrastructure Security Agency added the flaw to its catalog of actively exploited vulnerabilities, ordered federal civilian executive branch agencies to secure servers by March 21, 2026, and strongly urged all network defenders to apply mitigations and patch against related issues including CVE-2025-40551.
Analyzing the Current State of AI Use in Malware

unit42.paloaltonetworks.com · 4 months ago

There are three primary ways AI is being applied to malware: to write malware, to provide remote decision making via an AI-backed command and control, and to perform local agentic decision making, though only the first two have been observed in the wild. Researchers analyzed a trio of.NET infostealers that call OpenAI GPT-3.5-Turbo via HTTP to run four LLM-driven functions that mainly log suggested evasion or obfuscation names and in one case return a millisecond delay used for sleeping, and a Golang dropper that queries an LLM to assess the environment and gate execution. The findings show AI can lower the skill barrier for attackers but current integrations are often superficial or poorly implemented, and deploying local models for meaningful autonomous attack flows remains challenging for adversaries.
The multi-billion dollar mistake: Why cloud misconfigurations are your biggest security threat

www.csoonline.com · 4 months ago

Misconfigured cloud settings are the primary cause of breaches, with a 2024 Cloud Security Alliance analysis finding configuration errors enabled nearly every incident. The financial scale is steep, with IBM reporting average breach costs of 4.44 million globally and 10.22 million in the United States, and several high profile incidents exposed hundreds of millions of records or affected hundreds of companies. Root causes include human error, sprawling complex environments, shadow IT, unclear ownership, and a lack of monitoring, with industry data showing most errors are human driven, many storage locations go unmonitored, and remediations often take around three months. Recommended actions include enforcing multi factor authentication everywhere, locking down public storage and overly permissive network rules, enabling comprehensive logging and monitoring, using cloud security posture management and infrastructure as code checks, adopting least privilege, and investing in cross training and leadership support.
5 key priorities for your RSAC 2026 agenda

www.csoonline.com · 4 months ago

RSA Conference 2026 arrives at a significant inflection point for cybersecurity as AI dominates the event, accounting for roughly forty percent of sessions and embedding across tracks including Identity, Cloud Security, CISO Insights, the Human Element, and Threat Intelligence. CISOs face a defining tension between the need to adopt AI quickly to stay competitive and the simultaneous need to defend their organizations against AI driven threats such as prompt injection, training data poisoning, and model inversion. Five priorities for security leaders at RSA Conference 2026 are securing the AI stack, establishing AI governance and policy, managing non human identities, addressing shadow AI and AI generated code risks, and preparing security operations centers for autonomous remediation. Security leaders who leave with clearer governance frameworks and realistic assessments of AI stack exposure will be measurably better positioned than those who attend without focusing on these priorities.
OpenWebUI Servers Targeted in Attacks Using AI Payloads to Steal Data

gbhackers.com · 4 months ago

A recent campaign has targeted improperly secured Open WebUI systems that lack authentication, allowing attackers to upload malicious AI generated Python tools via the Open WebUI Tools plugin system. The payload was heavily obfuscated with a technique researchers call pyklump and 64 recursive layers of Base64, used Discord webhooks for command and control, and downloaded cryptominers T Rex and XMRig on Linux. On Linux the attack hid mining with LDPRELOAD injected shared objects named processhider and argvhider and persisted with a disguised systemd service called ptorchupdater, while Windows victims received a loader named application ref dot jar that dropped infostealers and targeted Chrome extension and Discord credentials. The campaign relied on internet exposed misconfigurations rather than software vulnerabilities and underscores the need to properly authenticate Open WebUI instances and deploy runtime security detections to spot memory manipulation and stealthy cryptomining.
Hacking a Robot Vacuum

www.schneier.com · 4 months ago

A researcher attempting to remotely control a DJI Romo robot vacuum inadvertently gained control of roughly seven thousand devices around the world. The incident highlights systemic insecurity in Internet of Things devices, including weak authentication and remote control mechanisms that allow a single experiment to affect thousands of units.
CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability

www.securityweek.com · 4 months ago

CISA warns that attacks are exploiting a recently patched Microsoft SharePoint remote code execution vulnerability tracked as CVE-2026-20963. The flaw was disclosed on January 13, 2026 as part of Microsoft’s January Patch Tuesday, affects SharePoint Server 2016, 2019, and Subscription Edition, and carries a CVSS score of 9.8. CISA added CVE-2026-20963 to its Known Exploited Vulnerabilities catalog on March 18, 2026 with a federal mitigation deadline of March 21, 2026, while public details about the attacks remain scarce and Microsoft updated its advisory on March 17, 2026.
Horabot Returns in Mexico, Spreading via Phishing and Email Worm Attacks

gbhackers.com · 4 months ago

Horabot has resurfaced in Mexico using a complex multi stage kill chain that begins with fake CAPTCHA pages that trick victims into running an mshta command to fetch remote HTA content and then executes chained JavaScript and VBScript served with server side polymorphism to evade detection. Subsequent stages deploy AutoIt loaders that decrypt an AES‑192 blob and map a Delphi banking trojan from the Casbaneiro family into memory, establish HTTPS command and control via embedded OpenSSL libraries, harvest credentials, and use distinctive XOR based socket framing that can be spotted by IDS rules. A PowerShell email worm spreader abuses Outlook MAPI to harvest contacts and send Spanish invoice lures that reinfect recipients, investigators observed over five thousand compromised hosts with about ninety three percent located in Mexico and linguistic artefacts pointing to Brazilian operators.
Kanboard Authenticated SQL Injection CVE-2026-33058 Writeup

0dave.ch · 4 months ago

NULL
DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover

thehackernews.com · 4 months ago

A full-chain iOS exploit kit called DarkSword has been used by multiple threat actors since at least November 2025 to steal sensitive data from iPhones running iOS versions roughly 18.4 through 18.7, with campaigns observed against users in Saudi Arabia, Turkey, Malaysia, and Ukraine via watering hole pages that load a malicious iFrame and JavaScript fingerprinting. DarkSword chains six vulnerabilities to deliver three payloads, including a dataminer named GHOSTBLADE that injects into mediaplaybackd to escalate privileges and exfiltrate emails, iCloud Drive files, contacts, messages, browsing data, cryptocurrency wallet and exchange data, photos, and other device information before cleaning staged files and exiting. The exploited flaws include CVE-2026-20700, CVE-2025-43529, CVE-2025-14174, CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520, several of which were zero-day vulnerabilities patched by Apple in subsequent updates.
Sorry, Mom. You’re Chatting With an A.I. Agent, Not Your Son.

www.nytimes.com · 4 months ago

Young Silicon Valley coders are building autonomous AI agents that run locally and automate everyday tasks, and many report a mix of excitement and anxiety about constantly needing to tend and scale these agents. Instances include agents performing unexpected real world actions such as deleting email or creating profiles on agent only platforms, prompting worries about unintended consequences and token anxiety among developers. Security researchers and companies warn of prompt injection, exposed tokens, and credential leakage risks, and independent analyses propose guardrail and proof of guardrail approaches while vendors pitch enterprise controls. The surge of agent experimentation is reshaping startup priorities and investor thinking, with companies and platforms racing to monetize or secure agent workflows even as users debate whether the productivity gains justify the risks.
Your MFA isn’t broken — it’s being bypassed, and your employees can’t tell the difference

www.csoonline.com · 4 months ago

Security teams are being warned that adversary-in-the-middle phishing captures entire real-time authentication flows, including session cookies, allowing attackers to open authenticated sessions without needing passwords or additional MFA prompts. Three systemic failures make this possible: awareness training that teaches users to spot fake pages instead of proxy attacks, overreliance on bearer session cookies that are not device bound, and incident response playbooks that focus on credential resets rather than revoking active sessions and detecting session replay. Recommended defenses include deploying phishing-resistant authentication such as FIDO2 security keys and passkeys, binding sessions to managed devices through conditional access, monitoring post-authentication anomalies like impossible travel and rapid MFA device registration, and retraining users to navigate to login pages directly rather than clicking links.
Cisco Firewall Vulnerability Exploited as Zero-Day in Interlock Ransomware Attacks

www.securityweek.com · 4 months ago

A vulnerability in Cisco Secure Firewall Management Center software tracked as CVE-2026-20131 has been exploited as a zero day since at least January 26 and can allow a remote unauthenticated attacker to execute arbitrary Java code with root privileges. Patches for the flaw were released on March 4 and Cisco advised that not exposing the FMC management interface to the internet reduces the attack surface, later updating its advisory to confirm in the wild exploitation. Amazon threat intelligence links the exploitation to the Interlock ransomware group and found evidence the actor most likely operates in the UTC plus three time zone with activity patterns suggesting likely ties to Russia. Amazon shared indicators of compromise to help defenders and reported Interlock targets sectors where operational disruption creates maximum pressure for payment, with education representing the largest share followed by engineering, architecture and construction, manufacturing and industrial organizations, healthcare providers, and government and public sector entities.
CVE-2026-22730: SQL Injection in Spring AI’s MariaDB Vector Store

blog.securelayer7.net · 4 months ago

CVE-2026-22730 is a SQL injection in Spring AI's MariaDB vector store caused by the filter expression converter failing to escape string values, allowing user-controlled input to be embedded directly into SQL. The flaw affects Spring AI 1.0.x versions prior to 1.0.4 and 1.1.x versions prior to 1.1.3 and enables injection in similarity search and filter-based delete paths that can bypass metadata access controls and delete the entire vector store, requiring only low privileges and crafted HTTP requests. The issue was fixed in commit 4602c23 on March 6, 2026 and in Spring AI releases 1.0.4 and 1.1.3 or later, and users are advised to upgrade or validate and allowlist filter values until patched.
CISA Adds Exploited Zimbra Collaboration Suite Flaw to Warning List

gbhackers.com · 4 months ago

There is a critical stored cross site scripting vulnerability in the Zimbra Collaboration Suite Classic user interface tracked as CVE-2025-66376, which CISA added to its Known Exploited Vulnerabilities catalog and which requires federal agencies and other organizations to apply updates by April 1, 2026. The flaw lets attackers embed CSS import directives in HTML email to bypass input filters so that opening a specially crafted message executes malicious scripts in the victim session, enabling access to sensitive emails, session hijacking, and potential wider compromise. Vendor Synacor has released patches that upgrade the AntiSamy HTML filtration component to version 1.7.8 and remove vulnerable legacy code, and administrators are urged to install patched versions 10.1.13 or 10.0.18 or discontinue use if they cannot update, with Synacor rating deployment risk as medium.
Open VSX Extension Delivers RAT and Stealer via GitHub Downloader

gbhackers.com · 4 months ago

An Open VSX extension named KhangNghiem/fast-draft, used by over 26,000 developers as of March 17, 2026, silently executed a GitHub-hosted downloader that fetched a second-stage payload from a BlokTrooper repository and deployed a compact attack framework. Confirmed malicious releases include versions 0.10.89, 0.10.105, 0.10.106, and 0.10.112, and the payload spawns detached Node processes that run four modules providing a Socket.IO remote access trojan, a browser and crypto wallet stealer, file exfiltration, and clipboard surveillance that exfiltrate data to infrastructure at 195.201.104.53 on ports 6931, 6936, and 6939. Researchers observed alternating clean and backdoored builds and say the version pattern and unanswered disclosure filed on March 12, 2026 point to a compromised publisher account or stolen release token rather than a maintainer deliberately shipping consistent malware.
Iran-Linked Botnet Exposed After Open Directory Leak Reveals 15-Node Relay Network

gbhackers.com · 4 months ago

There is a misconfigured open directory on an Iranian server that exposed a live censorship bypass relay and an SSH based botnet, revealing a 15 node relay network spanning Iran and Finland assembled with commodity tools and sloppy operational security. The discovery shows how financially or personally motivated actors can reuse tradecraft seen in Iranian advanced persistent threat operations.
EU Sanctions Companies in China, Iran for Cyberattacks

www.darkreading.com · 4 months ago

NULL
Anthropic ban heralds new era of supply chain risk — with no clear playbook

www.csoonline.com · 4 months ago

The Trump administration has designated Anthropic as a supply chain risk and banned its technology from Pentagon assets and other government systems, creating pressure on CISOs to identify, isolate, and potentially remove the model from their environments despite limited visibility into where it is used. A March 6 Pentagon memo requires military components to remove Anthropic products within 180 days and obligates contractors to notify vendors and certify compliance, effectively extending the requirement across the defense industrial base. Enterprises lack comprehensive inventories and AI governance, experts debate whether existing software bills of materials suffice, and removing or replacing embedded models may require code changes, revalidation, and coordination with vendors to avoid disrupting critical systems.
Aura Confirms Data Breach Exposing 900,000 Customer Records

gbhackers.com · 4 months ago

Digital security provider Aura confirmed a data breach affecting approximately 900,000 customer records following a targeted social engineering attack. The incident highlights the ongoing threat of sophisticated phishing campaigns that can bypass technical defenses by exploiting human elements, and Aura immediately initiated its incident response protocol upon detecting unauthorized network activity.
WaterPlum Unleashes “StoatWaffle” Malware in VSCode Supply Chain Attack

gbhackers.com · 4 months ago

A threat group linked to North Korea called WaterPlum, and its Team 8 subgroup, has introduced a new malware strain called StoatWaffle that focuses on developer ecosystems and supply chain attacks. The campaign uses malicious repositories that include a hidden.vscode directory with a crafted tasks.json set to runOn folderOpen, causing VSCode to execute a predefined task when a repository is opened and trusted, and the loader can download or install Node.js and retrieve env.npl and package.json to begin the infection chain. StoatWaffle is modular, deploying a stealer and a remote access trojan that exfiltrates browser credentials, extension data, macOS Keychain items, and system profiling details to command and control endpoints, and it contains awareness for Windows Subsystem for Linux to access Windows user data from WSL.
ScreenConnect Flaw Lets Hackers Steal Machine Keys and Hijack Sessions

gbhackers.com · 4 months ago

There is a critical vulnerability in ConnectWise ScreenConnect remote desktop software that allows attackers to extract server level cryptographic material and hijack active user sessions. The flaw is tracked as CVE-2026-3564 and categorized as CWE-347, carries a CVSS v3.1 base score of 9.0, and affects all ScreenConnect deployments before version 26.1. ConnectWise released ScreenConnect version 26.1 to replace local machine key storage with encrypted storage and active key management, cloud instances have been patched by the vendor and on premise administrators must install the 26.1 update and renew expired maintenance if necessary.