Blahalla

Criminal IP at Infosecurity Europe 2026: Introducing AITEM, the Next Chapter of Attack Surface Management

gbhackers.com · 4 months ago

Criminal IP showcased its AITEM framework at Infosecurity Europe 2026, defining the next generation of threat exposure management. This concept advances Continuous Threat Exposure Management beyond basic asset surface discovery. By integrating AI agents, AITEM guides remediation and prioritizes risks, helping security teams bridge the critical gap between mere detection and effective action.

Upcoming Speaking Engagements

www.schneier.com · 4 months ago

This is a current list of where and when I am scheduled to speak: I’m giving a keynote at Cybernation 2026 in Berlin, Germany, on June 24, 2026. I’m speaking at the Potsdam Conference on National Cybersecurity at the Hasso Plattner Institut in Potsdam, Germany. The event runs June 24, 25, 2026, and my talk will be the evening of June 24.

FBI disrupts massive AI-powered phishing service using a million URLs

www.bleepingcomputer.com · 4 months ago

FBI, Google, Black Lotus Labs busted Outsider Enterprise, a Chinese phishing service using AI for fake websites/text blasts via AT&T, T-Mobile, Verizon. The network stole data from 3.8M+ credit cards, causing over $1.9B loss.

Readers reply: Experts say we should use passkeys, but can a smartphone pin really be safer than a password?

www.theguardian.com · 4 months ago

The long-running series in which readers answer other readers’ questions on subjects ranging from trivial flights of fancy to profound scientific and philosophical concepts This week’s question: Is ‘ripen at home’ fruit the supermarkets’ idea of a joke? I’ve been struggling to get my head around the idea that a passkey, which can be a pin on your phone, or facial recognition, can be safer than usi

Merger Cleared, David Ellison to Join Trump at U.F.C. Bout

www.nytimes.com · 4 months ago

A U.F.C. fight on President Trump’s birthday will now double as a capstone for Paramount’s successful effort to secure Justice Department approval for a mega media merger.

Researcher accidentally gained access to a threat actor-controlled phishing website

potato.id · 4 months ago

An interesting write-up from https://x.com/unrequitedlyfe describing how an accidental login led to access to a threat actor-controlled phishing website. The blog provides a behind-the-scenes look at phishing infrastructure, operational mistakes made by the actor, backend panels, and infrastructure pivoting opportunities that can assist threat intelligence investigations.

Trump Administration Reignites Its Feud With Anthropic Over Latest A.I. Models

www.nytimes.com · 4 months ago

The administration imposed surprise restrictions Friday, cutting off foreign nations' access to Anthropic’s latest AI models. The move sparked immediate political debate regarding technological restrictions and international policy.

State Attorneys General Are Investigating OpenAI

www.nytimes.com · 4 months ago

OpenAI said that a coalition of states had opened an investigation over a wide range of its practices, including its handing of user data, safety of minors and advertising activities.

PromptSnatcher: AdBlocker stealing Ai Chats - 90k installs

malext.io · 4 months ago

Full write-up: MalExt Sentry - Malicious Browser Extension Tracker Two Chrome extensions presenting as adblockers also intercept every prompt and response on ChatGPT, Claude, Gemini, Copilot, Grok, Perplexity, DeepSeek, and Meta AI, exfiltrating them to operator-controlled servers. They also check whether you're a paid user on 5 of the 8 platforms (ChatGPT, Claude, Perplexity, Copilot, Gemini).

Ex-school district employee jailed for hacks on former employer

www.bleepingcomputer.com · 4 months ago

Former IT employee Ezekiel Dean Potter conducted cyberattacks against the Saydel Community School District after leaving his position. Prosecutors reported that Potter deleted key accounts across various platforms, including Apple School Manager, disrupting MacBooks and iPads for district employees. These actions impaired classroom operations and led to his sentencing to 21 months in prison.

MeshCentral: From XSS to RCE

www.techanarchy.net · 4 months ago

The research demonstrated how to utilize a Cross-Site Scripting (XSS) vulnerability within MeshCentral. Researchers combined this flaw with a rogue client setup. This sequence successfully escalates the exploit, culminating in Remote Code Execution (RCE).

NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks

www.securityweek.com · 4 months ago

By default, npm install will no longer execute scripts from dependencies, unless explicitly allowed.

Chinese hackers hijack auth flow, spy on isolated network for a decade

www.bleepingcomputer.com · 4 months ago

Chinese hackers took control of a target organization's authentication stack and maintained persistence for 10 years, with full visibility into the administrative activity.

Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication

thehackernews.com · 4 months ago

Splunk has released security updates to address a critical security flaw in Splunk Enterprise that could be exploited to conduct unauthenticated file operations and even remote code execution. The vulnerability, tracked as CVE-2026-20253, is rated 9.8 on the CVSS scoring system. "In Splunk Enterprise versions below 10.2.4 and 10.0.

US Gov asks Anthropic to ban 'foreign national' access to Fable, Mythos

www.bleepingcomputer.com · 4 months ago

The US government has ordered Anthropic to block all foreign nationals from accessing Fable 5 and Mythos 5, forcing the company to suspend both models worldwide. Anthropic is complying but disputes the basis, calling the cited jailbreak narrow and the capability widely available elsewhere.

New Agentjacking Attack Hijacks AI Coding Agents to Execute Malicious Code

gbhackers.com · 4 months ago

A newly disclosed Agentjacking attack class can silently weaponize AI coding agents against the very developers who rely on them, requiring no phishing, no server compromise, and no user interaction beyond a developer’s normal workflow of asking their AI assistant to investigate errors.

Getting the PID from random numbers in PHP

blog.ikaes.de · 4 months ago

In my blog article I analyze how random numbers in older PHP versions were generated. It turns out you can, under certain circumstances, derive the id of the process which generated a random number! While it has exactly 0 practical application, it was super fun to dig into the php's source code.

Critical Splunk Enterprise Pre-Auth RCE Chain Exposes Databases

gbhackers.com · 4 months ago

A critical pre-authentication remote code execution (RCE) vulnerability in Splunk Enterprise has been disclosed, carrying a near-perfect CVSS score of 9.8. Tracked as CVE-2026-20253, the flaw was published by Splunk on June 10, 2026, and affects the PostgreSQL Sidecar Service introduced in Splunk version 10.

Anthropic Blocks Fable 5 and Mythos 5 Following U.S. National Security Directive

gbhackers.com · 4 months ago

Anthropic has disabled all access to its Fable 5 and Mythos 5 artificial intelligence models following a sudden export-control directive from the United States government. Issued at 5:21 PM ET on June 13, 2026, the directive cited pressing national security concerns and strictly prohibited any foreign national from accessing the models.

Malicious 152 Chrome Extensions Caught Spoofing Google Organic Search Traffic

gbhackers.com · 4 months ago

A massive, coordinated network of 152 malicious Google Chrome browser extensions has been dismantled after researchers caught the operation generating fake organic Google search traffic. Socket’s Threat Research Team discovered the operation spanning 38 separate Chrome Web Store publisher accounts and tracing back to three primary brand backends: tabplugins[.]com, yowgames[.

Malicious 152 Chrome Extensions Caught Spoofing Google Organic Search Traffic

gbhackers.com · 4 months ago

A massive, coordinated network of 152 malicious Google Chrome browser extensions has been dismantled after researchers caught the operation generating fake organic Google search traffic. Socket’s Threat Research Team discovered the operation spanning 38 separate Chrome Web Store publisher accounts and tracing back to three primary brand backends: tabplugins[.]com, yowgames[.

Anthropic Says It Has Taken Its Latest AI Models Offline to Comply With New Export Controls

www.securityweek.com · 4 months ago

Anthropic takes Fable 5 and Mythos 5 offline to comply with a directive from the Trump administration to prevent use by foreign nationals.

U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals

thehackernews.com · 4 months ago

Anthropic said on Friday it will "abruptly disable" its most advanced artificial intelligence (AI) models, Claude Fable 5 and Mythos 5, for all users after the U.S. government ordered it to suspend access to the models for foreign nationals, whether inside or outside the U.S., citing national security concerns. The AI company said it received an order at 5:21 p.m.

Anthropic Blocks Foreign Nationals from Using Its Mythos and Fable A.I.

www.nytimes.com · 4 months ago

The San Francisco company said on Friday night that the federal government ordered the suspension of the two A.I. systems, citing national security concerns.

Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered

unit42.paloaltonetworks.com · 4 months ago

Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn more here.

GreatXML zero-day BitLocker bypass doesn’t seem to work, yet

www.csoonline.com · 4 months ago

A disgruntled researcher who has been publishing zero-day Microsoft Windows vulnerabilities for the past several months released a new exploit Thursday that promises to bypass BitLocker encryption on locked devices. A well respected security expert reported that the exploit doesn’t work as initially described, but the researcher is looking for ways to fix it.

Friday Squid Blogging: Squid-Inspired Fluid Pump

www.schneier.com · 4 months ago

This fluid pump was inspired by the way squids propel themselves through the water. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

SpaceX’s Unlikely Journey From Far-Out Idea to $2 Trillion Juggernaut

www.nytimes.com · 4 months ago

Elon Musk said he had initially given SpaceX less than a 10 percent chance of succeeding. His rocket company has come a long way.

ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed

www.darkreading.com · 4 months ago

A major bug in Oracle's ERP software disproportionately affected American universities, and hackers have capitalized by stealing gobs of data.

New Windows Zero-Day Claims BitLocker Bypass Amid Microsoft Disclosure Fight

www.techrepublic.com · 4 months ago

A new Windows zero-day reportedly bypasses BitLocker, adding pressure on Microsoft as researchers debate the exploit’s real-world impact.

Maine disables data breach notification portal after fake disclosures

www.bleepingcomputer.com · 4 months ago

Maine has taken its public data breach reporting portal offline after fraudulent breach disclosures were published on the state's website, prompting a review of procedures to prevent abuse in the future.

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

thehackernews.com · 4 months ago

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself.

400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer

thehackernews.com · 4 months ago

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself.

Google Sues Chinese Smishing Network Accused of Using Gemini AI in Phishing

thehackernews.com · 4 months ago

Google on Friday said it's pursuing legal action against a Chinese cybercrime network, accusing it of using its Gemini artificial intelligence (AI) agent to send phishing text messages targeting Americans. The network is said to be behind the development and management of a phishing-as-a-service (PhaaS) software kit called Outsider, per the tech giant.

What the SpaceX I.P.O. Means for OpenAI and Anthropic

www.nytimes.com · 4 months ago

Strong investor interest in SpaceX could be good news for the A.I. rivals, which have signaled that they, too, intend to go public this year.

Privacy own-goal: World Cup blunder leaks Lionel Messi’s passport details

www.bitdefender.com · 4 months ago

Argentina's World Cup squad had their passport numbers leaked before a ball was kicked - not by hackers, but by someone who failed to redact a document properly. document. It's a mistake that has been made many times in the past... Read more in my article on the Hot for Security blog.

phpBB forum fixes auth bypass bug lurking for a decade

www.bleepingcomputer.com · 4 months ago

A 10-year-old authentication bypass vulnerability discovered in the phpBB forum software allows an attacker to log in as any user, including administrators.

China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade

thehackernews.com · 4 months ago

Instead of hiding on the laptops and servers defenders watch most closely, a China-nexus group spent close to a decade hidden inside the Linux login system itself. Sygnia, which tracks the group as Velvet Ant, says it backdoored the PAM and OpenSSH components that decide who is allowed to sign in, planting its access where ordinary cleanup could not reach it.

Ukrainian national pleads guilty to role in Conti ransomware operation

www.bleepingcomputer.com · 4 months ago

A Ukrainian national extradited from Ireland to the United States last year has pleaded guilty to conspiracy charges tied to the Conti ransomware operation.

How Much SpaceX Are You About to Own?

www.nytimes.com · 4 months ago

If you have index funds, such as in a 401(k), they may soon include shares of the mega company. Here’s a rough calculation.

Over 400 Arch Linux packages compromised to push rootkit, infostealer

www.bleepingcomputer.com · 4 months ago

More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens.

In Other News: Google Security Layoffs, AudiA6 Takedown, $400 Million Coupang Fine

www.securityweek.com · 4 months ago

Other noteworthy stories that might have slipped under the radar: ICS device exposure remains flat as attack surface widens, Microsoft issues incident response playbook for AI, IBM and AT&T accused of hack cover-ups.

SpaceX Stock Rises 11% in Largest I.P.O. Ever

www.nytimes.com · 4 months ago

The stock market debut of Elon Musk’s rocket company paves the way for a wave of mega offerings that are coming from OpenAI and Anthropic.

Warrantless wiretaps cut off for a week following US Congress vote

www.csoonline.com · 4 months ago

Lawmakers have failed to extend a surveillance law that allows US intelligence agencies to monitor targets abroad without a warrant. Congress rejected a vote to extend Section 702 of the Foreign Intelligence Surveillance Act to July 2, which means, for a few days at least, some surveillance will be put on hold, for the first time since the Act was passed in 2008.

Elon Musk Becomes the World’s First Trillionaire

www.nytimes.com · 4 months ago

With SpaceX shares soaring on their first day of trading, the world’s richest person crossed another milestone, one with 13 digits.

French government’s secure messaging system breached

www.csoonline.com · 4 months ago

An intruder has breached the French government’s encrypted messaging service, Tchap, showing once again that human error is a weak spot in any security system. Tchap was developed in France as an example of national sovereignty and was designed to be a more secure option than WhatsApp for communication between government employees.

Major AI Clients Shipping With Broken OAuth Implementations (JUNE 2026 UPDATE)

www.redcaller.com · 4 months ago

The MCP authorization specification (November 2025) mandates OAuth 2.1 with PKCE for remote MCP servers. In practice, this security model is only achievable if MCP clients implement the OAuth refreshtoken grant.

How Security Debt Can Accumulate Faster Than Technical Debt

gbhackers.com · 4 months ago

Security debt sounds like a tidy metaphor until the first breach turns it into a billing department with teeth. Technical debt behaves like clutter. Code gets ugly, builds slow down, developers complain, and deadlines wobble. Security debt behaves like contagion.

Early Warning Signs of Supply-Chain Attacks Live in the Dark Web

www.bleepingcomputer.com · 4 months ago

GitHub access sales, leaked repositories, and stolen API keys can all become supply-chain attack footholds. Flare explores how underground forums expose early signals tied to software supply-chain risk.

Claude Fable 5 Doesn't Change the Mythos Security Story

www.darkreading.com · 4 months ago

Stay cool: Mythos 5 is an upgrade over Mythos Preview while Fable 5 is Mythos "made safe for general use," Anthropic explained.