Blahalla

Cyera Raises $600 Million at $12 Billion Valuation

www.securityweek.com · 4 months ago

Cyera secured $600M funding, hitting $12B valuation. The firm's AI platform manages data security posture for data at rest, in motion, or in use. This supports large-scale AI transformation.

Microsoft Reportedly Cuts Hundreds of Azure Jobs in China

www.techrepublic.com · 4 months ago

Microsoft reportedly cut between 200 and 400 Azure jobs in China, affecting staff across its Beijing and Shanghai teams. These layoffs occur as cross-border data scrutiny increases due to tightening US and Chinese regulations. Washington implemented the Data Security Program, while Beijing enforces laws like the Data Security Law and PIPL, challenging cloud operations.

Cloud Security Report Finds Fragmented Tools Widening the Cloud Complexity Gap

gbhackers.com · 4 months ago

The 2026 Cloud Security Report found that tool sprawl and visibility gaps limit cloud effectiveness for 69% of surveyed organizations. Additionally, 66% report low confidence in detecting or responding to real-time cloud threats. To address these vulnerabilities, security leaders now suggest consolidating into single-vendor platforms rather than using disparate point tools.

Microsoft’s Record-Breaking Patch Tuesday Fixes Over 200 Security Flaws

www.techrepublic.com · 4 months ago

Microsoft issued its record-breaking June Patch Tuesday, addressing over 200 CVEs, including public zero-days and the critical flaw CVE-2026-45586. Industry experts believe AI tooling supercharges vulnerability discovery, fundamentally challenging traditional monthly patching schedules. This massive release signals an industry shift toward rapidly escalating software defect finding.

Microsoft patches Exchange Server zero-day exploited in attacks

www.bleepingcomputer.com · 4 months ago

Microsoft patched CVE-2026-42897 affecting Exchange Server 2016, 2019, and Subscription Edition via XSS code execution from emails. CISA noted the critical flaw exploited in the wild; US agencies must patch by May 29.

Why schools remain one of cybercriminals’ favourite targets

www.bitdefender.com · 4 months ago

Ransomware gangs continue targeting educational institutions globally. Evanston Township High School suffered an attack, forcing a closure because it disabled critical systems like door access controls and public address announcements. Separately, Powys County Council in Wales disclosed that 13 schools faced hacker attacks, compromising student and staff personal data.

73 Microsoft Packages Weaponized in Password Stealer Attack

gbhackers.com · 4 months ago

GitHub disabled 73 repositories across four Microsoft organizations in a sudden 105-second window, impacting core Azure components like azure-functions-host. The scale points to automated abuse detection, indicating credential exposure within the code bases. This takedown relates to supply-chain weaponization waves where groups utilized malicious packages and tools for stealing credentials.

Aryon Security Raises $29 Million in Series A Funding

www.securityweek.com · 4 months ago

Cybersecurity startup Aryon Security raised $29 million in Series A funding, led by Brightmind Partners. The company provides proactive cloud protection and enforces security controls to prevent misconfigurations across complex environments. Aryon aims to help organizations maintain secure-by-design infrastructure during rapid cloud migration.

Critical HVAC and UPS Vulnerabilities Could Let Hackers Disrupt Data Centers

www.securityweek.com · 4 months ago

Claroty found vulnerabilities in Vertiv UPS network cards (auth bypass, RCE) and Trane Tracer SC+ HVAC controllers (unauthenticated control). Attackers could disrupt operations on these critical building systems.

New Windows CTF 0-Day Vulnerability Lets Attackers Gain Elevated Privileges

gbhackers.com · 4 months ago

Microsoft found CVE-2026-45586 in Windows CTFMON. This zero-day allows attackers elevated privileges via improper symbolic link handling with local access, bypassing user interaction for high-level code execution.

Microsoft feud escalates as researcher drops new Windows zero-day

www.csoonline.com · 4 months ago

Researcher Nightmare Eclipse published exploit code for RoguePlanet, a zero-day flaw targeting Microsoft Defender. The exploit uses a race condition vulnerability to potentially gain SYSTEM-level privilege and execute arbitrary code on Windows 10/11 with recent patches installed. This disclosure continues Eclipse's dispute with Microsoft over proper vulnerability disclosure timing.

How Fraudsters Bypass Facial Recognition and Stay Hidden in 2026

sumsub.com · 4 months ago

Fraudsters use deepfake technology and synthetic media to bypass facial recognition, with deepfake fraud surging by 1,100%. Attackers leverage AI-generated identities in virtual interviews, targeting financial institutions. To counter this, strong biometric systems must implement liveness detection; these measures verify physical presence and detect image manipulation beyond face matching.

New Windows Zero-Day Exploit ‘RoguePlanet’ Released

www.securityweek.com · 4 months ago

Nightmare Eclipse's RoguePlanet zero-day PoC exploits a Defender race condition for LPE (SYSTEM) on patched Win 10/11, building on CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45586, and CVE-2026-50507.

Microsoft: Some Windows PCs fail to install latest monthly updates

www.bleepingcomputer.com · 4 months ago

Microsoft warned customers that certain Windows PCs upgraded to versions 24H2 or 25H2 may fail installing monthly updates. Affected devices report specific errors, including 0x80073712 or 0x800f0993, when attempting the June 2026 cumulative update. Microsoft advises users to restart their PCs, noting a fix for unmanaged and Home edition systems will roll out following rebooting.

NSO Group Hacking WhatsApp Despite Court Order

www.schneier.com · 4 months ago

WhatsApp reportedly detected that the NSO Group was phishing its users while violating a court order. The company took action against the surveillance technology firm.

Hackers Use Fake Utility Downloads to Deploy ScreenConnect and Cryptominers

gbhackers.com · 4 months ago

A cryptojacking campaign was launched impersonating utilities like CrystalDiskInfo and HWMonitor. The attack poisons search results and leverages AI chatbots to direct users toward malicious download sites. The payload uses DLL sideloading techniques to silently install ScreenConnect, granting persistent remote access for cryptocurrency mining.

After AI Reaches Production: 12 Ways Security Teams Can Take Control

www.securityweek.com · 4 months ago

Security teams require a repeatable framework to monitor and defend AI applications moving into production. They must first achieve continuous visibility to detect data exposures, vulnerabilities, and fraud. Proper security demands generating telemetry from the AI, API, and application layers while building stakeholder trust early in the SDLC.

Autonomous AI agents duped into leaking sensitive data in phishing test

www.csoonline.com · 4 months ago

OpenClaw AI's Pinchy failed against social engineering, leaking AWS IAM keys & customer data despite resisting OAuth attacks. Human trust is the key vulnerability for autonomous agents.

CISA Issues Alert on Actively Exploited Google Chromium Zero-Day Flaw

gbhackers.com · 4 months ago

CISA warns of an actively exploited zero-day vulnerability, CVE-2026-11645, affecting Google Chromium's V8 JavaScript engine. This flaw involves out-of-bounds read and write issues, potentially allowing arbitrary code execution through malicious web content. Because this critical issue impacts browsers like Chrome and Edge, CISA urges organizations to apply vendor mitigations immediately.

Microsoft patches YellowKey, GreenPlasma, MiniPlasma zero-days

www.bleepingcomputer.com · 4 months ago

MS patched three flaws: GreenPlasma (CVE-2026-45586), MiniPlasma (CVE-2020-17103), grant local SYSTEM access on patched Windows. YellowKey (CVE-2026-45585) bypasses BitLocker with physical access. BlueHammer (CVE-2026-33825) and RoguePlanet details were leaked.

Tax Phishing Emails Deliver In-Memory Malware to Windows Systems

gbhackers.com · 4 months ago

Phishing emails mimicking HMRC/Intuit QuickBooks target India's sector via in-memory malware on Windows. It uses PowerShell/mshta.exe execution for evasion. Silver Fox deploys a modular RAT with C2 and LLVM Control Flow Flattening.

ServiceNow Patches Vulnerability Exploited Against Some Customers

www.securityweek.com · 4 months ago

ServiceNow patched a cloud platform vulnerability after reports indicated attackers exploited the flaw. The security update limits endpoint access and concerns potential unauthorized user access to instance data. ServiceNow detected anomalous activity for some customers, observing successful queries of specific instance tables via affected endpoints.

Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs

thehackernews.com · 4 months ago

Microsoft released fixes for a record 206 vulnerabilities impacting its software portfolio on Tuesday, including three flaws publicly disclosed at the time of patching. The patches address severity issues: 39 are rated Critical and 167 are Important. These comprehensive updates cover numerous flaw types, notably including 56 remote code execution and 63 privilege escalation issues.

AI red teaming comes of age

www.csoonline.com · 4 months ago

GPT-4 forces security teams to adapt past 2019's Microsoft AI red team due to probabilistic nature. Analyzing complex software dependencies is faster than traditional methods. Security risk determination now relies on frequency/conditions, not just existence.

Critical Vulnerabilities Patched in Fortinet, Ivanti Products

www.securityweek.com · 4 months ago

Fortinet patched CVE-2026-25089 (RCE/OS command injection) in FortiSandbox. Ivanti fixed OS command injection (CVE-2026-10520) and auth bypasses (CVE-2026-10523) for Sentry/EPMM, plus CVE-2026-6973 & CVE-2026-10727. Updates are now available.

certSIGN: Inconsistent revocation status (CRL "revoked" vs OCSP "good") for intermediate CA "certSIGN Web CA"

bugzilla.mozilla.org · 4 months ago

A Mozilla bug report identifies that certSIGN's intermediate CA, "certSIGN Web CA," exhibits inconsistent revocation status. The reporter demonstrated that checking the Certificate Revocation List (CRL) indicates the certificate is REVOKED, while performing an Online Certificate Status Protocol (OCSP) check reports its status as GOOD.

Malicious npm Package ‘dbmux’ Targets Developers

gbhackers.com · 4 months ago

npm package dbmux has a supply chain vulnerability allowing arbitrary code execution. Attackers can gain remote control by harvesting environment variables/credentials on affected systems. Isolate hosts and rotate all secrets now.

Windows BitLocker 0-Day Flaw Enables Security Feature Bypass Attacks

gbhackers.com · 4 months ago

Microsoft disclosed zero-day vulnerability CVE-2026-50507 in Windows BitLocker. This flaw compromises core disk encryption by exploiting a "Missing Authentication for Critical Function" weakness. Attackers could bypass protections using physical access without requiring user credentials.

Windows Defender Zero-Day “RoguePlanet” Lets Attackers Gain SYSTEM Privileges

gbhackers.com · 4 months ago

A zero-day vulnerability named "RoguePlanet" impacts Microsoft Defender on Windows 10 and 11, allowing attackers to escalate privileges to SYSTEM-level access. Security researcher "MSNightmare" published a proof-of-concept exploit demonstrating this flaw on GitHub. The attack leverages a race condition within Defender's file handling mechanisms by abusing ISO mounting behavior.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact

www.securityweek.com · 4 months ago

Siemens patched OpenSSL (CVE-2025-15467) for authenticated command execution. Schneider released updates for PowerLogic P7 DoS and EasyLogic T150 credential issues. Phoenix Contact warned of an unauthenticated log download flaw in CHARX SEC-3xxx. These advisories cover multiple critical ICS flaws.

Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards

thehackernews.com · 4 months ago

On June 9, Anthropic released Claude Fable 5, the most capable model it has developed to date. The company structured the release by splitting its core underlying model into two products using safety classifiers. Public access goes through Fable 5; simultaneously, a safeguarded twin, Claude Mythos 5, remains locked for vetted cybersecurity groups.

OpenClaw AI Agent Leaks Credentials in Phishing Simulation

gbhackers.com · 4 months ago

Phishing hit autonomous email agents; OpenClaw simulation showed agent "Pinchy" leaked AWS IAM keys and DB passwords when tricked by an attacker posing as "Dan," even with a Strict profile enforced.

GhostTrace – a Windows forensic scanner that finds what "Uninstall" leaves behind (22 modules, read-only, offline)

www.virustotal.com · 4 months ago

Researchers built GhostTrace, a Windows CLI tool investigating software remnants using 22 forensic modules in one pass. The utility detects artifacts like leftover registry keys, prefetch entries, and scheduled tasks remaining after uninstallation. GhostTrace covers persistence mechanisms including Run/RunOnce keys, services, AppInitDLLs, and WMI bindings associated with MITRE ATT&CK TA0003.

ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances

thehackernews.com · 4 months ago

Unknown groups exploited a flaw in ServiceNow instances to gain deep unauthorized access. The company issued an advisory and applied a security update on June 5, 2026. This patch addressed a vulnerability that could let unauthenticated users compromise susceptible hosted customer instances.

No Patch Planned for Exploited Arista EOS Vulnerability

www.securityweek.com · 4 months ago

Hackers exploit a zero-day vulnerability in Arista EOS (CVE-2026-7473) that processes non-verified tunnel traffic. Arista confirmed no patch exists, advising organizations to implement vendor mitigations for the flaw. CISA added CVE-2026-7473, alongside CVE-2026-11645 and CVE-2026-20245, to its Known Exploited Vulnerabilities list.

Jupyter Enterprise Gateway - From Notebook to Kubernetes Cluster Admin - elttam

www.elttam.com · 4 months ago

Jupyter Enterprise Gateway has three flaws: CVE-2026-44180, CVE-2026-44181 (RCE), and CVE-2026-44182. These let users compromise Kubernetes clusters via data science workloads. Updates are available in v3.3.0.

Ivanti: Max severity Sentry flaw allows code execution as root

www.bleepingcomputer.com · 4 months ago

Ivanti patched Sentry for two critical flaws: CVE-2026-10520 (root OS command injection) and CVE-2026-10523 (auth bypass). These affect its mobile gateway solution. Patches are now available to secure the product.

Microsoft Patch Tuesday June 2026 Fixes 198 Vulnerabilities, Including 3 Zero-Days

gbhackers.com · 4 months ago

MS June 2026 patch addressed 198 vulns incl. 3 zero-days. Flaws let BitLocker bypass (CVE-2026-50507) and HTTP.sys disruption (CVE-2026-49160). Fast deployment for AD, RDP, Hyper-V is required to mitigate risk.

Hackers Use ClickFix Chain to Deploy MLTBackdoor Malware

gbhackers.com · 4 months ago

Operators deploy MLTBackdoor, a new backdoor family, using a multi-stage ClickFix infection chain to establish ransomware footholds. The campaign leverages an automotive-themed lure; victims executing commands fetch a compressed archive from a DGA domain, dropping two artifacts that initiate the attack.

Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows

thehackernews.com · 4 months ago

Anonymous researcher Chaotic Eclipse released a proof-of-concept exploit targeting the Microsoft Defender zero-day named RoguePlanet. The security expert published the code under the GitHub account "MSNightmare." Though describing it as a race condition, Chaotic Eclipse claimed achieving 100% success with the vulnerable exploit.

Critical Veeam Flaw Could Let Attackers Execute Code on Backup Servers

gbhackers.com · 4 months ago

Critical RCE vulnerability CVE-2026-44963 affects Veeam Backup & Replication versions 12.x, allowing authenticated domain users to execute arbitrary code on backup servers. Attackers could leverage this flaw to delete backups or deploy ransomware within enterprise environments. Organizations must urgently upgrade to version 12.3.2.4854 and enforce strict network segmentation to mitigate the risk.

Hackers Use TikTok and Instagram Reels to Push Fake Software Malware

gbhackers.com · 4 months ago

ReversingLabs found attackers use TikTok/Instagram Reels for phishing. They post "how-to" videos pushing PowerShell commands or fake free apps, distributing infostealers like Vidarstealer.

Fortinet FortiSandbox Vulnerability Lets Attackers Execute Unauthorized Commands

gbhackers.com · 4 months ago

Fortinet disclosed CVE-2026-25089, a critical OS command injection flaw (CVSS 9.1) in FortiSandbox's web management interface. The vulnerability allows unauthenticated attackers to execute unauthorized commands via the "start VNC" feature using crafted JSON input. Organizations must urgently upgrade affected versions or restrict access to mitigate potential full system compromise.

Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS

thehackernews.com · 4 months ago

Cybersecurity researchers flagged six vulnerabilities in protobuf.js, a JavaScript and TypeScript implementation of Protocol Buffers. Exploiting these flaws could trigger remote code execution (RCE) or denial-of-service (DoS) attacks. Attackers only need one malicious schema, descriptor, or crafted payload to compromise affected environments.

Google Issues Urgent Chrome Security Update for Exploited Zero-Day Flaw

gbhackers.com · 4 months ago

Chrome updated to 149.0.7827.102/.103 for Windows/Mac, patching 74 flaws. Key fixes include zero-day CVE-2026-11645 (V8 OOB) and use-after-free issues (CVE-2026-11628 to CVE-2026-11644). Users should install the patch immediately.

UK move to filter photos and messages triggers encryption worries for CISOs

www.csoonline.com · 4 months ago

Starmer urged tech firms to block explicit imagery, alarming CISOs over enterprise security impact. On-device filtering faces hurdles, risking world encryption due to data analysis requirements. Reliable local scanning is currently unfeasible.

Enterprises know AI-generated code is vulnerable; they’re shipping it anyway

www.csoonline.com · 4 months ago

Checkmarx reports nearly half production code uses AI; companies shipping high volumes are 3.4x more vulnerable to builds. Most orgs face breaches and ship compromised code deliberately, pointing to human error as the core weakness.

Anthropic rolls out Claude Fable 5, but it's available for a limited time

www.bleepingcomputer.com · 4 months ago

Anthropic released Fable 5, a safeguarded version of its Mythos model class meant to curb misuse. The company embedded safeguards in Fable 5 that block sensitive queries involving topics like offensive cybersecurity or biology. Meanwhile, the unrestricted Claude Mythos 5 remains highly restricted only to vetted partners, including government cyberdefenders.

More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520) - watchTowr Labs

labs.watchtowr.com · 4 months ago

Ivanti Sentry (pre R10.5.2, R10.6.2, R10.7.1) has two critical flaws: CVE-2026-10520 allows unauthenticated root RCE via OS Command Injection (CVSS 10/10). CVE-2026-10523 lets unauthenticated users bypass auth to create admin accounts. Patch immediately.

SVD-2026-0601: Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

advisory.splunk.com · 4 months ago

Low-privileged users could achieve Remote Code Execution (RCE) in several versions of Splunk Secure Gateway via CVE-2026-20251. The vulnerability utilizes unsafe deserialization when reconstructing App Key Value Store data with the jsonpickle Python library. Administrators must upgrade affected instances to patched versions listed in the advisory to remediate this high-severity flaw.