Blahalla

Attackers Exploit Teams, Quick Assist to Deploy Stealthy A0Backdoor

gbhackers.com · 4 months ago

Attackers are utilizing a social engineering tactic involving email bombing and impersonating IT support staff through Microsoft Teams to gain remote access via Quick Assist. They then deploy a new backdoor, A0Backdoor, using digitally signed MSI installers hosted on Microsoft personal cloud storage. The backdoor employs a complex loader chain including a tampered hostfxr.dll to decrypt its payload and utilizes DNS tunneling over MX queries for command and control communication, evading typical security controls. This activity is linked to Blitz Brigantine, a financially motivated group associated with Black Basta and Cactus ransomware operations.
Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse

thehackernews.com · 4 months ago

Google is implementing a new security feature in Android 17, specifically within Advanced Protection Mode, to limit the use of accessibility services. This change restricts non-accessibility apps from using the accessibility services API to prevent malware abuse and data theft. Only verified accessibility tools, such as screen readers, are exempt from the restriction. Developers can use the AdvancedProtectionManager API to adapt to this new security posture.
Microsoft Issues Out-of-Band Patch for Critical Windows 11 RRAS RCE Flaws

gbhackers.com · 4 months ago

Microsoft has released an out-of-band security update, KB5084597, to address critical vulnerabilities in the Windows 11 Routing and Remote Access Service. These vulnerabilities, identified as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111, allow for remote code execution if a user connects to a malicious server. The hotpatch applies to Windows 11 versions 25H2 and 24H2 and is automatically installed on enabled devices. Users should verify that Windows Update is active and monitor network logs for suspicious activity.
Meta Permanently Disables End-to-End Encryption for Instagram DMs

gbhackers.com · 4 months ago

Meta plans to permanently disable end-to-end encryption for Instagram Direct Messages starting May 8, 2026. This change means Instagram will no longer prevent third parties from accessing private chats. Users will receive instructions on how to download and save their messages, and updating to the latest version of the Instagram application is advised. Currently, only the sender and recipient can read messages due to device-level cryptography, but this will no longer be the case.
GenAI-Security als Checkliste

www.csoonline.com · 4 months ago

Das Open Web Application Security Project (OWASP) gibt Unternehmen eine Checkliste für (mehr) GenAI-Sicherheit an die Hand. Foto: Gannvector | shutterstock.com Während Unternehmen wie OpenAI, Anthropic, Google oder Microsoft aber auch Open-Source-Alternativen bei ihren Generative-AI, und Large-Language-Model -Angeboten exponentielle User-Zuwächse verzeichnen, sind IT-Sicherheitsentscheider bemüht, mit der rasanten KI-Entwicklung in ihren Unternehmen Schritt zu halten. Die Non-Profit-Organisation OWASP trägt dieser Entwicklung mit einer neuen Veröffentlichung Rechnung: der “ LLM AI Cybersecurity & Governance Checklist “. LLM-Bedrohungskategorien Das Thema KI ist ziemlich umfangreich, weswegen die OWASP-Checkliste vor allem darauf abzielt, Führungskräfte dabei zu unterstützen, die wesentlichen Risiken im Zusammenhang mit generativer KI und großen Sprachmodellen möglichst schnell zu identifizieren und entsprechende Abhilfemaßnahmen einzuleiten. Das soll gewährleisten, dass Unternehmen über die nötigen, grundlegenden Sicherheitskontrollen verfügen, um generative KI und LLM-Tools, -Services und Produkte sicher einzusetzen. Dabei betont OWASP, dass die Checkliste keinen Anspruch auf Vollständigkeit erhebt und sich mit zunehmender Reife der Technologie und Tools ebenfalls weiterentwickeln wird. Die Sicherheitsexperten ordnen LLM-Bedrohungen in verschiedene Kategorien ein, wie die nachfolgende Abbildung veranschaulicht: Die OWASP KI-Bedrohungs-Map. Foto: OWASP Geht es darum, eine LLM-Strategie festzulegen, müssen Unternehmen vor allem mit den einzigartigen Risiken umgehen, die generative KI und LLMs aufwerfen. Diese müssen durch organisatorische Governance und entsprechende Security-Kontrollen minimiert werden. Im Rahmen ihrer Veröffentlichung empfehlen die OWASP-Experten Unternehmen einen sechsstufigen Ansatz, um eine wirksame LLM-Strategie zu entwickeln: Mit OWASP in sechs Schritten zum LLM-Deployment. Foto: OWASP Auch hinsichtlich der Deployment-Typen in Sachen LLM empfiehlt OWASP, ganz genau hinzusehen und entsprechende Überlegungen anzustellen: Welche Art von KI-Modell ist für Sie die richtige? Foto: OWASP Die OWASP-KI-Checkliste Im Folgenden haben wir die von OWASP veröffentlichte Checkliste etwas “aufgedröselt”. Folgende Bereiche sollten Sie im Rahmen Ihrer Generative-AI- respektive LLM-Initiativen unbedingt prüfen. Adversarial Risk Dieser Bereich umfasst sowohl Wettbewerber als auch Angreifer und konzentriert sich nicht nur auf die Angriffs-, sondern auch auf die Unternehmenslandschaft. In diesen Bereich fällt beispielsweise, zu verstehen, wie die Konkurrenz KI einsetzt, um bessere Geschäftsergebnisse zu erzielen und die internen Prozesse und Richtlinien (beispielsweise Incident-Response-Pläne ) zu aktualisieren, um für Cyberangriffe und Sicherheitsvorfälle im Zusammenhang mit generativer KI gewappnet zu sein. Threat Modeling Die Bedrohungsmodellierung gewinnt im Zuge des von zahlreichen Security-Institutionen propagierten “Secure-by-Design”-Ansatzes zunehmend an Bedeutung. In diesen Bereich fallen etwa die Überlegungen, wie Angreifer LLMs und generative KI für schnellere Exploits nutzen können, wie Unternehmen schadhafte KI-Nutzung erkennen können und wie sich die Technologie über interne Systeme und Umgebungen absichern lässt. KI-Bestandsaufnahme “Man kann nichts schützen, von dessen Existenz man nichts weiß” greift auch in der Generative-AI-Welt. Im Bereich der KI-Bestandsaufnahme geht es darum, Assets für intern entwickelte Lösungen und externe Tools und Plattformen zu erfassen. Dabei ist nicht nur wichtig, die Tools und Services zu kennen, die genutzt werden, sondern auch über die Verantwortlichkeiten Bescheid zu wissen. OWASP empfiehlt zudem, KI-Komponenten in SBOMs zu erfassen und Datenquellen nach Sensibilität zu katalogisieren. Darüber hinaus sollte es auch einen Prozess geben, der gewährleistet, dass zukünftige Tools und Services aus dem unternehmerischen Inventar sicher ein- und ausgegliedert werden können. KI-Security- und -Datenschutz-Schulungen Der Mensch ist das schwächste Glied in der Sicherheitskette, heißt es oft. Das muss allerdings nicht so sein, vorausgesetzt, Unternehmen integrieren KI-Sicherheits- und Datenschutztrainings in ihre GenAI-Journey. Das beinhaltet beispielsweise, der Belegschaft ein Verständnis über aktuelle AI- und LLM-Initiativen zu vermitteln, genauso wie zur Technologie an sich und den wesentlichen Problemen im Bereich Security. Darüber hinaus ist in diesem Bereich eine Kultur unabdingbar, die von Trust und Transparenz geprägt ist. Das ist auch ein ganz wesentlicher Punkt, um “ Schatten-KI ” zu verhindern. Anderenfalls werden Plattformen heimlich genutzt und die Security untergraben. Business Cases für KI etablieren Ganz ähnlich wie zuvor bei der Cloud erstellen die meisten Unternehmen keine kohärenten, strategischen Geschäftsmodelle für den Einsatz neuer Technologien, auch nicht, wenn es um generative KI und LLMs geht. Sich von Hype und FOMO anstecken zu lassen, ist relativ schnell geschehen, ohne soliden Business Case riskieren Unternehmen aber nicht nur, schlechte Ergebnisse zu erzielen. Governance Ohne Governance ist es nahezu unmöglich, Rechenschaftspflicht und klare Zielsetzungen zu realisieren. In diesen Bereich der OWASP-Checkliste fällt beispielsweise, ein RACI -Diagramm zu erstellen, dass die KI-Initiativen eines Unternehmens dokumentiert, Verantwortlichkeiten zuweist und unternehmensweite Richtlinien und Prozesse etabliert. Rechtliches Die rechtlichen Auswirkungen von KI sollten keinesfalls unterschätzt werden, sie entwickeln sich rasant weiter und können Reputation und finanziellem Gefüge potenziell beträchtliche Schäden zufügen. In diesen Bereich können diverse Aspekte fallen, zum Beispiel: Produktgarantien im Zusammenhang mit KI, KI-EULAs oder Intellectual-Property-Risiken. Kurzum: Ziehen Sie Ihr Legal-Team oder entsprechende Experten hinzu, um die verschiedenen rechtsbezogenen Aktivitäten zu identifizieren, die für Ihr Unternehmen relevant sind. Regulatorisches Aufbauend auf den juristischen Diskussionen entwickeln sich auch die regulatorischen Vorschriften schnell weiter, ein Beispiel ist der AI Act der EU. Unternehmen sollten deshalb die für sie geltenden KI-Compliance-Anforderungen ermitteln. LLM-Lösungen nutzen oder implementieren Der Einsatz von LLM-Lösungen erfordert spezifische Risiko- und Kontrollüberlegungen. Die OWASP-Checkliste nennt in diesem Bereich unter anderem die Aspekte: Access Control umsetzen, KI-Trainings-Pipelines absichern, Daten-Workflows mappen und bestehende oder potenzielle Schwachstellen in LLMs und Lieferketten identifizieren. Darüber hinaus sind kontinuierliche Audits durch Dritte, Penetrationstests und auch Code-Reviews für Zulieferer empfehlenswert. Testing, Evaluierung, Verifizierung, Validierung (TEVV) Der TEVV-Prozess wird vom NIST in seinem AI Framework ausdrücklich empfohlen. Dieser beinhaltet: Continuous Testing, Evaluierungen, Verifizierungen und Validierungen sowie Kennzahlen zu Funktionalität, Sicherheit und Zuverlässigkeit von KI-Modellen. Und zwar über den gesamten Lebenszyklus von KI-Modellen hinweg. Modell- und Risikokarten Für den ethischen Einsatz von großen Sprachmodellen sieht die OWASP-Checkliste Modell- und Risiko-“Karten” vor. Diese können den Nutzern Verständnis über KI-Systeme vermitteln und so das Vertrauen in die Systeme stärken. Zudem ermöglichen sie, potenziell negative Begleiterscheinungen wie Bias oder Datenschutzprobleme offen zu thematisieren. Die Karten können Details zu KI-Modellen, Architektur, Trainingsmethoden und Performance-Metriken beinhalten. Ein weiterer Schwerpunkt liegt dabei auf Responsible AI und allen Fragen in Zusammenhang mit Fairness und Transparenz. Retrieval Augmented Generation Retrieval Augmented Generation (RAG) ist eine Möglichkeit, die Fähigkeiten von LLMs zu optimieren, wenn es darum geht, relevante Daten aus bestimmten Quellen abzurufen. Dazu gehört, vortrainierte Modelle zu optimieren und bestehende auf neuen Datensätzen erneut zu trainieren, um ihre Leistung zu optimieren. OWASP empfiehlt, RAG zu implementieren, um den Mehrwert und die Effektivität großer Sprachmodelle im Unternehmenseinsatz zu maximieren. KI-Red-Teaming Last, but not least empfehlen die OWASP-Experten auch, KI- Red-Teaming-Sessions abzuhalten. Dabei werden Angriffe auf KI-Systeme simuliert, um Schwachstellen zu identifizieren und existierende Kontroll- und Abwehrmaßnahmen zu validieren. OWASP betont dabei, dass Red Teaming für sich alleine keine umfassende Lösung respektive Methode darstellt, um Generative AI und LLMs abzusichern. Vielmehr sollte KI-Red-Teaming in einen umfassenderen Ansatz eingebettet werden. Essenziell ist dabei jedoch laut den Experten insbesondere, dass im Unternehmen Klarheit darüber herrscht, wie die Anforderungen für Red Teaming aussehen sollten. Ansonsten sind Verstöße gegen Richtlinien oder gar juristischer Ärger vorprogrammiert. (fm) Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.
OpenAI says ChatGPT ads are not rolling out globally for now

www.bleepingcomputer.com · 4 months ago

false
The rise of malicious repositories on GitHub

rushter.com · 4 months ago

Researchers have observed a growing number of malicious repositories on GitHub. These repositories often mimic legitimate projects, providing only Windows binaries and altered descriptions generated by artificial intelligence. Over one hundred such repositories have been identified, utilizing techniques to improve search visibility and sometimes involving account hijacking. While web browsers are increasingly blocking downloads of these files due to antivirus flags, users are urged to carefully verify repositories before downloading any software.
Google, Microsoft, Amazon, and Others Unite Under New Anti-Scam Pact

www.techrepublic.com · 4 months ago

false
Betterleaks, a new open-source secrets scanner to replace Gitleaks

www.bleepingcomputer.com · 4 months ago

A new open-source tool, Betterleaks, is available to scan for sensitive information like credentials and API keys in code repositories. This tool is designed to be an improved successor to Gitleaks, offering features like rule-defined validation using CEL and faster scanning through parallelized Git analysis. Betterleaks was developed by the original author of Gitleaks and aims to combine user-friendly features with support for automated tools, including those used for analyzing AI-generated code. The project uses an open-source license and is maintained by a team including contributors from Royal Bank of Canada, Red Hat, and Amazon.
GlassWorm V2 analysis: Part 2. Infrastructure rotation and GitHub injection

codeberg.org · 4 months ago

Git functionality includes a sparse checkout feature, allowing developers to selectively retrieve parts of a repository. Bundles enable the transfer of Git objects and are related to Git pack-objects. Signing commits uses a GnuPG binary and can be configured to allow pushes from branches. This process involves creating and managing bundle creation tokens for remote repositories.
We audited authorization in 30 AI agent frameworks — 93% rely on unscoped API keys

grantex.dev · 4 months ago

A recent audit of 30 popular AI agent projects revealed widespread security flaws related to authorization. Nearly all projects rely on unscoped API keys, lack per-agent identities, and provide no user consent or granular revocation mechanisms. This allows compromised agents broad access and makes it difficult to trace actions. Several real-world incidents, including exposed OpenClaw instances and Google Cloud API key misconfigurations, highlight the risks, which aligns with emerging OWASP Agentic Top 10 vulnerabilities. The report recommends implementing scoped tokens, per-agent identities, user consent, granular revocation, audit trails, and delegation control to address these critical security gaps.
Post AI Agent Hacked Amazon & McKinsey, I compiled a list of 5 situations where deploying agents can be catastrophic

nanonets.com · 4 months ago

AI agents offer great potential but pose significant risks when deployed without proper safeguards. A recent data breach at McKinsey resulted from an AI agent gaining access to sensitive data through a SQL injection. Businesses are rapidly adopting these agents, creating potential for damage like altered financial models and corrupted advice, driven by errors scaling rapidly due to inadequate human oversight and incomplete context. Careful assessment and infrastructure development are needed before widespread implementation to prevent data breaches and regulatory penalties.
Loblaw Data Breach Impacts Customer Information

www.securityweek.com · 4 months ago

Canadian retailer Loblaw has announced a data breach impacting customer information. The compromised data includes names, email addresses, and phone numbers, but passwords, health information, and credit card data were not affected. Loblaw states PC Financial was not impacted and the number of affected customers is currently unknown. No ransomware group has claimed responsibility for the breach.
CVE-2024-45163: Remote DoS in Mirai C2 – research writeup + what it led me to build

flowtriq.com · 4 months ago

NULL
Quick question for people running CrowdStrike, Zscaler, Netskope or similar in production.

www.crowdstrike.com · 4 months ago

false
Analysis of 1,808 MCP servers: 66% had security findings, 427 critical (tool poisoning, toxic data flows, code execution)

agentseal.org · 4 months ago

A large-scale scan of 1,808 Model Context Protocol servers found that 66 percent had at least one security finding, totaling 8,282 tool-level issues including 427 critical and 1,841 high severity findings. The most common risks were code execution capabilities and toxic cross-server data flows, with real-world examples including a malicious npm package used for email exfiltration, a JFrog-disclosed command injection tracked as CVE-2025-6514 that allowed remote code execution, and two Cursor bugs tracked as CVE-2025-54136 and CVE-2025-54135 that enabled silent remote shells and configuration poisoning. Observed attack patterns include invisible prompt injections embedded in tool descriptions, rug pulls where servers change behavior after approval, and a reported zero-click remote code execution from calendar events with a CVSS score of 10.0.
Microsoft releases Windows 11 OOB hotpatch to fix RRAS RCE flaw

www.bleepingcomputer.com · 4 months ago

There is an out of band hotpatch KB5084597 that Microsoft released to fix remote code execution vulnerabilities in the Windows Routing and Remote Access Service affecting Windows 11 Enterprise devices that receive hotpatch updates instead of regular Patch Tuesday cumulative updates. The update applies to Windows 11 versions 25H2 and 24H2 and to Windows 11 Enterprise LTSC 2024 and addresses CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111 which were also fixed in the March 10, 2026 Patch Tuesday updates. The hotpatch is cumulative, performs in memory patching to avoid reboot on mission critical systems, updates files on disk for the next restart, is offered only to devices enrolled in the hotpatch program and managed through Windows Autopatch, and was re released to ensure comprehensive coverage across affected scenarios.
OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration

thehackernews.com · 4 months ago

China's National Computer Network Emergency Response Technical Team warned that OpenClaw, an open source self hosted autonomous AI agent formerly called Clawdbot and Moltbot, has inherently weak default security and elevated system privileges that could allow attackers to seize control of endpoints. Adversaries can perform prompt injection attacks, including indirect or cross domain prompt injection, to make the agent disclose sensitive data or run manipulated instructions, and researchers showed that link preview features in messaging apps can be abused to exfiltrate data automatically. CNCERT also highlighted risks that the agent may irreversibly delete data, that malicious skills uploaded to repositories can execute arbitrary commands or deploy malware, and that recently disclosed vulnerabilities could be exploited, and it recommended isolating the service, blocking exposure of management ports, avoiding plaintext credentials, restricting skill sources, disabling automatic skill updates, and keeping the agent updated.
Upcoming Speaking Engagements

www.schneier.com · 4 months ago

false
AppsFlyer Web SDK hijacked to spread crypto-stealing JavaScript code

www.bleepingcomputer.com · 4 months ago

The AppsFlyer Web SDK was temporarily hijacked and delivered obfuscated malicious JavaScript that targeted cryptocurrency transfers. The payload monitored pages for wallet input, replaced detected Bitcoin, Ethereum, Solana, Ripple, and TRON addresses with attacker controlled addresses, and exfiltrated the original addresses and metadata. The exposure window is estimated between March 9, 2026 at 22:45 UTC and March 11, 2026, and AppsFlyer reported a domain registrar incident on March 10, 2026 that allowed unauthorized code to reach a segment of customer websites before the issue was contained. Organizations using the web SDK, which AppsFlyer says is deployed by about 15,000 businesses across more than 100,000 applications, are advised to review telemetry for requests from websdk.appsflyer.com, downgrade to known good SDK versions, and investigate possible compromise.
GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers

thehackernews.com · 4 months ago

There is a new iteration of the GlassWorm supply chain campaign that represents a significant escalation in how it propagates through the Open VSX registry. There are at least 72 malicious Open VSX extensions discovered since January 31, 2026 that target developers by mimicking linters, formatters, code runners and AI coding assistant tools and by abusing extensionPack and extensionDependencies to turn benign appearing extensions into transitive delivery vehicles that install GlassWorm linked packages after trust has been established. The campaign hides loaders using invisible Unicode characters, uses Solana transactions as a dead drop resolver for command and control, rotates Solana wallets and increases obfuscation to evade detection, and related injections affected over 151 GitHub repositories and multiple npm packages in early March 2026. Separately, a mass npm campaign uploaded 88 malicious packages between November 2025 and February 2026 that abused remote URL dependencies to change payloads on the fly and harvest environment variables, CI CD tokens and system metadata before some payloads were later replaced with innocuous code on March 12, 2026.
scans2any: Convert and merge infrastructure scan results (Nmap, Nessus, Masscan) into Markdown, HTML, CSV and more

www.softscheck.com · 4 months ago

A major new release of scans2any, version 1.0, was released on March 5, 2026 and introduces persistent project databases, a unified column filter, a redesigned terminal interface, custom columns with trusted fields, and broad performance improvements. Persistent SQLite project databases let parsed scans be saved and reloaded in milliseconds to speed iterative workflows, while the new column filter replaces previous host and service filters and supports regular expression matching, negation, chaining, a value mode to trim multi value fields, and a host mode to preserve whole hosts when any service matches. Under the hood the core engine was rewritten for smarter host merging, adaptive multi process parsing to bypass the Python global interpreter lock, faster startup by loading heavy libraries only when needed, a test suite that runs about twenty times faster, and Pydantic based data models, and the removal of the old filters is listed as a breaking change.
Critical HPE AOS-CX Vulnerability Allows Admin Password Resets

www.securityweek.com · 4 months ago

Hewlett Packard Enterprise released patches for a critical vulnerability in Aruba Networking AOS CX that can be exploited remotely without authentication to reset administrator passwords. The flaw is tracked as CVE-2026-23813 with a CVSS score of 9.8 and affects the web based management interface of CX 4100i, CX 6000, CX 6100, CX 6200, CX 6300, CX 6400, CX 8320, CX 8325, CX 8360, CX 9300 and CX 10000 series switches. HPE issued AOS CX software updates version 10.17.1001, 10.16.1030, 10.13.1161 and 10.10.1180 to address CVE-2026-23813 and three additional high severity vulnerabilities tracked as CVE-2026-23814, CVE-2026-23815 and CVE-2026-23816 that could allow authenticated remote command injection, and a medium severity flaw that could redirect users to arbitrary URLs. Organizations are advised to apply updates promptly, restrict access to management interfaces, disable HTTP and HTTPS on switched virtual interfaces and routed ports, enforce access control lists and enable logging and monitoring.
Looking for an arXiv cs.CR endorser

arxiv.org · 4 months ago

false
GlassWorm Spreads via 72 Malicious Open VSX Extensions Hidden in Transitive Dependencies

gbhackers.com · 4 months ago

The GlassWorm campaign now uses transitive dependencies in Open VSX and VS Code compatible editors to deliver malware by publishing clean extensions that later add malicious extensionDependencies or extensionPack entries, allowing infected extensions to be pulled in after initial trust is established. Researchers found at least 72 malicious Open VSX extensions identified since January 31, 2026, and observed packages that quietly pulled in known malicious extensions in later versions, showing that a one time review is no longer sufficient. Operators target developer workstations to steal local credentials, tokens, configuration data and environment secrets, and have enhanced evasion through infrastructure rotation, use of Solana transaction memos and wallets as dead drops, geofencing, and heavier obfuscation with external decryption keys retrieved from HTTP headers. Recommended mitigations include auditing extension version histories and install chains for newly introduced dependencies, monitoring for staged loaders and known GlassWorm indicators, securing developer endpoints for exposed tokens, and using automated scanners to block suspicious dependency additions.
Global Authorities Take Down 45,000 Malicious IPs Used in Ransomware Campaigns

gbhackers.com · 4 months ago

Operation Synergia III ran from July 18, 2025 to January 31, 2026 and was coordinated by INTERPOL with support from private cybersecurity firms including Group-IB, Trend Micro, and S2W. Law enforcement across 72 countries disrupted more than 45,000 malicious IP addresses and servers used in phishing, malware, and ransomware campaigns. Raids resulted in 94 arrests, 110 suspects under active investigation, and the seizure of 212 electronic devices and servers, while regional actions dismantled over 33,000 phishing and fraudulent websites and multiple fraud rings. The coordinated action converted shared intelligence into tactical raids and underscores how international public private cooperation can cripple cybercriminal infrastructure and protect digital systems worldwide.
TikTok Investors Set to Pay $10 Billion Fee to Trump Administration

www.nytimes.com · 4 months ago

false
TikTok Investors Set to Pay $10 Billion Fee to Trump Administration

www.nytimes.com · 4 months ago

false
I Found 39 Algolia Admin Keys Exposed Across Open Source Documentation Sites

benzimmermann.dev · 4 months ago

There are 39 exposed Algolia admin API keys discovered across open source documentation sites. Most were found by scraping roughly 15,000 deployed documentation sites and by searching git histories, with 35 of the 39 discovered in frontend code and every key active at the time of discovery, and affected projects include Home Assistant, KEDA, and vcluster. These admin keys grant search plus full write and administrative permissions such as addObject, deleteObject, deleteIndex, editSettings, listIndexes, and browse, enabling attackers to modify or delete indexed content, export or dump data, or poison search results to redirect users to malicious pages. Remediation has been uneven with some vendors rotating or revoking keys and others still active, and the root cause is sites embedding write or admin keys in frontends instead of using search only keys, so the recommended fix is to verify frontend configs use search only keys and rotate any exposed credentials.
Technical challenge: Can a blockchain-published account be traced to its IP? (20,000 QORT bounty)

qortal.dev · 4 months ago

There is a 20,000 QORT bounty offered for a reproducible method to identify the IP address behind a specific publishing account on the Qortal network. The target is an account named Who Am I that is publishing on the Qortal Data Network from a local node that is not using a VPN or anonymity service. Participants must use only publicly observable network data to demonstrate a consistent and repeatable tracing method that reveals the publishing node IP address, with the bounty awarded if the method works reliably. A successful trace would indicate a vulnerability in the decentralized data network that would need to be addressed.
Microsoft: Windows 11 users can't access C: drive on some Samsung PCs

www.bleepingcomputer.com · 4 months ago

There is an issue affecting some Samsung laptops running Windows 11 that appeared after installing the February 2026 security updates, in which users lose access to their C drive and cannot launch applications. Microsoft is investigating the problem and working on a resolution for impacted devices.
Phishing campaign abusing Google Cloud Storage redirectors to multiple scam pages

malwr-analysis.com · 4 months ago

There is an ongoing phishing campaign that abuses Google Cloud Storage as a redirect layer to send victims to numerous scam sites hosted primarily on the autos top level domain. The campaign uses a single Google Cloud Storage page as a central traffic distribution hub that rotates victims across themes including fake Walmart surveys, Dell laptop giveaways, Netflix reward scams, antivirus renewal alerts, cloud storage full warnings, and fake job offers. Attackers reuse the same domains and a shared phishing kit or centralized backend to present multiple scam themes and quickly change destinations while keeping the initial delivery link stable. High volumes of phishing emails were observed, with around forty to fifty messages within a 24 hour period containing links to the redirector infrastructure and multiple phishing domains serving as indicators of compromise.
Friday Squid Blogging: Increased Squid Population in the Falklands

www.schneier.com · 4 months ago

false
FBI seeks victims of Steam games used to spread malware

www.bleepingcomputer.com · 4 months ago

The FBI's Seattle Division is asking gamers who installed any of eight malicious Steam titles between May 2024 and January 2026 to come forward. The identified games include BlockBlasters, Chemia, Dashverse also known as DashFPS, Lampy, Lunara, PirateFi, and Tokenova, and investigators say the titles delivered information stealer and cryptodrainer malware such as HijackLoader, Vidar, and a custom Fickle Stealer that led to account hijacks and cryptocurrency theft, with reports including a streamer losing more than thirty two thousand dollars and blockchain analysis estimating roughly one hundred fifty thousand dollars stolen from hundreds of accounts. The FBI requests affected users or anyone with relevant information to complete its questionnaire or to contact the agency by email at [email protected] and says victims may be eligible for services and restitution and that identities will be kept confidential.
Google warns of two actively exploited Chrome zero days

www.csoonline.com · 4 months ago

Two high severity zero day vulnerabilities in Chrome, CVE-2026-3909 and CVE-2026-3910, are being actively exploited and Google has issued emergency patches. CVE-2026-3910 allows remote code execution inside Chrome's V8 JavaScript and WebAssembly engine via a crafted HTML page. CVE-2026-3909 enables out of bounds memory access through an out of bounds write in the Skia graphics library and affects browsers before version 146.0.7680.75. Organizations are urged to update all Chromium and Chromium based browsers immediately, enable automatic updates, monitor for outdated versions, consider browser isolation, and note that Google is withholding technical details until most users are patched.
Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos

www.darkreading.com · 4 months ago

There are fake proof of concept exploits and misleading demonstrations circulating in the wake of Cisco Catalyst SD-WAN vulnerabilities, creating opportunities for fraud and confusing defenders. A maximum severity authentication bypass in Cisco Catalyst SD-WAN Controller tracked as CVE-2026-20127 and an older local privilege escalation tracked as CVE-2022-20775 have been exploited in the wild and prompted emergency guidance and a multinational threat hunting guide. Security teams are advised to avoid running untrusted PoCs, test exploits in isolated environments, apply vendor patches immediately, and hunt for indicators such as rogue peers, version downgrades, unexpected reboots, and unauthorized local accounts.
Adobe Settles With U.S. Over Hard-to-Cancel Subscriptions

www.nytimes.com · 4 months ago

false
Critical Chrome Security Flaws Threaten Billions of Users Worldwide

www.techrepublic.com · 4 months ago

There are two high severity zero day vulnerabilities in Google Chrome that are being actively exploited, affecting the Skia graphics library and the V8 JavaScript engine and potentially allowing attackers to crash browsers or execute malicious code. The flaws are tracked as CVE-2026-3909, an out of bounds write in Skia that can cause memory corruption, and CVE-2026-3910, an inappropriate implementation issue in V8 that can lead to memory errors or attacker controlled code execution. Because Chrome is used by roughly 3.8 billion people worldwide, these actively exploited flaws could put billions of systems at risk until patches are applied. Google has released patches while limiting technical details, and users and organizations are urged to update Chrome, verify deployments, and apply mitigations such as browser isolation, endpoint monitoring, least privilege, and extension control to reduce exposure.
Coding After Coders: The End of Computer Programming as We Know It

www.nytimes.com · 4 months ago

Silicon Valley programmers are increasingly using AI agents and a practice called vibe coding, supplying high level goals to models like Claude and ChatGPT instead of hand writing most code. Engineers are spending more time orchestrating agent workflows, designing prompts, debugging outputs, and configuring tools than writing line by line implementations. Some workers and critics report strange new work patterns and feelings of uselessness or sadness, while others warn that AI generated code can be error prone and raise maintenance and security risks. The shift is reshaping job roles and hiring, particularly for entry level programming positions, and raising questions about how software work and career paths will evolve.
OSS Cartography can now map AI agents to cloud attack paths

cartography.dev · 4 months ago

Cartography can now automatically discover AI agents inside container images by using Cisco AIBOM to detect frameworks such as pydanticai, langchain, and openai and to extract declared tools, models, memory, embeddings, and prompts. Detected components become AIBOMComponent and AIAgent nodes that are joined by manifest digest to ECR images so the graph can trace from an agent through ECS containers and tasks to IAM roles, network interfaces, load balancers, and DNS records to determine internet exposure and permissions. This enables queries that return which agents are reachable from the internet, their DNS names, IAM roles, tools and models, and supports security rules and governance alerts to flag agents that violate policies.
The Data Gap: Why Nonprofit Cyber Incidents Go Underreported

www.darkreading.com · 4 months ago

Nonprofits face rising cyberattacks but the true scale is obscured because reporting requirements are inconsistent and incident data are scattered and incomplete. In March 2025 advanced email attacks against nonprofits grew by 35 percent year over year and phishing targeting nonprofits increased by 50 percent, while an identity and access management vendor found nonprofits to be the second most targeted industry across its customers. Incidents are often recorded as collateral damage from third party breaches, which deepens the underreporting problem and makes it harder for organizations to justify additional support. Experts say nonprofits need more than funding; they require education, training, dedicated time, and to be treated like businesses with immediate support rather than waiting for perfect data.
Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware

thehackernews.com · 4 months ago

There is a suspected China-based cyber espionage operation targeting Southeast Asian military organizations that dates back to at least 2020 and is tracked by Palo Alto Networks Unit 42 as CL-STA-1087. The campaign shows hallmarks of an advanced persistent threat, demonstrating strategic operational patience and a focus on harvesting specific intelligence such as military organizational structures and C4I capabilities rather than bulk data theft. Observed tools include two backdoors called AppleChris and MemFun and a credential harvester named Getpass, with both backdoors using Pastebin as a dead drop resolver and AppleChris sometimes using Dropbox as a fallback to retrieve command and control addresses. Initial intrusion methods remain unknown but the actors used suspicious PowerShell with long sleep timers, DLL hijacking, process hollowing, in-memory loaders, and a custom Mimikatz variant to escalate privileges and extract credentials enabling modular payload delivery and prolonged access.
U.S. Tech Giants Flocked to the Persian Gulf. Now They Are Targets.

www.nytimes.com · 4 months ago

NULL
Alipay (1B+ users) DeepLink vulnerability allows silent GPS extraction via URL - 6 regulators now investigating, vendor says normal functionality

packetstorm.news · 4 months ago

There are seventeen vulnerabilities in the Alipay mobile app that allow a single crafted URL to silently exfiltrate precise GPS coordinates via a DeepLink to WebView to JSBridge chain, achieving roughly eight point eight meter accuracy in about seven seconds without prompting the user. The attack flow exploits a trusted domain open redirect to trigger the alipays scheme deep link, which opens a privileged WebView and invokes AlipayJSBridge.call getLocation to return location silently, while iOS exposes five additional APIs including tradePay that broaden the impact. Six CVEs were submitted to MITRE CNA-LR with CVSS scores reported between 7.4 and 9.3, testing captured three hundred eight server side GPS logs across three devices in three countries including the vendor security lead's location, and the vendor characterized the behavior as normal functionality then issued a takedown complaint.
Microsoft Authenticator Flaw on Android, iOS Could Leak Login Codes for Millions

www.techrepublic.com · 4 months ago

A vulnerability in Microsoft Authenticator for Android and iOS can allow a malicious app installed on the same device to intercept one time login codes and sign in links by mishandling deep links, potentially enabling attackers to complete logins and access emails and files tied to compromised accounts. The flaw is tracked as CVE-2026-26123 and requires the victim to install and then select a malicious application to handle an authentication deep link. A patch has been released and users are urged to update via the Apple App Store or Google Play Store, and Microsoft plans additional protections that will restrict the app on jailbroken or rooted phones with a staged rollout that began on Android in late February 2026 and is scheduled to start on iOS in April 2026.
Cyberattackers Don't Care About Good Causes

www.darkreading.com · 4 months ago

Nonprofit organizations are being heavily targeted by threat actors because they hold sensitive data but often operate with weak security due to limited funding and a shortage of skilled personnel. Experts say the sector should be treated as critical infrastructure and needs better incident reporting, appropriate technologies, training, and sustained attention, though many nonprofits lack the resources to implement these defenses. Panelists warn that donating free tools or applying one size fits all security can be harmful when nonprofits lack staff to configure and monitor solutions, and that adopting AI tools without assessing data use and operational capacity can introduce new risks. They recommend tailored engagement that prioritizes mission needs, practical basics such as log monitoring and risk based decisions, and partnerships with companies that understand nonprofit constraints.
RegPwn - Windows LPE vulnerability (now fixed)

www.mdsec.co.uk · 4 months ago

There is an Elevation of Privilege vulnerability named RegPwn affecting Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, 2022, and 2025 that was fixed on Patch Tuesday and is tracked as CVE-2026-24291. The issue arises because Windows Accessibility features create per user ATConfig registry entries that are copied by system processes into system registry locations, allowing a low privilege user to influence data copied into HKLM and HKU dot DEFAULT. An exploit wins a short race window by placing an opportunistic lock on a shared system file, replacing the target ATConfig key with a registry symbolic link to achieve an arbitrary registry write as SYSTEM, allowing overwriting of a service ImagePath to escalate to SYSTEM, and a proof of concept is publicly available.
Poland's nuclear research centre targeted by cyberattack

www.bleepingcomputer.com · 4 months ago

Poland's National Centre for Nuclear Research reported that hackers targeted its IT infrastructure but detection and blocking prevented any impact. Built in security systems and internal procedures allowed a rapid response that secured targeted systems and ensured the MARIA research reactor remained uncompromised and operating safely at full power. The institute notified authorities and opened an investigation, and although no attribution was made, outside reporting noted indicators that Iran may be behind the attack while investigators cautioned these could be false flags.
Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026

thehackernews.com · 4 months ago

Meta will discontinue support for end to end encryption for chats on Instagram after May 8, 2026. Users with impacted chats will be shown instructions to download any media or messages they want to keep and may need to update older versions of the Instagram app to do so. The feature was first tested in 2021 and is currently available only in some areas, and the change follows reports that Meta moved forward with encrypted messaging despite internal warnings in 2019 that it could hinder detection of illegal content.
Microsoft investigates classic Outlook sync and connection issues

www.bleepingcomputer.com · 4 months ago

false