Blahalla

SolarWinds Serv-U Vulnerability Exploited in the Wild

www.securityweek.com · 4 months ago

CISA added the SolarWinds Serv-U vulnerability, CVE-2026-28318, to its Known Exploited Vulnerabilities catalog following reports of unauthenticated attacks. These flaws exploit a Denial-of-Service issue using crafted POST requests, crashing the core service. Organizations must install the vendor hotfix immediately, especially those running End-of-Life versions like 15.4.2.

UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign

thehackernews.com · 4 months ago

Cybersecurity researchers have disclosed details of a financially motivated data theft extortion campaign that has targeted dozens of organizations across professional, legal, and financial services in the U.S. between January and May 2026. The activity has been attributed by Google Mandiant and Google Threat Intelligence Group (GTIG) to a threat actor dubbed UNC3753, which is also known as

Ukraine’s foreign minister offer recipe for improved resilience

www.csoonline.com · 4 months ago

Dmytro Kuleba, former Ukrainian Foreign Minister, taught that resilience hinges on pre-planning following the Russian invasion. He cited KyivStar restoring its network after a cyberattack in December 2023 due to preparedness. Kuleba advised global technologists, stressing that proactive contingency planning remains vital even when facing unexpected crises.

Critical UniFi OS RCE Chain Grants Root Access Without Credentials

gbhackers.com · 4 months ago

A critical vulnerability chain in UniFi OS Server allows unauthenticated remote code execution leading to full root takeover. This exploit combines an authentication-gateway bypass and a path-traversal mismatch, along with command injection issues within the package-update service. Attackers can send one crafted HTTP request to gain root access via the admin interface without needing credentials.

Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse

www.securityweek.com · 4 months ago

Meta reported that hackers compromised about 20,000 Instagram accounts by exploiting a vulnerability in its account recovery support tool. This flaw allowed attackers to reset passwords using an unassociated email address without proper verification. The social media giant disabled the tool and informed authorities about the breach impacting high-profile targets like the Obama White House.

VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks

thehackernews.com · 4 months ago

Microsoft added a two-hour delay when updating VS Code extensions automatically. This measure aims to strengthen protection against software supply chain threats. The feature adds an extra layer of defense upon publishing newer versions.

Over 20,000 Instagram accounts stolen in Meta AI support hack

www.bleepingcomputer.com · 4 months ago

Hackers gained access to 20k+ Instagram accounts via a flaw in Meta's High Touch Support AI. Attackers reset passwords without MFA or email verification. Meta disabled HTS; users beware of stolen DMs/data.

EDRChoker Tool Abuses Windows QoS Policies to Disrupt Endpoint Security Tools

gbhackers.com · 4 months ago

A newly disclosed red-team tool dubbed “EDRChoker” is drawing attention across the cybersecurity community for its novel approach to disrupting Endpoint Detection and Response (EDR) visibility by abusing Windows Policy-based Quality of Service (quality of service). Unlike traditional EDR evasion techniques that rely on firewall manipulation or Windows Filtering Platform (WFP) rule injection, EDRCh

Microsoft Warns Claude Code GitHub Action May Expose CI/CD Secrets

gbhackers.com · 4 months ago

Anthropic’s Claude Code GitHub Action could unintentionally expose CI/CD workflow secrets when AI agents process untrusted GitHub content. The risk arises because certain tools the agent uses to read files were not sandboxed like subprocess execution paths such as Bash. In particular, the Read tool was able to access /proc/self/environ and returned environment variables, including

Hackers Exploit Claude Code MCP Traffic to Hijack OAuth Authentication Tokens

gbhackers.com · 4 months ago

Threat researchers have uncovered a novel man-in-the-middle (MitM) attack chain targeting Anthropic’s Claude Code ecosystem, where adversaries hijack Model Context Protocol (MCP) traffic to steal OAuth authentication tokens and persist access to enterprise SaaS platforms. The technique, detailed by Mitiga, abuses weak protections around the local Claude Code configuration file (~/.claude.json), ef

Free Samsung and LG Smart TV Apps Reportedly Exploit Devices for AI Proxy Traffic

gbhackers.com · 4 months ago

Free apps available on Samsung, LG, Roku, and other connected TV (CTV) platforms are quietly enrolling users’ smart televisions into a commercial residential proxy network operated by Bright Data, according to a technical investigation published June 5, 2026, by Include Security researcher Buchodi. The embedded SDK, embedded inside partner apps under the guise of a

Hackers Exploit 2026 FIFA World Cup With Phishing and Ticket Scams

gbhackers.com · 4 months ago

Cybercriminals are already turning the 2026 FIFA World Cup into a fraud opportunity, using phishing pages, fake online stores, and ticket scams to steal money and personal data. The risk is rising because the tournament will attract huge global demand, fast purchases, and buyers who may act quickly before checking whether a site is real.

New ChatGPT Lockdown Mode Aims to Block Prompt Injection and Data Exfiltration Attacks

gbhackers.com · 4 months ago

OpenAI this week introduced Lockdown Mode, a security-focused setting for ChatGPT designed to reduce the risk of data exfiltration from prompt-injection attacks. The feature is rolling out to eligible personal accounts (Free, Go, Plus, Pro) and self-serve ChatGPT Business workspaces, and managed-workspace administrators can assign a Lockdown Mode role to members. Prompt injection is a

Hands on with Intelligent Terminal, an AI-powered Windows Terminal

www.bleepingcomputer.com · 4 months ago

Microsoft has created an open-source fork of Windows Terminal called "Intelligent Terminal," and it allows you to use AI directly inside Terminal without interfering with the regular session.

Top 10 Best Software Composition Analysis (SCA) Tools for Security Teams in 2026

gbhackers.com · 4 months ago

The complexity of modern software development requires security to be deeply embedded within the engineering pipeline rather than treated as an afterthought. With modern applications consisting of over 80% open-source components, the attack surface has shifted drastically. Whether you are managing extensive codebases or integrating third-party APIs, catching flaws before code is compiled is crucia

C0XMO botnet spreads via DD-WRT router flaw, kills rival malware

www.bleepingcomputer.com · 4 months ago

A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures.

Silent Ransom Group targets law firms with fake IT support calls

www.bleepingcomputer.com · 4 months ago

The Silent Ransom Group extortion gang is actively targeting U.S. law firms and professional services organizations in social engineering attacks that often lead to data theft within hours of initial contact, according to a new report by cybersecurity firm Mandiant.

Emphere Raises $2.1 Million for AI-Powered Vulnerability Remediation

www.securityweek.com · 4 months ago

Emphere’s solution delivers AI-driven remediation to software companies to speed up releases.

EDRChoker: Choking The Telemetry Stream to Bypass Defenses

www.zerosalarium.com · 4 months ago

EDRChoker uses Policy-based Quality of Service (QoS) to set hard bandwidth caps (throttling) on Endpoint Detection and Response (EDR) agents, causing them to always time out - effectively blocking them.

PSA: Attack Shark R85 HE (FREEWOLF US / Amazon) — BadUSB credential harvester, confirmed malware

www.amazon.com · 4 months ago

TL;DR: Bought an Attack Shark R85 HE from FREEWOLF US on Amazon. Plugged it in. It immediately ran a BadUSB credential-harvesting attack, opened login pages, ran PowerShell recon, targeted my password manager, and downloaded confirmed malware. Windows Defender detected two threats, both requiring manual removal. Two days of incident response. Amazon called it a defective return. It wasn't defectiv

CVE-2026-46640: Developing payloads for Twig sandbox bypass

gist.github.com · 4 months ago

I recently learned about multiple sandbox bypasses discovered in Twig by project Glasswing. From the descriptions, only CVE-2026-46640 and CVE-2026-46633 seemed universally exploitable, so I decoded to research them. This writeup documents my development of payloads for the CVE-2026-46640 and the corresponding SSTImap module.

Critical Everest Forms Pro flaw exploited to take over WordPress sites

www.bleepingcomputer.com · 4 months ago

Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro plugin, which lets them take complete control of a WordPress website.

New ChatGPT Lockdown Mode Limits Tools That Could Enable Data Exfiltration

thehackernews.com · 4 months ago

OpenAI has begun rolling out a new Lockdown Mode to ChatGPT for eligible personal accounts to reduce the risk of data exfiltration arising from prompt injection attacks. The feature is primarily designed for people and organizations that handle sensitive data and require stricter protection guarantees. Lockdown Mode is available to logged-in users across Free, Go, Plus, and Pro, and

China-Linked Espionage Cluster Deploys Custom ASPX/ASHX Shells on IIS

gbhackers.com · 4 months ago

OP-512, a China-linked espionage cluster, targets end-of-life Windows Server 2016/NET Framework 4.0 via custom web shells on IIS. They use specialized handlers with variable randomization for persistence and evade detection using Base64 decoding, RC4 decryption, and RSA signature verification.

Critical UniFi OS Auth Bypass Flaws Lead to Unauthenticated Root RCE

gbhackers.com · 4 months ago

UniFi OS Server faces RCE via three flaws: CVE-2026-34908/34909 (Nginx auth bypass) and CVE-2026-34910 (package update command injection). The chain allows unauthenticated root code execution.

Opal Security Raises $23 Million for AI-Native Identity Governance

www.securityweek.com · 4 months ago

Identity governance startup Opal Security announced raising $23 million in new funding, bringing its total investment to $59 million. The company developed an AI-native platform providing real-time policy enforcement for human, service, and AI agents. Additionally, Opal appointed five senior leaders across product and engineering divisions to support expansion.

CISA Alerts on Actively Exploited SolarWinds Serv-U Denial-of-Service Flaw

gbhackers.com · 4 months ago

CISA added SolarWinds Serv-U vulnerability CVE-2026-28318 due to active exploitation. Unauthenticated attackers can use malicious POST requests to crash the file transfer service (DoS). Apply SolarWinds 15.5.4 Hotfix 1 immediately and restrict network access.

Malspam Campaign Abuses DoubleClick to Deploy Stealthy .NET Loader

gbhackers.com · 4 months ago

Huntress found malspam bypassing gateways via DoubleClick infrastructure. The attack uses personalized lures in HTML attachments, executing JScript, PowerShell, and a.NET loader to patch AMSI and silence ETW.

UNC3753 Targets US Law Firms with Vishing, RMM Tools, and Physical Break-Ins

gbhackers.com · 4 months ago

UNC3753 (Silent Ransom Group) hit U.S. professional services using voice phishing, RMM abuse, and physical intrusions to steal client data from iManage. They issue extortion demands within three days of harvesting sensitive info.

People Love to Hate This Fake Private Equity Guy

www.nytimes.com · 4 months ago

Johnny Hilbrant Partridge has found social media fame as PE Guy, a character who embodies obnoxious entitlement.

Americans hate rising prices. AI is making it worse.

www.washingtonpost.com · 4 months ago

Massive investments in artificial intelligence compel tech companies to spend hundreds of billions developing technology and building compute hubs. Some Federal Reserve officials and Wall Street assessors suggest that this tremendous spending pushes up inflation across the United States. This industry activity likely raises costs for consumers on various goods and services.

Free Apps Are Quietly Turning Smart TVs Into Web-Scraping Proxies for AI

thehackernews.com · 4 months ago

A researcher reverse-engineered Bright Data's embedded iOS SDK, documenting how it repurposes consumer devices into exit nodes. The mechanism allows the company to relay web-scraping traffic using smart TVs and similar always-on hardware. These assets support a data business that Bright Data heavily markets to the AI industry.

CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog

thehackernews.com · 4 months ago

CISA added a high-severity vulnerability in SolarWinds Serv-U multi-protocol file server software to its Known Exploited Vulnerabilities catalog. The agency cited evidence of active exploitation for the flaw. This issue, tracked as CVE-2026-28318 with a CVSS score of 7.5, functions as a denial-of-service bug that causes the service to crash.

AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs

thehackernews.com · 4 months ago

A security startup reported 21 previously unknown vulnerabilities in FFmpeg, leveraging an autonomous AI agent to find the zero-days. Concurrently, Google shipped Chrome 149 with patches for 429 security bugs, setting a record for fixes in one release. This pair of events underscores new methods and volumes of vulnerability discovery across critical media libraries and web browsers.

Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack

thehackernews.com · 4 months ago

The Miasma self-replicating supply chain attack impacted Microsoft's GitHub repositories. The threat compromised 73 repositories spread across four organizational groups, including Azure and MicrosoftDocs. Following the incident, GitHub initiated measures to disable access to the vulnerable codebases.

Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available

thehackernews.com · 4 months ago

Cisco warned that groups are actively exploiting a high-severity flaw in Catalyst SD-WAN Manager. The vulnerability receives the identifier CVE-2026-20245, which holds a CVSS score of 7.8 out of 10. The flaw affects several deployments, including On-Prem and Cisco SD-WAN Cloud-Pro.

SpaceX Has $30 Billion Deal to Provide Google With A.I. Computing Power

www.nytimes.com · 4 months ago

SpaceX revealed Google will pay the rocket company $920 million monthly for computing power through June 2029, supporting its major IPO preparation. This agreement allows Google access to Nvidia chips, helping it meet demand for services like Gemini Enterprise. Additionally, SpaceX signed a separate deal with Anthropic, reportedly earning $1.25 billion per month from the AI lab.

Suspicious Polyfill login prompts pop up on Toshiba, Muji websites

www.bleepingcomputer.com · 4 months ago

Toshiba and Muji warned users about suspicious sign-in prompts on their websites that could collect credentials. The issue came from the external service polyfill.io, which started sending malicious HTTP 401 authentication requests in late May 2026. Browsers interpret these persistent requests as required logins, displaying deceptive pop-ups despite warnings and mitigation efforts.

AI Upgrades, Security Flaws, and SpaceX’s Record IPO Define the Week in Tech

www.techrepublic.com · 4 months ago

See what you missed in Daily Tech Insider from June 1, 5.

Cisco Warns Agentic AI Will Put New Pressure on Enterprise Networks

www.techrepublic.com · 4 months ago

Cisco executives said agentic AI could triple network traffic, creating new infrastructure and security demands for enterprises.

CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers

www.bleepingcomputer.com · 4 months ago

CISA warned today that hackers are now actively exploiting a recently patched high-severity SolarWinds Serv-U flaw to crash servers.

Exposed Fuel Tank Gauges Under Attack in the US

www.darkreading.com · 4 months ago

Threat actors are taking advantage of Internet-exposed tank gauges by breaching gas stations, opening the door to disruption.

Reid Hoffman to Leave Microsoft’s Board of Directors

www.nytimes.com · 4 months ago

The LinkedIn co-founder was a key bridge to Microsoft’s relationship with OpenAI, but he also came with some baggage.

Chinese APT deploys new malware to keep access to hacked networks

www.bleepingcomputer.com · 4 months ago

A Chinese espionage group tracked as UNC5221 has been accessing Microsoft 365 environments using the Brickstorm backdoor and previously undocumented malware named Plenet and AgentPSD.

IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks

thehackernews.com · 4 months ago

Multiple software supply chain attacks have hit the npm ecosystem, with threat actors using both malicious and poisoned versions of over 50 legitimate packages to distribute a Rust-based information stealer and a self-spreading worm, respectively. According to JFrog, the information stealer "scrapes every secret it can find on a developer's machine, hides behind an eBPF kernel rootkit, and

Malicious Hugging Face Models Could Trigger Remote Code Execution

www.techrepublic.com · 4 months ago

A flaw in Hugging Face Transformers could allow malicious AI models to execute code, exposing credentials and highlighting AI supply chain risks.

Dark web Nemesis Market vendor gets 26 years for selling drugs

www.bleepingcomputer.com · 4 months ago

A California man was sentenced to more than 26 years in federal prison for trafficking fentanyl and methamphetamine through Nemesis Market, one of the world's largest dark web marketplaces.

Chinese Spies Using LinkedIn, Job Sites to Recruit Western Workers

www.techrepublic.com · 4 months ago

Five Eyes agencies warn that fake online recruiters linked to Chinese intelligence are targeting workers for sensitive policy and defense information.

Microsoft identifies seven new ways AI agents can be hacked

www.csoonline.com · 4 months ago

Microsoft has identified seven new failure modes in agentic AI systems, in addition to those it identified last year in its first Taxonomy of Failure Modes in Agentic AI Systems. Four things contributed to the growing list of ways agentic AI can go wrong: the speed at which the technology went mainstream, the growing maturity of the Model Context Protocol (MCP) ecosystem, the rise of computer-use

Got a LinkedIn message from a recruiter? It might be Chinese intelligence, warn FBI and MI5

www.bitdefender.com · 4 months ago

If you've ever received an out-of-the-blue message via LinkedIn from a recruiter offering some well-paid consultancy work, intelligence agencies have a message for you: be very careful. Read more in my article on the Hot for Security blog.