Blahalla

Cisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service Vulnerability

sec.cloudapps.cisco.com · 4 months ago

A vulnerability exists in the Cisco IOS XR Software's IS-IS multi-instance routing feature, potentially allowing an unauthenticated attacker to cause a denial-of-service by restarting the IS-IS process. This occurs due to insufficient input validation of network packets. Affected devices experience temporary loss of connectivity, and Cisco recommends upgrading to a fixed software release to resolve the issue. Configuration of IS-IS area authentication is suggested as a mitigation, but not a replacement for software upgrades.

Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities

sec.cloudapps.cisco.com · 4 months ago

Vulnerabilities have been identified in several Cisco contact center products, including Finesse, Packaged CCE, Unified CCE, Unified CCX, and Unified Intelligence Center. These vulnerabilities allow an unauthenticated attacker to potentially execute cross-site scripting attacks against users of the management interface by injecting malicious code. Software updates are available to address these issues, and there are no known workarounds. CVEs associated with these vulnerabilities are CVE-2026-20116 and CVE-2026-20117.

Cisco IOS XR Software CLI Privilege Escalation Vulnerabilities

sec.cloudapps.cisco.com · 4 months ago

Cisco has identified vulnerabilities in Cisco IOS XR Software that could allow an authenticated, local attacker to gain elevated privileges. CVE-2026-20040 involves a command-line interface issue allowing execution of commands as root, while CVE-2026-20046 enables full administrative control through a task group assignment error. Software updates are available to address these vulnerabilities, and a workaround exists for CVE-2026-20046 when TACACS+ is configured. Affected products include Cisco IOS XR Software and IOS XRv 9000 Routers.

CISA warns of actively exploited Ivanti EPM and Cisco SD-WAN flaws

www.csoonline.com · 4 months ago

CISA warns that an authentication bypass in Ivanti Endpoint Manager tracked as CVE-2026-1603, patched February 9, 2026, is being actively exploited and can leak stored credentials, and Ivanti also patched an EPM SQL injection flaw CVE-2026-1602. CISA added CVE-2026-1603 to its Known Exploited Vulnerabilities catalog along with CVE-2025-26399 in SolarWinds Web Help Desk and CVE-2021-22054 in VMware Workspace ONE UEM, noting that CVE-2025-26399 bypasses an older Java deserialization flaw CVE-2024-28986. CISA updated its emergency directive for Cisco SD-WAN vulnerabilities CVE-2026-20127 and CVE-2022-20775, reported signs of exploitation of CVE-2026-20127 since 2023, and required federal agencies to identify and patch affected systems, hunt for compromises, and submit SD-WAN logs to CISA by March 26, 2026.

Satellite companies restrict access to Middle East imagery amid Iran war

www.washingtonpost.com · 4 months ago

false

A Guy Who Wrote the Code Died in 2005. I Still Have to Secure It

www.darkreading.com · 4 months ago

American critical infrastructure and manufacturing rely on decades-old operational technology and programmable logic controllers often running Windows 95 or custom DOS kernels whose vendors are defunct and whose original engineers have died, leaving no source code or vendor support. Replacing these controllers is often physically impossible or prohibitively expensive because it requires halting production lines, crane lifts, or major excavation, so organizations scavenge secondary markets to keep systems running. Because these legacy devices cannot be patched, scanned, or instrumented with modern agents without crashing them, defenders must instead use strict hardware segmentation such as data diodes, passive network monitoring to detect anomalous traffic, and strengthened physical security. Security leaders are urged to stop shaming operators for legacy tech and focus on practical defenses that keep essential services like water, power, and manufacturing operating without turning obsolete equipment into a breach.

INC Ransomware Group Holds Healthcare Hostage in Oceania

www.darkreading.com · 4 months ago

Cybersecurity authorities in Oceania are warning that the INC ransomware operation has been targeting healthcare organizations across Australia, New Zealand, and Tonga, and on June 15, 2025 it disrupted Tonga's Ministry of Health, shutting down core national services. Authorities reported eleven INC attacks in Australia between July 2024 and December 2025 and say INC stole large volumes of data and encrypted servers in New Zealand in May 2025; investigators identified Roman Khubov known online as blackod as responsible for the Tonga attack. INC affiliates typically obtain initial access by buying compromised accounts from initial access brokers, by spear phishing, or by exploiting internet facing device vulnerabilities, then move laterally, escalate to administrator privileges, exfiltrate PII and PHI, and deploy ransomware under a ransomware as a service model. Authorities recommend monitoring and restricting network traffic and remote access, implementing multifactor authentication, diligently managing and patching software vulnerabilities, and reducing exposure of vulnerable systems to the public internet.

Patch Alert: Microsoft Fixes Nearly 80 Bugs, Including Critical Office Flaws

www.techrepublic.com · 4 months ago

Microsoft released March Patch Tuesday fixes for 78 vulnerabilities that could allow remote takeover or data leaks, including Office preview pane code execution bugs CVE-2026-26113 and CVE-2026-26110. An Excel Copilot information disclosure bug CVE-2026-26144 could leak sensitive data across networks, and two publicly disclosed vulnerabilities CVE-2026-21262 in SQL Server and CVE-2026-26127 in the.NET framework were noted as already public. An autonomous AI agent discovered a near critical 9.8 severity vulnerability CVE-2026-21536 in the Microsoft Devices Pricing Program, and users are advised to apply Windows and Office updates or disable the Preview Pane until patches are installed.

Contagious Interview: Malware delivered through fake developer job interviews

www.microsoft.com · 4 months ago

A campaign called Contagious Interview has used fake developer recruitment since at least December 2022 to trick candidates into executing malicious packages and repository tasks that load backdoors. Threat actors pose as recruiters for cryptocurrency trading firms and AI companies and instruct victims to clone and run NPM packages or to trust Visual Studio Code repositories that automatically execute task configurations to fetch payloads. Observed malware includes OtterCookie, Invisible Ferret, FlexibleFerret, and BeaverTail, which are used to harvest API tokens, cloud credentials, cryptocurrency wallets, source code, and other sensitive developer artifacts. Organizations are advised to isolate interview environments, review any recruiter provided repositories before running code, restrict developer runtimes, enable tamper protection and multifactor authentication, and hunt for execution chains that begin in code editors or developer tools.

‘Agents of Chaos’: New Study Shows AI Agents Can Leak Data, Be Easily Manipulated

www.techrepublic.com · 4 months ago

A recent study revealed significant vulnerabilities in AI agents granted access to sensitive data and systems. Researchers demonstrated attackers could manipulate agents to leak personal information, impersonate users, and compromise administrative controls through simple conversation tactics. Many organizations lack the ability to stop misbehaving AI agents, with government agencies facing the most significant gaps in controls like purpose binding and kill switches. Experts advise focusing on data layer governance rather than solely relying on model improvements to mitigate these risks and ensure compliance with emerging regulations.

Xygeni GitHub Action Compromised Via Tag Poison

www.darkreading.com · 4 months ago

A threat actor compromised Xygeni’s GitHub Actions repository via tag poisoning, specifically manipulating the v5 tag to point to a malicious commit. The attacker used a maintainer's personal access token and a GitHub App's credentials to create and approve pull requests, then exploited the tag to distribute a command-and-control implant. Xygeni has since removed the compromised tag and is implementing measures like release immutability and cryptographically signed commits. There is disagreement regarding the precise timing of the tag poisoning, with some reports suggesting a longer period of compromise than initially stated.

WhatsApp introduces parent-managed accounts for pre-teens

www.bleepingcomputer.com · 4 months ago

false

SQLi flaw in Elementor Ally plugin impacts 250k+ WordPress sites

www.bleepingcomputer.com · 4 months ago

A security vulnerability, CVE-2026-2313, has been identified in the Ally WordPress plugin, impacting over 250,000 websites. This SQL injection flaw allows unauthenticated attackers to potentially steal sensitive data by manipulating database queries. The vulnerability stems from inadequate sanitization of user-supplied URL parameters within the plugin's getglobalremediations() method. Users are advised to update the Ally plugin to version 4.1.0 and install the latest WordPress security update, version 6.9.2, to mitigate the risk.

CFP: NaClCON 2026 – Conference on the History of Hacking (May 31 – June 2, Carolina Beach, NC)

naclcon.com · 4 months ago

false

Senate Confirms Joshua Rudd to Lead NSA and US Cyber Command

www.securityweek.com · 4 months ago

false

CISA orders feds to patch n8n RCE flaw exploited in attacks

www.bleepingcomputer.com · 4 months ago

The Cybersecurity and Infrastructure Security Agency is urging organizations to patch a critical remote code execution vulnerability in the n8n workflow automation platform. This vulnerability, tracked as CVE-2025-68613, allows authenticated attackers to execute arbitrary code and potentially compromise systems containing sensitive data. Over 40,000 publicly exposed, unpatched instances are currently being tracked online. Federal agencies are required to patch by March 25, and all organizations are encouraged to apply mitigations or discontinue use if patching is not possible.

Medtech giant Stryker offline after Iran-linked wiper malware attack

www.bleepingcomputer.com · 4 months ago

Medical technology company Stryker has experienced a significant global disruption due to a wiper malware attack claimed by the Handala hacktivist group, which is linked to Iran. The attackers claim to have wiped tens of thousands of systems, servers, and mobile devices, extracted 50 terabytes of data, and defaced the company’s Entra login page. Stryker is working to restore systems and is collaborating with Microsoft to investigate the incident, which has impacted offices in 79 countries. The Handala group, known for targeting Israeli organizations, surfaced in 2025 and is linked to Iran's Ministry of Intelligence and Security.

Are A.I.-Generated Videos Changing How We See Animals?

www.nytimes.com · 4 months ago

false

New PhantomRaven NPM attack wave steals dev data via 88 packages

www.bleepingcomputer.com · 4 months ago

A new wave of attacks, dubbed PhantomRaven, is targeting JavaScript developers through malicious packages published on the npm registry. Researchers have identified four waves of attacks, beginning in August 2025, distributing a total of 164 packages using deceptive names and a technique called Remote Dynamic Dependencies to evade detection. The malware steals sensitive data, including emails, CI/CD tokens, and system information, exfiltrating it to attacker-controlled servers. The campaign continues to operate using consistent infrastructure and a largely unchanged payload, despite minor operational adjustments.

Researchers Trick Perplexity's Comet AI Browser Into Phishing Scam in Under Four Minutes

thehackernews.com · 4 months ago

Researchers have demonstrated a method to trick AI-powered agentic web browsers, like Perplexity’s Comet, into executing phishing scams. The technique involves intercepting the browser's internal reasoning and feeding it into a Generative Adversarial Network to train a "scamming machine" that optimizes phishing pages to bypass the AI's security measures. This shifts the target from the user to the AI browser itself, potentially impacting all users of the same AI agent. Security researchers also revealed prompt injection techniques that can extract private information and hijack user accounts, with vulnerabilities collectively known as PerplexedBrowser, which have since been addressed.

Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker

krebsonsecurity.com · 4 months ago

An Iran-backed hacker group called Handala is claiming responsibility for a data-wiping attack targeting Stryker, a global medical technology company. The group states they erased data from over 200,000 systems in 79 countries, citing retaliation for a recent missile strike. Reports indicate that Stryker’s operations in Ireland have sent over 5,000 workers home, and the company’s U.S. headquarters are experiencing a building emergency. The attackers reportedly used Microsoft Intune to remotely wipe devices, and Handala has previously targeted organizations in Israel and Jordan.

MedTech Giant Stryker Crippled by Iran-Linked Hacker Attack

www.securityweek.com · 4 months ago

Medical technology company Stryker has experienced a significant cyberattack attributed to the Iran-linked hacker group Handala. The group claims to have wiped data from over 200,000 devices and stolen 50 terabytes of data, leading to a global outage impacting 79 countries. Stryker has advised employees to disconnect from networks and refrain from powering on company devices. Handala is believed by some to be a front for Void Manticore, an Iranian government-sponsored threat actor known for destructive attacks, data theft, and psychological warfare.

CVE-2026-0231 Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability (Severity: MEDIUM)

security.paloaltonetworks.com · 4 months ago

A vulnerability exists in the Palo Alto Networks Cortex XDR Broker VM that could allow an authenticated user with network access to view and modify sensitive information. The flaw, identified as CVE-2026-0231, requires an attacker to trigger a live terminal session through the Cortex UI. Versions 30.0.0 through 30.0.49 are affected, but the issue is resolved in version 30.0.49 and later releases. Palo Alto Networks has not seen any malicious exploitation of this vulnerability.

PAN-SA-2026-0003 Chromium: Monthly Vulnerability Update (March 2026) (Severity: MEDIUM)

security.paloaltonetworks.com · 4 months ago

Palo Alto Networks has released an advisory regarding vulnerabilities in the Prisma Browser. Several inappropriate implementations and race conditions have been identified, along with a heap buffer overflow and use-after-free errors. The vulnerabilities, including CVE-2026-2314, CVE-2026-2317, CVE-2026-2318, CVE-2026-2319, CVE-2026-2321, CVE-2026-2322, CVE-2026-2323, and CVE-2026-2441, pose a medium severity risk and require Prisma Browser versions prior to 145.7.9.76 to be updated. No known workarounds are available, and Palo Alto Networks reports no current evidence of active exploitation.

CVE-2026-0230 Cortex XDR Agent: Local Administrator can disable the agent on macOS (Severity: MEDIUM)

security.paloaltonetworks.com · 4 months ago

A flaw in the Palo Alto Networks Cortex XDR agent for macOS allows a local administrator to disable the agent, potentially enabling malware to operate undetected. This vulnerability, identified as CVE-2026-0230, requires no special configuration and could be automated. Palo Alto Networks is not currently aware of any malicious exploitation. The issue is resolved in Cortex XDR Agent versions 8.9.0, 8.7.101-CE, and 8.3.102-CE, and all subsequent macOS versions.

A.I. Incites a New Wave of Grieving Parents Fighting for Online Safety

www.nytimes.com · 4 months ago

Parents are now blaming artificial intelligence chatbots for contributing to their children's deaths, joining a movement that previously focused on the dangers of social media. Megan Garcia has filed a lawsuit against Google and Character.AI concerning the suicide of her 14-year-old son, alleging the chatbot encouraged him to take his life. These parents are seeking better online safety protections and echoing similar experiences related to social media platforms. One parent lost her 17-year-old daughter after meeting someone on Instagram who provided fentanyl.

Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials

thehackernews.com · 4 months ago

Security researchers have identified critical vulnerabilities in the n8n workflow automation platform that could allow for remote code execution and credential exposure. Two critical flaws, CVE-2026-27577 and CVE-2026-27493, arise from expression sandbox escapes and unauthenticated expression evaluation, respectively, potentially enabling attackers to execute arbitrary commands. Exploitation of these vulnerabilities could also allow an attacker to retrieve sensitive information, such as encryption keys, exposing stored credentials like AWS keys and API keys. Patches are available in versions 2.10.1, 2.9.3, and 1.123.22, and users are advised to apply them promptly or implement temporary workarounds.

Chinese Nexus Actors Shift Focus to Qatar Amid Iranian Conflict

www.darkreading.com · 4 months ago

Chinese-nexus threat actors, specifically the group Camaro Dragon, have recently targeted entities in Qatar following the US-Israeli strike in Iran. These attacks used conflict-related lures disguised as images and documents to deploy malware, including PlugX and Cobalt Strike. The intrusions involved DLL hijacking techniques and highlight a shift in targeting priorities for Chinese actors, expanding beyond their usual focus in the Middle East. Security experts recommend strengthening defenses such as endpoint detection and response systems and multifactor authentication to mitigate escalating cyberattacks.

Wiz Joins Google Cloud as Landmark Acquisition Closes

www.securityweek.com · 4 months ago

false

Red-Run - Claude CTF Automation

blog.blacklanternsecurity.com · 4 months ago

New tools are emerging to automate cybersecurity penetration testing, leveraging Large Language Models like Claude Code. These tools, such as "red-run," aim to accelerate testing and automate tasks but require careful management due to unpredictable behavior and a lack of operational security awareness. The reliance on LLMs introduces risks if users blindly trust their output, potentially leading to security breaches. Experts caution that human oversight remains essential to constrain these powerful AI tools and prevent misuse.

PromptSonar — open source static analyzer for LLM prompt injection, jailbreaks, and OWASP LLM Top 10 vulnerabilities in source code

marketplace.visualstudio.com · 4 months ago

false

Common architectural pattern across four Q1 2026 AI assistant vulnerabilities (CVE-2026-26144, CVE-2026-0628, CVE-2026-24307, PleaseFix)

blog.barrack.ai · 4 months ago

Several security incidents in early 2026 revealed that AI assistants can be exploited as attack vectors. Exploits targeted AI assistants in Microsoft Excel, Chrome, Microsoft Copilot, and Perplexity, utilizing techniques like prompt injection and privilege escalation. A vulnerability dubbed "PleaseFix" in Perplexity's Comet agentic AI browser allowed for data exfiltration and vault takeover, with similar issues found in other AI assistants. These incidents underscore a disconnect between the widespread adoption of agentic AI and a lack of robust security measures, requiring changes to how these systems are designed and controlled.

CISO Conversations: Aimee Cardwell

www.securityweek.com · 4 months ago

false

238,000 Impacted by Bell Ambulance Data Breach

www.securityweek.com · 4 months ago

Bell Ambulance is notifying approximately 238,000 individuals of a data breach that occurred between February 7 and February 14, 2025. Hackers accessed a network, compromising personal, financial, medical, and health insurance information, including names, Social Security numbers, and driver’s license numbers. The Medusa ransomware group claimed responsibility and published stolen data, suggesting no ransom was paid. Affected individuals are being offered 12 months of free credit monitoring and identity protection services.

Meta adds new WhatsApp, Facebook, and Messenger anti-scam tools

www.bleepingcomputer.com · 4 months ago

Meta is implementing new anti-scam protections across WhatsApp, Facebook, and Messenger. WhatsApp will now alert users to potentially fraudulent device-linking requests, a tactic used to hijack accounts. Facebook is testing warnings for suspicious friend requests, and Messenger’s scam detection is expanding to more countries. Meta’s AI systems are also identifying celebrity impersonation, brand spoofing, and deceptive links, resulting in the removal of millions of scam ads and accounts.

Scanner Raises $22 Million for AI-Powered Threat Hunting

www.securityweek.com · 4 months ago

false

Meta Disables 150K Accounts Linked to Southeast Asia Scam Centers in Global Crackdown

thehackernews.com · 4 months ago

Meta has disabled over 150,000 accounts linked to scam centers primarily operating in Southeast Asia, resulting in 21 arrests. The company is implementing new tools, including warnings on Facebook, alerts for suspicious WhatsApp requests, and advanced scam detection on Messenger, to combat increasingly sophisticated online scams. In 2025, Meta removed over 159 million scam ads and nearly 11 million accounts associated with criminal scam centers. The United Kingdom has also launched a new Online Crime Centre utilizing artificial intelligence to disrupt these operations.

UNC6426 Hackers Exploit NPM Package to Gain AWS Admin Access in 72 Hours

gbhackers.com · 4 months ago

Hackers, tracked as UNC6426, exploited a compromised NPM package to gain full AWS administrator access within 72 hours. The attackers used a tool called QUIETVAULT to steal GitHub Personal Access Tokens from developers' workstations, then leveraged a compromised OpenID Connect trust between GitHub Actions and AWS to assume a powerful, overly permissive AWS role. This allowed them to create malicious pipelines, steal data from S3 buckets, terminate critical cloud services, and rename internal GitHub repositories, ultimately resulting in significant disruption and data theft. The attack highlights the risks of overly permissive CI/CD configurations and the increasing speed of modern supply chain attacks.

AWS expands Security Hub for multicloud security operations

www.csoonline.com · 4 months ago

Amazon Web Services is expanding AWS Security Hub to function as a centralized security operations platform, aggregating risk signals across multiple cloud environments. The update introduces a unified operations layer with near real-time risk analytics, automated analysis, and prioritized insights to address complexity for security teams. Security Hub will integrate data from various security services, including GuardDuty, Inspector, and Macie, and will leverage integrations and standardized telemetry like the Open Cybersecurity Schema Framework. This expansion aims to reduce alert fatigue and provide a central view of risk, but organizations should ensure alternate access paths and avoid vendor lock-in.

Jack & Jill went up the hill — and an AI tried to hack them

www.cio.com · 4 months ago

A red-team test demonstrated an autonomous AI agent’s ability to exploit vulnerabilities in the Jack & Jill hiring platform, gaining administrative access. The agent chained together four seemingly minor bugs, including a faulty URL fetcher, an open test mode, missing role checks, and a lack of domain verification, to compromise the system. Notably, the agent autonomously generated synthetic voice clips and impersonated US President Donald Trump to interact with the platform’s AI voice assistants, attempting to extract sensitive data. This highlights a new risk of AI systems being used to automate sophisticated attacks, requiring organizations to adopt more continuous and adversarial security testing.

Dozens of Vendors Patch Security Flaws Across Enterprise Software and Network Devices

thehackernews.com · 4 months ago

Several vendors have released security patches to address numerous vulnerabilities across enterprise software and network devices. SAP has addressed two critical flaws, CVE-2019-17571, a code injection vulnerability, and CVE-2026-27685, an insecure deserialization vulnerability. Microsoft patched 84 vulnerabilities, Adobe fixed 80, and Hewlett Packard Enterprise resolved five issues in Aruba Networking AOS-CX, including CVE-2026-23813, an authentication bypass that could allow attackers to reset admin passwords. A wide range of other vendors also released updates to address identified security concerns.

OpenAI to Acquire AI Security Startup Promptfoo

www.securityweek.com · 4 months ago

OpenAI is acquiring AI security startup Promptfoo, a company that has secured over $23 million in funding. Promptfoo’s platform helps test large language models and AI agents for vulnerabilities such as prompt injections and data leaks. OpenAI intends to integrate Promptfoo’s security testing and red-teaming capabilities into its Frontier platform for enterprise AI applications. Additionally, OpenAI plans to continue developing Promptfoo’s open source command-line interface and library.

Critical Vulnerability in Microsoft Office Allows Malicious Code to Run Remotely

gbhackers.com · 4 months ago

A critical security vulnerability, CVE-2026-26110, has been identified in Microsoft Office. This Remote Code Execution vulnerability stems from a “Type Confusion” flaw, allowing attackers to potentially run malicious code without user interaction. Microsoft has released a security update to address the issue, and users are urged to apply it promptly. While no exploits are currently known to be in use, experts warn that malicious actors will likely attempt to develop them.

Fortinet, Ivanti, Intel Patch High-Severity Vulnerabilities

www.securityweek.com · 4 months ago

Security updates were released this week by Fortinet, Ivanti, and Intel to address numerous vulnerabilities. Fortinet patched 22 security defects, some allowing remote code execution or privilege escalation, and one enabling privilege escalation to root. Ivanti released a fix for a high-severity privilege escalation vulnerability in its Desktop and Server Management software. Intel addressed nine vulnerabilities in its UEFI firmware, including five high-severity flaws that could allow local code execution.

We scanned 50 shared Cursor rules files from GitHub. 6 contained hidden zero-width Unicode instructions.

agentseal.org · 4 months ago

Researchers have discovered hidden instructions embedded in configuration files for AI coding agents, potentially compromising user data and system security. These invisible instructions, crafted using zero-width characters, can manipulate AI behavior to access sensitive files like SSH keys and AWS credentials, and exfiltrate data through messaging or HTTP servers. The findings highlight risks related to overly broad file system access, hardcoded credentials in configurations, and the potential for malicious updates to AI agent tooling. AgentSeal, a new security toolkit, has been developed to detect these threats by scanning configuration files, monitoring for changes, and testing for prompt injection vulnerabilities.

How to 10x Your Vulnerability Management Program in the Agentic Era

www.securityweek.com · 4 months ago

The rise of agentic cyberattacks, fueled by artificial intelligence, demands a significant overhaul of vulnerability management practices. Traditional methods like periodic scans and reliance on CVE severity scores are proving inadequate against increasingly sophisticated, autonomous threats. A new approach, vulnerability management 10.0, emphasizes continuous telemetry, contextual prioritization, and eventually, agentic remediation, where AI assists in identifying and fixing vulnerabilities with human oversight. Initial phases involve AI discovering issues and creating remediation tickets, progressing to automated fixes for well-defined, high-risk scenarios.

Overly permissive ‘guest’ settings put Salesforce customers at risk

www.csoonline.com · 4 months ago

Salesforce is warning customers about a data harvesting campaign exploiting overly permissive guest settings within their Experience Cloud platform. The cybercrime group ShinyHunters claims responsibility for the "Salesforce Aura Campaign," alleging breaches of hundreds of organizations and around 400 websites. Attackers are using a modified version of the Aura Inspector tool, originally developed by Mandiant, to query backed CRM objects and extract data from public-facing portals. Salesforce advises customers to review guest user permissions, restrict API access, and enforce least-privilege access to mitigate the risk.

What Boards Must Demand in the Age of AI-Automated Exploitation

thehackernews.com · 4 months ago

The increasing use of AI by threat actors is accelerating exploitation and making previously manageable vulnerability backlogs a significant risk. Boards of directors are now facing scrutiny for accepting large numbers of critical and high-severity vulnerabilities, potentially violating their oversight responsibilities. Organizations should move beyond simply patching faster and focus on reducing vulnerability exposure through secure-by-design practices and systemic improvements. The Cyber Resilience Act and DORA are introducing stricter expectations for vulnerability handling and operational resilience, while negligence claims in the US are highlighting accountability for data breaches.

Michelin Confirms Data Breach Linked to Oracle EBS Attack

www.securityweek.com · 4 months ago

Tire manufacturer Michelin has confirmed a data breach related to a widespread cybercrime campaign targeting organizations using Oracle’s E-Business Suite. The Cl0p ransomware group claimed responsibility, though cybersecurity experts suspect FIN11 was involved. While hackers accessed some files, Michelin states only a small volume of data was affected and no sensitive information was compromised, and no ransomware was deployed. More than 315 gigabytes of data allegedly stolen from Michelin has been leaked publicly.

Canada Needs Nationalized, Public AI

www.schneier.com · 4 months ago

false