Blahalla

'Overly Permissive' Salesforce Cloud Configs in the Crosshairs

www.darkreading.com · 4 months ago

A threat actor group is exploiting overly permissive guest user configurations in Salesforce Experience Cloud to steal sensitive data. The attackers are using a modified version of the open-source Aura Inspector tool to extract data directly from Salesforce CRM objects without requiring login credentials. Salesforce recommends customers audit guest user configurations, disable public APIs, and implement other security measures to mitigate the risk. This issue is related to customer configurations, not a vulnerability within the Salesforce platform itself, and follows a series of other financially motivated attacks targeting Salesforce instances.

Classifying email providers of 2000+ Swiss municipalities via DNS, looking for feedback on methodology

mxmap.ch · 4 months ago

false

New 'Zombie ZIP' technique lets malware slip past security tools

www.bleepingcomputer.com · 4 months ago

A new malware technique called “Zombie ZIP” allows malicious payloads to bypass security tools by manipulating ZIP file headers. The technique tricks antivirus and endpoint detection and response systems into scanning files as uncompressed, concealing malicious code. Security researchers have demonstrated the method’s effectiveness against numerous antivirus engines, and the CERT Coordination Center has issued a warning. The vulnerability has been assigned CVE-2026-0866, with similarities to CVE-2004-0935.

The CSO role is evolving fast with AI in Cyber Defense strategy

www.csoonline.com · 4 months ago

false

Microsoft Patches 83 Vulnerabilities

www.securityweek.com · 4 months ago

Microsoft has released patches for 83 vulnerabilities across its products. Two vulnerabilities have been publicly disclosed: CVE-2026-26127, a denial-of-service issue in.NET, and CVE-2026-21262, an elevation of privilege defect in SQL Server. A critical remote code execution vulnerability, CVE-2026-21536, exists in the Devices Pricing Program, although it has already been mitigated. Security experts suggest paying close attention to privilege escalation vulnerabilities in Windows and Azure, particularly those requiring non-standard patching.

Meta Acquires Moltbook, the Social Network Just for A.I. Bots

www.nytimes.com · 4 months ago

false

Russian Threat Actor Sednit Resurfaces With Sophisticated Toolkit

www.darkreading.com · 4 months ago

The threat group Sednit, also known as Fancy Bear or APT28, has resumed using custom-developed malware in cyberespionage campaigns targeting Ukrainian cyber assets. Researchers at ESET discovered two new implants, BeardShell and Covenant, used in a 2024 breach; BeardShell uses Icedrive for command and control, while Covenant is a modified open-source framework for data exfiltration and monitoring. Sednit's return to custom malware development, combined with the use of legitimate cloud services for command and control, complicates detection efforts. The group has been active since 2004 and is linked to attacks against the Democratic National Committee and other organizations.

Whistleblower claims ex-DOGE member says he took Social Security data to new job

www.washingtonpost.com · 4 months ago

The Social Security Administration is facing a potential security breach. An investigation is underway regarding a former employee who allegedly transferred sensitive data, potentially including information from two agency databases, to a thumb drive. The employee reportedly intended to share this data with their new employer. This situation, if verified, would be considered a significant breach of security protocols for the agency.

Whistleblower claims ex-DOGE member says he took Social Security data to new job

www.washingtonpost.com · 4 months ago

The Social Security Administration is facing a potential security breach. An investigation is underway regarding a former employee who allegedly took sensitive data on a thumb drive to a new job. This individual reportedly had access to two highly sensitive agency databases and intended to share the information with a private employer. The incident could affect over 70 million Americans.

Microsoft Patch Tuesday March 2026 Fixes 79 Vulnerabilities Including Two Public Zero-Days

www.neuracybintel.com · 4 months ago

NULL

Microsoft releases Windows 10 KB5078885 extended security update

www.bleepingcomputer.com · 4 months ago

Microsoft has released Windows 10 extended security update KB5078885 to address vulnerabilities from the March 2026 Patch Tuesday. The update resolves seventy-nine security flaws, including two actively exploited zero-day vulnerabilities. It fixes an issue preventing some devices from shutting down or entering hibernation when System Guard Secure Launch is enabled. The update also includes improvements to File History, graphics stability, and Secure Boot certificate distribution.

Adobe Patches 80 Vulnerabilities Across Eight Products

www.securityweek.com · 4 months ago

Adobe has released security updates to address 80 vulnerabilities across eight products. Patches are available for Adobe Commerce, Magento, Illustrator, Acrobat Reader, Premiere Pro, Substance 3D Stager, DNG SDK, and Experience Manager. The Commerce and Magento updates address 19 flaws, including six high-severity bugs, such as CVE-2026-21290, CVE-2026-21361, CVE-2026-21284, CVE-2026-21311, CVE-2026-21309, and CVE-2026-21289. Adobe reports that none of these vulnerabilities are currently being exploited.

Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws

www.bleepingcomputer.com · 4 months ago

Microsoft’s latest security update resolves 79 vulnerabilities across its products and services. This includes two publicly disclosed zero-day vulnerabilities and three critical issues. Fixes address privilege escalation, denial-of-service, and information disclosure flaws impacting Excel, SQL Server, and other components. The update also resolves remote code execution vulnerabilities and addresses issues in Azure, Mariner, and Microsoft Semantic Kernel, with exploitation observed in CVE-2026-21533 and CVE-2026-21525.

Jazz Emerges From Stealth With $61M in Funding for AI-Powered DLP

www.securityweek.com · 4 months ago

false

Windows 11 KB5079473 & KB5078883 cumulative updates released

www.bleepingcomputer.com · 4 months ago

Microsoft has released cumulative updates KB5079473 and KB5078883 for Windows 11 versions 23H2, 24H2, and 25H2, incorporating March 2026 security patches. The updates introduce new features including a taskbar network speed test, Windows Backup for Organizations integration, and native System Monitor (Sysmon) functionality. Several improvements were made to File Explorer, Nearby Sharing, and the login screen, alongside visual consistency updates and WebP image support for desktop backgrounds. IT administrators will now have access to Remote Server Administration Tools (RSAT) on Windows 11 Arm64 devices.

Google’s $32B Wiz Acquisition Set to Become Israel’s Largest Tech Deal Ever

www.techrepublic.com · 4 months ago

false

HPE warns of critical AOS-CX flaw allowing admin password resets

www.bleepingcomputer.com · 4 months ago

HPE has released security updates to address vulnerabilities in its Aruba Networking AOS-CX operating system. A critical authentication bypass vulnerability, CVE-2026-23813, allows unauthorized users to reset administrator passwords. Workarounds include restricting management interface access, implementing strict access policies, and disabling unnecessary interfaces. HPE has not observed any active exploitation of these flaws.

Boeing Says Wiring Issue Will Delay Some 737 Max Deliveries

www.nytimes.com · 4 months ago

false

FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials

thehackernews.com · 4 months ago

Cybersecurity researchers have observed threat actors exploiting vulnerabilities in FortiGate network appliances to gain access to victim networks. Attackers are targeting healthcare, government, and managed service providers, extracting configuration files containing service account credentials and network topology data. These breaches often involve exploiting vulnerabilities such as CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858, or leveraging weak credentials. Once inside, attackers have created administrator accounts, enrolled rogue workstations, deployed remote access tools, and exfiltrated sensitive data like the NTDS.dit file.

How to Stop AI Data Leaks: A Webinar Guide to Auditing Modern Agentic Workflows

thehackernews.com · 4 months ago

Artificial intelligence agents are automating tasks like sending emails and managing software, creating a potential security risk. These agents, often operating without oversight, can become a target for hackers who manipulate them to access sensitive information. Experts say traditional security measures are not designed to protect these "digital workers." A webinar will detail how to identify these agents, prevent manipulation, and ensure data safety.

KadNap Malware Infects 14,000+ Edge Devices to Power Stealth Proxy Botnet

thehackernews.com · 4 months ago

Researchers have identified a new malware strain called KadNap that infects Asus routers and other edge devices to build a proxy botnet. Over 14,000 devices have been compromised, with the majority of victims in the United States. The malware uses a custom version of the Kademlia Distributed Hash Table protocol to hide its infrastructure and connect to a command-and-control server. Infected devices are then sold through a proxy service named Doppelgänger, which claims to offer anonymous proxies. Simultaneously, a new Linux malware, ClipXDaemon, has emerged, targeting cryptocurrency users by intercepting and altering copied wallet addresses.

Twitter suspended 800 million accounts last year – so why does manipulation remain so rampant?

www.bitdefender.com · 4 months ago

X, formerly Twitter, suspended 800 million accounts in 2024 for violating rules against platform manipulation and spam. Russia was identified as the most active manipulator of the site, followed by Iran and China, with attempts to influence the 2024 US presidential election. Despite these suspensions, manipulation attempts persist, with hundreds of millions of accounts taken down recently. Concerns remain about X's approach to content moderation and its vulnerability to disinformation, as the platform faces scrutiny and investigations regarding its handling of misinformation and foreign interference.

Fake Gemini AI Chatbot Promotes ‘Google Coin’ in New Crypto Scam

www.techrepublic.com · 4 months ago

Cybersecurity researchers have identified a new scam involving a fake chatbot impersonating Google’s AI assistant to promote a nonexistent cryptocurrency called “Google Coin.” The chatbot, embedded on a fraudulent website, delivers a detailed investment pitch and encourages users to send cryptocurrency payments to a specific wallet address. Scammers use familiar branding and AI interaction to create a sense of legitimacy, but Alphabet, Google's parent company, does not have a cryptocurrency. Experts advise verifying claims directly with companies and reporting any losses to law enforcement.

After the $82K Gemini API key incident — here's why GCP billing alerts won't protect you in real-time

cloudsentinel.dev · 4 months ago

NULL

From 2017: Frances Gabe, Creator of the Only Self-Cleaning Home, Dies at 101

www.nytimes.com · 4 months ago

false

Microsoft brings phishing-resistant Windows sign-ins via Entra passkeys

www.bleepingcomputer.com · 4 months ago

false

Kai Emerges From Stealth With $125M in Funding for AI Platform Bridging IT and OT Security

www.securityweek.com · 4 months ago

false

Webinar Today: Securing Fragile OT in an Exposed World

www.securityweek.com · 4 months ago

false

New KadNap botnet hijacks ASUS routers to fuel cybercrime proxy network

www.bleepingcomputer.com · 4 months ago

A new botnet called KadNap is compromising ASUS routers and other network devices, creating a proxy network for malicious activity. The botnet, which began in August 2025, currently involves around 14,000 devices spread primarily in the United States, Taiwan, Hong Kong, and Russia. KadNap uses a modified Kademlia Distributed Hash Table protocol to obscure its command-and-control infrastructure, making it difficult to track. The botnet is linked to the Doppelganger proxy service, which offers infected devices for malicious purposes such as denial-of-service attacks. Lumen Technologies has disrupted KadNap's control infrastructure on its network.

How Do You Use A.I. for Daily Life?

www.nytimes.com · 4 months ago

false

Former Meta A.I. Chief’s Start-Up Is Valued at $3.5 Billion

www.nytimes.com · 4 months ago

false

SAP Patches Critical FS-QUO, NetWeaver Vulnerabilities

www.securityweek.com · 4 months ago

SAP released fifteen security notes this month to address several vulnerabilities. A critical code injection vulnerability in Quotation Management Insurance, CVE-2019-17571, stems from a Log4Shell defect. Another critical vulnerability, CVE-2026-27685, allows for potential code execution and denial-of-service. A high-severity denial-of-service bug in Supply Chain Management, CVE-2026-27689, is also being resolved.

Thousands Affected by Ericsson Data Breach

www.securityweek.com · 4 months ago

A data breach at Ericsson has impacted the personal information of approximately 15,000 individuals. The breach occurred at a third-party service provider in April 2025, with unauthorized access to files potentially occurring between April 17th and 22nd. Ericsson reports the service provider has no evidence of misuse of the data, though this is a standard disclaimer. The investigation concluded in February 2026.

The New Turing Test: How Threats Use Geometry to Prove 'Humanness'

www.bleepingcomputer.com · 4 months ago

Attackers are increasingly using stealthier tactics, prioritizing long-term, undetected infiltration over disruptive breaches. Malware now includes advanced evasion techniques, such as mathematically complex human-verification tests and CPU-level time monitoring, to avoid detection in automated analysis environments. Three key techniques driving this shift are System Checks, which profile the host environment; User Activity Based Checks, which use trigonometry to verify human interaction; and Time Based Checks, which monitor CPU execution time to detect virtualization. Security teams must shift focus from analyzing files to validating adversarial behavior to effectively defend against these evolving threats.

YouTube Adds Tool to Help Public Figures Report Fake Videos

www.nytimes.com · 4 months ago

YouTube is launching a program to assist public figures in identifying and reporting fake videos created using artificial intelligence. The pilot program allows government officials, political candidates, and journalists to submit a selfie and identification for verification, and then view detected deepfakes through an online dashboard. Participants can flag these videos for removal, with exceptions for parody, satire, and content of public interest. YouTube states that identity information will be used solely for verification purposes and not to train A.I. models.

YouTube Adds Tool to Help Public Figures Report Fake Videos

www.nytimes.com · 4 months ago

YouTube is launching a pilot program to help public figures identify and report videos that use artificial intelligence to impersonate them. The tool will be available to government officials, political candidates, and journalists, requiring a video selfie and identification for enrollment. Detected videos will appear in a dashboard, allowing users to flag them for potential removal, with exceptions for parody and public interest content. YouTube states the identity information will only be used for verification and not for training artificial intelligence models.

Top 10 Best Anti-Phishing Tools in 2026

gbhackers.com · 4 months ago

Reports indicate a rise in sophisticated, AI-powered phishing attacks, necessitating advanced protection beyond basic spam filters. Top solutions include Microsoft Defender for Office 365, Proofpoint Core Email Protection, and Mimecast Email Security, emphasizing behavioral analytics and real-time threat intelligence. Several other solutions like Guardio, Check Point Harmony, and Cofense offer distinct advantages for different organization sizes and needs, including business continuity and fraud prevention. Experts recommend a layered defense combining automated AI tools and user education to effectively combat modern phishing threats.

'BlackSanta' EDR Killer Targets HR Workflows

www.darkreading.com · 4 months ago

Threat actors are employing a sophisticated campaign targeting human resources workflows to compromise systems and evade detection. Attackers deliver malicious payloads, dubbed "Black Santa," concealed within resume-themed ISO files, utilizing steganography to hide code within images. Once executed, "Black Santa" disables security protections like antivirus software and endpoint detection and response agents by leveraging legitimate, signed kernel drivers. This allows for stealthy data exfiltration and persistence, demonstrating a mature adversary's tactics.

OpenAI Rolls Out Codex Security Vulnerability Scanner

www.securityweek.com · 4 months ago

OpenAI has released Codex Security, an AI-powered vulnerability scanner designed to identify complex software issues. The tool, previously in beta testing with companies like Netgear, analyzes code repositories to create threat models and suggest patches. During recent testing, Codex Security uncovered nearly 800 critical vulnerabilities and over 10,000 high-severity issues in projects including Chromium, OpenSSL, PHP, GOGS, and GnuTLS. Codex Security is now available to ChatGPT Pro, Enterprise, Business, and Edu customers for a limited time.

Kevin Mandia’s Armadin Launches With $190 Million in Funding

www.securityweek.com · 4 months ago

Kevin Mandia, founder of Mandiant, has launched a new cybersecurity startup called Armadin, securing $189.9 million in funding. The company utilizes AI-powered red teaming to simulate and exploit vulnerabilities, mirroring how attackers operate. Armadin’s goal is to create an autonomous offensive security platform to counter the increasing threat of AI-driven cyberattacks. The company’s founders include Travis Lanham, Evan Peña, and David Slater, with Mandia serving as CEO.

New "LeakyLooker" Flaws in Google Looker Studio Could Enable Cross-Tenant SQL Queries

thehackernews.com · 4 months ago

Researchers have identified nine cross-tenant vulnerabilities, collectively named LeakyLooker, in Google Looker Studio. These flaws could have allowed attackers to execute unauthorized SQL queries and potentially exfiltrate sensitive data from organizations using Google Cloud environments and services like BigQuery and Spanner. Exploitation could have given attackers access to entire datasets and projects across different cloud tenants through methods like specially crafted reports and the report copying feature. Google has addressed these issues following responsible disclosure.

CISA Alerts on Ivanti Endpoint Manager Vulnerability Auth Bypass Exploited in the Wild

gbhackers.com · 4 months ago

The Cybersecurity and Infrastructure Security Agency, or CISA, has added a security vulnerability to its Known Exploited Vulnerabilities catalog. This vulnerability, CVE-2026-1603, affects Ivanti Endpoint Manager and allows attackers to bypass authentication. Threat actors are actively exploiting this flaw to potentially access sensitive data. Federal agencies must remediate the vulnerability by March 23, 2026, and organizations are urged to apply vendor mitigations and monitor systems for unauthorized access.

Trust no one: are one-way trusts really one way?

offsec.almond.consulting · 4 months ago

A security vulnerability exists in Windows one-way trusts, allowing attackers to bypass access restrictions. Using a tool like tdodump.py, an attacker who compromises a "trusting" domain can extract the password of a trust account and authenticate within the "trusted" domain. This enables lateral movement and compromises the security of the trusted domain, permitting standard Active Directory attacks. The exploit leverages Microsoft’s trust object structure and specific GUIDs, impacting environments utilizing one-way trusts, particularly administration forests.

Attackers Use Malformed ZIP Archives to Evade Antivirus and EDR Tools

gbhackers.com · 4 months ago

Cybersecurity researchers are warning of a new technique used by attackers to bypass antivirus and endpoint detection and response tools. Threat actors are manipulating ZIP archive headers to hide malicious payloads, causing security tools to miss the threats. This involves altering the declared compression method, which standard extraction tools often fail to handle, requiring custom malware loaders to execute the payload. The vulnerability, tracked as VU976247, is similar to CVE-2004-0935, and Cisco has been confirmed as affected.

Hundreds of Salesforce Customers Allegedly Targeted in New Data Theft Campaign

www.securityweek.com · 4 months ago

A new data theft and extortion campaign is targeting Salesforce customers. The cybercrime group ShinyHunters claims to have compromised data from several hundred companies using social engineering and exploiting customer misconfigurations. Attackers are abusing a modified version of the Aura Inspector tool to extract data from Salesforce instances, specifically through overly permissive guest user settings. Salesforce emphasizes that its platform is secure, and these incidents are not due to vulnerabilities within its products.

Chrome Extension Sold to New Operators Became a Full Malware Chain — Caught via Console Logs, Google Pulled It, THN Covered It (ShotBird)

monxresearch-sec.github.io · 4 months ago

A malicious campaign has compromised a popular Google Chrome extension, allowing attackers to gain control of user browsers and potentially their computers. The attackers altered developer information to secretly inject malicious code that delivered fake Chrome updates containing malware disguised as a legitimate installer. This sophisticated operation, potentially linked to Russian-speaking operators, involved techniques to bypass security measures and steal sensitive data. The attack shares characteristics with a prior campaign and Google has been notified.

SAP Releases Patches for Security Flaws Allowing Remote Code Execution

gbhackers.com · 4 months ago

SAP recently released security updates addressing fifteen vulnerabilities across its enterprise software products. The most critical issue is a code injection vulnerability in the SAP Quotation Management Insurance application, identified as CVE-2019-17571, which could allow remote code execution. Another critical flaw, CVE-2026-27685, is an insecure deserialization vulnerability in SAP NetWeaver. Administrators are urged to immediately apply these patches to protect systems and review the SAP Support Portal for a complete list of affected products.

Escape Raises $18 Million to Automate Pentesting

www.securityweek.com · 4 months ago

false

Recent Ivanti Endpoint Manager Flaw Exploited in Attacks

www.securityweek.com · 4 months ago

The US Cybersecurity Agency is urging organizations to immediately patch several vulnerabilities. A high-severity authentication bypass flaw, CVE-2026-1603, exists in Ivanti Endpoint Manager, potentially allowing credential data leakage. Another vulnerability, CVE-2021-22054, is a server-side request forgery issue impacting VMware Workspace One UEM, and a remote code execution flaw, CVE-2025-26399, affects SolarWinds Web Help Desk. Federal agencies are required to patch these vulnerabilities within one week.

CISA: Recently patched Ivanti EPM flaw now actively exploited

www.bleepingcomputer.com · 4 months ago

The Cybersecurity and Infrastructure Security Agency has identified a high-severity vulnerability in Ivanti Endpoint Manager software as actively exploited. The flaw, tracked as CVE-2026-1603, allows attackers to bypass authentication and steal credentials. Federal agencies are required to patch systems within three weeks, and Ivanti reports it has not received any confirmation of exploitation despite a large number of internet-facing instances. Previous Ivanti EPM vulnerabilities, including CVE-2024-13159, CVE-2024-13160, CVE-2024-13161, and CVE-2024-29824, have also been exploited in the wild.