Blahalla

Coralogix Raises $200M at $1.6B Valuation to Scale AI Observability Platform

www.securityweek.com · 4 months ago

Coralogix offers a full-stack observability platform that unifies logs, metrics, traces, security, and AI observability.

Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)

thehackernews.com · 4 months ago

A use-after-free vulnerability in Redis's blocking-client code allows authenticated users to run arbitrary OS commands on the host machine. The flaw, tracked as CVE-2026-23479, debuted in Redis 7.2.0 and remained unpatched across stable branches for over two years. Researchers discovered this critical bug using an autonomous AI tool, prompting fixes applied on May 5.

CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog

thehackernews.com · 4 months ago

CISA added a critical flaw impacting Mirasvit Cache Warmer to its Known Exploited Vulnerabilities catalog following reports of active exploitation. The vulnerability, CVE-2026-45247 (CVSS score: 9.8), involves the deserialization of untrusted data within the popular Magento full-page cache extension. These findings underscore an urgent need for users to patch the system immediately.

Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT

thehackernews.com · 4 months ago

Researchers flagged a malspam campaign that exploits Google's legitimate DoubleClick domain for evasion. Attackers route the lure through this trusted domain, bypassing security tools before delivering their payload. This effort ultimately distributes a remote access trojan named DesckVB RAT.

Cisco Finesse Remote File Inclusion Vulnerability

sec.cloudapps.cisco.com · 4 months ago

Cisco identified CVE-2026-20175 in Cisco Finesse, a remote file inclusion vulnerability. Attackers can exploit this flaw by persuading a user to click crafted links, which loads arbitrary external files into an active session due to insufficient HTTP input validation. Organizations must apply the updated fixed software releases provided by Cisco to fully remediate the risk of script execution.

Cisco Webex Meetings Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 4 months ago

Cisco issued an advisory for CVE-2026-20233, a Cross-Site Scripting vulnerability affecting the Webex Meetings web interface. This flaw allowed unauthenticated, remote attackers to execute arbitrary scripts through insufficient user input validation. Cisco addressed this vulnerability within the cloud service, meaning customers require no immediate action or workarounds.

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

sec.cloudapps.cisco.com · 4 months ago

Cisco released advisory CVE-2026-20230 regarding an SSRF vulnerability affecting Cisco Unified CM and SME. When running, improper input validation allows unauthenticated remote attackers to exploit this flaw using crafted HTTP requests aimed at the WebDialer service. Successful exploitation permits file writing on the underlying OS, potentially enabling root privilege escalation.

CISA Flags 2-Year-Old Oracle WebLogic Vulnerability as Actively Exploited

www.techrepublic.com · 4 months ago

CISA added Oracle WebLogic flaw CVE-2024-21182 to its KEV catalog, giving federal agencies until June 4 to patch exposed servers.

CISA warns of active attacks exploiting Android, Linux bugs

www.bleepingcomputer.com · 4 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting vulnerabilities in the Linux kernel and Android operating system.

Beyond the Zero-Day: See Your Network Like an Attacker | Webinar with HD Moore

thehackernews.com · 4 months ago

Security expert HD Moore argues organizations must assume a breach exists due to rapidly accelerating zero-day exploits written by AI. Winning the race to patch vulnerabilities is nearly impossible; therefore, defenses should focus on correctly shaping the network perimeter. This crucial architectural design limits what an intruder can reach after gaining initial access.

Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag

thehackernews.com · 4 months ago

M365 Android builds flaw bypasses token sharing restrictions. Malicious apps can steal tokens from any app, granting unauthorized access to emails, files, and calendars. No CVE number was provided.

What 345 Days of Untested Exposure Looks Like at a Bank

www.bleepingcomputer.com · 4 months ago

A two-week penetration test can leave roughly 345 days of real-world exposure unvalidated. Sprocket Security explores why continuous testing is becoming critical as attack surfaces constantly change.

Error 524 Decoy Campaign Uses Brand Impersonation to Phish Mobile Users

gbhackers.com · 4 months ago

Group-IB documented a large-scale smishing campaign impersonating over 260 brands across 72 countries. Attackers leverage fake Cloudflare "Error 524" pages as decoy landing zones, concealing malicious logic from automated scanners and security researchers. This technique only delivers the phishing content to targeted mobile users in regions including Latin America, Europe, and APAC.

Kirki, Burst Statistics WordPress Plugin Flaws in Attackers’ Crosshairs

www.securityweek.com · 4 months ago

Kirki plugin versions 6.0.0 to 6.0.6 have a vulnerability, CVE-2026-8206, allowing attackers account takeover via the password reset feature. Burst Statistics plugins (versions 3.4.0, 3.4.1.1) allow unauthenticated privilege escalation through a REST API request impersonating an administrator. Update Kirki to version 6.0.7 or newer and Burst Statistics to version 3.4.2 or later to fix these issues.

Security of 100 AI Agents Tested and Ranked – What You Need to Know

www.securityweek.com · 4 months ago

Researchers evaluated 100 AI agents and classified them in a new Risk Quadrant, finding only 11 operate with both capability and robust defenses. The analysis warns of the "lethal trifecta", private data access combined with exposure to untrusted content and outbound actions, which poses systemic risk.

Gentlemen Ransomware Exploits Fortinet Flaws, AI, and Custom C2 Tools

gbhackers.com · 4 months ago

A leak analyzing The Gentlemen ransomware group reveals operators recycle intrusion techniques across major brands like Conti and Black Basta. These attackers exploited Fortinet edge devices using CVE-2024-55591 while also embedding AI tools such as ChatGPT for crafting phishing messages.

Hackers Target Global Stock Exchange in Espionage Operation

www.securityweek.com · 4 months ago

Individuals accessed a senior executive’s Outlook mailbox at a global stock exchange for an estimated 150 days, seeking intelligence for espionage. The attackers deployed malware disguised as Adobe and OneDrive applications to establish persistence and steal sensitive information. To evade detection, they exfiltrated data in small batches using Dropbox and OneDrive services over several months.

Interesting- What LLM vuln research looks like

claroty.com · 4 months ago

Team82 used Anthropic’s Claude Opus 4.6 model to conduct hands-free vulnerability research on the Zenitel TCIV-3+ video intercom platform. Researchers replicated prior manual testing that uncovered critical flaws, including command-injection and cross-site scripting vulnerabilities. This automated approach demonstrates how AI could dramatically speed up security discovery.

WordPress Plugin Flaw Opens Door to Privilege Escalation Attacks Across 500,000+ Sites

gbhackers.com · 4 months ago

A critical flaw in the Kirki WordPress plugin, tracked as CVE-2026-8206, enables unauthenticated attackers to achieve full account takeover and privilege escalation. This vulnerability affects versions 6.0.0 through 6.0.6 by exploiting a logic flaw in the password reset workflow. Site owners must update immediately to the patched version 6.0.7 to mitigate this severe threat.

Expiring Microsoft Secure Boot Keys May Block DBX Updates on Legacy Devices

gbhackers.com · 4 months ago

Microsoft Secure Boot keys expire on June 27, 2026, when KEK CA 2011 stops authorizing DB/DBX updates via Windows Update. This expiry prevents affected Windows and Linux systems from getting future boot-level protections or revocations through Microsoft's servicing channel. Devices will continue booting initially but lose the ability to incorporate new security certificates after this period ends.

IMA Diligence Services Data Breach Impacts 525,000 People

www.securityweek.com · 4 months ago

IMA Diligence Services confirmed over 525,000 individuals suffered a data breach when attackers accessed their third-party server between December 8 and December 16. Hackers stole highly sensitive records, including SSNs, driver’s license numbers, financial account details, and medical information.

Critical Apache ActiveMQ Vulnerability Exposes Systems to Security Header Injection Attacks

gbhackers.com · 4 months ago

Apache ActiveMQ disclosed CVE-2026-42253, a critical header injection flaw from the MessageServlet's mishandling of JMS properties. Exploiting this allows injecting arbitrary HTTP headers, possibly causing XSS or session hijacking. Additionally, CVE-2026-49157 lets low-privilege users misuse Jolokia controls for unauthorized configuration changes; upgrade to versions like 5.19.7 or 6.2.

Malicious Notifications Could Trick Google Gemini Users

www.darkreading.com · 4 months ago

SafeBreach identified a prompt injection vulnerability in Google Gemini's voice assistant that lets attackers misuse message notification summaries. Attackers bypassed guardrails using "Fake Context Alignment," enabling unauthorized actions like controlling smart devices or executing social engineering commands.

Shrinking the IAM Attack Surface through Identity Visibility and Intelligence Platforms (IVIP)

thehackernews.com · 4 months ago

Securing organizations against software vulnerabilities involves steps focused on AI models. Experts must deploy defenses that specifically address weaknesses discovered by artificial intelligence systems. These measures help safeguard enterprise operations leveraging machine learning capabilities.

Organizations Warned of Exploited Linux Kernel Vulnerability

www.securityweek.com · 4 months ago

CISA warned of active exploitation of CVE-2022-0492, an improper authentication bug in Linux kernel cgroups v1. This flaw enables attackers to bypass namespace isolation, allowing container escapes and privilege escalation via modifying the releaseagent file. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate patching across federal agencies.

Acer working to patch max severity zero-days in Wave 7 routers

www.bleepingcomputer.com · 4 months ago

Acer confirmed two maximum-severity zero-day vulnerabilities in its Wave 7 mesh routers, affecting devices with older firmware versions. A security researcher reported CVE-2026-49200, which allows unauthenticated remote access to plaintext login credentials stored in log archives.

Microsoft wants to put AI agents on a short leash

www.csoonline.com · 4 months ago

Microsoft unveiled new controls to secure agentic AI workflows at Build 2026. They introduced Microsoft Execution Container (MXC), a runtime containment technology that sandboxes autonomous agents by strictly limiting their access to files, networks, and credentials. The company expanded MDASH, its multi-agent vulnerability research system, enhancing security across the development lifecycle.

38% of GitHub Actions Workflows Exposed to Script Injection Risks

gbhackers.com · 4 months ago

Analysis reveals that 38% of organizations utilize vulnerable GitHub Actions workflows susceptible to script injection or unsafe triggers. Attackers exploit these flaws using techniques like the s1ngularity attack, which abuses the pullrequesttarget trigger. This risk is compounded because 71% of organizations fail to pin actions to specific commit hashes, leaving them open to tampered versions.

AI Used to Decrypt Medieval Ciphers

www.schneier.com · 4 months ago

Researchers utilize machine learning algorithms to tackle historical pencil-and-paper ciphers. This technique represents an application of AI in cryptanalysis, potentially allowing decoding of materials previously deemed secure by historians and cryptographers.

Hacking your PC using your speaker without ever touching it

blog.nns.ee · 4 months ago

Researchers found vulnerabilities in the Creative Sound Blaster Katana V2X, allowing attackers to remotely transform the USB speaker into a covert spying tool or BadUSB device. The exploit operates within approximately 15M range and requires neither physical contact nor pairing with the device.

‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in Seconds

www.securityweek.com · 4 months ago

Researchers warn that the "HTTP/2 Bomb" exploits a compression bomb against HPACK with Slowloris-style holds, causing denial of service on web servers. The attack targets default HTTP/2 configurations in major platforms like NGINX, Apache, IIS, Envoy, and Cloudflare Pingora, potentially impacting 880,000 sites.

Ivanti ITSM Flaw Could Allow Attackers to Escalate to Admin Access

gbhackers.com · 4 months ago

A critical vulnerability, CVE-2026-9614, impacts Ivanti Neurons for ITSM, allowing authenticated attackers to escalate privileges within the platform. This improper access control flaw allows remote exploitation without user interaction, granting full administrative system access.

Hackers Leverage AI-Powered Tools to Streamline Active Directory Compromise

gbhackers.com · 4 months ago

Attackers leveraged AI-powered tools to streamline Active Directory compromise and evade Endpoint Detection and Response systems. Sophos revealed a post-exploitation framework using customized Cobalt Strike profiles and a Telegram Bot API C2 channel routed through Cloudflare Workers.

Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes

thehackernews.com · 4 months ago

Researchers disclosed an unpatched vulnerability allowing exploitation to disclose a user's NTLMv2 hash to attackers. Huntress identified the issue resides within the Windows Search URI handler. The flaw echoes concerns raised by CVE-2026-33829, which previously impacted the ms-screensketch URI handler.

Police dismantles 9 crime groups in illegal streaming crackdown

www.bleepingcomputer.com · 4 months ago

Agencies coordinated "Operation KRATOS 2," dismantling nine organized crime groups and arresting 29 suspects involved in illegal streaming operations. This joint effort spanned 13 countries, allowing investigators to pinpoint over 18,000 IP addresses and remove more than 27,000 unauthorized streaming URLs.

Global Stock Exchange Hit by Monthslong Email Campaign

www.darkreading.com · 4 months ago

Researchers documented how someone spied on an influential finance executive at a global stock exchange for over five months. The attackers gained access to the executive's Microsoft Outlook mailbox, systematically stealing sensitive corporate communications.

AI may finally unlock the cyber budgets CISOs have wanted for years

www.csoonline.com · 4 months ago

Autonomous, agentic AI systems create unprecedented operational risks across enterprises. Security leaders now face challenges where AI blurs historical boundaries and collapses system isolation, exposing technical debt. This realization drives a structural shift, compelling organizations to increase cybersecurity spending against AI threats.

Microsoft Tries to Calm Legal Threat Fears After Zero-Day Disclosure Backlash

www.securityweek.com · 4 months ago

A researcher publicly disclosed PoC exploits for multiple unpatched vulnerabilities in Microsoft products, including CVE-2026-33825 and CVE-2026-45498. This action drew legal threats from Microsoft regarding proper vulnerability disclosure procedures.

HazyBeacon Campaign Abuses AWS for Stealthy C2 Communications

gbhackers.com · 4 months ago

Cyber espionage group HazyBeacon, tracked as CL-STA-1020, targets government networks in Southeast Asia by abusing AWS for stealthy command-and-control channels. The operation utilizes stolen IAM credentials to deploy lightweight Lambda functions with unauthenticated public endpoints.

Google adds Android protection against AI deepfake scam calls

www.bleepingcomputer.com · 4 months ago

Google released "fake call detection," an Android security feature rolling out globally to combat AI deepfake impersonation scams. When using Phone by Google, the system verifies calls by sending encrypted confirmation signals; if spoofed, the recipient's device pings the contact's actual phone for instant verification.

Lessons from the Canvas cyberattack

www.csoonline.com · 4 months ago

The ShinyHunters criminal group targeted Canvas LMS users on May 6 and 7, 2026, defacing login pages and warning of an Instructure compromise. The attackers reportedly stole 3.65 terabytes of sensitive data from nearly 9,000 educational institutions globally, affecting 275 million students and staff.

Windows Search URI Handler Vulnerability Exposes NTLMv2 Hashes to Remote Attackers

gbhackers.com · 4 months ago

Windows systems are once again exposed to NTLM credential leakage through a newly observed abuse of the search, URI handler, a vulnerability class closely mirroring the previously patched CVE-2026-33829 in the Snipping Tool. Windows Search URI Handler Vulnerability Security researchers from Huntress have identified that the Windows search URI handler improperly processes user-supplied parameters, allowing attackers to coerce

HTTP/2 Bomb Remote DoS Exploit Impacts nginx, Apache, IIS, Envoy, and Cloudflare Pingora

gbhackers.com · 4 months ago

Security researcher Quang Luong disclosed an "HTTP/2 Bomb" attack allowing remote Denial-of-Service against major servers including nginx, Apache httpd, and Microsoft IIS. The exploit combines HPACK header compression abuse with flow-control stalling, creating a memory exhaustion vector that consumes massive server resources using low bandwidth.

New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare

thehackernews.com · 4 months ago

Researchers discovered a remote denial-of-service exploit, dubbed "HTTP/2 Bomb," affecting major web servers. This vulnerability resides in the default HTTP/2 configurations of systems including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The flaw enables attackers to execute a Denial-of-Service attack against these critical services.

Abusing iDEAL (Wero): how criminals weaponise legitimate payment links in phishing

zolder.io · 4 months ago

Criminals exploit the iDEAL payment system in the Netherlands by capturing valid transaction URLs for phishing attacks. They initiate purchases on favored merchants, such as crypto exchanges or gift card resellers, to acquire these functional links.

CISA Warns of Cyberattacks Targeting U.S. Tank Gauge Systems

gbhackers.com · 4 months ago

CISA and federal partners warned of ongoing cyberattacks targeting Automatic Tank Gauge (ATG) systems across critical sectors like energy and transport. Attackers exploit weak security controls, utilizing techniques such as default credentials or SQL injection flaws to gain unauthorized access.

Laravel CRLF Injection Flaw Could Disrupt Outbound Email Handling

gbhackers.com · 4 months ago

A high-severity CRLF Injection flaw, tracked as CVE-2026-48019, affects Laravel's email validation logic by improperly neutralizing carriage return sequences. This vulnerability allows attackers to manipulate outgoing messages using user input, potentially bypassing authentication and redirecting emails without detection.

Fake Purchase Orders Spread JS.MonoGlyphRAT in U.S. Enterprise Attacks

gbhackers.com · 4 months ago

Malware uses fake purchase orders containing JS attachments to infiltrate US enterprises with the JS.MonoGlyphRAT backdoor. This malware executes via Windows Script Host and establishes persistence by adding an autorun entry while using distinctive "monoglyph" obfuscation. The RAT communicates with a C2 server over HTTP, collecting detailed host telemetry using WMI for remote control.

VS Code zero-day lets hackers steal GitHub tokens in one click

www.bleepingcomputer.com · 4 months ago

Security researcher Ammar Askar disclosed a VS Code zero-day vulnerability exploiting the sandboxed webview system. This flaw lets attackers install malicious extensions that steal GitHub OAuth tokens when users interact with github.dev. The exploit allows actors to query the GitHub API, enumerating all private repositories accessible via the victim's token.

Golang code review notes II - elttam

www.elttam.com · 4 months ago

The article offers notes for auditing Golang code, focusing on subtle behaviors beyond obvious bugs. It details how Go 1.24 introduced os.Root APIs to mitigate path traversal by establishing secured root directories. Authors also release new Semgrep rules to help secure coding practices against tricky, persistent vulnerabilities.