Blahalla

1-Click GitHub Vulnerability Enables OAuth Token Theft

gbhackers.com · 4 months ago

A newly disclosed vulnerability in GitHub’s browser-based editor, GitHub.dev, allows attackers to steal powerful OAuth tokens with just a single click, giving them read and write access to private repositories. The flaw exploits how Visual Studio Code (VSCode) webviews handle keyboard events and message passing, enabling a malicious repository to execute attacker-controlled actions inside the

50+ Malicious Chrome Extensions Hit 30K Users

gbhackers.com · 4 months ago

50+ malicious Chrome extensions posing as “live wallpaper” utilities have been caught running an adware operation that hijacks browser behavior and quietly pushes remote HTML content to around 30,000 users. These extensions were distributed through at least three publisher accounts and made available via the Chrome Web Store and third‑party download portals that advertised animated

Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content

thehackernews.com · 4 months ago

Cybersecurity researchers flagged Weedhack, a Malware-as-a-Service campaign targeting Minecraft players. The threat utilizes YouTube as a vector, spreading malware by impersonating official game clients and mods. This malicious activity aims to gain control of victims' systems through compromised platforms.

CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities (Severity: HIGH)

security.paloaltonetworks.com · 4 months ago

There are authentication bypass vulnerabilities identified as CVE-2026-0257 in the GlobalProtect portal and gateway of PAN-OS that can allow an attacker to bypass security restrictions and establish an unauthorized VPN connection. Palo Alto Networks rates the issue as medium severity with suggested urgency moderate and reports CVSS metrics of 4.7 and 7.8. Affected releases include multiple PAN-OS 12.1, 11.2, 11.1 and 10.2 builds and the vendor recommends upgrading to specified fixed versions. Mitigations include generating and using a dedicated certificate for authentication override cookies or disabling authentication override until systems are patched.

Hackers Spread WeedHack Malware via YouTube and SEO Poisoning

gbhackers.com · 4 months ago

Hackers are increasingly abusing trusted platforms like YouTube and search engines to distribute malware, and a newly uncovered campaign targeting Minecraft players highlights how effective this tactic has become. Minecraft, originally released in 2011 by Mojang Studios, remains the best-selling video game globally with more than 350 million copies sold. Its open ecosystem, which supports

Microsoft MSRC Allegedly Declines Action on Dependency Confusion Vulnerability

gbhackers.com · 4 months ago

Microsoft is facing scrutiny after reportedly declining to treat a critical dependency confusion vulnerability affecting Azure Portal assets as a security issue, despite a proof-of-concept exploit demonstrating remote code execution (RCE). Security researcher Wahid Fayad identified the issue while analyzing JavaScript assets served via portal.azure.com. The investigation revealed an internal Node.js dependency, FxInternal/NetDiagnostics, that was not

Project Glasswing Grows as Anthropic Extends Claude Mythos Preview Program

gbhackers.com · 4 months ago

Anthropic has expanded its Project Glasswing initiative, significantly scaling access to its Claude Mythos Preview model as part of a broader effort to strengthen global software security. The program, first launched in April 2026 with around 50 organizations, has now grown to include approximately 200 partners worldwide, marking a major shift in how artificial intelligence

North Korean APT Targets macOS to Steal Crypto Wallets and SSH Keys

gbhackers.com · 4 months ago

A newly uncovered macOS intrusion campaign attributed to the North Korean state-sponsored threat group Sapphire Sleet, also known as BlueNoroff or UNC1069, is targeting high-value organizations in the financial and cryptocurrency sectors. The operation focuses on venture capital firms, Web3 developers, and crypto platforms, highlighting a continued shift in North Korean cyber operations toward financially

Red Hat Confirms Supply Chain Breach Impacting @redhat-cloud-services npm Packages

gbhackers.com · 4 months ago

Red Hat has confirmed a supply chain security breach impacting multiple npm packages under the @redhat-cloud-services namespace, as detailed in security bulletin RHSB-2026-006 released on June 2, 2026. The incident was publicly disclosed a day earlier and stems from a compromised GitHub account that introduced malicious code into trusted repositories maintained within Red Hat’s infrastructure.

Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign

www.microsoft.com · 4 months ago

A large-scale npm supply chain attack compromised over 90 versions of @redhat-cloud-services packages, silently infecting CI/CD environments and developer systems. The malicious code steals credentials from GitHub, cloud platforms, and local machines, then spreads like a worm by republishing trusted packages. Discover how the attack works, what data is at risk, and the steps you can take to protect your organization.

Trump Signs Executive Order Seeking Oversight of A.I. Models

www.nytimes.com · 4 months ago

The order, which signaled a shift from the hands-off approach the White House had previously taken toward A.I., followed debates over how to gain control of A.I. models without disrupting innovation.

Anthropic grants Project Glasswing access to 150 more companies, with a focus on critical infrastructure

www.csoonline.com · 4 months ago

Anthropic added 150 companies, focusing on critical infrastructure like power, water, and healthcare, to its Project Glasswing vulnerability hunting initiative. While this expansion increases bug identification rates using AI, analysts warn the sector faces a major "patch bottleneck.

Scientists Find Way to Supercharge Dangerous Computer ‘Worms’ With A.I.

www.nytimes.com · 4 months ago

Researchers at the University of Toronto showed how hackers could use artificial intelligence to create a program that could target any known flaw in the world’s computers.

Two-year old Oracle WebLogic Server vulnerability is being exploited

www.csoonline.com · 4 months ago

US federal government departments have been given until Thursday to patch a two-year old high severity vulnerability in Oracle WebLogic Server that could allow an unauthenticated attacker to access critical data. The vulnerability, CVE-2024-21182, was added Monday to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog, giving federal Oracle admins a mere four days to plug the hole. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. While the KEV is aimed at US federal departments, inclusion of a vulnerability on the list should be taken as a warning to the private sector as well. At the time it was discovered, this vulnerability was rated 7.3 on the CVSS scale, nowhere near the 9+ rating that many infosec pros would see as signaling a need for immediate attention. However, Robert Enderle, a consultant who heads the Enderle Group, said the inclusion of this vulnerability in the KEV now means that CISA has recently confirmed that threat actors are actively weaponizing it. “To make the CISA KEV means that we’re seeing active exploitations,” agreed Tyler Reguly, Fortra’s associate director of security R&D. “Given that this CVE was patched by Oracle in the July 2024 Critical Patch Update (CPU), I would expect most admins to have patched this by now, particularly since it is a WebLogic vulnerability and, prior to the addition of this CVE, there were already a dozen WebLogic vulnerabilities listed in the KEV catalog.” Older vulns under exploit Reguly also had an observation about how fast vulnerabilities are added to the KEV. Based on a cursory review, he figured only about 41% of CVEs in the list were added during the same year they were released. Looking at release year + 1, that goes up to about 58%. That still means that, surprisingly, more than 40% of the CVEs added to the CISA KEV catalog are added two or more years after they are released. “I suppose it makes sense that it [the two-year-old Oracle hole] is just popping up now, if you consider that an organization that hasn’t patched their systems in multiple years is likely an easier target than an organization that patches regularly. After all, regular patching probably implies a more security-conscious environment.” Asked for comment on why this vulnerability is being added two years after its discovery, a CISA spokesperson referred to the department’s webpage explaining criteria for including bugs in the catalog, which says the list is of vulnerabilities that have been exploited in the wild. The spokesperson didn’t answer a question about how many federal servers were still unpatched after so long. Oracle WebLogic Server is a unified and extensible platform for developing, deploying, and running enterprise applications in Java, on-premises and in the cloud. It’s fully supported on Kubernetes, and enables users to migrate and efficiently build modern container apps with comprehensive Java services. It short, it’s a vital piece of middleware that can host sensitive corporate data. Not surprisingly, threat actors are eager to exploit any vulnerabilities of this type. In 2019 it was reported that threat actors were scanning for WebLogic servers vulnerable to a new method of bypassing protections that Oracle had fixed the year before. Earlier this year, security firm CloudSek set up a honeypot to study threat actor response to a newly discovered and extremely serious WebLogic Server remote code execution vulnerability, CVE-2026-21962, with a CVSS score of 10, as well examining their interest in older holes. Over a 12 day period, attack attempts targeting the new zero day-like flaw were observed immediately following the public release of its exploit code, “demonstrating the rapid weaponization of critical Oracle WebLogic vulnerabilities.” Attackers also tried to exploit a flaw reported in 2017 and two 2020 vulnerabilities in the unpatched honeypot server that CloudSek created. Slow patching a ‘clear risk’ Given the importance of Oracle products to large enterprises, the company recently switched to a monthly security patch release cycle from quarterly. The first of these patches was released Monday. The recent addition of the WebLogic vulnerability to the KEV illustrates a common problem in how many organizations handle security, said Gene Moody, field CTO at Action1. “The issue is not just the vulnerability itself. The bigger problem is the delay between when a fix is released and when it is actually applied to real systems. That delay gives attackers a chance to act, while also signaling that the security practices of the target org may be under-enforced.” It takes on average around 60 days for organizations to apply patches, he pointed out. Meanwhile, attackers are building and using exploits in just hours or days. This gap creates a convenient window where unpatched systems become simple targets, he pointed out. In addition, systems suffering from vulnerabilities greater than a year in age are likely not silos in an otherwise well-managed vulnerability management plan. “Attackers pay close attention to how quickly patches are applied,” he said. “When a well-known fix is not widely used, it demonstrates more than just exposure. It can point to poor system tracking, weak patch processes, or other priorities taking focus away from security. These issues often mean there are more weaknesses beyond the one vulnerability.” Organizations should treat slow patching as a clear risk, Moody warned, not just a yet another task waiting to be done. To improve the situation, there needs to be better tracking of systems, clear patch timelines, and making sure that fixes are actually applied, not just planned.

Microsoft's Coreutils project brings Linux commands to Windows

www.bleepingcomputer.com · 4 months ago

Microsoft announced today at its Build 2026 developer conference the release of Coreutils for Windows, bringing many commonly used Linux command-line utilities to Windows as native applications.

OpenAI upgrades GPT-5.5, as it plans to retire legacy ChatGPT models

www.bleepingcomputer.com · 4 months ago

OpenAI says it's rolling out a new update that improves the existing GPT-5.5 Instant model, and this move comes ahead of the scheduled retirement of multiple legacy models, including o3.

Critical Kirki flaw exploited to hijack WordPress admin accounts

www.bleepingcomputer.com · 4 months ago

Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators.

Over 116,000 Minecraft systems infected in WeedHack malware campaign

www.bleepingcomputer.com · 4 months ago

A large-scale malware campaign dubbed WeedHack is targeting Minecraft players and has infected more than 116,000 systems since January.

Over 116,000 Mincraft systems infected in WeedHack malware campaign

www.bleepingcomputer.com · 4 months ago

A large-scale malware campaign dubbed WeedHack is targeting Minecraft players and has infected more than 116,000 systems since January.

Zoom CISO: AI as a Security Enabler, Not Role-Replacer

www.darkreading.com · 4 months ago

As Zoom's CISO, Sandra McLeod, discusses the challenges of securing a global communication platform, the promise of AI-driven security workflows, and advice for aspiring cybersecurity leaders.

FBI-Flagged Phishing Kit Kali365 Expands Its Reach

www.darkreading.com · 4 months ago

Once targeting just Microsoft 365, the phishing-as-a-service platform now aims at AWS, Okta, and Russian platforms, while relying on device code phishing.

HP Poly VoIP vulnerability sets the stage for executive voice deepfakes

www.csoonline.com · 4 months ago

Researchers from Rapid7 discovered CVE-2026-0826, a critical buffer overflow vulnerability in HP Poly VoIP phones when ICE enables peer connections. This flaw allows unauthenticated attackers to obtain root privileges using specially crafted SIP INVITE requests, enabling eavesdropping and collecting audio data for deepfakes.

DriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks

www.darkreading.com · 4 months ago

A sneaky, wide-scale IAB operation uses a malicious traffic distribution system (TDS) to redirect visitors of trusted websites to ones that deliver malware.

Trump Signs Executive Order That Invites Vetting of Top AI Models for National Security Risks

www.securityweek.com · 4 months ago

The order establishes a framework for the federal government to vet the national security risks of the most advanced AI systems for up to a month before their public release.

AI-built ransomware toolkit automates EDR evasion, AD discovery

www.bleepingcomputer.com · 4 months ago

A threat actor is using an AI-built ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and response (EDR) solutions.

China Uses Dual-Method Cyberattack on Czech Orgs

www.darkreading.com · 4 months ago

China is stealing data from high-value targets via a sneaky, double-layer spear-phishing campaign that includes the Azureveil malware.

Cisco Live 2026: New Security Tools Target AI Threats

www.techrepublic.com · 4 months ago

At Cisco Live 2026, the company unveiled Cloud Control, Live Protect, and Hybrid Mesh Firewall to help enterprises manage security operations in the AI era. The platform unifies monitoring across compute, networking, and security domains, connecting to over 50 third-party tools via ModelContext Protocol.

Securing AI Agents Before They Go Rogue Is Next to Impossible

www.darkreading.com · 4 months ago

High-autonomy agents with broad permissions and unfettered access are a recipe for disaster, and enterprises need to act now before they become the next horror story.

Four coordinated npm supply chain campaigns active in May–June 2026 — TTPs, IOCs, and detection notes

www.sonatype.com · 4 months ago

Sonatype researchers documented a campaign involving 176 malicious npm packages exploiting dependency confusion using high version numbers like 99.99.99. The attacker-controlled packages execute postinstall scripts to download platform-specific payloads, which then steal sensitive data including credentials and CI/CD secrets from developer environments.

Trump revives parts of canceled AI order with cybersecurity-focused directive

www.csoonline.com · 4 months ago

Donald Trump signed an executive order called Promoting Artificial Intelligence Innovation and Security. This directive strengthens cybersecurity defenses by directing federal agencies to accelerate AI deployment for cyber capabilities. Furthermore, the order establishes a voluntary government-industry vulnerability-sharing initiative and creates evaluation processes for frontier AI models.

Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited

thehackernews.com · 4 months ago

Google on Monday released patches for 124 security vulnerabilities impacting its Android operating system for the month of June 2026, including one high-severity flaw in the Framework component that has come under active exploitation. Tracked as CVE-2025-48595 (CVSS score: 8.4), the security flaw has been described as a case of privilege escalation without requiring any user interaction. The

Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine

thehackernews.com · 4 months ago

The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multiple malware families aimed at data theft and propagation. Per Sekoia, the activity involves the weaponization of CVE-2025-8088, a path traversal flaw in WinRAR, to launch an HTML Application payload dubbed GammaPhish, which is then used to retrieve an

Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation

thehackernews.com · 4 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The vulnerability, CVE-2024-21182 (CVSS score: 7.5), allows an unauthenticated attacker with network access to take control of susceptible servers. It was

We Added a Detection Rule. We Were Not Expecting This.

profero.io · 4 months ago

An analysis revealed a critical attack chain in AI agents utilizing the dangerous --allow-dangerously-skip-permissions flag. Researchers caution that merely blocking the shell fails to prevent data theft; an agent can still read SSH private keys, AWS credentials, and browser session databases. The flaw allows writing to critical files like ~/.

Anthropic Files to Go Public, Setting Stage for Huge I.P.O.

www.nytimes.com · 4 months ago

The artificial intelligence company has seen explosive growth over the last year thanks largely to new technology that can automatically write computer code.

The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2)

unit42.paloaltonetworks.com · 4 months ago

Security researchers have identified a sophisticated series of supply chain attacks within the npm ecosystem, initially dubbed "Shai-Hulud." The malware propagates through compromised packages, steals credentials from cloud environments like AWS, Azure, and Google Cloud, and exfiltrates data to command and control servers and public GitHub repositories. Attackers use wormable propagation, persistent CI/CD pipeline access, and obfuscated payloads to evade detection. The recent attack involved a malicious version of the @bitwarden/cli package, highlighting the need for enhanced security practices and vigilance.

Microsoft Build 2026: Securing code, agents, and models across the development lifecycle

www.microsoft.com · 4 months ago

Discover how Microsoft enables fast, secure AI development with MDASH and new security capabilities.

Microsoft Exchange Online outage causes email delays, failures

www.bleepingcomputer.com · 4 months ago

Microsoft is working to address a widespread service issue affecting the mail flow pipeline for Exchange Online customers across North America and Germany.

Two New Reports Offer Competing Explanations for Cybersecurity’s Growing Crisis

www.securityweek.com · 4 months ago

As AI shortens the path from vulnerability disclosure to exploitation, researchers disagree on whether the problem is inadequate security tools or inadequate operational control.

Fake Claude Code Installers Deliver Credential-Stealing Malware

www.techrepublic.com · 4 months ago

Fake Claude Code install sites are pushing malware that steals API keys, developer credentials, crypto wallets, and other sensitive data.

Google Patches Android Zero-Day Vulnerability in June 2026 Security Update

www.techrepublic.com · 4 months ago

Google’s June 2026 Android update fixes dozens of flaws, including a potentially exploited Framework vulnerability and critical system bugs.

Instagram users locked out after Meta AI abused to steal accounts

www.bleepingcomputer.com · 4 months ago

Multiple Instagram users had their accounts hijacked after attackers convinced Meta's AI-powered support tools that they were the legitimate owners.

Halo Security Honored with 2026 MSP Today Product of the Year Award

gbhackers.com · 4 months ago

Miami Beach, FL, USA, June 2nd, 2026, CyberNewswire Attack Surface Management Platform Recognized for Exceptional Innovation and Successful Deployment Through The Channel Halo Security today announced that its attack surface management solution has been named a 2026 MSP Today Product of the Year Award winner by TMC, a leading global media company recognized for building

Device Code Phishing Forensics: What We Learned Investigating BEC in the Wild

research.eye.security · 4 months ago

Researchers investigated Device Code Phishing as a forensic method used in Business Email Compromise (BEC) attacks. Examining a DragonForce ransomware case, the research revealed techniques for analyzing how attackers exploit these systems. This investigation helps organizations defend against credential theft through phishing campaigns.

Exclusive: How One Line of Code Put Billions of Microsoft Android App Downloads at Risk

www.securityweek.com · 4 months ago

Researchers found a vulnerability in six Microsoft 365 Android applications, including Word and Excel. The flaw results from developers leaving a debug flag active in the production code, bypassing required security restrictions on token sharing. This oversight lets malicious third-party apps steal valuable Microsoft access tokens by requesting them through auto-updating malicious updates.

Android Update Patches Exploited Zero-Day, 123 Other Vulnerabilities

www.securityweek.com · 4 months ago

Google released an Android update patching 124 vulnerabilities, including high-severity zero-day CVE-2025-48595 affecting the Framework component. The advisory details that 18 critical flaws impact system components from Qualcomm and MediaTek, potentially enabling denial of service. Developers must apply these patches to mitigate risks like remote code execution across various Android subsystems.

Why the browser is now the front line for AI security

www.bleepingcomputer.com · 4 months ago

AI-powered attacks and shadow AI adoption are creating new security risks inside the browser. Push Security explains why browser visibility is becoming critical for both threat detection and AI governance.

Anthropic Expanding Mythos Access to 150 New Organizations

www.securityweek.com · 4 months ago

Anthropic expanded its Project Glasswing initiative, granting Mythos access to 150 new organizations from critical infrastructure sectors like power, water, and healthcare. New partners include Okta, Samsung, ENISA, and NATO, all facing high potential cyberattack impact.

[An RX Global Event] Infosecurity Europe

www.darkreading.com · 4 months ago

Infosecurity Europe will be held in London from June 2, 2026 through June 4, 2026. It is positioned as the leading gathering for the cybersecurity industry in Europe, bringing the community together to share innovations, learn from one another, and test and benchmark solutions. Attendees are cybersecurity decision makers and stakeholders who will find expanded features including new zones, stages, networking events, product demonstrations, and learning opportunities aimed at informing investment and information assurance decisions.

FBI Warning: World Cup Scammers Are Spoofing FIFA Tickets, Job Sites

www.techrepublic.com · 4 months ago

The FBI warns that fake FIFA websites are targeting World Cup fans with phishing, ticket scams, fake merchandise, and job-related fraud.