Blahalla

Stolen Gemini API Keys Fuel Automated Telegram Influence Campaign

gbhackers.com · 4 months ago

A group used stolen Gemini API keys to automate a Telegram influence campaign over five years. The operator bypassed the AI's safety guardrails using prompt engineering and memory manipulation, enabling unrestricted content generation. Using these compromised resources, the group generated propaganda and compromised 29 WordPress administrator accounts.

Update Now: Apple Rolls Out Critical Fixes for iPhone 17, M5 Macs

www.techrepublic.com · 4 months ago

Apple released iOS 26.5.1 and macOS 26.5.1 to fix iPhone 17 charging issues and M5 Mac shutdown problems before WWDC.

CISA flags two-year-old Oracle flaw as actively exploited in attacks

www.bleepingcomputer.com · 4 months ago

CISA has ordered government agencies to secure their systems against a high-severity Oracle WebLogic Server vulnerability that was patched two years ago and is now actively exploited in attacks.

The Zero-Knowledge Threat Actor and the End of Responsible Disclosure

www.securityweek.com · 4 months ago

AI enables groups to conduct cyberattacks despite limited technical expertise. These adversaries leverage generative technology to automate attack planning, generate malware, and exploit vulnerabilities efficiently. Smaller organizations face heightened risk because security gaps, such as poor patching culture, make them prime initial access targets.

Critical Vulnerability in HP VoIP Phones Enables Enterprise Network Breaches

www.securityweek.com · 4 months ago

Rapid7 found a critical RCE vulnerability (CVE-2026-0826, CVSS 9.2) in multiple HP Poly Voice VoIP models allowing enterprise network breaches. The flaw uses a stack buffer overflow during SDP attribute parsing when ICE is active. Attackers exploit the bug with malicious SIP INVITE requests on affected VVX and Trio series phones; administrators must update firmware or disable ICE connectivity.

Infected Red Hat npm packages expose developer credentials

www.csoonline.com · 4 months ago

Researchers exposed a supply chain attack compromising Red Hat npm packages using malware named Miasma. This Shai-Hulud variant steals developer credentials and expanded its focus to collect Google Cloud and Azure identities. The attackers utilized unauthorized modifications across over 30 packages from the Red Hat Cloud Services namespace.

Beyond Assume-Breach: How AI-Native Security Will Reshape Enterprise Defense

www.darkreading.com · 4 months ago

Twenty years after Dark Reading launched, we're looking ahead at what's next for enterprise security. Spoiler: It's hyper-segmented, AI-orchestrated, and way more sophisticated than your dad's firewall.

Critical KMW CCTV Flaw Allows Unauthorised Access to Surveillance Feeds

gbhackers.com · 4 months ago

A critical vulnerability, CVE-2026-5386, permits unauthorized access to KMW CCTV feeds via an "unverified password change" flaw. This severe issue received a CVSS v3 score of 9.1 and impacts models like KM-IP521 across critical infrastructure sectors. CISA urges organizations to segment these systems with firewalls and avoid direct public internet exposure to mitigate risk.

Foreign Spyware Found on Phones of Top Russian Officials

gbhackers.com · 4 months ago

The FSB disclosed an alleged foreign cyber espionage campaign targeting top Russian officials' mobile devices. The spyware reportedly enables data exfiltration, live call interception, and unauthorized activation of microphones and cameras. Analysts suspect the attackers utilized zero-click vulnerabilities or exploited global telecom infrastructure to maintain covert access.

AI-Driven Exploitation is Destroying Vulnerability Management. Here’s How to Handle It.

thehackernews.com · 4 months ago

AI-driven exploitation timelines are rapidly shrinking, and they are not going to stop shrinking. Vulnerabilities are being discovered, reproduced, and weaponized faster than ever in the history of enterprise security. As a result, the window between a vulnerability being disclosed and indiscriminate exploitation observed across the internet is now measured in hours, not days. The industry's

Oracle WebLogic Vulnerability Exploited in the Wild

www.securityweek.com · 4 months ago

CISA warned organizations about active exploitation of the Oracle WebLogic vulnerability, CVE-2024-21182. This flaw enables remote, unauthenticated hackers to compromise critical data or gain complete access to vulnerable WebLogic Server instances. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on June 1, instructing federal agencies to remediate it by June 4.

Mustang Panda Uses LNK, PowerShell Chain to Deploy PlugX RAT

gbhackers.com · 4 months ago

Mustang Panda, an APT group linked to China, deploys PlugX RAT using multi-stage attacks. Attacks often start with weaponized LNK files disguised as "Browser Updater" lures. The attack chain uses PowerShell to drop payloads that deploy the RAT by exploiting DLL sideloading techniques. They misuse a legitimate G DATA antivirus component (Avk.

Claude Code GitHub Actions Flaw Exposes Repositories to Full Compromise

gbhackers.com · 4 months ago

A researcher identified a critical supply chain flaw in Anthropic’s Claude Code GitHub Actions workflow. This vulnerability allows attackers to bypass permission controls using malicious GitHub issues, triggering automated workflows with unvalidated input.

Attackers exploit Palo Alto GlobalProtect flaw days after disclosure

www.csoonline.com · 4 months ago

Exploitation of Palo Alto GlobalProtect vulnerability, CVE-2026-0257, allowed unauthorized VPN access shortly after vendor disclosure. This bug permits a fully credential-less authentication bypass, enabling attackers to create forged cookies and enter corporate networks without malware. Security experts advise treating this issue as critical due to the high enterprise risk.

Google fixes one actively exploited Android zero-day, 124 flaws

www.bleepingcomputer.com · 4 months ago

Google has released the June 2026 Android security patches to address 124 vulnerabilities, including one zero-day flaw exploited in targeted attacks.

The Intersection of Encryption and AI

www.schneier.com · 4 months ago

Bruce Schneier warned cryptography struggles to secure modern networks because its mathematical properties fail against threats like DDoS attacks and identity theft. He contrasted crypto’s defender-favoring structure with general computer security, describing it as a volatile arms race between attacker and defender.

Microsoft Threatening Security Researcher

www.schneier.com · 4 months ago

Anonymous researcher Nightmare Eclipse published multiple zero-day exploits targeting Microsoft Windows, including a vulnerability that breaks BitLocker encryption. Consequently, Microsoft has threatened legal action against the individual who released these security findings.

Meta Expands Safety Features for Teenagers

www.nytimes.com · 4 months ago

The changes, after Meta’s legal losses in two child safety cases, are aimed at limiting harmful content shown to teenagers on Instagram, Facebook and Messenger.

Meta AI Hands Over High-Profile Instagram Accounts to Hackers

www.securityweek.com · 4 months ago

Attackers exploited a logic flaw, classified as a 'confused deputy' issue, within Meta's AI account recovery assistant. This vulnerability allowed bad actors to trick the chatbot into resetting passwords and linking new emails for high-profile Instagram accounts, bypassing two-factor authentication (2FA).

How Leading Organizations Are Turning EDR Into Operational Resilience

thehackernews.com · 4 months ago

Most organizations now recognize that endpoint protection alone is no longer sufficient. That's why adoption of endpoint detection and response (EDR) has accelerated rapidly in recent years. Organizations understand that modern attacks move faster, evade traditional prevention controls, and require continuous visibility into suspicious activity across the environment. But owning EDR

CISA Warns of Active Exploitation of Palo Alto Networks PAN-OS Vulnerability

gbhackers.com · 4 months ago

CISA alerted that groups are actively exploiting CVE-2026-0257 in Palo Alto Networks PAN-OS. This authentication bypass vulnerability allows remote attackers to establish unauthorized VPN connections by bypassing standard login requirements. Organizations must immediately apply vendor patches, while federal agencies must remediate the flaw by June 1, 2026.

Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor

unit42.paloaltonetworks.com · 4 months ago

Malvertising campaign "Operation FlutterBridge" targets macOS systems, deploying FlutterShell, a backdoor that combines adware functionality with system control. The malicious payload grants shell command execution and file system manipulation capabilities to compromise devices.

Attack targeting OpenAI Codex users exposes AI software supply chain risks

www.csoonline.com · 4 months ago

Researchers at Aikido found that a malicious npm package, codexui-android, targeted OpenAI Codex users by stealing developer authentication tokens. The bad code was hidden in the published software artifact instead of disclosing it within the public source code repository.

Supply Chain Attack Hits 32 Red Hat NPM Packages

www.securityweek.com · 4 months ago

Hackers conducted a supply chain attack on Red Hat's NPM repository, publishing malicious versions of 32 packages in a rapid sequence. The payload distributed a Mini Shai-Hulud worm variant designed to harvest sensitive credentials, including GitHub secrets and cloud tokens. Organizations must rotate all affected tokens and API keys immediately as maintainers removed the compromised packages.

Pakistan-Linked SideCopy Targets Afghanistan Finance Ministry with Xeno RAT

thehackernews.com · 4 months ago

Cybersecurity researchers have disclosed details of a spear-phishing campaign likely undertaken by the Pakistan-aligned SideCopy group targeting Afghanistan's Ministry of Finance with an open-source remote access trojan called Xeno RAT. "The campaign opens with a spear phishing delivery - a ZIP archive containing a malicious LNK file bearing a carefully crafted Pashto-language filename,"

CISA Issues Alert on Oracle WebLogic Server Flaw Under Active Exploitation

gbhackers.com · 4 months ago

CISA added CVE-2024-21182, a critical flaw in Oracle WebLogic Server, to its Known Exploited Vulnerabilities catalog due to active exploitation. The vulnerability allows unauthenticated attackers access through the T3 and IIOP protocols. Organizations must urgently patch systems and restrict network exposure because successful compromise risks severe data theft or complete system control.

Android Zero-Day Vulnerability Actively Exploited in Device Takeover Attacks

gbhackers.com · 4 months ago

Google reported CVE-2025-48595, a critical zero-day vulnerability in the Android Framework component allowing remote privilege escalation. This flaw lets attackers perform "zero-click" attacks, enabling full device compromise without user interaction. Security experts urge users to apply the June 2026 security patch or later to reduce risk from exploitation.

Dashlane Brute-Force Attack Leads to Limited Encrypted Vault Downloads

www.securityweek.com · 4 months ago

On May 31, individuals launched a brute-force campaign against Dashlane, attempting to compromise accounts by guessing two-factor authentication codes. Attackers successfully downloaded encrypted vaults from fewer than 20 personal plan users by registering devices to targeted accounts.

34 Malicious Packages Steal Cloud Keys, Wallets, and SSH Credentials

gbhackers.com · 4 months ago

Attackers launched a "TrapDoor" supply chain campaign using 34 malicious packages across npm, PyPI, and Crates.io to steal cloud keys, SSH credentials, and cryptocurrency wallets from developers. Tools like token-usage-tracker and git-config-sync exploit package installation processes to harvest high-value data and modify build environments for persistent access.

Oracle’s First Monthly Patches Resolve 77 Vulnerabilities

www.securityweek.com · 4 months ago

Oracle released its first monthly Critical Security Patch Update (CSPU), patching 77 vulnerabilities including twelve critical flaws across five key products. These updates patch services like Database Server and REST Data Services, addressing multiple bugs exploitable by remote attackers without authentication.

Hackers Use Spearphishing to Deploy AZUREVEIL Adaptix C2 Agent

gbhackers.com · 4 months ago

Hackers deployed AZUREVEIL Adaptix C2 Agent using spearphishing in targeted campaigns against government sectors in Taiwan and the Czech Republic. The attack leverages malicious ZIP archives containing disguised files, enabling multi-stage execution chains through hidden VBScripts or standalone executables.

Critical StrongDM Flaw Exposes Users to Authentication Token Theft and Reuse

gbhackers.com · 4 months ago

SpecterOps disclosed CVE-2026-4387, a critical flaw in StrongDM allowing attackers to steal and reuse authentication tokens. The vulnerability stems from storing plaintext JWTs and key pairs within the local state.kv file. Attackers can copy this session data across systems to bypass MFA and gain unauthorized access to protected resources without credentials.

7 tabletop exercise mistakes that sabotage incident response

www.csoonline.com · 4 months ago

Cybersecurity experts recommend running tabletop exercises with clear, measurable objectives to test incident response readiness effectively. Sharon Chand advises organizations shift focus from vague breach walk-throughs to testing specific legal notifications, executive decision rights, and recovery prioritization.

SolyxImmortal Malware Steals Passwords, Cookies, Files, and Keystrokes

gbhackers.com · 4 months ago

A Python-based info stealer named SolyxImmortal actively steals sensitive user data, including browser credentials, cookies, files, and keystrokes. Researchers report the malware targets Turkish users, stealing passwords from Chromium browsers and exfiltrating data via Discord webhooks.

PHANTOMPULSE RAT Uses UAC Bypass to Hijack Windows Systems

gbhackers.com · 4 months ago

PHANTOMPULSE RAT achieves persistent access on Windows systems using process injection and a UAC bypass mechanism. The malware evades detection by utilizing direct system calls and hardware breakpoints to disable security features like AMSI or ETW.

TP-Link Router Security Bug Enables Remote Command Execution Attacks

gbhackers.com · 4 months ago

TP-Link disclosed CVE-2026-5509, a high-severity authenticated command injection flaw affecting Archer BE450 and BE7200 routers. Attackers logging in can exploit this vulnerability through the web management interface to execute arbitrary commands with elevated privileges. Users must upgrade firmware immediately to version 1.3.0 Build 20260416 or later to eliminate this risk.

Meta’s AI Bot Misused by Hackers to Take Over Instagram Accounts

gbhackers.com · 4 months ago

Hackers exploited Meta’s AI support chatbot using natural language requests to hijack Instagram accounts, bypassing two-factor authentication without needing passwords. This flaw allowed attackers to compel the bot backend to change emails without verifying user identity.

Nimbus Manticore APT Uses Fake Jobs to Deliver Custom Malware

gbhackers.com · 4 months ago

The Nimbus Manticore APT targets aerospace organizations using social engineering via fake job postings on platforms like LinkedIn. Attackers lure victims to fraudulent portals where they download an "two-factor authentication" application zip archive. The resulting malware hijacks AppDomain through ServiceHub.VSDetouredHost.exe to load TOTPGuard.

Red Hat Cloud Services npm Packages Hijacked in Credential-Theft Malware Campaign

gbhackers.com · 4 months ago

Security researchers discovered a major supply chain attack compromising multiple redhat-cloud-services npm packages. Attackers utilized the Miasma malware variant to exploit GitHub Actions' OIDC mechanism, injecting malicious CI workflows into Red Hat developer repositories.

Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded

thehackernews.com · 4 months ago

Password manager Dashlane has disclosed that "fewer than" 20 users on the personal subscription plan had their encrypted vaults downloaded following a brute-force attack launched by an unknown party. On May 31, 2026, the company said an "external" threat actor launched a brute-force attack against certain Dashlane user accounts with the aim of breaking two-factor authentication (2FA)

NuGet Code Execution As A Service

tierzerosecurity.co.nz · 4 months ago

There are concerns regarding NuGet packages executing code during development processes. The automatic running of dependencies and the ability for custom package files to add build targets present risks. Specifically, MSBuild tasks can execute arbitrary programs or commands through a built-in task. This potential allows attackers to compromise builds via manipulated package content.

CVE-2026-0251 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM)

security.paloaltonetworks.com · 4 months ago

There are multiple local privilege escalation vulnerabilities tracked as CVE-2026-0251 in the Palo Alto Networks GlobalProtect app that allow a non administrative local user to execute arbitrary commands as the NT AUTHORITY SYSTEM account on Windows and as root on macOS and Linux. No special configuration is required to be affected, the issues are rated medium severity with a CVSS score of 5.9, and Palo Alto Networks reports no known active exploitation. Affected desktop releases include GlobalProtect 6.0, 6.2, and 6.3 with fixed updates available such as 6.0.13, 6.2.8 h10, and 6.3.3 h9 or later, while iOS, Android, Chrome OS, and UWP builds are not affected. There are no known workarounds and administrators are advised to upgrade impacted clients to the published fixed versions to mitigate the vulnerability.

Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks

www.bleepingcomputer.com · 4 months ago

A threat actor tracked as DriveSurge has been operating large-scale malware distribution campaigns using ClickFix and FakeUpdates techniques on compromised sites.

Red Hat npm packages compromised to steal developer credentials

www.bleepingcomputer.com · 4 months ago

More than 30 npm packages under Red Hat's '@redhat-cloud-services' namespace were compromised in a supply-chain attack that distributed a new variant of the Shai-Hulud credential-stealing malware, dubbed "Miasma."

Spain arrests doxer leaking sensitive data of govt employees

www.bleepingcomputer.com · 4 months ago

The Spanish National Police has arrested an individual for leaking sensitive information related to members of various key state organizations, including the National Cybersecurity Institute (INCIBE).

Anthropic to Open Mythos AI to EU's ENISA

www.darkreading.com · 4 months ago

The European security agency's entry to Project Glasswing is the result of "strong bilateral cooperation" between the European Commission and Anthropic.

Blind POST SSRF in phpBB 4.0.0-alhpa1 Web Push (CVD with phpBB)

syntetisk.tech · 4 months ago

A medium severity flaw exists in the web push notification subsystem of phpBB 4.0.0-alpha1, allowing unvalidated user input to be stored as a server endpoint. This vulnerability enables a registered user to trick the system into sending notifications via an attacker controlled or internal host upon any subsequent forum event. The issue stems from the lack of URL validation when persisting the push endpoint after a user subscribes. A fix was implemented in phpBB 4.0.0-a2 by requiring an allowlist of known push service HTTPS endpoints.

How Box Created 13 New Types of Jobs Because of A.I.

www.nytimes.com · 4 months ago

Box, a Silicon Valley software maker, expects to have more employees, not fewer, as it hires A.I. architects, A.I. solutions managers and other new A.I.-related positions.

Microsoft's Zero-Day Legal Threats Spark Backlash

www.darkreading.com · 4 months ago

After a disgruntled security researcher published several zero-day exploits in recent weeks, Microsoft seemingly indicated criminal charges were in order.

Florida Sues OpenAI Over Chatbot Safety Concerns

www.nytimes.com · 4 months ago

The state became the first to sue the ChatGPT maker over claims that its technology posed a risk to children and that the company had failed to warn the public of dangers.