Blahalla

US charges Google security engineer with Polymarket insider trading

www.bleepingcomputer.com · 4 months ago

A Google security engineer was charged with insider trading after winning $1.2 million using confidential company data to place bets on the cryptocurrency-based Polymarket decentralized prediction market.

Typosquatted npm Packages Steal Cloud and CI/CD Secrets

gbhackers.com · 4 months ago

A coordinated npm supply chain attack has been uncovered targeting developers working with OpenSearch, ElasticSearch, and DevOps tooling, with attackers actively stealing cloud credentials and CI/CD secrets from infected systems. The malicious packages imitate legitimate libraries by using lookalike names such as opensearch-setup and elastic-opensearch-helper, while falsely linking to the official OpenSearch GitHub repository in

GitLab Patches Multiple Duo AI, DoS, and Authorisation Vulnerabilities

gbhackers.com · 4 months ago

GitLab has released patch versions 19.0.1, 18.11.4, and 18.10.7 to fix seven security issues affecting GitLab CE and EE, including Duo AI workflow runner access control, a Wiki denial-of-service flaw, and several authorization bugs across GraphQL, Duo Workflows, Operations, Pipelines, and authentication endpoints. The company says self-managed installations should upgrade immediately. At the same time

Notepad++ vulnerabilities could enable arbitrary code execution on Windows systems

www.csoonline.com · 4 months ago

Two high severity vulnerabilities, CVE-2026-48778 and CVE-2026-48800, allow local attackers to achieve arbitrary code execution in Notepad++ by modifying XML configuration files. The flaws exist because the editor reads command and interpreter paths without validation, enabling malicious commands to be injected into the Run menu or substituted for the operating system command prompt. An attacker with write access to the user’s profile can exploit these weaknesses, while a third, lower severity crash bug is tracked as CVE-2026-48770. Users are advised that these vulnerabilities were patched in version 8.9.6.1.

Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets

thehackernews.com · 4 months ago

Cybersecurity researchers have discovered a malicious NuGet package that masquerades as a C software development kit for Sicoob, one of Brazil's largest cooperative financial systems, to siphon client IDs and PFX certificates. According to Socket, versions 2.0.0 through 2.0.4 of "Sicoob.Sdk" contain functionality to exfiltrate sensitive information, including PFX certificates that are used to

The Gentlemen are coming for your files, and then your network

www.csoonline.com · 4 months ago

Gentlemen ransomware uses a self-propagating Go based encryptor that can move laterally across networks. This malware identifies additional systems and spreads over Server Message Block using harvested credentials. Operators can control the encryptor through command line arguments for tasks like full drive encryption or lateral propagation. Experts advise defenders to focus on understanding the attack path and network controls to contain the threat.

Amid data center protests, a billionaire and the Trump administration see a foreign plot

www.washingtonpost.com · 4 months ago

Claims by a billionaire TV star and Interior Secretary Doug Burgum that China and overseas propaganda drive American protests against data centers are based on scant evidence.

Cybersecurity trends in SEC filings

www.csoonline.com · 4 months ago

Public companies are required by the SEC to disclose comprehensive information regarding cybersecurity risk management, governance, and strategy in their 10-K filings. The Chief Information Security Officer remains the primary role responsible for cybersecurity, and board oversight most frequently falls under the Audit Committee. Data suggests that the CISO position typically reports to the Chief Information Officer. These disclosures reveal a reliance on frameworks like the National Institute of Standards and Technology guidelines to manage growing risks.

Fake Adobe Document Cloud Pages Spread ScreenConnect Malware

gbhackers.com · 4 months ago

Hackers are actively exploiting trust in Adobe Document Cloud by using fake delivery pages to install remote access malware. The campaign leverages a sophisticated phishing kit named “RatPressto,” which abuses compromised WordPress sites and legitimate software to evade detection while targeting financial organizations. The attack begins with phishing emails that appear to be standard corporate

1,001 IPs, 64 countries, one operation: mapping a botnet by its back end · HoneyLabs blog

honeylabs.net · 4 months ago

A large botnet operation involving one thousand one IP addresses spread across sixty four countries was mapped using backend infrastructure and unique client fingerprints. Investigators determined that the shared back end and consistent TLS and HTTP fingerprints provided a unified view of the campaign, even when individual IPs rotated. The operation utilized an exploit based on Apache path traversal, identified as CVE-2021-41773. This vulnerability deployed a self-replicating shell stage that turned every infected server into a new node for the attack.

Charter Communications data breach affects 4.9 million accounts

www.bleepingcomputer.com · 4 months ago

The ShinyHunters extortion gang stole personal information from 4.9 million accounts after hacking the U.S. telecom giant Charter Communications in early April, according to data breach notification service Have I Been Pwned.

Police arrest man following hack of Ajax football club

www.bitdefender.com · 4 months ago

Dutch police have arrested a 35-year-old man suspected of hacking into the computer systems of Amsterdam football giant Ajax, after the personal data of hundreds of thousands of supporters was put at risk. Read more in my article on the Hot for Security blog.

Samba Security Flaw Lets Attackers Execute Code Remotely

gbhackers.com · 4 months ago

A critical security vulnerability in Samba’s printing subsystem has been disclosed, allowing unauthenticated attackers to execute arbitrary code remotely on affected servers. Tracked as CVE-2026-4480, the flaw carries a maximum CVSS score of 10.0, highlighting its severe impact on confidentiality, integrity, and availability. The issue affects Samba print servers configured with the “print command” and

Zapocalypse Attack Lets Threat Actors Hijack Zapier Accounts

gbhackers.com · 4 months ago

“Zapocalypse” is a newly disclosed attack chain that shows how attackers could have abused Zapier’s “Code by Zapier” feature to move from a single sandboxed Python step to a potential full-scale Zapier account takeover. The research, carried out by Token Security, is notable because it did not rely on any unknown zero‑days or exotic primitives.

I evaluated 5 LLM agents on patching real-world CVEs. Here is what I found.

giovannigatti.github.io · 4 months ago

The evaluation used a new benchmark called CVE-Bench, designed to test how well AI models can fix real-world security vulnerabilities. Five frontier models were tested on 20 actual CVEs, reaching a maximum overall solve rate of 50 percent under favorable conditions. Researchers found that no model reliably fixes real vulnerabilities, and the difficulty increased significantly when models had to fix code without a description of the flaw. The benchmark covered a broad range of weaknesses across 15 categories of CWE issues.

OpenVPN Connect macOS Vulnerability Allows Remote Command Execution

gbhackers.com · 4 months ago

OpenVPN has released a critical security update for its macOS client after researchers uncovered a vulnerability that could allow remote command execution on affected systems. The issue, tracked as CVE-2026-9560, impacts the privileged helper component in OpenVPN Connect and has been fixed in version 3.8.2 (build 6009), released on May 25, 2026. OpenVPN Connect macOS

Claude Opus 4.8 Released With Advanced Engineering-Level Coding Capabilities

gbhackers.com · 4 months ago

Anthropic has announced the release of Claude Opus 4.8, a major upgrade to its flagship AI model that introduces advanced engineering-level coding capabilities and improved autonomous task execution. The latest version builds on Opus 4.7, focusing on enhanced reasoning, longer independent operation, and more transparent decision-making. These improvements are expected to affect both software development

GDPR set the tone for regulatory action — and the AI fine pushback to come

www.csoonline.com · 4 months ago

While large technology companies continue to challenge fines related to European data protection law, nearly 40 percent of announced General Data Protection Regulation fines are currently under legal challenge or have been annulled. The regulation successfully established a global standard, notably the influential 72-hour breach notification rule. Experts contend that even with structural weaknesses in enforcement, the law has significantly improved corporate security maturity. Furthermore, the framework is evolving due to the approaching full application of the European Union's comprehensive AI Act.

Fake Video Player Updates Spread Miner and RAT Malware

gbhackers.com · 4 months ago

Hackers are actively exploiting illegal streaming platforms to distribute advanced malware, using fake video player updates as a lure to infect unsuspecting users. The attack begins when users attempt to play a video on compromised streaming websites. Instead of playback, a message appears claiming the video player plugin is outdated, prompting users to download an

Fake Codex Remote UI Steals OpenAI Auth Tokens

gbhackers.com · 4 months ago

A newly uncovered supply chain attack is leveraging a legitimate-looking developer tool, codexui-android, to silently steal OpenAI Codex authentication tokens, highlighting a growing trend where threat actors build credible software to mask malicious intent. Unlike typical typosquatting or disposable malware packages, this tool delivers real functionality, making it attractive to developers. However, investigators found that for

Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels

thehackernews.com · 4 months ago

The North Korean state-sponsored threat actor known as Kimsuky (aka Velvet Chollima) has been attributed to a fresh set of cyber attacks targeting South Korean military and corporate entities through March and April 2026. "Kimsuky employed a range of tailored social engineering tactics, such as spoofing security software installation pages and crafting a fake Webex meeting page that leveraged

MicrosoftSystem64 Malware Abuses Hugging Face for Stealthy Data Theft

gbhackers.com · 4 months ago

A sophisticated supply chain attack targeting the npm ecosystem has been uncovered, involving a malicious package named js-logger-pack that evolved into a powerful cross-platform malware loader. First observed in early April 2026, the package went through 29 incremental versions, gradually transforming from a seemingly benign logging utility into a full-scale information stealer and remote access Trojan. Despite

Carnival Cruise Breach Leaks Sensitive Customer Information

gbhackers.com · 4 months ago

Carnival Corporation has disclosed a significant data breach impacting approximately 5.99 million individuals, raising serious concerns about data security within the global travel and hospitality sector. The incident, officially reported to the Maine Attorney General’s office, involved unauthorized access to sensitive customer information for 9,746 Maine residents. Carnival Cruise Breach According to regulatory filings, the

Malicious RVTools Installer Uses Sectigo Cert to Evade SmartScreen

gbhackers.com · 4 months ago

A malicious fake RVTools installer is abusing a legitimately issued Sectigo code‑signing certificate to slip past Microsoft Defender SmartScreen and many endpoint controls, ultimately deploying a multi‑stage Python‑based RAT with deep AD reconnaissance and persistent C2 access. For VMware‑heavy environments, compromise of an administrator via this vector can effectively hand over domain‑level control to the

New Gogs 0-Day Flaw Enables Remote Code Execution on Servers

gbhackers.com · 4 months ago

A new 0-day vulnerability in Gogs, a popular self-hosted Git service, allows authenticated users to run arbitrary commands on the server and potentially take full control of the system. The flaw was discovered by Rapid7 Labs and is rated Critical with a CVSS v4 score of 9.4. At the time of publication, there is no

Fooling around with encrypted reasoning blobs

blog.cryptographyengineering.com · 4 months ago

Advanced methods for handling encrypted reasoning data were detailed. These encrypted reasoning blobs hold complex information that requires strong cryptographic protections. Techniques were discussed that preserve the utility of the data while strictly maintaining confidentiality. Understanding these novel approaches is critical for deploying secure and trustworthy artificial intelligence systems.

CALIF: An AI audit of FreeBSD

blog.calif.io · 4 months ago

An artificial intelligence audit was performed on the FreeBSD operating system to assess its security posture. The analysis identified areas for improvement across various system components. Researchers highlighted the benefits of adopting a comprehensive, automated approach to continuous security testing. Implementing these recommendations can significantly enhance the overall resilience and reliability of the platform.

Typosquatted npm packages used to steal cloud and CI/CD secrets

www.microsoft.com · 4 months ago

The Mini Shai-Hulud campaign used malicious npm packages to target cloud and CI/CD credentials across developer environments. This report details the attack chain, detection opportunities, and mitigation guidance to help organizations identify and disrupt related activity.

IBM and Red Hat want to become the ‘security clearinghouse’ for open source applications in the enterprise

www.csoonline.com · 4 months ago

IBM and Red Hat are launching Project Lightwell, a $5 billion initiative involving 20,000 engineers to establish an enterprise clearinghouse for open source vulnerabilities. This new system will use artificial intelligence to accelerate the discovery and delivery of validated fixes directly into software supply chains. The technology functions as a security coordination layer, allowing patches to be backported to exact dependency versions without requiring disruptive upgrades. The project addresses the vulnerability gap, acknowledging the publication of nearly 50,000 common vulnerabilities and exposures in 2025.

Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects

www.csoonline.com · 4 months ago

A newly discovered and so far unpatched critical vulnerability in the open source Gogs Git service not only demands immediate action from developers to secure their code, it also puts a spotlight on the potential issues in using self-hosted code platforms from small maintainers. The hole is a critical argument injection vulnerability, discovered by a researcher at Rapid7, that allows any authenticated user to remotely execute code on a Gogs server by creating a pull request with a malicious branch name during a merge operation. Rapid7 published an analysis of the vulnerability today, after the maintainer of Gogs did not respond to a request for status updates or to an offer to defer disclosure after it first reported the hole over two months ago. “This is a serious vulnerability in software that isn’t commonly exposed to the public internet,” Ryan Emmons, staff security researcher at Rapid7, said in an email. “Gogs is typically used in an internal capacity; the most likely threat model is an attacker that has already gained access to an internal network environment exploiting the vulnerability to gain read/write access to source code repositories on the Gogs server. An attacker might leverage this access to silently tamper with source code and exfiltrate sensitive information, such as user password hashes and proprietary software.” Rapid defensive action required David Shipley, head of security awareness provider Beauceron Security, said both the Gogs maintainer and developers must take defensive action fast, because with the publication of a vulnerability “any attackers that didn’t know about this are going to be on it viciously.” The fact that it has been left unpatched for months as of Thursday afternoon is another reason why CSOs and developers prefer GitHub, he added. With any open source project, there are worries about if or when a patch will be issued. “The exploit requires no admin privileges and no interaction with other users,” Rapid7 said in its report. “An attacker operates entirely within their own account. Since Gogs ships with open registration enabled by default (DISABLEREGISTRATION = false) and no limit on repository creation (MAXCREATIONLIMIT = -1), an unauthenticated attacker can simply create an account and repository on any default-configured instance. Any registered user who creates a repo is automatically its owner. From there, enabling rebase merging is a single toggle in settings, and the entire exploit chain can be operated without interaction from any other user.” In addition, any user with write access to a repository where rebase is already enabled can exploit it directly. On instances where repository creation is restricted, an attacker still only needs write access to any repository that has (or can have) rebase merging enabled. If exploited, the vulnerability could not only lead to a Gogs server compromise, but from there it could turn into to a cross-tenant data breach, credential theft, lateral movement across an IT network, and software supply chain attacks through the code that is being developed on the compromised Gogs platform. Until a patch is released, developers and CSOs in organizations with the platform in use should strictly enforce restricted network access to Gogs, Emmons said, and ensure that only those who need access can use the application. Furthermore, if user self-registration is not already disabled, it should be. Only administrators should be able to create new user accounts. Rapid7 describes Gogs as a lightweight, self-hosted Git service written in Go that can run on any platform supported by the Go toolchain, including Linux, macOS, and Windows, as well as on ARM-based systems. It’s one of the more popular self-hosted alternatives to Microsoft-owned GitHub, says Rapid7, and is commonly deployed by companies, universities, and open-source projects. Other self-hosted Git services for developers include GitLab Community Edition, Gitea, Forgejo (a fork of Gitea), and Atlassian’s Bitbucket Data Center. Gogs pros and cons In a blog earlier this month, Open Source Alternatives, which describes itself as a curated directory of self-hosted tools that replace paid software, noted that developers may chose to self-host a git server to avoid GitHub outages, arguing, “your repositories stay online when GitHub goes down, your GitHub Actions minutes bill disappears and your source code never leaves your own server”. Emmons said Gogs is popular because it’s a lightweight and self-contained Git solution. It’s easy to deploy and run, he said, unlike many other Git servers that require heavy operational overhead and IT management. It’s also self-hosted on-prem software, which he said is ideal for teams that don’t, or cannot, for one reason or another, store source code in the cloud. The main pro, Emmons said, is that Gogs is an appealing solution from an operational simplicity perspective. It works well for what it does, and it doesn’t take much management effort to keep it working. But, he added, “a major con is what we saw with this disclosure; Gogs is open-source software maintained by kind people in their free time, and the developers behind it don’t have the support of a major corporate information security team. That means security issues can sometimes present in ways that they typically wouldn’t for a well-funded enterprise product.” This article

Anthropic confirms Claude Mythos-class models will roll out to the public

www.bleepingcomputer.com · 4 months ago

Anthropic has confirmed that it plans to bring Mythos-class models to the general public after delaying the rollout due to security risks to public and private software.

CVE-2026-0250 GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway (Severity: MEDIUM)

security.paloaltonetworks.com · 4 months ago

A buffer overflow vulnerability identified as CVE-2026-0250 exists in the Palo Alto Networks GlobalProtect app and is triggered during processing of requests and responses exchanged between Portal and Gateway. A man in the middle attacker could exploit the flaw to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges, and iOS builds are not affected. The issue is rated medium with a CVSS score of 5.2, no active exploitation is known, and users of affected Windows, macOS, Linux, Android, ChromeOS and UWP releases should upgrade to the vendor supplied patched versions such as 6.3.3-h9, 6.2.8-h10, 6.1.13, or 6.0.14 or later.

CVE-2026-0249 GlobalProtect App: Certificate Validation Bypass Vulnerabilities (Severity: MEDIUM)

security.paloaltonetworks.com · 4 months ago

There are certificate validation bypass vulnerabilities in the GlobalProtect App tracked as CVE-2026-0249 that can allow an attacker to intercept encrypted communications and potentially compromise the endpoint. A local non-administrative operating system user or an attacker on the same subnet could redirect traffic to an unauthorized server and facilitate installation of malicious software. macOS, Android and Chrome OS builds are affected in older releases with macOS exposure requiring SAML authentication using an embedded browser, while Windows, Linux, iOS and UWP builds are not affected. Users are advised to upgrade to the vendor provided patched versions for the affected clients as specified by Palo Alto Networks.

GreyVibe hackers use ChatGPT, Gemini to power cyberattacks

www.bleepingcomputer.com · 4 months ago

A likely Russian threat cluster tracked as GreyVibe has been targeting Ukrainian entities with AI-generated lures and a rich set of custom malware tools.

ShinyHunters Alleges 42M Records Stolen from Charter Communications

www.techrepublic.com · 4 months ago

Charter confirmed a cyber incident after ShinyHunters claimed it stole Spectrum customer data through vishing and SaaS account access.

BTMOB Android malware service generates custom phishing payloads

www.bleepingcomputer.com · 4 months ago

An Android remote access trojan named BTMOB is offered to cybercriminals with a builder interface for generating malware payloads tailored to phishing lures.

CVE-2026-0258 PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching (Severity: MEDIUM)

security.paloaltonetworks.com · 4 months ago

A server side request forgery vulnerability, CVE-2026-0258, in the IKEv2 implementation of PAN OS can allow an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or to trigger a denial of service. Multiple PAN OS releases in the 12.1, 11.2, 11.1 and 10.2 families are affected when a Site to Site VPN Gateway is configured with IKEv2; Panorama, Cloud NGFW and Prisma Access are not impacted, and fixed builds and upgrade guidance are available for each affected minor version. Mitigations include removing IKEv2 VPN gateway configurations if not required and enabling Threat Prevention by turning on Threat ID 510014, and the advisory was published May 13, 2026 with no known active exploitation.

CVE-2026-0259 WildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B) (Severity: MEDIUM)

security.paloaltonetworks.com · 4 months ago

There is an arbitrary file read and delete vulnerability affecting Palo Alto Networks WildFire WF-500 and WF-500-B appliances running in the default non FIPS configuration, tracked as CVE-2026-0259 and published May 13, 2026. The flaw can be exploited over the network with low complexity and low privileges required, allows reading sensitive information and deleting arbitrary files, and is rated medium severity with CVSS 5.0 and a CVSS base metric of 7.1. A software update is available and customers are advised to upgrade to the fixed versions for their release lines or apply mitigations such as restricting access on air gapped deployments and enabling Threat ID 510010 with SSL decryption for Threat Prevention subscriptions.

CVE-2026-0265 PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled (Severity: HIGH)

security.paloaltonetworks.com · 4 months ago

An authentication bypass vulnerability identified as CVE-2026-0265 allows an unauthenticated attacker with network access to bypass authentication controls in PAN-OS when the Cloud Authentication Service is enabled, with the highest risk if CAS is enabled on the management interface. The issue affects PAN-OS on PA-Series and VM-Series firewalls and Panorama but does not impact Cloud NGFW or Prisma Access, and exposure requires an authentication profile using CAS attached to a login interface. Recommended actions include restricting management interface access to trusted IP addresses, temporarily disabling CAS or migrating to other authentication methods, upgrading to the fixed PAN-OS versions, and for customers with Threat Prevention enabling Threat ID 510008 as additional mitigation.

CVE-2026-0256 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (Severity: MEDIUM)

security.paloaltonetworks.com · 4 months ago

A stored cross site scripting vulnerability identified as CVE-2026-0256 in PAN-OS web interface enables a malicious authenticated administrator to store a JavaScript payload, affecting PA Series and VM Series firewalls and Panorama while Cloud NGFW and Prisma Access are not impacted. The issue is rated medium with a CVSS score of 4.4, is exploitable over the network with high privileges required, and Palo Alto Networks reports no known malicious exploitation as of May 13, 2026. Palo Alto Networks recommends upgrading to fixed PAN-OS versions or applying hotfixes and offers mitigations including enabling Threat ID 510020 with Threat Prevention, routing management traffic through a data plane port, replacing management certificates, decrypting inbound management traffic for inspection, and enabling threat prevention on inbound management services.

CVE-2026-0264 PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution (Severity: HIGH)

security.paloaltonetworks.com · 4 months ago

A heap based buffer overflow in the DNS proxy and DNS server features of PAN OS allows an unauthenticated attacker with network access to cause a denial of service on most PAN OS platforms and to potentially execute arbitrary code on PA Series hardware. The issue is tracked as CVE-2026-0264, is rated high with suggested urgency highest, and has remediation updates available with recommended upgrades to fixed PAN OS releases such as 12.1.7 or later and 11.2.12 or later. Until updates can be applied, customers can mitigate risk by disassociating DNS Proxy from externally accessible interfaces or disabling DNS Proxy, configuring DNS servers to use RFC1918 or trusted public IP addresses, and enabling Threat Prevention signature 510027 in content version 9100-10044 or later.

CVE-2026-0262 PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing (Severity: MEDIUM)

security.paloaltonetworks.com · 4 months ago

CVE-2026-0262 is a PAN-OS network traffic parsing vulnerability that allows an unauthenticated attacker with network access to cause a denial of service by sending specially crafted traffic. Panorama and Cloud NGFW are not impacted, and affected PAN-OS releases include multiple 12.1, 11.2, 11.1, and 10.2 builds for which fixed versions such as PAN-OS 12.1.7, 11.2.12, 11.1.15, and 10.2.18-h6 or equivalent updates have been published. Customers are advised to upgrade to the vendor fixed versions or mitigate HTTP exposure by enabling Threat Prevention IDs 510011, 510015, 510022 and 510023 with SSL decryption and appropriate Applications and Threats content updates. No malicious exploitation is known and the issue is rated medium severity with a CVSS score of 6.6.

CVE-2026-0263 PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing (Severity: HIGH)

security.paloaltonetworks.com · 4 months ago

A buffer overflow in IKEv2 processing of PAN-OS allows an unauthenticated network attacker to execute arbitrary code with elevated privileges or cause a denial of service, tracked as CVE-2026-0263. The vulnerability affects multiple PAN-OS 12.1, 11.2, and 11.1 releases prior to listed fixed versions, while Panorama, Cloud NGFW, and Prisma Access are not impacted. Customers are advised to upgrade to the fixed PAN-OS releases or mitigate exposure by configuring IKEv2 tunnels only with NIST approved Post Quantum Cryptography ciphers, and the issue is rated with urgency HIGHEST with no known exploitation at this time.

CVE-2026-0261 PAN-OS: Authenticated Admin Command Injection Vulnerability (Severity: MEDIUM)

security.paloaltonetworks.com · 4 months ago

There are multiple command injection vulnerabilities in PAN-OS that allow an authenticated administrator with access to the CLI or web user interface to bypass system restrictions and execute arbitrary commands as root, tracked as CVE-2026-0261. Affected products include PAN-OS on PA-Series and VM-Series firewalls and Panorama virtual and M-Series, while Cloud NGFW and Prisma Access are not impacted. The issue is rated Medium with a CVSS base score of 6.1 and suggested urgency Moderate, and the vendor recommends upgrading to fixed PAN-OS versions, restricting management interface access to trusted IP addresses, and enabling specified Threat Prevention signatures as mitigations.

The CISO Whisperer’s Watch List For The Gartner Security & Risk Management Summit 2026

gbhackers.com · 4 months ago

New York, USA, May 28th, 2026, CyberNewswire TVC Analyst Group has released its list of twelve cybersecurity companies identified for their activity and positioning ahead of the Gartner Security & Risk Management Summit 2026, where participating vendors are expected to present product updates, strategic initiatives, and technology developments. The annual Gartner Security & Risk Management

Anthropic Tops OpenAI to Become the World’s Most Valuable A.I. Start-Up

www.nytimes.com · 4 months ago

Anthropic raised $65 billion in new fund-raising that put its value at $900 billion, ahead of OpenAI’s last valuation of $730 billion, as the companies duel for A.I. dominance.

The Word 'Toad' Gave Any Website Full Control of Chrome's Most Popular VPN

amibeingpwned.com · 4 months ago

A vulnerability was discovered in the popular Urban VPN Chrome extension, allowing any website to send unauthorized commands without origin verification. The extension relied only on two static and publicly known strings for authentication, making it susceptible to exploitation. Attackers could use this flaw to disconnect the VPN, reroute traffic through foreign countries, or force users into data collection. The critical flaw, which received a CVSS score of 8.3, was resolved in version 5.12.5.

FBI warns of fake FIFA websites running World Cup fraud schemes

www.bleepingcomputer.com · 4 months ago

The FBI is warning of fake websites impersonating FIFA ahead of the 2026 World Cup, to steal personal and financial information, sell fake tickets and hospitality packages, and push other fraud related to the event.

Visual Studio Extensions Revisited

www.mdsec.co.uk · 4 months ago

Following concerns raised by compromised code extensions, security analysis is focused on Visual Studio. The report identifies two types of extensions: classic VSSDK extensions and modern VisualStudio.Extensibility components. Experts warn that the vulnerability risk from extension malware remains high.

Dutch Raid Fails to Dent Russian Bulletproof Host

www.darkreading.com · 4 months ago

Dutch law enforcement seized 800 servers and arrested two operators of THE.Hosting but left the hosting provider's core IP address space intact.