Blahalla

AI Chatbot Warnings May Not Stop Hallucinations, Researchers Say

www.techrepublic.com · 13 days ago

A June 2026 research review found that AI chatbot warning labels may be a weak safeguard for organization-backed AI advisors, raising new audit questions for IT, security, and compliance teams.

ESET Threat Report H1 2026 Highlights Malicious AI Skills, ClickFix Surge, and EDR Killers

gbhackers.com · 13 days ago

ESET’s H1 2026 threat report shows attackers accelerating the use of familiar playbooks with AI-flavored lures, social engineering, and defense evasion rather than inventing entirely new ones. The clearest signals are the rise of malicious AI skills, a doubled ClickFix footprint, first-wave AI-powered Android malware, record QR-code phishing, and a growing ecosystem of EDR killers.

The Verification Step Is the New ATO Battleground in 2026

thehackernews.com · 13 days ago

For years, account takeover (ATO) followed a predictable script. Attackers bought stolen credentials in bulk, ran them through automated tools, and waited for matches. Credential stuffing was cheap, scalable, and for defenders, relatively well understood. That era is ending. Not because attackers gave up, but because the front door finally got harder to kick in. Passkeys are now mainstream.

Telco giant KDDI says data breach affects over 12 million people

www.bleepingcomputer.com · 13 days ago

Japanese telecommunications giant KDDI says that millions of people had their email addresses and passwords exposed after attackers breached an email platform used by five internet service providers (ISPs) in the country.

GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code

thehackernews.com · 13 days ago

An AI coding assistant that refuses to answer a dangerous request in its chat box can answer it anyway if the same request is broken into small, ordinary-looking steps inside a code editor. That is the finding of a new study of GitHub Copilot by researchers Abhishek Kumar and Carsten Maple.

Cybersecurity and the Gap Between Skill and Ability

www.schneier.com · 14 days ago

Last week, national security agencies from the Five Eyes, that’s the rich, English-language-speaking countries club, jointly released a statement warning of the increasing cyber risks of AI models: in particular, their ability to autonomously hack into systems and networks.

CISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla Flaws

www.securityweek.com · 14 days ago

Two newly disclosed critical vulnerabilities in Adobe ColdFusion and Langflow join two Joomla extension flaws in CISA's Known Exploited Vulnerabilities catalog, with federal agencies given until July 10 to patch.

Exposed Banana RAT Infrastructure Reveals Payload Generator and Obfuscator Tooling

gbhackers.com · 14 days ago

A publicly indexed server at 198[.]245[.]53[.]26, discovered via Shodan, exposed more than simple staging files it revealed an active payload-generation backend and obfuscation tooling tied to two distinct Banana RAT branches. The host served static stages (st.txt, payload.php) and a FastAPI-based builder (servidorcompletopool.py) plus an ofuscador.py helper.

Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection

www.securityweek.com · 14 days ago

Researchers show how attackers can use a crafted public GitHub Issue to trick AI-powered workflows into exposing data from private repositories without authentication.

CrowdStrike Uncovers 5 New Prompt Injection Techniques Targeting AI Agents

gbhackers.com · 14 days ago

CrowdStrike has identified five new techniques for prompt injection targeting AI agents, emphasizing the rapid evolution of adversarial methods as enterprises increasingly deploy autonomous AI systems. Detailed in a report published on July 7, 2026, by CrowdStrike’s AI security research team, these techniques expand the company’s prompt injection taxonomy to over 200 documented attack methods.

CISA orders feds to prioritize patching Langflow auth bypass flaw

www.bleepingcomputer.com · 14 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) gave federal agencies until Friday to patch an actively exploited vulnerability in the Langflow visual framework for building AI agents.

Discord Confirms Bug That Incorrectly Banned 8,200 Users Since May 2026

gbhackers.com · 14 days ago

Discord has confirmed a significant flaw in its automated moderation and enforcement pipeline that led to the wrongful banning of approximately 8,200 user accounts between May and early July 2026. This raises concerns about the reliability of AI-assisted trust and safety systems.

www.techrepublic.com · 14 days ago

ESET NOD32 Antivirus blocks malware, ransomware, and phishing for $19.99 a year without slowing your PC down.

China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware

thehackernews.com · 14 days ago

A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box (ORB) network by breaking into internet-facing networking devices. According to findings from Cisco Talos, UAT-7810 is an advanced persistent threat (APT) actor that's responsible for maintaining and proliferating LapDogs, an ORB network that first came to light in June 2025.

My threat feed told me it was ‘Chalubo.’ The binary disagreed

www.csoonline.com · 14 days ago

I’ve spent two years doing incident response and threat intel, and the one habit I’d keep if I had to give up every other is also the most boring. I don’t act on a piece of intelligence until I’ve checked it against the thing it claims to describe. It’s slow. It’s tedious. Almost nobody does it, because checking costs the exact time the feed was supposed to save.

Claude Code, Cursor, and OpenAI Codex Trigger Cyberattack-Like Telemetry Alerts

gbhackers.com · 14 days ago

AI-powered coding assistants such as Claude Code, Cursor, and OpenAI Codex are increasingly triggering endpoint detection and response (EDR) alerts that resemble active cyberattacks, according to new research from Sophos X-Ops.

CISA Warns of Actively Exploited Adobe ColdFusion Vulnerability

gbhackers.com · 14 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Adobe ColdFusion, tracked as CVE-2026-48282, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability is actively being exploited in the wild.

Ubiquiti warns of new max severity UniFi OS vulnerability

www.bleepingcomputer.com · 14 days ago

Ubiquiti has released security updates to patch seven critical vulnerabilities in UniFi OS, including a maximum-severity flaw that can be exploited in command injection attacks.

REF6045 Uses SCMBANKER PowerShell Toolkit to Target Mexican Banking Customers

gbhackers.com · 14 days ago

A human-operated Mexican banking fraud campaign tracked as REF6045 has been observed using a bespoke PowerShell toolkit SCMBANKER to turn commodity click-fraud lures into operator-assisted account takeovers and payment diversion. The operation relies on social engineering through fake CAPTCHA/verification pages that trick victims into running a single command from the Windows Run dialog.

State IDs for AI Agents: Will Estonia Set a Precedent?

www.darkreading.com · 14 days ago

The world's digital testing ground plans to help people use AI agents for government purposes.

Over 70% of Public WordPress Sites Running Outdated PHP Exposed to Cyberattacks

gbhackers.com · 14 days ago

A new analysis has revealed a significant security gap within the global web ecosystem. Over 70% of publicly accessible WordPress sites are running outdated, end-of-life (EOL) PHP versions, significantly increasing their vulnerability to cyberattacks.

15-Year-Old GhostLock Linux Kernel Vulnerability Enables Root Access and Container Escape

gbhackers.com · 14 days ago

A critical vulnerability in the Linux kernel, known as “GhostLock” (CVE-2026-43499), has been disclosed by researchers at Nebula Security. This vulnerability, which has existed for 15 years, allows for reliable privilege escalation and container escape across nearly all Linux distributions. The issue dates back to Linux kernel version 2.6.

NordVPN, 1-Year Subscription for 10 Devices is Only $30 With This Code

www.techrepublic.com · 14 days ago

Public Wi-Fi can expose your data. NordVPN locks it down across 10 devices for a year, and it's $40 off today.

CISA orders feds to patch max severity ColdFusion flaw by Friday

www.bleepingcomputer.com · 14 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered government agencies to patch an actively exploited maximum-severity flaw in the Adobe ColdFusion commercial web app development platform by Friday.

Lurking Lizard Uses Drop-Catch Domains and Lookalike Brands to Distribute Proxyware

gbhackers.com · 14 days ago

A sophisticated, long-running operation that converts consumer devices into rentable exit nodes for residential proxy services. The initial signal was a fake 7-Zip installer hosted at 7zip[.]com a domain that mimicked the legitimate 7-zip[.]org and benefitted from years of search-engine history due to a common misquote.

13 in-demand IT security certifications for higher pay

www.csoonline.com · 14 days ago

With change a constant, cybersecurity professionals looking to improve their careers can benefit from the latest insights into employers’ needs. Data from Foote Partners on the skills and certification most in demand today may provide helpful signposts.

Indian Income Tax Department Phishing Lure Deploys Gh0st RAT and AsyncRAT Implants

gbhackers.com · 14 days ago

A targeted phishing campaign impersonating the Indian Income Tax Department has been observed delivering a sophisticated, six-stage infection chain that culminates in two in-memory remote-access implants: a Gh0st RAT derivative and a Quasar/AsyncRAT-family.NET payload.

15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros

thehackernews.com · 14 days ago

Researchers at Nebula Security have disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw that lets any logged-in user take full root control of a machine that has not been patched. The vulnerable code has shipped by default in essentially every mainstream distribution since 2011.

LONGLEASH Malware Adds Reverse Shell, Proxying, and Intermediate C2 Capabilities

gbhackers.com · 14 days ago

A significant upgrade to malware maintained by the UAT-7810 actor: LONGLEASH, a successor to the previously reported SHORTLEASH implant, now sporting reverse-shell, multi-protocol proxying, and intermediate command-and-control (C2) forwarding capabilities. LONGLEASH retains SHORTLEASH’s ff-agent codebase but expands its operational scope. The implant, internally named “nz1.

CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

thehackernews.com · 14 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-48282 (CVSS score: 10.

China-Aligned UNK_MassTraction Exploits Roundcube Servers to Target Universities

gbhackers.com · 14 days ago

A suspected China-aligned cluster dubbed UNKMassTraction that is exploiting n-day flaws in Roundcube webmail to compromise physics and engineering departments at U.S. and Canadian universities. The operators use a two-stage browser-to-server infection chain that begins with a Cross-Site Scripting (XSS) exploit against CVE-2024-42009 to execute JavaScript in the victim’s browser.

China-Aligned UNK_MassTraction Exploits Roundcube Servers to Target Universities

gbhackers.com · 14 days ago

Since May 2026, Proofpoint Threat Research has been tracking a suspected China-aligned cluster dubbed UNKMassTraction that is exploiting n-day flaws in Roundcube webmail to compromise physics and engineering departments at U.S. and Canadian universities.

U.S. Government Reportedly Approves OpenAI’s GPT-5.6 Sol, Terra, and Luna Models

gbhackers.com · 14 days ago

The Trump administration has reportedly lifted previous restrictions on the launch of OpenAI’s GPT-5.6, enabling a broader commercial rollout of this advanced model after weeks of government-mandated cybersecurity and national security vetting. This decision marks a significant turning point in U.S. AI governance, moving GPT-5.

Anthropic Keeps Claude Fable 5 Available on Paid Plans Until July 12

gbhackers.com · 14 days ago

Anthropic has announced an extension of access to its advanced AI model, Claude Fable 5, allowing users on all paid plans to continue using the system until July 12, 2026.

Google Dialogflow CX Flaw Lets Attackers Bypass VPC-SC and Steal Sensitive Chatbot Data

gbhackers.com · 14 days ago

A critical vulnerability in Google Cloud’s Dialogflow CX platform allowed attackers to bypass VPC Service Controls (VPC-SC) and silently exfiltrate sensitive chatbot data, raising significant concerns about the security of enterprise AI deployments.

Accenture Data Breach Exposes 35GB Source Code and Azure DevOps Credentials

gbhackers.com · 14 days ago

Accenture is currently investigating a potential data breach after a threat actor using the alias “888” claimed to be selling approximately 35GB of stolen data, including source code and sensitive credentials, on a cybercrime forum.

GitLost Vulnerability Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos

gbhackers.com · 14 days ago

A critical vulnerability known as “GitLost” has been discovered in GitHub’s newly introduced Agentic Workflows by Noma Labs. This flaw allows unauthenticated attackers to exfiltrate sensitive data from private repositories.

Accenture confirms breach after hacker offers stolen data for sale

www.bleepingcomputer.com · 14 days ago

IT services giant Accenture has confirmed it suffered a security breach after a threat actor claimed to have stolen 35 GB of source code and other data from the company.

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

unit42.paloaltonetworks.com · 14 days ago

A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination.

16-year-old KVM flaw allows attackers to escape VMs and take over Linux servers

www.csoonline.com · 14 days ago

A critical vulnerability in the Kernel-based Virtual Machine (KVM) module of the Linux kernel allows attackers with root access in a guest VM to execute arbitrary code on the host system. This violates the most important security boundary that cloud providers and enterprises rely on to isolate sensitive processes on servers.

Watch out for fake support calls in Microsoft Teams

www.csoonline.com · 14 days ago

Palo Alto Networks’ security division, Unit 42, is warning of yet another campaign targeting Microsoft Teams users. The new campaign begins with Teams users receiving an email asking if they would like to participate in a survey. If they open the attached PDF file, they will shortly thereafter receive a voice call purporting to be from Microsoft Support.

Big Brand Jobs Scam Targets Marketing Pros' Google Accounts

www.darkreading.com · 14 days ago

The phishing campaign uses several tactics, including nested redirects, to evade detection and steal credentials from unsuspecting targets.

Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft

www.darkreading.com · 14 days ago

Varonis reported the flaw to Google in late 2025 and it has been addressed, but it reminds defenders to take a fresh look at their AI Infrastructure security.

Meta Unveils an A.I. Image Generator

www.nytimes.com · 14 days ago

Muse Image, which can create realistic images for users on Instagram and WhatsApp, is the company’s latest attempt to catch up in the global artificial intelligence race.

Chinese hackers develop LONGLEASH malware to expand ORB network

www.bleepingcomputer.com · 14 days ago

Chinese hackers tracked as 'UAT-7810' are actively evolving their malware to expand their Operational Relay Box (ORB) network by compromising internet-facing networking devices, primarily unpatched Ruckus routers.

County Government Reportedly Paid $1 Million to Cyber Extortion Group

www.securityweek.com · 14 days ago

The alleged victim, believed to be a small Ohio county, reportedly paid the extortion group to prevent the public release of sensitive stolen data.

Hidden backdoor in Tenda router firmware grants admin access

www.bleepingcomputer.com · 14 days ago

A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an attacker to gain administrative access to the device's web management panel.

Critical Gitea Flaw Under Active Exploitation, Researchers Warn

www.securityweek.com · 14 days ago

Attackers are exploiting the critical Gitea vulnerability CVE-2026-20896 to bypass authentication with a single HTTP header and access vulnerable repositories and secrets.

RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service

thehackernews.com · 14 days ago

A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service. It lets even low-skill criminals take over a victim's phone, steal their banking logins, and capture the one-time codes that protect their accounts.

Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots

thehackernews.com · 14 days ago

A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project. From there, they could read live conversations, steal the data users shared, and make the bots send attacker-written messages, including requests to re-enter a password.