Blahalla

Nginx-poolslip Flaw Exposes Servers to DoS and Code Execution Attacks

gbhackers.com · 5 months ago

There is a critical vulnerability tracked as CVE-2026-9256 in the ngxhttprewritemodule of NGINX that can be triggered by specially crafted HTTP requests to cause a heap based buffer overflow, resulting in denial of service and, under certain conditions, remote code execution. The flaw is caused by improper handling of overlapping unnamed PCRE capture groups in rewrite directives, where ambiguous regular expression patterns and multiple backreferences can produce out of bounds writes. Affected releases include NGINX Open Source up to 1.30.1 and NGINX Plus 37.0.0 with fixes in Open Source 1.30.2 and 1.31.1 and Plus 37.0.1.1, and recommended mitigations are to upgrade immediately, audit rewrite rules to replace unnamed captures with named captures, and enable exploit mitigations such as ASLR.
Hackers Use CypherLoc Kit to Push Fake Microsoft Support Scams

gbhackers.com · 5 months ago

CypherLoc is a sophisticated browser-lock scareware that executes an encrypted, condition-gated payload inside compromised web pages to evade scanners and sandboxes and coerce victims into calling fraudulent technical support numbers. It uses runtime page replacement, developer tools disruption, aggressive full-screen locking, audio pressure, fake login forms, and public IP display to heighten fear, prevent live analysis, and keep victims engaged. Barracuda researchers observed about 2.8 million attacks since the start of 2026 and defenders are advised to prioritize anti-phishing, browser and endpoint protections, and user education because legitimate security alerts do not lock browsers or display phone numbers.
nmap on Linux: Guide to Network Scanning and Discovery

linuxblog.io · 5 months ago

There are instructions for using Nmap on Linux to perform host discovery, port and UDP scanning, service and version detection, operating system fingerprinting, and running Nmap Scripting Engine scripts for enumeration and vulnerability checks. Common commands and options shown include -sn for host discovery, -sS for SYN scans, -sU for UDP scans, -sV for version detection, -O for OS detection, -A for an aggressive combined scan, and --script with categories such as vuln or ftp-anon for targeted checks. The guide also explains output formats including normal, XML, and grepable files, timing templates from T0 to T5, ways to scan ranges or lists of hosts, and cautions to only scan systems you own or have explicit permission to test and to use conservative timing on production networks.
Prompt Injection finally broke my brain a little. My first article as a security student.

www.cmxchat.com · 5 months ago

Prompt injection is a class of attack that lets malicious language in system prompts, retrieved documents, emails, and files manipulate a large language model's reasoning and override intended instructions. There are direct attacks that inject commands into conversations and indirect attacks that poison retrieval pipelines or documents, with real world 2025 to 2026 enterprise examples showing data leakage, moderation bypasses, and tool hijacking when agents and retrieval augmented generation systems pull in poisoned content. Defenses are layered and include separating core system instructions from outside data, sanitizing or filtering retrieved content, applying least privilege to tools, monitoring outputs closely, running regular red and purple team tests, and requiring human approval for high risk actions.
Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

www.bleepingcomputer.com · 5 months ago

A large-scale campaign is exploiting a critical SQL injection vulnerability CVE-2026-26980 in Ghost CMS to steal admin API keys and inject malicious JavaScript that triggers ClickFix social engineering flows. Researchers at XLab confirmed the campaign impacted more than 700 domains, including university portals, AI and SaaS companies, media outlets, fintech firms, security sites, and personal blogs. The attack chain abuses the vulnerability to read database data and obtain admin API keys, then injects a lightweight loader that fetches cloaked second-stage scripts which display a fake Cloudflare prompt instructing victims to paste a command that drops payloads observed as DLL loaders, JavaScript droppers, and an Electron sample named UtilifySetup.exe. Administrators are urged to upgrade Ghost to version 6.19.1 or later, rotate any exposed keys, remove injected scripts using provided indicators of compromise, and retain at least 30 days of admin API logs for retrospective investigation.
How to Use Claude AI: A Complete Technical Beginner's Guide

tblogs.site · 5 months ago

There are three architectural pillars for getting the most from Claude AI: structured XML prompting that separates instructions, context, and rules to force deterministic behavior, multi file Projects that provide persistent knowledge and workspace isolation for large codebases, and Artifacts that render and let users interact with live code, SVGs, and web elements in a side by side development window. Effective use requires pruning noisy files before loading the platform's 200000 token context window, seeding Projects with targeted documentation to avoid repetitive prompting, and enabling Artifacts in feature previews to test and iterate quickly. Recommended practices include treating prompts as tagged metadata to prevent attention loss, excluding heavy directories to save tokens and reduce latency, and monitoring Pro tier usage limits to avoid throttling.
Tech billionaires used performance drugs in secret. Now they’re selling a revolution.

www.washingtonpost.com · 5 months ago

There is a Silicon Valley backed athletic tournament called the Enhanced Games that encourages medically supervised use of steroids, hormones, peptides and other legal performance enhancing drugs and staged an inaugural event in Las Vegas. Investors include Peter Thiel and 1789 Capital, the company recently had a reported valuation of 1.2 billion dollars and plans to use the spectacle to mainstream and sell longevity and enhancement therapies through a telehealth platform. Organizers said 36 of 42 athletes doped in preparation, with reported usage rates of 91 percent testosterone, 79 percent human growth hormone, 62 percent stimulants, 50 percent metabolic modulators, 41 percent EPO and 29 percent anabolic agents, and athletes can earn million dollar bonuses for breaking certain records. Medical and anti doping experts and organizations warn the concept is dangerous and unethical, citing unclear long term safety for stacked or off label use of powerful drugs and the risk of normalizing performance enhancing drug use among children and other athletes.
UK Institute Is Hunting for Dangers Lurking in AI

www.nytimes.com · 5 months ago

The United Kingdom's AI Security Institute is staffed by senior alumni from OpenAI and Google DeepMind and operates within the Department of Science, Innovation and Technology. It conducts independent pre deployment testing of frontier AI systems, has released open source evaluation tools, and has published assessments that include prerelease testing of major models. The institute has attracted industry funding and formal cooperation from major firms including OpenAI and Microsoft and is being used as a model for international coordination on emerging AI risks.
Laravel Lang packages hijacked to deploy credential-stealing malware

www.bleepingcomputer.com · 5 months ago

There was a supply chain attack against Laravel Lang localization packages that abused GitHub version tags to distribute malicious Composer releases. Attackers rewrote hundreds of historical git tags across multiple repositories to point to malicious commits in attacker controlled forks, which autoloaded a malicious helpers file that acted as a dropper for a second payload. The second payload is a large cross platform credential stealer that harvests cloud credentials, Kubernetes secrets, Vault tokens, Git and continuous integration secrets, SSH keys, browser data and encryption keys, cryptocurrency wallets, password manager data, VPN configurations and local environment files, and the Windows component named DebugElevator targets Chromium based browsers to extract browser encryption keys. Packagist removed the malicious versions and temporarily unlisted the affected packages, and developers are advised to review installed package versions, rotate any exposed credentials and inspect systems for indicators of compromise.
npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks

thehackernews.com · 5 months ago

There is a staged publishing feature on npm that requires a human maintainer to complete a two factor authentication challenge to approve a prebuilt tarball in a staging queue before the package becomes publicly installable. To use staged publishing a maintainer must have publish access, the package must already exist on the registry, and the account must have two factor authentication enabled, and the npm stage publish command requires npm CLI 11.15.0 or newer. npm also added three install source flags, --allow-file to control installs from local files and tarballs, --allow-remote to control installs from remote URLs, and --allow-directory to control installs from local directories, enabling an explicit allowlist for non registry install sources. The changes are intended to strengthen the software supply chain after a recent surge in package poisoning campaigns by threat actors such as TeamPCP.
Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware

thehackernews.com · 5 months ago

A coordinated supply chain campaign infected eight Packagist packages with malicious code that downloads a Linux binary from a GitHub Releases location, saves it to the /tmp/.sshd folder, grants execute permissions, and runs it in the background. The attacker placed postinstall scripts in package.json rather than composer.json to target projects that ship JavaScript build tooling alongside PHP, and the malicious package versions have been removed from Packagist. Investigators found references to the same payload across hundreds of GitHub files and in at least two GitHub Actions workflows, and the installer attempts to hide activity by disabling TLS verification, suppressing errors, and enabling remote code execution during installation and build workflows while the second stage binary is currently unavailable.
Italy disrupts CINEMAGOAL piracy app that stole streaming auth codes

www.bleepingcomputer.com · 5 months ago

Italian authorities dismantled a piracy ecosystem built around the CINEMAGOAL app that provided access to multiple legitimate streaming services including Netflix, Disney Plus, Spotify, Sky, and DAZN, executing a large operation called Tutto Chiaro with 100 searches and seizures of servers in France and Germany. The app connected directly to legitimate platforms by fetching valid authentication and decryption codes from foreign servers, used virtual machines in Italy to capture codes from subscriptions created with false identification every three minutes, redistributed those codes to customers, and masked users IP addresses to evade blocks. Authorities reported more than 70 resellers, annual subscriptions priced between 40 and 130 euros with payments via cryptocurrency or foreign bank accounts, estimated damages around 300 million euros, penalties already issued to the first 1,000 subscribers ranging from 154 to 5,000 euros, and that a pezzotto IPTV service was also dismantled as the investigation continues.
Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software

thehackernews.com · 5 months ago

Project Glasswing has surfaced more than 10,000 high or critical vulnerabilities across systemically important software since launching last month, with 6,202 initially classified as high or critical across more than 1,000 open source projects and triage confirming 1,726 true positives of which 1,094 are high or critical. One notable finding is a critical wolfSSL certificate verification flaw tracked as CVE-2026-5194 with a CVSS score of 9.1 that can allow attackers to forge certificates and impersonate legitimate services. Companies and defenders are being urged to shorten patch cycles, harden default configurations, enforce multi factor authentication, and maintain comprehensive logs while Anthropic provides a Cyber Verification Program and other tools to help validate and remediate vulnerabilities.
‘Underminr’ Vulnerability Lets Attackers Hide Malicious Connections Behind Trusted Domains

www.securityweek.com · 5 months ago

There is a vulnerability named Underminr that affects roughly 88 million domains and lets attackers hide malicious connections behind trusted domains by abusing shared content delivery network infrastructure. The technique presents the SNI and HTTP Host of one domain while forcing the request to the IP address of another tenant, enabling attackers to bypass DNS filtering and conceal command and control, VPN, and proxy traffic even where domain fronting mitigations exist. ADAMnetworks reports the flaw can be abused with four strategies to evade Protective DNS and has been observed against large hosting providers, with internet infrastructure in the United States, the United Kingdom, and Canada most impacted. Security teams are warned that increased use of AI could accelerate attacks that weaponize this capability.
Hackers Exploit F5 BIG-IP to Gain SSH Access and Pivot Into Linux Networks

gbhackers.com · 5 months ago

Threat actors are exploiting end of life F5 BIG-IP appliances to gain unauthorized SSH access and use compromised devices as launchpads for multi stage intrusion campaigns that pivot into Linux hosts, an internal Confluence server, and Active Directory infrastructure. Microsoft Threat Intelligence disclosed the full attack chain on May 22, 2026, showing initial access to an Azure hosted F5 BIG-IP Virtual Edition running version 15.1.201000 which reached end of life on December 31, 2024. The campaign leverages a reclassified remote code execution flaw tracked as CVE-2025-53521 and an NTLM relay weakness tracked as CVE-2025-33073 to move from edge appliances to domain level compromise. Recommended mitigations include retiring end of life appliances, urgently patching internal applications such as Confluence, disabling or minimizing NTLM and enforcing SMB signing, implementing tiered administration, and enabling Microsoft Defender for Endpoint in block mode.
Hackers Exploit F5 BIG-IP to Gain SSH Access and Pivot Into Linux Networks

gbhackers.com · 5 months ago

There are active attacks exploiting end of life F5 BIG IP appliances to gain unauthorized SSH access and use the devices as launchpads to pivot into enterprise Linux hosts, internal Confluence servers, and Active Directory environments. Microsoft Threat Intelligence disclosed the full attack chain on May 22, 2026, tracing initial access to an Azure hosted F5 BIG IP Virtual Edition running version 15.1.201000 which reached end of life on December 31, 2024. The campaign leverages a critical F5 flaw tracked as CVE-2025-53521 which was reclassified as remote code execution in March 2026 and added to known exploited vulnerabilities, and the actor later abused an unpatched Confluence instance to harvest credentials and perform Kerberos relay attacks exploiting CVE-2025-33073. Recommended mitigations include retiring end of life appliances, urgently patching internal applications, disabling or minimizing NTLM and enforcing SMB signing, enabling endpoint protection in block mode on Linux servers, and implementing a tiered administration model.
Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer

thehackernews.com · 5 months ago

A software supply chain attack compromised multiple Laravel-Lang PHP packages, including laravel-lang lang, laravel-lang http-statuses, laravel-lang attributes, and laravel-lang actions, with more than 700 republished versions and malicious tags pushed rapidly on May 22 and May 23, 2026. A malicious file named src helpers.php, registered for automatic loading, fingerprinted hosts and contacted a remote command and control server to fetch a cross platform payload that executes on Windows, Linux, and macOS. The dropper delivers a Visual Basic Script launcher on Windows and executes native payloads on Linux and macOS, while a roughly 5,900 line PHP stealer with fifteen collector modules harvests cloud credentials, tokens, cryptocurrency seed phrases, browser and password manager data, development and infrastructure secrets, encrypts the results, and deletes itself.
LiteSpeed cPanel Plugin 0-Day Exploited for Server Root Access

gbhackers.com · 5 months ago

A critical zero-day privilege escalation in the LiteSpeed User-End cPanel plugin is being actively exploited in the wild, allowing any authenticated cPanel user to execute arbitrary scripts as root and gain full server control. The flaw is a logic bug in the lsws.redisAble JSON API endpoint exposed to all logged-in cPanel users, is tracked as CVE-2026-48172 with a maximum CVSS score of 10.0, and was patched on May 21, 2026; the cPanel ecosystem also saw related advisories including CVE-2026-41940. Administrators are advised to detect exploitation attempts by searching cPanel access logs for calls to the redisAble API and to assume compromise if found, rotating credentials, auditing cron jobs and authorized keys. Mitigation steps include upgrading to LiteSpeed WHM Plugin version 5.3.1.0 bundled with cPanel Plugin version 2.4.7, forcing a full cPanel update, or uninstalling the vulnerable plugin to immediately remove the attack surface.
‘It’s called winning’: Why a tech industry super PAC is running ads about ICE

www.washingtonpost.com · 5 months ago

There are rival deep pocketed super PACs and nonprofit networks funded by factions inside the AI industry that have poured tens of millions of dollars into midterm congressional primaries, using sharply targeted TV, radio and social media ads that often do not mention artificial intelligence. Public First, linked to the AI company Anthropic, spent about 1.6 million dollars in North Carolina’s fourth district and has raised additional funds, while a rival network called Leading the Future has attracted roughly 140 million dollars from Trump aligned tech leaders. The spending is aimed at shaping policy priorities including AI regulation, data center permitting and export controls, and critics say the interventions highlight donor opacity and how corporate factions are influencing political outcomes.
Ubiquiti Patches Critical UniFi OS Privilege Escalation Flaws

gbhackers.com · 5 months ago

There are five critical and high severity UniFi OS vulnerabilities that allow remote command execution, privilege escalation, improper access control, and path traversal across many UniFi devices including Dream Machines, Network Video Recorders, and Cloud Gateways. The flaws are tracked as CVE-2026-33000, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, and CVE-2026-34911, with CVE-2026-33000 enabling command injection with privileged access, CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 rated CVSS 10.0 and exploitable without authentication, and CVE-2026-34911 a high severity path traversal requiring low privileges. Administrators should treat these as emergency updates and immediately apply vendor patches such as UniFi OS Server to version 5.0.8, most devices to 5.1.12, Express to 4.0.14, and UNAS appliances to 5.1.10.
Hackers Use SEO Poisoning to Fake Gemini CLI, Claude Installers

gbhackers.com · 5 months ago

There is an active financially motivated campaign first identified in early March 2026 that uses SEO poisoning and paid ads to impersonate AI developer tools and trick developers into running a single paste and execute PowerShell or mshta command. The lure runs a visible legitimate install command while silently memory executing a second stage fileless PowerShell infostealer or an HTA payload appended to a genuine MSIX bundle, which disables event tracing for Windows, bypasses AMSI, and harvests browser credentials, session tokens, SSH keys, cloud synced files, and CI and CD credentials. Stolen session cookies bypass multifactor authentication and the actor uses rotating lures and bulletproof hosts to target developer workstations across sectors worldwide, so teams should hunt for download cradle patterns, enforce constrained PowerShell modes, and apply stronger account protections.
Pardon MIE?: how Mythos did not bypass Apple MIE

ironpeak.be · 5 months ago

There is a bypass of Apple Memory Integrity Enforcement on M5 silicon that exploits an integer overflow in the kernel function zallocromut to make target plus length wrap past 64 bits, allowing a single oversized memcpy to overwrite read only zone structures such as ucred and flip an effective user ID to root. This issue is tracked as CVE-2026-28952 and was developed into a local unprivileged to root exploit by Calif with assistance from Anthropic’s Mythos in roughly five days. Apple released a minimal two instruction patch in macOS Tahoe 26.5 that adds per CPU bound checks in zallocromut to prevent the wraparound used by the exploit. The chain demonstrates that hardware memory tagging and page table enforced read only zones can still be defeated by carefully crafted data only attacks and integer overflows, narrowing the time between disclosure and working exploit and making timely patching critical for affected systems.
LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root

thehackernews.com · 5 months ago

A maximum-severity vulnerability in the LiteSpeed user-end cPanel plugin is being actively exploited to run arbitrary scripts as root by abusing incorrect privilege assignment in the lsws.redisAble function. The flaw is tracked as CVE-2026-48172 with a CVSS score of 10.0, affects plugin versions 2.3 through 2.4.4, and was reported by researcher David Strydom. Administrators should search cPanel logs for entries referencing the API parameter named cpanel jsonapi func or the redisAble function to detect compromise, upgrade to cPanel plugin version 2.4.7 bundled with WHM plugin 5.3.1.0, or remove the user-end plugin if patching is not immediately possible. This disclosure follows a recent actively exploited cPanel vulnerability CVE-2026-41940 that was used to deploy Mirai botnet variants and the Sorry ransomware, underscoring the urgent need to patch.
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV

thehackernews.com · 5 months ago

CISA added CVE-2026-9082, an SQL injection vulnerability in Drupal Core with CVSS score 6.5, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation, and the flaw can allow privilege escalation and remote code execution via specially crafted requests using the database abstraction API. Patches are available for Drupal 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, and 10.4.10, with manual updates required for Drupal 9.5 and 8.9, and Federal Civilian Executive Branch agencies were advised to apply fixes by May 27, 2026. Drupal confirmed exploit attempts on May 22, 2026, and security firm Imperva reported observing over fifteen thousand attack attempts against almost six thousand sites across sixty five countries, primarily probing gaming and financial services sites and targeting PostgreSQL backed configurations, with activity that could rapidly move from reconnaissance to data extraction or privilege escalation if successful.
Hackers Compromise Laravel-Lang Packages via 700 GitHub Repos

gbhackers.com · 5 months ago

A sophisticated supply chain attack compromised more than seven hundred historical package versions across four Laravel Lang PHP localization repositories, with malicious Git tags published in rapid succession on May 22 and May 23, 2026. The attacker added a malicious src/helpers.php registered under composer autoload.files that executes automatically when Composer's autoloader runs, delivering a remote code execution backdoor that fetches and runs a second stage payload. The second stage is a cross platform PHP credential stealer that harvests cloud metadata and service tokens, CI and developer credentials, browser and password manager data, and cryptocurrency wallets before exfiltration, prompting Packagist to remove the malicious versions and urging teams to treat impacted hosts as fully compromised, rotate secrets, block affected package versions, and rebuild from known good images.
Claude Mythos Preview Discovers 10,000+ 0-Days in Glasswing

gbhackers.com · 5 months ago

Anthropic's Project Glasswing, powered by the Claude Mythos model, surfaced more than ten thousand high or critical zero day vulnerabilities after scanning over one thousand open source projects, generating 23,019 candidate findings and yielding 1,726 confirmed true positives from 1,900 items sent for formal review, a 90.8 percent true positive rate. The surge has created a remediation bottleneck, with 1,596 findings reported to maintainers, 1,451 acknowledgements, only 97 upstream patches and 88 published advisories as of May 22, 2026, and 827 confirmed high or critical vulnerabilities still awaiting disclosure while some maintainers have asked Anthropic to slow disclosures. A notable exploit against the wolfSSL library that could forge TLS certificates was patched and assigned CVE-2026-5194, Mythos helped Mozilla fix 271 issues in Firefox 150, and the model outperformed prior systems on academic and industry benchmarks and solved previously unsolvable cyber range simulations. To help address scale, Anthropic launched Claude Security in public beta for enterprises, released scanning skills, codebase mapping tools and a Cyber Verification Program, and partnered with open source initiatives to assist maintainers.
Google leaks details for Chromium bug that can turn browsers into bots

www.csoonline.com · 5 months ago

An unpatched vulnerability in Chromium can let attackers execute JavaScript persistently across browser restarts, enabling hijacked browsers to be used for distributed denial of service attacks, running crypto miners, persistent tracking, and other abuses. The flaw, reported more than three years ago by researcher Lyra Rebane, exploits the Service Worker feature and the Background Fetch API by repeatedly creating and aborting background fetches to keep service workers alive, and technical details were briefly exposed in the project bug tracker before the entry was set private. Some browser UI visibility issues were patched in January 2023, but the deeper persistence mechanism remains and would require a specification level fix to introduce a hard time limit for quitting service workers. The exploit can execute remote JavaScript and WebAssembly payloads, harvest browser open timestamps IP addresses and User Agent information, or trigger cross site requests that could be used to build botnets of compromised browsers.
Waymo Suspends Service in Six Cities After Cars Drove Into Flooded Roads

www.nytimes.com · 5 months ago

There are temporary suspensions of Waymo robotaxi service in Atlanta and parts of Texas after videos showed unoccupied Waymo vehicles stopped on flooded Atlanta streets during a sudden downpour on Wednesday. Waymo said the vehicles stopped after encountering deep water, the cars were recovered, and the company paused operations while it updates software to improve handling of flooded roadways and construction zones and has suspended freeway rides in several U.S. cities. There were no reported injuries and the company described the pause as an abundance of caution ahead of forecasted severe weather.
Friday Squid Blogging: Regulating Squid Fishing in the South Pacific

www.schneier.com · 5 months ago

A call has been made for the South Pacific Regional Fisheries Management Organization to regulate squid fishing in the South Pacific to address expanding fishing activity. The post also invites readers to discuss related security stories and notes the site’s blog moderation policy.
CVE-2026-9256 - "nginx-poolslip", another new vulnerability in the rewrite module

my.f5.com · 5 months ago

NULL
AI Security CTF (free, open) - prompt injection, agent workflow hijacking, guardrail bypass - June 17-22

kubearmor.io · 5 months ago

There is an AI security capture the flag created by the KubeArmor developer relations team that runs entirely in the browser and focuses on AI specific attack surfaces often missing from traditional CTFs. It contains three tracks with 18 challenges: Prompt Injection Lab, covering system instruction override, persona drift via roleplay and translation, multi turn memory manipulation, indirect injection through poisoned context, and guardrail filter bypass; Agent Workflow Hijack, covering coercing agent tool misuse, poisoning indexed sources with hidden instructions, manipulating fake approval gates, exploiting agent memory as a prompt injection surface, and chaining tool calls to exfiltrate secrets; and Hidden API and Guardrail Bypass, covering triggering debug endpoints, tampering safety mode parameters via developer tools, abusing export features for data leaks, intercepting streamed responses before redaction, and replaying weak preview tokens. The event runs in the browser with no cluster access or local tools required, is free for individual play, scored on CTFd, runs June 17 through June 22, and awards more than one thousand dollars in prizes to top performers.
Just added an interactive security map to my project NoEyes showing exactly what the server sees (and doesn't)

ymsniper.github.io · 5 months ago

NoEyes is a security architecture at version 0.5 that provides end to end encryption and zero metadata routing implemented in Python using PyNaCl and cryptography. The design is organized into security layers including crypto primitives, key hierarchy, zero metadata routing, forward secrecy, identity and trust on first use, transport and TLS, access and denial of service protection, and file transfer. An interactive map interface allows nodes to be inspected and supports scroll to zoom and drag to pan for exploration of the architecture.
Google Appeals Landmark Ruling Declaring It a Monopolist in Search

www.nytimes.com · 5 months ago

A federal appeals court was asked to reverse a judge's ruling that Google violated antitrust laws and to overturn a requirement that the company share portions of its search data with rivals. Google told the court that the data sharing would risk exposing trade secrets and asked for the order to be paused while it pursues its appeal, but a district judge has previously found a stay premature. The dispute follows a 2024 finding that Google maintained dominance through exclusive distribution agreements and a remedies phase that would require making search index and user interaction data available to qualified competitors.
FBI warns of Kali Oauth stealers

www.csoonline.com · 5 months ago

There is a new wave of phishing attacks generated by a tool called Kali365 that enables criminals to obtain Microsoft 365 access tokens and bypass multi factor authentication by capturing OAuth tokens tied to a victim's Microsoft 365 account. The scam sends emails impersonating trusted cloud document services and directs recipients to enter a code on a legitimate Microsoft site that instead authorizes the attacker device to access the victim's account. The FBI advises IT managers to mitigate the threat by creating conditional access policies to block the authorization code flow with narrow exceptions for necessary business processes and by blocking authentication transfer policies to prevent users from handing over access from corporate devices to mobile devices.
First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups

thehackernews.com · 5 months ago

Authorities in Europe and North America announced the dismantling of a criminal virtual private network service called First VPN after a coordinated operation led by France and the Netherlands between May 19 and May 20, 2026, which included interviewing the service administrator, executing a house search in Ukraine, taking down thirty three servers, and seizing infrastructure used to support global cybercriminal activity. First VPN, active since about 2014 and operating about thirty two exit nodes across twenty seven countries, was promoted on Russian language cybercrime forums and offered protocols and transport options designed to disguise traffic such as OpenConnect, WireGuard, Outline, VLess with Reality, and multiple encryption methods while claiming not to store logs. Investigators say at least twenty five ransomware groups used the service for reconnaissance and intrusions, subscription plans ranged from one day to one year costing between two dollars for a single day and four hundred eighty three dollars for a year, and payments were accepted through cryptocurrencies and other anonymous methods.
Netherlands seizes 800 servers of hosting firm enabling cyberattacks

www.bleepingcomputer.com · 5 months ago

Dutch financial crime investigators arrested two men and seized 800 servers, laptops, phones, and administrative records from data centers linked to a web hosting company that enabled cyberattacks, interference operations, and disinformation campaigns. The suspects, a 57 year old company director and a 39 year old head of a separate connectivity firm, are accused of indirectly providing economic resources to Russian and Belarusian entities sanctioned by the European Union, and investigators say the hosting firm Stark Industries, founded on February 10, 2022, was added to the EU sanctions list on May 20, 2025 after which its infrastructure was transferred to a newly created Dutch front company named WorkTitans B.V. operating under the brand THE.Hosting. Authorities allege links between the infrastructure and pro Russian hacktivist group NoName05716 and say Mirhosting provided colocation and high capacity connectivity that acted as the transport layer into Europe, while the implicated firms have denied knowingly supporting illegal operations.
Drupal Vulnerability in Hacker Crosshairs Shortly After Disclosure

www.securityweek.com · 5 months ago

There are active exploitation attempts against CVE-2026-9082, a highly critical Drupal vulnerability that allows unauthenticated attackers to perform arbitrary SQL injection against sites using PostgreSQL, potentially enabling data theft, privilege escalation, or remote code execution. Drupal warned exploitation could emerge within hours or days and released a patch on May 20, 2026, and its advisory was updated on March 22, 2026 to raise the NIST CMSS risk score from 20 to 23 after detections in the wild. Security firms reported more than fifteen thousand exploitation attempts targeting nearly six thousand sites across sixty five countries, with almost half aimed at gaming and financial services, while Drupal estimates fewer than five percent of its sites use PostgreSQL and are therefore affected.
Police take down VPN service (this time with a good reason)

www.csoonline.com · 5 months ago

European authorities led by investigators in France and the Netherlands with support from Europol and Eurojust dismantled First VPN after finding the service was used to conceal identities and infrastructure for ransomware attacks, large scale fraud, data theft, and other serious offences. The service had been heavily promoted within Russia as a way to evade law enforcement. The takedown has prompted debate over broader attempts to restrict VPNs, with Australia adopting age and access rules and the United Kingdom considering similar measures. Privacy advocates including Mozilla and the Electronic Frontier Foundation say mandatory age assurance and restrictions on VPNs undermine fundamental rights and are unlikely to withstand legal challenges in the United States.
From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence

www.microsoft.com · 5 months ago

An exposed F5 BIG-IP Virtual Edition instance running an end of life image provided initial SSH access, allowing a threat actor to pivot to an internal Linux host and then to an unpatched Confluence server. The actor performed automated reconnaissance, deployed custom ELF payloads and commodity tooling, stole credentials from Confluence configuration files, and attempted Kerberos relay and other authentication abuse including exploitation of CVE-2025-33073. References in the investigation also note a BIG-IP APM vulnerability CVE-2025-53521 associated with similar activity, and Microsoft Defender blocked the HackTool MalPack.B payload and detected multiple stages of the intrusion. Guidance includes treating edge appliances as Tier 0 assets, rapidly patching or restricting management exposure, hardening internal web applications, minimizing NTLM and enforcing SMB and LDAP protections, and enabling consistent real-time protection across Linux servers.
Lawmakers Demand Answers as CISA Tries to Contain Data Leak

krebsonsecurity.com · 5 months ago

A CISA contractor intentionally published AWS GovCloud keys and dozens of plaintext credentials and other agency secrets in a public GitHub repository named Private-CISA, prompting demands for answers from lawmakers in both houses of Congress. The repository, reportedly created in November 2025, included commit logs showing the contractor disabled GitHub protections against publishing secrets, and the exposure was flagged to CISA by the security firm GitGuardian while CISA said there is no indication sensitive data was compromised. TruffleHog researcher Dylan Ayrey said an exposed RSA private key granted access to a CISA-owned GitHub app with full access to enterprise repositories, enabling an attacker to read private code, hijack CI/CD runners, and change repository admin settings, and CISA was still working to invalidate and rotate multiple leaked credentials after notification. Lawmakers including Senator Maggie Hassan and Representative Bennie Thompson have demanded detailed answers about CISA’s internal policies and contract management as the agency attempts to contain the breach.
Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware

thehackernews.com · 5 months ago

A Belarus aligned threat actor known as Ghostwriter has used lures tied to Prometheus, a Ukrainian online learning platform, to target Ukrainian government organizations with phishing emails sent from compromised accounts since spring 2026. The phishing messages contain PDF attachments that link to ZIP archives holding a JavaScript named OYSTERFRESH which displays a decoy document while stealthily writing an obfuscated and encrypted payload called OYSTERBLUES into the Windows Registry and downloading OYSTERSHUCK to decode it. OYSTERBLUES harvests system information including computer name, user account details, OS version, last boot time, and running processes, posts the data to a command and control server, and awaits further JavaScript delivered and executed using the JavaScript eval function, with the final payload assessed to be Cobalt Strike. CERT-UA advises restricting the ability to run wscript.exe for standard user accounts to reduce the attack surface, and Ukraine's National Security and Defense Council warns that Russian backed actors are using artificial intelligence to scout targets and embed AI into malware for follow up exploitation and influence operations.
Microsoft Security success stories: How St. Luke’s and ManpowerGroup are securing AI foundations

www.microsoft.com · 5 months ago

AI is reshaping work and the threat landscape across cloud, data, and identity, and protections must be built into how AI systems are developed, governed, and used with a foundation of cloud security posture, data governance, and Zero Trust principles. St. Luke’s unified Microsoft Defender and Microsoft Sentinel with Microsoft Security Copilot to gain a single AI powered view across endpoints, identity, email, and cloud, automating alert triage and vulnerability remediation to reduce false positives and save up to 200 analyst hours per month. ManpowerGroup consolidated security tooling by deploying Microsoft 365 E5 and Microsoft Sentinel to reduce complexity, accelerate integrations from weeks to hours or days, unify global operations, and create an AI ready security foundation, while both organizations followed a repeatable playbook of leading with business risk, unifying visibility, operationalizing governance, hardening posture, and automating outcomes so security enables AI at scale.
Microsoft says it’s making AI ‘safe for work’ in your browser

www.csoonline.com · 5 months ago

Microsoft is testing agentic AI in Edge for Business through a limited preview that automates multi step tasks such as filling forms, navigating sites, and gathering information across tabs using enterprise managed tools. A new tab page will surface calendar entries, files and Copilot prompts to reduce switching between tools. Enterprises can block copy and paste and ensure AI prompts and responses remain inside their Microsoft 365 tenant and are not used to train models, while auditing prompts and blocking sensitive uploads. Microsoft Purview will analyze file uploads to detect sensitive data and allow enterprises to track or block users who violate policy, and access to the features requires signing up for the limited preview.
Akamai Joins Growing Chorus of Vendors Betting Big on Secure Enterprise Browsers

www.darkreading.com · 5 months ago

Akamai agreed to acquire LayerX for 205 million dollars and will continue to offer the LayerX browser as a standalone product while integrating it into its zero trust network access portfolio. LayerX is a Tel Aviv startup founded in 2021 that provides a lightweight browser extension which turns major browsers into a policy enforced secure workspace and enforces policy before traffic is encrypted and transmitted to extend access decisions into the browser session. Secure enterprise browsers are becoming a hot area with multiple recent acquisitions and new products, Gartner projects adoption rising to twenty five percent by 2028, and Akamai plans to extend the combined ZTNA and LayerX model across API security, AI protection, its content delivery network and Akamai Cloud.
Former US execs plead guilty to aiding tech support scammers

www.bleepingcomputer.com · 5 months ago

Two former executives of a call tracking and analytics company, former CEO Adam Young and former CSO Harrison Gevirtz, pleaded guilty to concealing a years long tech support fraud scheme and admitted to misprision of a felony with sentencing scheduled for June 16, 2026. They operated C.A. Cloud Attribution Limited from early 2017 to April 2022 and knowingly provided telephone numbers, call recordings, call forwarding, and call tracking services to customers engaged in telemarketing and tech support fraud, advising the use of large pools of rotating phone numbers to reduce complaints and sometimes introducing fraudsters to one another. Scammers used deceptive pop up warnings and impersonation to extort hundreds of dollars for fake technical services, remotely accessed some victims systems, and in some cases stole personal and financial information that left many victims financially devastated.
Microsoft Warns: Windows Zero-Day ‘YellowKey’ Can Bypass BitLocker

www.techrepublic.com · 5 months ago

Microsoft released a temporary mitigation for YellowKey, a Windows zero-day tracked as CVE-2026-45585, after disclosure of a proof of concept showing it can bypass BitLocker by abusing the Windows Recovery Environment. The exploit requires physical access and uses a crafted FsTx file on a USB drive to trigger a shell in WinRE, giving an attacker access to a device’s disk contents. The mitigation script aims to remove the autofstx.exe component that enables the bypass and Microsoft also recommends enabling TPM plus PIN at startup, though the researcher who released the PoC claims TPM plus PIN can still be exploited. Administrators are urged to apply the mitigation immediately, treat YellowKey as a real physical-access risk, and monitor Microsoft for a permanent security update.
Restoring Testability: Handling Complex Scenarios in Burp Suite with a Custom Extension

hnsecurity.it · 5 months ago

There is a talk about restoring testability in HTTP based applications using custom Burp Suite extensions to handle complexities such as custom protocols, payload encryption, request signatures, replay protection, and non standard encoding. Slides, example code, and a recording are published to show how to work in Proxy and Repeater, run automated tools like Intruder and Scanner, and even drive external tools such as SQLMap through Burp.
Sundar Pichai Understands Why People Are Anxious About A.I.

www.nytimes.com · 5 months ago

Sundar Pichai said he understands why people are anxious about artificial intelligence and discussed how Google is responding after a busy Google I O. He said Google is redesigning Search to be AI first, expanding Gemini and deploying persistent AI agents across Gmail, Docs, Chrome and YouTube to handle complex research and retain context over time. He also offered advice to college graduates worried about the job market, and the conversation included updates on model access, disclosure timelines, and practical consumer precautions.
Zyxel low-priv account leaked super-admin, FTPS, and TR-069 secrets across router fleets

minanagehsalalma.github.io · 5 months ago

CVE-2021-35036 is a credential exposure that allowed authenticated low-privilege Zyxel sessions to retrieve cleartext passwords for higher-privilege local accounts, FTPS credentials, and TR-069 management secrets via web accessible management handlers. The root cause was shared management code that copied password fields into getter responses, and initial vendor fixes masked displayed values without preventing backend disclosure. Zyxel expanded the affected scope to many CPE, ONT, LTE, and 5G product lines. Reverse engineering and an emulated genpass tool demonstrated that supervisor and admin passwords could be deterministically regenerated from device serial numbers, highlighting a systemic design weakness.
In Other News: Industrial Router Exploitation, CISA KEV Nomination Form, Gas Station Hacking

www.securityweek.com · 5 months ago

Iranian-linked attackers breached internet-connected automatic tank gauge systems at multiple US gas stations by accessing unprotected devices without passwords and altering displayed fuel readings without changing actual volumes, raising concerns about masking leaks and other infrastructure risks. A contractor working for CISA left administrative keys and plaintext passwords in a public GitHub repository, a zero day in Huawei enterprise router software triggered a July 2025 Luxembourg telecom outage, and a high severity SSRF in Open WebUI was reported as CVE-2026-45401. Four-Faith F3x36 industrial cellular routers are being aggressively exploited via CVE-2024-9643, an authentication bypass stemming from hardcoded credentials that attackers are using to conscript devices into botnets, and CISA has launched an online nomination form to crowdsource known exploited vulnerabilities for its KEV catalog.