Blahalla

Juniper Networks PTX Routers Affected by Critical Vulnerability

www.securityweek.com · 5 months ago

A critical vulnerability, CVE-2026-21902, has been identified in Juniper Networks Junos OS Evolved software running on PTX series routers. This flaw allows an unauthenticated attacker with network access to execute code with root privileges, potentially taking complete control of the device. The vulnerability impacts the On-Box Anomaly detection framework, which is enabled by default. Patches are available in versions 25.4R1-S1-EVO and 25.4R2-EVO, while Juniper reports no evidence of this vulnerability being exploited in the wild.

South Korea Clears Way for Google Maps to Fully Operate

www.nytimes.com · 5 months ago

false

Trojanized Gaming Tools Spread Java-Based RAT via Browser and Chat Platforms

thehackernews.com · 5 months ago

Threat actors are using trojanized gaming utilities distributed through browsers and chat platforms to install a remote access trojan. Attackers use a portable Java runtime and PowerShell to evade detection and maintain persistence with scheduled tasks and startup scripts, connecting to a command-and-control server at 79.110.49[.]15. Security researchers have also disclosed a new Windows RAT called Steaelite that combines data theft and ransomware capabilities and offers extensive remote control features. Additionally, DesckVB RAT and KazakRAT have been recently discovered, with KazakRAT potentially linked to a state-affiliated group.

A World Where All Is Free? That’s Elon Musk’s Theory of ‘Sustainable Abundance.’

www.nytimes.com · 5 months ago

false

Elon Musk’s Secret Web of Companies in Texas

www.nytimes.com · 5 months ago

false

The hypothetical nuclear attack that escalated the Pentagon’s showdown with Anthropic

www.washingtonpost.com · 5 months ago

A dispute has emerged between Anthropic, an artificial intelligence firm, and the Pentagon regarding the military’s potential use of AI. The disagreement centers around a discussion concerning a hypothetical nuclear attack on the United States, with both sides presenting conflicting accounts. This standoff highlights a broader concern over the deployment of lethal autonomous weapons. No CVEs were mentioned.

We’re about to turn night into day. Is that a good idea?

www.washingtonpost.com · 5 months ago

Proposals are being considered that involve using mirrors to illuminate entire cities with artificial sunlight. SpaceX plans to deploy a million satellites intended to function as data centers. These technological advancements highlight a shift toward potentially transforming darkness into day. The imagery evokes a biblical reference to the separation of light and darkness.

Back to the repair shop for NASA’s lunar ambitions

www.washingtonpost.com · 5 months ago

false

Enterprise Spotlight: Data Center Modernization

us.resources.csoonline.com · 5 months ago

false

How to make LLMs a defensive advantage without creating a new attack surface

www.csoonline.com · 5 months ago

Large language models, or LLMs, are transforming security, offering benefits like automated alert triage and detection engineering assistance. However, these models also create new attack surfaces, enabling attackers to personalize social engineering and accelerate malware development. To mitigate risk, organizations should implement controls such as explicit data sourcing, restricting model access to sensitive data, and requiring human approval for actions that change system states. Security teams must also proactively threat model LLM deployments, focusing on areas like prompt injection and data leakage, and prioritize technical and behavioral signals over language cues for detection.

Critical Trend Micro Apex One Vulnerabilities Allow Remote Malicious Code Execution

gbhackers.com · 5 months ago

Trend Micro has identified eight security vulnerabilities within its Apex One endpoint protection platform. Two critical vulnerabilities, CVE-2025-71210 and CVE-2025-71211, allow unauthenticated remote attackers to execute code on Windows systems. Six additional vulnerabilities, rated high, enable local privilege escalation on both Windows and macOS. A critical patch, Solution ID KA-0022458, is available for Apex One 2019 on Windows and macOS platforms.

Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor in Developer Environments

gbhackers.com · 5 months ago

Cybercriminals have compromised a Go cryptography module, identified as github.com/xinfeisoft/crypto, to steal passwords and deploy a Rekoobe Linux backdoor. The malicious module masquerades as a legitimate cryptography library, capturing typed passwords and storing them in an unusual location. It then exfiltrates this data to a dynamically supplied endpoint and executes a shell script that installs a Rekoobe backdoor, modifies SSH authorized keys, and alters iptables policies. The campaign uses GitHub Raw as an indirection layer and has been identified through indicators of compromise, including endpoints like img.spoolsv[.]cc and network addresses 154[.]84[.]63[.]184.

Europe’s ManoMano Hit: 38M Customer Records Compromised in Vendor Breach

www.techrepublic.com · 5 months ago

European online DIY marketplace ManoMano is notifying approximately 38 million customers about a data breach affecting a third-party customer service provider. Compromised data may include names, email addresses, phone numbers, and customer service communications, though passwords were not accessed. A threat actor claimed responsibility, alleging possession of user records and support tickets, which ManoMano’s notification confirms. The company has revoked the subcontractor’s access and is strengthening security measures while investigating the incident.

Meta Files Lawsuits Against Brazil, China, Vietnam Advertisers Over Celeb-Bait Scams

thehackernews.com · 5 months ago

false

Infostealers Drive Massive Brute-Force Attacks on Corporate SSO Gateways with Stolen Credentials

gbhackers.com · 5 months ago

Cybersecurity researchers have observed a significant increase in credential-stuffing attacks targeting corporate Single Sign-On systems, particularly F5 BIG-IP devices. These attacks utilize stolen credentials harvested by Infostealers like RedLine, Raccoon, and Vidar from compromised employee devices. Attackers then sell these logs on underground marketplaces, which are used to launch brute-force attacks against corporate portals. One attack originated from IP address 219.75.254.166, which involved a compromised Fortinet FortiGate-60E firewall hosted by OPTAGE Inc. in Japan, exposing ports 541/tcp and 10443/tcp.

We scanned 6,500+ ClawHub skills. 36% have security flaws. Built a Free Community run scanner to catch them before they execute

clawned.io · 5 months ago

NULL

Critical Flaws Exposed Gardyn Smart Gardens to Remote Hacking

www.securityweek.com · 5 months ago

Gardyn smart indoor gardens recently experienced critical security vulnerabilities that could have enabled remote hacking. These flaws include a command injection issue CVE-2025-29631, exposure of hardcoded admin credentials CVE-2025-1242, cleartext transmission of sensitive information CVE-2025-29628, and default SSH credentials CVE-2025-29629. Researchers estimate approximately 138,000 devices were potentially affected, and an attacker could have gained control of devices and accessed limited personal information. Gardyn has released patches, and there is no evidence of active exploitation.

1 Million Records from Dutch Telco Odido Leaked Online in Massive Data Breach

gbhackers.com · 5 months ago

A massive data breach at the Dutch telecommunications company Odido has exposed the personal information of nearly 700,000 customers. Attackers leaked the data in two phases, comprising a total of 2 million records with sensitive information including names, addresses, email addresses, phone numbers, bank account details, and government identification numbers. Odido is investigating the incident and advising affected customers to monitor their accounts and strengthen their online security. The leak presents a significant risk of identity theft and financial fraud for current and former customers.

FreeBSD Vulnerabilities Enable Attackers to Crash Entire System

gbhackers.com · 5 months ago

A critical security vulnerability, CVE-2025-15576, has been identified in FreeBSD versions 14.3 and 13.5. This flaw allows attackers to escape FreeBSD jail environments and gain unauthorized access to the entire host filesystem. The vulnerability stems from a flawed interaction involving nullfs mounts and Unix domain sockets, requiring control of two cooperating processes within separate jails. No workaround is available, and users are urged to immediately update their systems using the FreeBSD update utility or manually apply patches.

Ransomware groups switch to stealthy attacks and long-term access

www.csoonline.com · 5 months ago

Ransomware attackers are shifting tactics from disruptive attacks to stealthier, long-term access methods, prioritizing data theft and extortion over encryption. Attackers are increasingly routing command-and-control traffic through trusted enterprise services to evade detection. Experts note a rise in groups like Qilin, Cl0p, and Akira, with Scattered Spider/Lapsus$/ShinyHunters offering extortion-as-a-service. To counter these evolving threats, organizations should strengthen identity controls, monitor trusted applications, and focus detection strategies on persistence and data exfiltration.

Hacker kompromittieren immer schneller

www.csoonline.com · 5 months ago

Der CrowdStrike Global Threat Report zeigt, dass Angreifer 2025 im Schnitt nur noch 29 Minuten benötigten, um vollständigen Zugriff auf ein Netzwerk zu erreichen, rund 65 Prozent schneller als im Vorjahr. Die schnellste gemessene Breakout-Zeit lag bei 27 Sekunden, und in einem Fall begann die Datenexfiltration bereits vier Minuten nach dem initialen Zugriff. Als Hauptgrund wird der verstärkte Einsatz von KI-Tools genannt, wobei Angreifer, die KI nutzen, ihre Aktivitäten um 89 Prozent erhöhten. Staatlich unterstützte und kriminelle Gruppen wie Fancy Bear, Punk Spider und Famous Chollima setzen KI ein, unter anderem Lamehug Malware, KI-generierte Skripte zur schnellen Extraktion von Zugangsdaten und KI-generierte Identitäten, was Incident Response und Forensik deutlich erschwert.

gbhackers.com · 5 months ago

A remote administration tool called Vshell is gaining popularity among cybercriminals as an alternative to Cobalt Strike. Developed as a cross-platform command-and-control framework, it allows for remote management of Windows and Linux systems, lateral movement, and traffic proxying. Vshell’s functionality mirrors Cobalt Strike’s architecture, using listeners for encrypted communication across networks, and is frequently associated with campaigns like Operation DRAGONCLONE and UNC5174. Security teams should monitor high-numbered TCP ports, DNS tunneling, and WebSocket activity to detect Vshell deployments.

Microsoft Defender Enhances Security with URL Click Alerts for Microsoft Teams

gbhackers.com · 5 months ago

false

Microsoft Defender Discovers Trojanized Gaming Utility Campaign Stealing Data with RATs

gbhackers.com · 5 months ago

Microsoft Defender researchers have identified a new malware campaign targeting gamers by distributing trojanized versions of popular gaming utilities like Xeno.exe and RobloxPlayerBeta.exe. Once executed, the malware uses a Java Runtime Environment and a disguised Java archive to load attacker-controlled code and establish persistence through scheduled tasks and scripts. The threat actors employ living-off-the-land binaries and PowerShell to evade detection and ultimately deploy a remote access trojan (RAT) that communicates with a command-and-control server at IP address 79.110.49[.]15 to exfiltrate data and potentially deploy additional malware. Microsoft Defender provides detection and response capabilities to mitigate the threat, advising organizations to monitor network traffic and audit system configurations.

Juniper Networks PTX Vulnerability Allows Full Router Takeover, Exposing Networks

gbhackers.com · 5 months ago

A critical vulnerability has been identified in Juniper Networks PTX Series routers running Junos OS Evolved, allowing unauthorized network access and potential full device takeover. Tracked as CVE-2026-21902, the flaw is due to incorrect permissions within the On-Box Anomaly detection framework, which is accessible without authentication. Affected versions include those prior to 25.4R1-S1-EVO and 25.4R2-EVO, while updates to 25.4R1-S1-EVO, 26.2R1-EVO, and later releases resolve the issue. Administrators are advised to update or implement temporary mitigations such as access control lists or disabling the vulnerable service.

North Korean APT37 Unleashes Novel Malware to Target Air-Gapped Systems

gbhackers.com · 5 months ago

A North Korean threat group, APT37, is using a new toolset called Ruby Jumper to compromise systems and move data between internet-connected and air-gapped networks. The campaign utilizes malicious Windows shortcut files to deploy several custom components, including RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE, and the existing BLUELIGHT backdoor, to spread via USB and establish persistent surveillance capabilities. Attackers leverage cloud services like Zoho WorkDrive and Google Drive for command and control, and conceal malicious activity within hidden folders on removable media. This sophisticated attack chain emphasizes the importance of monitoring USB activity and unusual cloud storage access.

India Built the World’s Back Office. A.I. Is Starting to Shrink It.

www.nytimes.com · 5 months ago

false

Google API Keys Leak Sensitive Data Without Warning via Gemini

gbhackers.com · 5 months ago

Researchers have identified vulnerabilities in several popular open-source projects. These flaws could allow attackers to potentially execute arbitrary code or cause denial-of-service conditions. The affected projects include versions of ImageMagick, Ghostscript, and cURL. Specifically, CVE-2024-24830, CVE-2024-24831, CVE-2024-24832, CVE-2024-24833, CVE-2024-24834, CVE-2024-24835, CVE-2024-24836, and CVE-2024-24837 are associated with these issues.

Google Workers Seek ‘Red Lines’ on Military A.I., Echoing Anthropic

www.nytimes.com · 5 months ago

More than 100 Google artificial intelligence employees have voiced concerns about the company’s collaboration with the Pentagon. They sent a letter to a chief scientist, requesting Google establish boundaries similar to those sought by Anthropic regarding government contracts. Specifically, they oppose the use of Google’s Gemini A.I. for U.S. surveillance or autonomous weapons systems without human control. This action reflects a wider debate within Silicon Valley prompted by the Pentagon’s negotiations with Anthropic.

Nvidia’s Quarterly Profit Hits $43 Billion on Strong A.I. Chip Sales

www.nytimes.com · 5 months ago

Nvidia reported record fiscal 2026 results, posting revenue of about 215.9 billion dollars and net income of roughly 120 billion dollars. The surge was driven by a boom in data center sales and strong demand for the Blackwell AI platform, which produced record data center revenue. Net income was about 4.4 billion dollars in fiscal 2023, three years earlier.

Anthropic rejects Pentagon terms for lethal use of its chatbot Claude

www.washingtonpost.com · 5 months ago

Anthropic refused Pentagon terms that would provide full access to its AI model Claude, saying it will not permit the technology to be used for domestic mass surveillance or for fully autonomous weapons. The decision follows a dispute over Claude's alleged role in a raid to capture Venezuelan President Nicolás Maduro and conflicting accounts between the company and the Defense Department. The Pentagon says it will only pursue lawful applications but has declined to categorically prohibit surveillance or autonomous weapons in the contract and set a deadline with the possibility of invoking the Defense Production Act to compel access. Anthropic CEO Dario Amodei said the company has firm red lines and urged the department to reconsider.

Block Cuts 40% of Its Work Force Because of Its Embrace of A.I.

www.nytimes.com · 5 months ago

About 4,000 workers will lose their jobs at Block as the company shifts to AI driven tools, cutting total headcount from just over 10,000 to just under 6,000, CEO Jack Dorsey said. Company leaders said the move is intended to make Block smaller, flatter and AI first, arguing intelligence tools allow a significantly smaller team to do more and do it better, and cited examples of AI features inside Square that give sellers real time insights and recommendations. Block said it will incur roughly four hundred fifty to five hundred million dollars in restructuring charges, opted for a single deep round of cuts rather than repeated smaller layoffs, and saw its shares jump more than twenty percent after the announcement.

In Landmark Trial, Plaintiff Says Social Media Harm Started at Age 6

www.nytimes.com · 5 months ago

A 20 year old plaintiff identified as K.G.M. testified in a Los Angeles bellwether trial accusing Meta and YouTube of designing addictive platform features that she says damaged her mental health. She said early exposure to features such as infinite scroll and autoplay fueled years of anxiety, depression and body dysmorphia, and her therapist testified that social media contributed to but did not solely cause her struggles. Meta executives have disputed that the products are intentionally addictive, with Instagram chief Adam Mosseri saying clinical addiction differs from problematic use and Mark Zuckerberg defending decisions to restore features like beauty filters.

The A.I. Videos on Kids’ YouTube Feeds

www.nytimes.com · 5 months ago

The YouTube recommendation algorithm is surfacing bizarre and often nonsensical videos generated by artificial intelligence that are being shown to children. Experts warn that repeated exposure to this content could affect children’s cognitive development. Guidance is provided on how parents can identify these AI generated videos and steps they can take to limit children’s exposure.

Marquis v. SonicWall Lawsuit Ups the Breach Blame Game

www.darkreading.com · 5 months ago

A large fintech provider, Marquis, says a ransomware actor gained access to its network on August 14, 2025, and is suing its firewall vendor SonicWall, alleging that a SonicWall breach that exposed customers' firewall configuration backups enabled follow-on attacks. SonicWall first disclosed a breach on September 17, 2025 claiming five percent of customers were affected and later acknowledged on October 8, 2025 that all customers were impacted, while reports put the number of Marquis-affected individuals at more than 780,000 though that figure was not independently confirmed. Legal experts say the lawsuit, filed February 23, 2026 in the U.S. District Court for the Eastern District of Texas, exemplifies a growing trend of enterprises seeking damages from cybersecurity vendors and highlights disputes over negligence standards, contract terms, and how responsibility is allocated after third-party breaches.

Cisco SD-WAN Zero-Day Under Exploitation for 3 Years

www.darkreading.com · 5 months ago

A maximum severity authentication bypass vulnerability tracked as CVE-2026-20127 has been exploited in Cisco Catalyst SD WAN Controller systems in the wild for at least three years, allowing attackers to log into controllers as an internal high privileged non root user. Threat actors added rogue peers to SD WAN management, used the built in update mechanism to downgrade controllers to versions vulnerable to local privilege escalation including CVE-2022-20775, escalated to root, and created local accounts for persistence. The United States Cybersecurity and Infrastructure Security Agency issued an emergency directive requiring federal civilian executive branch agencies to patch CVE-2026-20127 and CVE-2022-20775 by February 27, 2026. Organizations are urged to update controllers to fixed software versions, restrict Internet exposure, disable HTTP access to the Manager web user interface, change default administrator passwords, search for signs of rogue peering and unexpected version downgrades, enable centralized logging, and apply the recommended golden star software version.

Former Air Force officer arrested for conspiring with hacker to provide flight training to Chinese military

therecord.media · 5 months ago

A former U.S. Air Force major, Gerald Eddie Brown, 65, was arrested in Jeffersonville, Indiana on February 26, 2026, after spending nearly three years living in China and allegedly providing combat aircraft training to pilots in the People's Liberation Army Air Force. Prosecutors say Brown conspired with convicted hacker Stephen Su Bin to negotiate a contract to train Chinese military pilots, traveled to China in December 2023 to meet Chinese officials, and returned to the United States in February 2026. He is accused of violating the International Traffic in Arms Regulations by providing defense expertise to a foreign military without a State Department license and now faces federal prosecution.

Your staff are your biggest security risk: AI is making it worse

www.fortra.com · 5 months ago

A Ponemon Institute and DTEX report finds the average annual cost of insider security incidents rose twenty percent over two years to nineteen point five million US dollars per organization, with companies experiencing about twenty five such incidents per year. More than half of reported incidents were caused by negligent or mistaken employees, accounting for fifty three percent of incidents and about ten point three million US dollars of the average annual loss, compared with approximately four point seven million from malicious insiders. Shadow AI and unauthorized use of AI meeting assistants are identified as the fastest growing drivers of insider negligence, with ninety two percent of organizations saying AI has changed how staff handle information but only eighteen percent formally integrating AI governance, even as insider risk budgets increased and average containment time fell from eighty six to sixty seven days.

Wyden blocks Rudd confirmation to lead Cyber Command, NSA

therecord.media · 5 months ago

Senator Ron Wyden pledged to block a Senate confirmation vote for Lieutenant General Joshua Rudd to lead U.S. Cyber Command and the National Security Agency, saying Rudd lacks experience in cyber operations and signals intelligence. Wyden wrote in a letter entered into the Congressional Record that Rudd does not have the background to immediately step into the role and criticized his vague answers about the NSA’s surveillance authorities during his Intelligence Committee hearing. Wyden’s hold would require a formal Senate vote instead of unanimous consent and could lead Republicans to use rules changes to confirm the nomination, while both organizations have been led by acting officials since President Trump fired the previous leader nearly a year ago.

Previously harmless Google API keys now expose Gemini AI data

www.bleepingcomputer.com · 5 months ago

There is a vulnerability where Google Cloud API keys embedded in public client side code for services like Maps and YouTube can be used to authenticate to the Gemini AI assistant and access private data. Researchers at TruffleSecurity found more than 2,800 live exposed Google API keys across organizations and even on a Google product page by scanning the November 2025 Common Crawl dataset. Attackers who copy an exposed key can call the Gemini API and potentially generate thousands of dollars in charges, and TruffleSecurity reported the issue to Google on November 21, 2025, with Google classifying it as a single service privilege escalation on January 13, 2026. Google says it has implemented measures to detect and block leaked keys from accessing Gemini, will default new AI Studio keys to Gemini only scope, and developers are advised to audit and rotate exposed keys and use detection tools such as TruffleHog.

New Malware - Moonrise Analysis

evalian.co.uk · 5 months ago

There is a new Golang 64 bit Windows remote access trojan called Moonrise that maintains a persistent unencrypted WebSocket command and control channel to a hard coded operator endpoint. It uses a JSON based tasking model with structured fields and WriteJSON for replies, performs host registration and fingerprinting, and runs a continuous command loop that supports interactive operator control including start and stop commands for a keylogger and clipboard monitoring. Moonrise contains explicit crypto and address handling consistent with wallet interception, can receive file uploads to deploy additional tooling for DPI evasion and traffic filtering, and the analysed sample escaped antivirus detection at the time of analysis.

Reverse CAPTCHA: Evaluating LLM Susceptibility to Invisible Unicode Instruction Injection

www.moltwire.com · 5 months ago

Tool access transforms invisible Unicode from an ignorable artifact into a decoded instruction channel, increasing compliance from near zero without tools to as high as seventy one percent with tools and full hints. Encoding vulnerability is provider specific, with OpenAI models favoring zero width binary encodings and Anthropic models favoring Unicode Tag encodings, and explicit hints create a consistent compliance gradient. Recommended mitigations include input sanitization to strip known zero width and Tag characters at the input boundary, tokenizer level filtering and tool use guardrails, and training models to refuse instructions decoded from invisible characters while preserving the zero width joiner needed for emoji rendering.

From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510)

boschko.ca · 5 months ago

Two remote code execution vulnerabilities were discovered in Unitree Go2 robots: CVE-2026-27509 is an unauthenticated DDS based RCE that abuses the programmingactuator DataWriter to execute arbitrary Python as root, and CVE-2026-27510 enables RCE by tampering with Blockly preprogrammed action blocks in the Android app's local database. Both proofs of concept can be triggered by a controller keybinding, making the RCE persistent, and confirmed affected firmware versions include V1.1.7, V1.1.8, V1.1.9 and V1.1.11 with other versions potentially affected. Unitree validated the issues and developed patches but deployment has been delayed and EDU versions may remain unpatched.

Apple iPhone and iPad Cleared for Classified NATO Use

www.securityweek.com · 5 months ago

There are new approvals allowing iPhone and iPad to handle classified NATO information and they have been added to the NATO Information Assurance Product Catalogue at the NATO RESTRICTED level. The NIAPC listing enables use of native Mail Calendar and Contacts for secure access without special software or settings and notes an indigo configuration while Apple says a standard device configuration was approved, with testing by Germany’s Federal Office for Information Security ensuring compliance with NATO requirements. NIAPC entries must meet strict rules including origin from NATO countries, approved certifications and national authority sign off, and approval remains discretionary with violations risking delisting.

Aeternum C2 Botnet Stores Encrypted Commands on Polygon Blockchain to Evade Takedown

thehackernews.com · 5 months ago

A new botnet loader named Aeternum C2 uses the Polygon blockchain to store encrypted commands in smart contracts, allowing infected hosts to fetch instructions via public Polygon RPC endpoints and making the command and control infrastructure resistant to traditional takedowns. The native C++ loader is available in x32 and x64 builds and decodes and runs encrypted commands returned by a smart contract function deployed from a web based panel implemented in Next.js. Operators can manage multiple smart contracts and push commands that become immutable once confirmed on chain, enabling payloads such as clippers, stealers, remote access trojans, and miners while keeping operational costs negligible at roughly one dollar of MATIC for one hundred to one hundred fifty command transactions. The threat actor known as LenAI has marketed the loader since December 2025 and has offered the toolkit and full source code for sale, and the malware includes anti analysis checks and options to scan builds to evade antivirus detection.

Trend Micro warns of critical Apex One code execution flaws

www.bleepingcomputer.com · 5 months ago

Two critical Apex One vulnerabilities that permit remote code execution on Windows systems were patched. The first is CVE-2025-71210, a path traversal weakness in the Apex One management console that can allow attackers without privileges to execute malicious code, and the second is CVE-2025-71211, a similar path traversal flaw affecting a different executable. Trend Micro released fixes for SaaS Apex One and Critical Patch Build 14136 for on premise installations and cautioned that successful exploitation requires access to the Apex One Management Console, so customers with consoles exposed externally should apply source restrictions and update to the latest builds. Related Apex One flaws previously referenced include CVE-2025-54948, CVE-2023-41179, and CVE-2022-40139.

Intellexa founder, three others sentenced to 8 years in prison over Greek spyware scandal

therecord.media · 5 months ago

A Greek court sentenced the founder of the Intellexa Consortium and three associates to prison for their role in a spyware scandal that emerged in 2022. The Misdemeanour Court imposed combined prison terms totalling 126 years and eight months, but under Greek law the maximum time to be served for the misdemeanour convictions is eight years, and the defendants will remain free pending appeal. The defendants were Tal Dilian, Sara Hamou, Felix Bitzios, and Yiannis Lavranos, and the Predator spyware sold by Intellexa was used to infect more than 90 people including journalists, opposition politicians, government ministers, military officials, and prosecutors. The court ordered prosecutors to investigate potential felony charges such as espionage and to probe additional criminal liability and Intellexa itself, and observers say the verdict could have significant legal and commercial consequences for the consortium.

European DYI chain ManoMano data breach impacts 38 million customers

www.bleepingcomputer.com · 5 months ago

ManoMano is notifying customers that a data breach discovered in January 2026 affected 38 million individuals after hackers compromised a third party customer service provider. Exposed information varies by individual and includes full names, email addresses, phone numbers, and customer service communications, while the company states account passwords were not accessed and no modifications occurred on its systems. The company says it disabled the subcontractor’s access, strengthened access controls and monitoring, notified authorities including the CNIL and ANSSI, and is urging customers to remain vigilant against phishing and social engineering.

How A.I.-Generated Videos Are Distorting Your Child’s YouTube Feed

www.nytimes.com · 5 months ago

There are growing concerns that low-quality AI generated videos on YouTube aimed at very young children often contain conflicting information, lack coherent plot structure, and use fast paced, attention grabbing edits that can be cognitively overwhelming. Experts warn that repeated exposure to such content during critical early years may impair young children’s developing sense of reality and hinder language and cognitive development. YouTube has taken steps to penalize repetitive and inauthentic channels and remove some content, but policy gaps such as exempting animated material from synthetic content disclosure allow many AI made children’s cartoons to remain undisclosed and monetized.

Four Risks Boards Cannot Treat as Background Noise

www.securityweek.com · 5 months ago

There are four risks reshaping organizational resilience including AI acting as a force multiplier that can corrupt data and enable more frequent and surgical attacks, supply chain incidents that remain the organization’s liability, quantum computing risk that requires a staged transition to post quantum cryptography, and geopolitics that increase unpredictability and complicate cross border response. Boards are urged to shift from trying to prevent every attack to ensuring business continuity by defining decision rights, assigning human in the loop controls and kill switches for high risk AI activity, mapping data flows across third parties, and preparing fallbacks to maintain a minimum viable company. Organizations should inventory encrypted assets, prioritize sensitive data, commit to a staged multi year plan for quantum readiness, and pursue public private partnerships to manage geopolitical complications.