Blahalla

CISA Warns Trend Micro Apex One Vulnerability Is Being Exploited in Attacks

gbhackers.com · 5 months ago

CISA added CVE-2026-34926 to its Known Exploited Vulnerabilities catalog on May 21, 2026, warning that the flaw in on premise Trend Micro Apex One is being actively exploited. The bug is a directory traversal vulnerability that allows a pre authenticated local attacker to modify a critical server key table and inject malicious code that can be distributed to endpoint agents, potentially turning the security platform into a malware delivery mechanism. CISA issued a remediation directive requiring federal agencies to fix the issue by June 4, 2026 and urges all organizations to apply vendor patches, restrict local access to Apex One servers, monitor for unauthorized configuration changes and conduct threat hunting to detect possible compromise.
Megalodon Malware Rapidly Infects Over 5,500 GitHub Repositories

gbhackers.com · 5 months ago

There are more than 5,500 GitHub repositories compromised by a campaign known as Megalodon that spreads via malicious code injections hidden in seemingly legitimate projects and infects developers who download or execute the code. The malware establishes persistence, disables or evades security tools, and is modular with capabilities including credential harvesting, cryptocurrency wallet theft, remote command execution, data exfiltration, and deployment of secondary payloads such as ransomware or crypto miners. Indicators include suspicious outbound connections, unexpected processes running from temporary directories, unauthorized scheduled tasks, and obfuscated scripts, and recommended mitigations include verifying repository authenticity, scanning downloaded code with updated security tools, testing untrusted code in sandboxes, and enabling multi factor authentication while takedown efforts continue.
Hackers Abuse Hugging Face to Deliver npm Malware

gbhackers.com · 5 months ago

There is a newly uncovered supply chain attack in the npm ecosystem linked to DPRK aligned actors that uses a malicious package named terminal-logger-utils embedding a multi stage malware capable of keylogging, data exfiltration, and remote system control. The package was propagated through dependent libraries pretty-logger-utils, ts-logger-pack, and pinno-loggers, where a malicious postinstall script drops an obfuscated utils.cjs that downloads a platform specific second stage payload hosted on Hugging Face and runs as a bundled Node.js binary. The implant establishes persistence on Windows via a hidden VBS script, scheduled tasks, and a registry Run key, harvests keystrokes and high value files including Telegram session data, browser credentials, cryptocurrency wallets, SSH keys, and cloud configuration files, and exfiltrates data over HTTP while providing a WebSocket based command and control channel with remote shell, file manipulation, screenshot capture, input injection, and self update capabilities.
CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV

thehackernews.com · 5 months ago

CISA added two actively exploited flaws to its Known Exploited Vulnerabilities catalog: CVE-2025-34291 affecting Langflow and CVE-2026-34926 affecting on premise Trend Micro Apex One. CVE-2025-34291 is an origin validation error with a CVSS score of 9.4 that can allow arbitrary code execution and full system compromise, expose stored access tokens and API keys, and was found to combine overly permissive CORS, lack of CSRF protection, and an endpoint that permits code execution and has been used by the MuddyWater group to gain initial access. CVE-2026-34926 is a directory traversal flaw with a CVSS score of 6.7 that requires access to the Apex One server and administrative credentials to exploit and has seen at least one observed attempt, and Federal Civilian Executive Branch agencies are required to apply fixes by June 4, 2026.
Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access

thehackernews.com · 5 months ago

Cisco has released updates to address a maximum severity authentication bypass in Secure Workload tracked as CVE-2026-20223 with a CVSS score of 10.0 that results from insufficient validation and authentication of internal REST API endpoints. An unauthenticated remote attacker who can send a crafted API request could read sensitive information and make configuration changes across tenant boundaries with the privileges of the Site Admin user, and there are no workarounds. Cisco lists fixes in Secure Workload 3.10.8.3 and 4.0.3.17, says releases 3.9 and earlier must be migrated to a fixed release, and reports the flaw was found during internal testing with no evidence of exploitation in the wild. The disclosure follows a separate maximum severity authentication bypass, CVE-2026-20182, that Cisco said was exploited against Catalyst SD-WAN systems a week earlier.
Mini Shai-Hulud Attack Prompts npm to Revoke 2FA-Bypass Tokens

gbhackers.com · 5 months ago

npm forced a platform-wide reset of granular access tokens that bypass two-factor authentication after the Mini Shai-Hulud supply chain campaign compromised hundreds of JavaScript packages, invalidating all write-enabled tokens on May 19. Attackers hijacked the maintainer account atool to publish 639 malicious versions across 323 packages and previously breached 42 TanStack packages on May 11, with the campaign attributed to a group tracked as TeamPCP and impacting projects across npm, PyPI, and Composer. The campaign abuses CI and automation workflows by scanning for long-lived secrets and extracting OIDC tokens from runner memory, leading npm to introduce staged publishing in public preview on May 20 to require human approval and multifactor authentication before releases go live. Maintainers must regenerate tokens and update automation, and security guidance recommends rotating exposed credentials, restricting CI workflows, enabling staged publishing for critical packages, and adding release delays to reduce supply chain risk.
Flipper Introduces Flipper One as a Modular Linux-Based Cyberdeck

gbhackers.com · 5 months ago

Flipper One is a modular Linux based cyberdeck aimed at high performance networking software defined radio and embedded Linux development for security professionals researchers and hardware developers. It is built on a Rockchip RK3576 system on chip with an eight core CPU a Mali G52 GPU an integrated neural processing unit for local AI workloads eight gigabytes of RAM and a Raspberry Pi RP2350 co processor to handle low level control when the main Linux environment is offline. The platform offers dual gigabit Ethernet Wi Fi 6E with monitor mode and packet injection USB Ethernet at up to five gigabits per second M2 expansion for 5G and LTE modems software defined radio modules NVMe or SATA storage and AI accelerators plus optional experimental satellite support and up to five simultaneous uplinks for inline packet sniffing man in the middle analysis VPN gateway and multi WAN routing. A Debian based Flipper OS provides profile based system management and a FlipCTL menu driven interface while the vendor is working to upstream chipset support into the mainline Linux kernel and resolve remaining hardware video decoding and NPU integration challenges.
Authorities Take Down “First VPN” Service Used in Ransomware Attacks

gbhackers.com · 5 months ago

European authorities dismantled a criminal VPN service called First VPN during a coordinated operation on May 19 and 20, 2026, seizing more than 33 servers and conducting searches and an interview in Ukraine. First VPN was marketed to cybercriminals, promised no logging or cooperation with law enforcement, and was widely used by ransomware operators and other threat actors to conceal ransomware attacks, hacking campaigns, and data theft. The investigation began in May 2022 and evolved into a Joint Investigation Team in November 2023 involving 16 countries, with authorities seizing multiple domains, notifying identified users, and warning defenders to expect threat actors to seek alternative anonymization services.
Critical vulnerability in Cisco Secure Workload rated at maximum severity

www.csoonline.com · 5 months ago

A critical vulnerability in the on premises version of Cisco Secure Workload could allow an unauthenticated remote attacker to bypass authentication and gain site administrator privileges by sending a crafted HTTP request to an internal REST API, enabling compromise of endpoints and modification of configuration and security policies. The flaw is tracked as CVE-2026-20223 and was given a CVSS score of 10.0, and there are no workarounds. Affected on premises systems must be updated to fixed releases, with version 4.0 upgraded to 4.0.3.17, version 3.10 upgraded to 3.10.8.3, and systems on 3.9 or earlier migrated to a newer patched release. The vulnerability impacts internal REST APIs in both SaaS and on premises deployments but does not affect the web based management interface, and Cisco has already patched the SaaS product; administrators are urged to treat this as an active threat and patch immediately.
Microsoft patches two zero-day flaws in Defender

www.csoonline.com · 5 months ago

Microsoft released emergency fixes for two zero day vulnerabilities in the malware protection components of Microsoft Defender. The flaws allow local attackers to gain system level privileges or to disrupt the antimalware service, enabling detection evasion and potential full system control. The United States Cybersecurity and Infrastructure Security Agency added both vulnerabilities to its Known Exploited Vulnerabilities catalog, tracked as CVE-2026-41091 and CVE-2026-45498, indicating exploitation observed in the wild. Administrators are advised to install updates so the Malware Protection Engine is at version 1.1.26040.8 or newer and the Microsoft Defender Antimalware Platform is at version 4.18.26040.7 or newer, and to note that the Malware Protection Engine update also addresses CVE-2026-45584 which has not been publicly disclosed.
Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada

krebsonsecurity.com · 5 months ago

Canadian authorities arrested 23-year-old Jacob Butler of Ottawa, known online as Dort, on May 20, 2026 on suspicion of building and operating the Kimwolf Internet of Things botnet and he now faces criminal charges in both Canada and the United States. Kimwolf allegedly enslaved millions of devices to conduct massive distributed denial of service attacks over the prior six months, with attacks measured at nearly 30 terabits per second, more than 25,000 attack commands issued, and financial losses for some victims exceeding one million dollars. A criminal complaint unsealed in Alaska on May 21, 2026 charges Butler with aiding and abetting computer intrusion while Canadian prosecutors charged him with unauthorized use of a computer and related offences, investigators seized the botnet infrastructure on March 19, and law enforcement agencies including the Department of Justice, the Defense Criminal Investigative Service and the FBI are involved in the probe.
Unpatched ChromaDB flaw leaves servers open to remote code execution

www.csoonline.com · 5 months ago

There is a critical vulnerability in ChromaDB that allows unauthenticated attackers to execute arbitrary code and access sensitive data on servers running the open source vector database, tracked as CVE-2026-45829. The issue is a race condition in the API server that fetches and executes embedding model references before performing authentication, enabling attackers to load malicious model configurations hosted on Hugging Face with the trustremotecode parameter set to true. The flaw affects ChromaDB versions 1.0.0 through 1.5.8, researchers report that over 73 percent of internet accessible instances found via Shodan run vulnerable versions, and private disclosure attempts since February went unanswered. Until a patch is available, recommended mitigations include deploying the Rust implementation which is not affected and restricting network access to the ChromaDB port to trusted IP addresses only.
Meta Settles a School District’s Social Media Addiction Lawsuit

www.nytimes.com · 5 months ago

Meta reached an undisclosed settlement with a rural Kentucky school district that had sued social media companies for fueling student addiction and driving up school costs, ending Meta’s role in a bellwether case that had been scheduled for trial in mid June in federal court in Oakland, California. YouTube, Snap and TikTok had already reached separate settlements with the same district earlier this week, and the terms of the agreements have not been publicly disclosed.
Google API Keys Remain Active After Deletion

www.darkreading.com · 5 months ago

Google Cloud API keys can remain valid for minutes after deletion, with a median revocation window of about 16 minutes and a longest observed window of 23 minutes. Researchers at Aikido Security found highly unpredictable authentication success rates after deletion in tests across GCP regions, with some trials showing 79 percent success after one minute and others as low as 5 percent, and regional differences driven by the request origin rather than the customer location. Because the GCP console asserts that deleted keys cannot be used, these delays undermine incident response assumptions and Aikido recommends treating deleted keys as potentially active for thirty minutes while monitoring API usage by credential. Google closed the report as won't fix and did not respond at press time, even though service account deletions and Gemini key revocations occur much faster, indicating the issue is technically solvable.
durabletask (Microsoft's Python Durable Task client) compromised by TeamPCP | same Mini Shai-Hulud payload as last week's TanStack wave

www.aikido.dev · 5 months ago

There are three malicious versions of the durabletask Python package, versions 1.4.1, 1.4.2, and 1.4.3, that include a backdoor dropper which executes at import time and downloads a second stage payload. The second stage is a Python zip application that functions as a full-featured infostealer and worm, harvesting credentials from password managers, cloud providers, Kubernetes, Docker, HashiCorp Vault, developer tooling, and numerous local credential files, then encrypting and exfiltrating the results. The malware spreads via AWS Systems Manager SendCommand and kubectl exec, installs persistent systemd services, and supports a remotely triggered disk wiper that can play audio and then run destructive commands on selected targets. Hosts with any of these package versions should be treated as compromised, check for marker files and persistence artifacts, rotate and revoke all cloud, SSH, Vault, and registry credentials, and inspect AWS and Kubernetes audit logs for SendCommand and exec activity.
New Verizon Report Reveals the Security Gap Attackers Are Exploiting Most

www.techrepublic.com · 5 months ago

Vulnerability exploitation has overtaken credential abuse as the leading initial access vector, accounting for 31 percent of initial access compared with 13 percent for credential abuse, while only 26 percent of critical vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog were fully remediated in 2025 and the median remediation time rose from 32 to 43 days. Generative AI is accelerating cybercrime by automating reconnaissance, crafting phishing content, aiding vulnerability research, and assisting malware development, and shadow AI increased insider risk as 67 percent of users accessed AI through noncorporate accounts and 45 percent of employees are now regular AI users up from 15 percent the previous year. Human involvement contributed to 62 percent of breaches, and third party risk surged with 48 percent of breaches involving a third party following a 60 percent year over year increase. Ransomware was present in 48 percent of breaches and disproportionately impacted small and midsize businesses, representing about 96 percent of known ransomware victims, while remote monitoring and management abuse jumped 240 percent year over year and the largest DDoS attacks grew roughly 198 percent in bits per second and 156 percent in packets per second.
[Analysis] CISA contractor left AWS GovCloud admin keys, plaintext passwords, SAML certs, and Kubernetes configs on a public GitHub repo for 183 days — with secret scanning deliberately disabled

medium.com · 5 months ago

A public repository exposed 844 megabytes of internal credentials and infrastructure data including AWS GovCloud administrative keys, browser password exports, Entra ID SAML certificates that allow SSO impersonation, GitHub personal access tokens, a Kubernetes kubeconfig for a DevSecOps cluster, ArgoCD secret files, Terraform infrastructure as code, CI CD logs, and internal documentation and hostnames. There were five defense failures identified: plaintext credential storage, deliberate disabling of GitHub secret scanning and push protection, use of personal cloud storage that bypassed enterprise data controls, lack of internal monitoring for 183 days with external discovery by GitGuardian, and AWS GovCloud keys remaining valid for 48 hours after the repository was taken down. The 48 hour window meant credentials harvested during the 183 day exposure could still be used after containment, and MITRE ATTACK mapping included techniques T1078, T1552.001, T1552.004, T1098, T1087, T1619, T1021, T1530, T1567.002, and T1562.001. Recommended detection and remediation measures include CloudTrail based Sigma rules for post exposure AWS key usage, gitleaks and TruffleHog scanning, Kubernetes API anomaly detection, honeytokens, and a three tier remediation plan with immediate, short term, and 30 day strategic actions.
Google accidentally exposed details of unfixed Chromium flaw

www.bleepingcomputer.com · 5 months ago

There is an unfixed Chromium vulnerability that lets a Service Worker keep JavaScript running even after the browser is closed, enabling remote JavaScript execution and persistent control of a device. The bug was reported by researcher Lyra Rebane in December 2022; it was marked fixed in the Chromium tracker on February 12, 2026 without a shipped patch, and access restrictions were removed on May 20, 2026, exposing details and allowing confirmation that the exploit still works in Chrome Dev 150 and Edge 148. Exploitation could enable stealthy botnets, distributed denial of service attacks, traffic proxying and redirection, and the researcher said the bug does not bypass browser security boundaries or grant direct access to user emails, files, or the host operating system.
Samsung Averts a Walkout With Big Bonuses, but Discord Over A.I. Profits Brews

www.nytimes.com · 5 months ago

There are deep divisions at Samsung over how to share profits from the AI driven memory chip boom, with memory division workers being offered far larger bonuses than foundry and logic staff, a disparity that has fueled anger and union demands. More than 45,000 workers threatened an 18 day strike starting May 21 that risked cutting production of memory chips and high bandwidth memory used in AI data centers, and Samsung began winding down some chip production ahead of the planned walkout. Last minute talks produced a tentative pay deal that led the union to suspend the strike vote, averting immediate disruption to the global AI chip supply chain.
Trump Cancels Signing of Executive Order Granting Oversight of A.I. Models

www.nytimes.com · 5 months ago

An executive order is set to shift the White House from a hands-off stance to require a formal government review process for advanced A.I. models before public release. The move follows pressure from parts of the president's political base and internal White House debates after the emergence of models such as Anthropic's Mythos raised national security and cybersecurity concerns, with officials weighing early government access and testing of powerful models. Officials warned the step could slow rollouts or force developers to change models and remains under active consideration as the administration finalizes the order.
Defenders fall behind, as AI rewrites the rules of a data breach

www.fortra.com · 5 months ago

There is a shift in initial access methods with exploitation of vulnerabilities overtaking stolen credentials and accounting for 31 percent of breaches according to the 2026 DBIR. AI is helping attackers discover and weaponize known flaws much faster, shrinking the disclosure to exploit window from months to hours, while only about a quarter of disclosed vulnerabilities get fully patched and it takes on average 43 days to fix half of them. Phishing has moved toward mobile channels with fraudulent SMS and voice attacks succeeding about 40 percent more often than email, and Shadow AI usage in the workplace jumped from 15 percent to 45 percent with 75 percent of that use involving unsanctioned services, creating new data leakage risks. Supply chain breaches increased by 60 percent to represent 48 percent of incidents, ransomware appears in roughly 48 percent of confirmed breaches but victim nonpayment rose to 69 percent and average payments are falling.
GitHub Actions Cache Poisoning is eating open source

neciudan.dev · 5 months ago

GitHub Actions cache poisoning enables attackers to plant poisoned dependency folders or binaries into a repository's shared Actions cache so that later higher-privilege release workflows restore and execute the malicious content with access to publish secrets. Attackers obtain write access either by tricking privileged workflows into running untrusted pull request code or AI-driven bots, or by evicting legitimate caches via least-recently-used eviction and then writing poisoned entries. Notable incidents include Adnan Khan's 2024 Angular research, the March 2025 tj-actions changed-files supply-chain compromise, the February 2026 Cline compromise, and the May 11 2026 TanStack compromise, and recommended mitigations include removing unsafe pullrequesttarget checkouts, isolating or removing caches from release-capable workflows, pinning third-party actions to commit SHAs, treating untrusted inputs as untrusted, and migrating to OIDC trusted publishing with caution.
macOS Kernel Memory Corruption Exploit

www.schneier.com · 5 months ago

A Palo Alto security team used Anthropic's Mythos Preview to help develop a working macOS kernel memory corruption exploit against Apple's M5 silicon, producing a full local privilege escalation to root in roughly five days. The exploit chain bypassed Apple's Memory Integrity Enforcement by linking two kernel bugs and a tag-collision side-channel technique, and Apple shipped a fix in macOS Tahoe 26.5, assigning the kernel vulnerability CVE-2026-28952 and crediting Calif and Anthropic. Security researchers warn this case shows generative models can dramatically compress exploit development timelines, increasing urgency around AI access controls, defensive tooling, and faster patching.
What’s new in Microsoft Security: May 2026

www.microsoft.com · 5 months ago

Microsoft Security released May 21, 2026 updates that extend visibility, control, and protection across AI agents, data, identities, and multi cloud environments as organizations accelerate AI adoption. The Microsoft Purview Data Security Posture Management experience is now generally available, unifying discovery to remediation with goal oriented flows, deeper remediation, expanded reporting, and third party visibility, while Purview Data Security Investigations adds optical character recognition and custom examinations to extract and analyze text from images. Microsoft Entra ID Account recovery introduces an identity verification and trust reestablishment flow for restoring access when all registered authentication methods are lost, and Windows 365 for Agents together with Agent 365 in public preview provides managed Cloud PCs and shared organizational policies to securely run and govern AI agents.
CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox

voidsec.com · 5 months ago

NULL
CVE-2026-34474: Pre-auth credential disclosure in ZTE H298A / H108N via ETHCheat

minanagehsalalma.github.io · 5 months ago

An unauthenticated crafted GET request to the router management endpoint with the ETHCheat parameter set to one returns credential bearing HTML on affected ZTE ZXHN H298A version 1.1 and H108N version 2.6, exposing the administrator password, WLAN PSK, ESSID, and a companion wizard endpoint that discloses the device serial number. Because the secrets appear directly in the response body this deterministic authentication boundary failure allows immediate management interface access and wireless network compromise without relying on weak passwords or session state. The issue was first reported on May 2, 2024, the vendor later characterized the products as discontinued, and MITRE assigned CVE-2026-34474 which was published on May 6, 2026.
AI Agents Are Shifting Identity Security Budget Dynamics

www.darkreading.com · 5 months ago

AI agent projects are proliferating across enterprises and those agent identities require management, security, and governance as they evolve into autonomous systems accessing sensitive data, APIs, and workflows. New Omdia research found budget dynamics for AI agent identity work differ from traditional IAM, with 45 percent of IT respondents reporting standalone AI budgets and 36 percent of identity leaders tapping separate AI budgets to fund identity security for agents. Other funding approaches include reallocating technology or innovation budgets at 28 percent, using digital transformation or AI initiative funds at 21 percent, and reducing existing identity budgets at 15 percent, indicating an identity cost burden being shifted into AI budgets. Identity security for AI agents requires visibility into agent inventories and behaviors, fine grained access management, governance to prevent policy drift, and lifecycle management, and identity teams are advised to engage AI stakeholders and tap AI budgets to fund these new identity layers.
FatGid - FreeBSD 14.x kernel LPE

fatgid.io · 5 months ago

There is a kernel stack buffer overflow in the FreeBSD setcred system call that can be triggered by any unprivileged local user and may lead to a kernel panic or full local privilege escalation, tracked as CVE-2026-45250. Working exploits deliver root on amd64 kernels both with and without SMAP and SMEP; the SMAP and SMEP safe technique requires zfs.ko and abuses a sizeof type error in kernsetcredcopyinsuppgroups that doubles the intended byte count when copying supplementary groups. Systems running FreeBSD 14.3 and 14.4 are exploitable if below 14.3-RELEASE-p14 and 14.4-RELEASE-p5 respectively, 15.0 can panic if below 15.0-RELEASE-p9, and security fixes were published on May 21 2026 so administrators should apply the listed updates immediately.
Gov. Gavin Newsom to Sign Executive Order Aimed at A.I. Job Loss

www.nytimes.com · 5 months ago

An executive order will direct state agencies to study the impact of artificial intelligence on the labor market and to explore overhauling labor policies to address potential mass job displacement. The order will require agencies to develop procurement and vendor certification standards for AI suppliers, perform risk assessments of high risk uses, and set safeguards to prevent discrimination, civil rights violations, and other harms. The initiative will involve consultations with labor groups, lawmakers, and industry stakeholders and could lead to policy proposals on worker protections, retraining programs, notice requirements for AI driven layoffs, and other measures to support affected workers.
Keys to the Kingdom: Anonymous SQL Injection in Drupal Core (CVE-2026-9082)

slcyber.io · 5 months ago

There is a highly critical SQL injection in Drupal core identified as CVE-2026-9082 that allows fully anonymous users to exploit sites backed by PostgreSQL. The vulnerability is caused by entity query code that preserves attacker-controlled JSON object keys or bracketed query parameter keys and interpolates them into PostgreSQL placeholder names on case-insensitive IN comparisons, with the JSON login handler and JSON:API filter syntax confirmed as attack paths. One variant enables boolean blind extraction by inducing divide by zero errors while the other yields error-based leaks that surface PDO SQLSTATE HY093, both producing distinct HTTP status responses useful for scanning and data extraction. Fixes were released across supported branches including 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, and 10.4.10 and administrators are strongly advised to upgrade promptly.
Apple blocked over $11 billion in App Store fraud in 6 years

www.bleepingcomputer.com · 5 months ago

Apple blocked over $11 billion in fraudulent App Store transactions over the past six years, including more than $2.2 billion in potentially fraudulent transactions in 2025 alone. The company rejected over 2 million problematic app submissions in 2025, evaluated 9.1 million app submissions, blocked more than 1.1 billion fraudulent account creations, and deactivated about 40.4 million customer accounts suspected of fraud and abuse. Apple also terminated 193,000 developer accounts, rejected over 138,000 developer enrollments, stopped more than 5.4 million uses of stolen credit cards, blocked nearly 195 million fraudulent ratings and reviews, and reported the App Store draws over 850 million weekly visitors across 175 storefronts worldwide.
Nvidia’s Profit Hits $58.3 Billion as A.I. Boom Gathers More Steam

www.nytimes.com · 5 months ago

The chip maker reported that profit in its most recent quarter rose 211 percent from a year earlier, driven by extreme demand from large technology companies for its AI-focused chips. Revenue and earnings topped expectations and executives signaled continued strength in data center sales going forward.
Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor

thehackernews.com · 5 months ago

Showboat is a modular post exploitation framework for Linux capable of spawning remote shells, transferring files, and functioning as a SOCKS5 proxy. It has been used in a campaign targeting a telecommunications provider in the Middle East since at least mid 2022 and is linked to clusters affiliated with China, with command and control infrastructure geolocated to Chengdu. The malware gathers system information and exfiltrates it as an encrypted Base64 string embedded in PNG fields, can hide from process lists, retrieve a Pastebin code snippet created January 11, 2022 to conceal itself, upload and download files, manage C2 servers, scan for other devices, and proxy connections to internal machines via SOCKS5. An ELF binary was uploaded to VirusTotal in May 2025 and is tracked by Kaspersky as EvaRAT, and investigations identified victims including an Afghanistan internet service provider, an entity in Azerbaijan, and possible compromises in the United States and Ukraine tied to a secondary C2 cluster.
Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet

www.bleepingcomputer.com · 5 months ago

Researchers analyzing about seven hundred underground posts found modern crypto drainers now operate as Drainer-as-a-Service platforms that scale wallet theft by recruiting affiliates to deliver phishing traffic while operators handle signature approvals, transaction logic, and take commissions. These services rely on social engineering rather than device compromise, tricking users into approving malicious wallet signatures and abusing Permit and Permit2 authorizations, and they use automation features such as website cloning, off-chain signatures, and zero configuration deployments to lower the technical barrier for affiliates. Warning signs include immediate wallet connection requests, unexpected signature or unlimited approval prompts, cloned or suspicious domains, multiple redirects, urgent messages from social or support accounts, requests to disable wallet protections, and evidence that operators migrate infrastructure to resilient platforms after takedowns.
Chinese hackers target telcos with new Linux, Windows malware

www.bleepingcomputer.com · 5 months ago

There is a Chinese cyber espionage campaign active since at least mid 2022 targeting telecommunications providers across the Asia Pacific and parts of the Middle East and attributed to the Calypso threat group also tracked as Red Lamassu. There are two newly discovered implants: a modular Linux post exploitation framework called Showboat or kworker that collects host information, can act as a SOCKS5 proxy and port forward for internal pivoting, hide processes, upload and download files, and establish persistence. There is also a Windows implant called JMFBackdoor delivered via a batch script and DLL sideloading chain that provides reverse shell access, file management, TCP proxying, process and registry manipulation, screenshot capture with encryption, encrypted configuration management, and self removal and anti forensics, and the attackers used telecom themed domains to impersonate victims while sharing tooling and certificate generation patterns across clusters.
Chinese APTs Share Linux Backdoor in Central Asia Telco Attacks

www.darkreading.com · 5 months ago

For years Chinese state aligned hackers have spied on telecommunications providers in Central Asia and beyond using a Linux post exploitation framework called Showboat also known as kworker. Showboat can scan local area networks to infect devices that are not connected to the public Internet, has evidence dating back to mid 2022 with virtually zero detections on VirusTotal, and appears shared among multiple Chinese APT clusters with at least one identified as Calypso which has also deployed a Windows backdoor called JFMBackdoor and historically reused PlugX. The tool is less sophisticated than high end telco malware such as BPFdoor but has been effective for small market testing and has been observed against an ISP in Afghanistan and other victims in Azerbaijan the Donbas region and the Middle East.
Max severity Cisco Secure Workload flaw gives Site Admin privileges

www.bleepingcomputer.com · 5 months ago

Cisco released security updates to fix a maximum severity vulnerability in Secure Workload that allows unauthenticated attackers to exploit internal REST APIs and gain Site Admin privileges. The flaw is tracked as CVE-2026-20223 and results from insufficient validation and authentication of REST API endpoints, potentially allowing attackers to read sensitive information and make configuration changes across tenant boundaries. There are no workarounds; on-premises customers must install provided fixed releases while the cloud Secure Workload SaaS deployment has already been patched, with fixes available in versions 3.10.8.3 and 4.0.3.17. Cisco said its Product Security Incident Response Team found no evidence the vulnerability had been exploited in the wild and noted that a separate maximum severity authentication bypass CVE-2026-20182 affecting Catalyst SD-WAN was being actively exploited earlier.
Police seize “First VPN” service used in ransomware, data theft attacks

www.bleepingcomputer.com · 5 months ago

A joint international law enforcement operation took offline a virtual private network service named First VPN after it was used in ransomware and data theft attacks. Authorities seized 33 servers across 27 countries, disrupted key infrastructure, seized related domains, arrested the administrator, and carried out a house search in Ukraine during coordinated actions between May 19 and May 20, 2026. Investigators who had previously infiltrated the VPN infrastructure collected traffic data that enabled user identification, and an Operational Taskforce coordinated analysis and intelligence sharing among 16 countries. Information about 506 users and 83 intelligence packages was shared internationally, identified users were directly notified, and the gathered intelligence exposed thousands of users linked to the cybercrime ecosystem.
Content Delivery Exploit Opens Websites to Brand Hijacking

www.darkreading.com · 5 months ago

There is a new domain fronting variant called Underminr that lets attackers modify web requests and leverage trusted sites hosted on shared content delivery network edge addresses to cloak malicious activity. ADAMnetworks found the issue exposes nearly half of websites globally, with 42 percent vulnerable overall and 51 percent in the United States, allowing attackers to route scams, command and control, and data exfiltration through legitimate domains to evade DNS and behavior based detection. Moving a domain off a shared CDN or adopting CDN practices that group domains by reputation reduces exposure, though such measures do not fully eliminate the underlying infrastructure risk.
Trump Approved a Nvidia Chip for Sale in China. Beijing Doesn’t Want It.

www.nytimes.com · 5 months ago

There have been no completed purchases of Nvidia’s H200 AI chip by Chinese buyers despite U.S. authorization to export the model. The United States approved limited H200 sales under strict conditions including security guarantees and inspection routing requirements, but Beijing has restricted approvals and told customs the chips are not permitted, leaving shipments stalled. The impasse has turned the H200 into a geopolitical test of U.S.-China technology policy, prompted scrutiny of export controls, and coincided with reports of investigations into attempted smuggling and enforcement actions.
Cisco Patches Critical Vulnerability in Secure Workload

www.securityweek.com · 5 months ago

There is a critical vulnerability in Cisco Secure Workload's internal REST APIs that could allow a remote attacker to send crafted API requests and obtain Site Admin privileges, enabling access to sensitive information and modification of configurations across tenant boundaries. The flaw is tracked as CVE-2026-20223 with a CVSS score of 10.0 and was fixed in Secure Workload versions 3.10.8.3 and 4.0.3.17; it affects SaaS and on-prem deployments regardless of device configuration but does not impact the web based management interface. Cisco reports no known exploitation in the wild, urges users to apply updates, and also released patches for three medium severity issues affecting ThousandEyes appliances and Nexus switches.
Apache OFBiz RCE Flaw Abuses Password-Change Restrictions for Authentication Bypass

gbhackers.com · 5 months ago

A critical authentication bypass in Apache OFBiz enables attackers to hijack forced password change flows and achieve remote code execution with a single crafted HTTP request, affecting all versions before 24.09.06. The flaw is tracked as CVE-2026-45434, has a CVSS 3.1 score of 8.8, and was disclosed on May 20, 2026 by researcher Aretiq AI. Attackers chain a checkLogin logic error that treats a requirePasswordChange response as successful, a client controlled requirePasswordChange parameter that allows inline password updates, and unsandboxed Groovy execution in ProgramExport.groovy to gain full JVM and operating system command execution. Recommended actions are to upgrade to Apache OFBiz 24.09.06, remove or change default demo accounts, restrict access to the ProgramExport control endpoint at the network or application layer, and audit accounts for requirePasswordChange flags.
ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories

thehackernews.com · 5 months ago

There is a growing pattern of attackers exploiting trusted components such as updates, apps, cloud controls, support chats, and trusted accounts rather than breaking in directly. Recent incidents include a Composer vulnerability that leaked GitHub Actions tokens assigned CVE-2026-45793 and a critical HP HPLIP heap buffer overflow assigned CVE-2026-8631 that can allow arbitrary code execution via malicious print jobs. Operators continue to refine a persistent Linux userland rootkit called OrBit, separate campaigns are using agentic AI to generate and deploy intrusion tools, and attackers have abused Azure self service password reset workflows to exfiltrate data.
Ocean Emerges From Stealth With $28M for Agentic Email Security Platform

www.securityweek.com · 5 months ago

Ocean emerged from stealth with 28 million dollars in funding from Lightspeed Venture Partners, Picture Capital, Cerca Partners and prominent angel investors. Headquartered in New York City and Tel Aviv and founded in 2024 by Shay Shwartz and Oran Moyal, Ocean built a platform that uses specialized AI agents to inspect every incoming message, evaluate sender intent, gather conversation context and review evidence to detect threats. The solution targets sophisticated attacks such as business email compromise, vendor email compromise and AI generated phishing by conducting in depth analysis of infrastructure, files, links, identities and financial requests, automating reported email triage, quarantine releases and incident handling while delivering real time guidance to employees.
Microsoft Defender Zero-Day Vulnerabilities Actively Exploited in the Wild

gbhackers.com · 5 months ago

Two zero-day vulnerabilities in Microsoft Defender are being actively exploited and were disclosed by Microsoft on May 19, 2026, tracked as CVE-2026-41091 and CVE-2026-45498. CVE-2026-41091 is an elevation of privilege flaw with a CVSS score of 7.8 caused by improper link resolution classified under CWE-59, exploitable locally with low complexity to grant high-level privileges without user interaction and has confirmed exploitation activity. CVE-2026-45498 is a denial-of-service vulnerability rated 4.0 that can be triggered locally without privileges or user interaction and is also being actively exploited; Microsoft has released patches and organizations are urged to apply updates, review logs, and implement defense-in-depth measures such as endpoint detection and least privilege.
Automated vulnerability intel, using Hermes AI

threat-modeling.com · 5 months ago

There are multiple actively exploited and high risk vulnerabilities affecting widely used software, including Microsoft Defender privilege escalation CVE-2026-41091, Microsoft Defender denial of service CVE-2026-45498, a BitLocker bypass CVE-2026-45585 with a public proof of concept and no security patch yet, an NGINX heap buffer overflow CVE-2026-42945, a Drupal core SQL injection and potential RCE CVE-2026-9082, a ZKTeco camera authentication bypass CVE-2026-8598, and a Linux kernel privilege escalation CVE-2026-46333. Immediate actions recommended include verifying and updating Defender engine versions and remediating by June 3, 2026 per CISA, applying Microsoft BitLocker mitigations or enforcing TPM plus PIN, patching NGINX and ensuring ASLR is enabled, updating Drupal core patched on May 20, 2026, applying ZKTeco firmware and isolating cameras, and applying Linux kernel fixes or raising ptrace scope to two as a temporary workaround. A supply chain compromise of TanStack and Nx npm packages delivered credential stealing malware during a May 11, 2026 window and earlier Nx activity in August 2025 and requires updating to patched package versions, deleting node modules and lockfiles, and rotating all credentials.
Discord Enables End-to-End Encryption by Default Across Voice and Video Features

gbhackers.com · 5 months ago

Discord has enabled end to end encryption by default for all voice and video communications across desktop, mobile, web browsers, and gaming consoles following an announcement on May 18, 2026. The change covers direct messages, group calls, voice channels, and live streaming features such as Go Live while excluding Stage channels, and is powered by Discord's custom DAVE protocol which was open sourced and externally audited by Trail of Bits and included in the company bug bounty program. Discord collaborated with Mozilla to resolve a Firefox issue, completed a gradual migration from 2024 through March 2026 that removed legacy unencrypted fallbacks, and said it will not extend E2EE to text messaging because moderation tools, bots, and integrations require server side access.
Apple Rejected 2 Million App Store Submissions in 2025 for Security and Fraud Prevention

www.securityweek.com · 5 months ago

Apple rejected over 2 million App Store submissions in 2025, reviewing more than 9.1 million submissions and approving roughly 306,000 new developers while rejecting over 1.2 million new apps and about 800,000 updates. There were more than 1.1 million fraudulent account creation attempts blocked, 40.4 million accounts deactivated for fraud and abuse, 138,000 developer enrollments rejected, and 193,000 developer accounts terminated for suspected fraud. Combined AI detection and human review prevented over 2.2 billion dollars in potentially fraudulent transactions in 2025, stopped more than 5.4 million stolen credit cards from being used, banned nearly 2 million user accounts from transacting again, and detected and blocked 28,000 illegitimate apps on pirate storefronts.
Flipper One project needs community help to build open Linux platform

www.bleepingcomputer.com · 5 months ago

Flipper Devices is asking the community to help build Flipper One, an open Linux portable ARM platform designed for networking and hardware experimentation with enough performance to support software defined radio analysis and local large language models. The device is built around a Rockchip RK3576 system on chip with 8 gigabytes of RAM and a Raspberry Pi RP2350 microcontroller in a dual processor architecture that keeps the display and power subsystem operational even when the main OS is off, and it will be modular with interfaces such as M.2, PCIe, USB 3.1, SATA, GPIO, UART, I2C, and SIM to add SDRs, SSDs, Wi Fi cards, AI accelerators, and 5G or satellite modems. Major challenges include upstreaming full mainline Linux support for the RK3576, developing and upstreaming dual processor drivers, building Flipper OS and the FlipCTL framework for a small screen Linux user experience, and resolving hardware compatibility issues for DisplayPort Alt Mode and video encoding, with Collabora assisting on kernel support while the project remains an active development effort.
Drupal Patches Highly Critical Vulnerability Exposing Websites to Hacking

www.securityweek.com · 5 months ago

Drupal patched a highly critical vulnerability tracked as CVE-2026-9082 that can be exploited without authentication to cause information disclosure, privilege escalation, and remote code execution. The flaw affects an API intended to sanitize database queries and allows arbitrary SQL injection on sites using PostgreSQL, with patches available for Drupal versions 11.3, 11.2, 10.6, and 10.5.x. The updates also address important upstream vulnerabilities in Symfony and Twig and administrators are urged to update Drupal and its dependencies because only sites using PostgreSQL are impacted yet many websites run the CMS.