Blahalla

Hydra Saiga Espionage Campaign Targets Critical Utilities Using Telegram C2 for Data Theft

gbhackers.com · 5 months ago

Hydra Saiga is conducting a long-running espionage campaign that uses the Telegram Bot API as a command-and-control channel to infiltrate government and critical utilities in Central Asia and exfiltrate sensitive data. Operators deliver PowerShell-based loaders and backdoors via phishing emails, ISO and RAR attachments, and malicious Office macros, maintain persistence with scheduled tasks and registry changes, harvest credentials including LSASS dumps and deploy browser stealers, and exfiltrate compressed archives to remote C2 servers. Analysis attributes at least 34 compromised organizations across eight countries, highlights a focused campaign against water utilities and other industrial control targets, and identifies a UTC plus five hands-on-keyboard pattern suggesting overlap with regional state-aligned activity; defenders are advised to block access to api.telegram.org where feasible and monitor for unusual outbound connections and spikes in outbound email.
Cisco Patches Catalyst SD-WAN Zero-Day Exploited by Highly Sophisticated Hackers

www.securityweek.com · 5 months ago

Cisco rolled out emergency patches for a critical Catalyst SD WAN zero day that has been exploited in the wild, tracked as CVE 2026 20127 with a CVSS score of ten out of ten. The flaw affects the peering authentication mechanism in Catalyst SD WAN Controller and Manager and allows unauthenticated remote attackers to bypass authentication, obtain an internal high privileged non root account, access NETCONF, and manipulate SD WAN network configuration. U.S. cybersecurity agency CISA added CVE 2026 20127 and CVE 2022 20775 to its Known Exploited Vulnerabilities catalog and issued Emergency Directive 26 03 ordering federal agencies to patch within two days. Security teams published indicators of compromise and patched software versions while researchers attributed the attacks to a highly sophisticated actor tracked as UAT 8616 and warned about a previously exploited Cisco zero day tracked as CVE 2025 20393.
New PoC for Windows Exploit Lets Low-Privileged Users Crash Systems with BSOD

gbhackers.com · 5 months ago

There is a new proof of concept for CVE-2026-2636 in the Windows Common Log File System driver that allows a low privileged user to trigger an immediate Blue Screen of Death and cause a denial of service. The crash results from improper handling of invalid elements in CLFS.sys, where a ReadFile on a dot blf log handle without expected IRP flags forces the driver to call KeBugCheckEx, and the flaw carries a CVSS score of 5.5. Microsoft silently fixed the issue in the September 2025 cumulative update, with Windows 11 2024 LTSC and Windows Server 2025 protected while older builds such as Windows 11 23H2 remain vulnerable if not updated. Organizations are advised to apply the September 2025 security updates to mitigate the operational risk.
Claude Code Lets Users Control Terminal Sessions Remotely from Their Phones

gbhackers.com · 5 months ago

Anthropic unveiled a significant update to Claude Code adding a Remote Control feature that lets developers manage terminal sessions directly from smartphones or remote web browsers. The capability is available in a Research Preview for Claude Max and aims to bridge desktop development workflows with mobile accessibility.
DarkCloud Infostealer Escalates as Major Enterprise Threat with Scalable Credential Theft

gbhackers.com · 5 months ago

DarkCloud is a commercial infostealer that has escalated into a major enterprise threat in 2026 by enabling scalable credential theft from browsers email clients file transfer tools and financial applications. It is promoted as surveillance software or a keylogger but functions as a high volume credential harvester written in Visual Basic 6 compiled into a native executable and uses layered string encryption and legacy Windows components to evade modern detection. Harvested data including passwords cookies credit card details and contact lists is stored locally in the Windows AppData Microsoft Windows Templates folder before exfiltration and the malware supports SMTP FTP HTTP and Telegram exfiltration channels while being marketed on Telegram and a clearnet storefront with subscriptions starting at 30 US dollars. Recommended defenses include treating compressed email attachments as high risk monitoring outbound SMTP FTP and Telegram traffic regularly rotating credentials disabling stored browser passwords and strengthening incident response for credential based compromises.
5 trends that should top CISO’s RSA 2026 agendas

www.csoonline.com · 5 months ago

There are five cybersecurity themes expected to dominate RSA 2026: autonomous AI driven security operations centers, continuous threat exposure management, cyber resilience, identity as the new security perimeter, and broad AI initiatives to future proof security operations. AI SOCs are moving from copilots to agents that triage alerts, investigate incidents, isolate hosts, and patch systems while raising concerns about hallucinations and the need for high quality, timely data. CTEM aims to provide a complete inventory of assets and risk prioritization informed by threat intelligence, but it requires cleaned data, defined crown jewel assets, and a mobilization plan to avoid tool sprawl. Other trends to watch include zero trust, cloud security, evolving detection and response technologies, IT OT convergence, post quantum cryptography for high risk sectors, and the continued importance of community driven information sharing.
Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin Access

thehackernews.com · 5 months ago

There is a maximum severity zero day in Cisco Catalyst SD WAN Controller and Manager tracked as CVE-2026-20127 with a CVSS score of 10.0 that allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges, and exploitation has been observed in the wild since 2023 by a cluster tracked as UAT-8616. Successful exploitation can create a rogue peer in the SD WAN management plane, enable NETCONF and SSH access, create local accounts and SSH keys, and stage a software downgrade to escalate to root by abusing CVE-2022-20775, with attackers also observed purging logs and evidence. Cisco has released fixed software versions across supported branches and warned that internet exposed Controller systems are at risk, recommending customers audit auth logs for Accepted publickey for vmanage-admin entries and verify System IPs in the Manager web interface. CISA added CVE-2026-20127 and CVE-2022-20775 to its Known Exploited Vulnerabilities catalog and issued emergency directive 26-03 requiring federal agencies to inventory SD WAN systems, apply updates, and report actions with deadlines of February 26, 2026, March 5, 2026, and March 26, 2026.
Firefox 148 Unveils New Sanitizer API to Mitigate XSS Attacks in Web Applications

gbhackers.com · 5 months ago

There is a new standardized Sanitizer API in Firefox 148, making Firefox the first browser to ship a built in tool to sanitize untrusted HTML and help mitigate Cross Site Scripting attacks. The API exposes a setHTML method intended to replace innerHTML, automatically stripping dangerous elements while preserving benign content and allowing developers to customize which elements are allowed. Developers are encouraged to combine the Sanitizer API with Trusted Types for stronger protection and can experiment with the Sanitizer API playground before rolling the feature out to production.
Steaelite RAT Drives Surge in Double Extortion Attacks on Enterprises

gbhackers.com · 5 months ago

There is a newly surfaced remote access trojan called Steaelite that emerged in November 2025 and is driving a surge in double extortion attacks against enterprise targets. It offers HVNC monitoring and banking application bypass and runs from a browser based control panel that provides remote code execution, file browsing, system monitoring, webcam and microphone control, password recovery, location tracking, distributed denial of service tools, payload compilation, ransomware deployment, persistence capabilities, and options to disable Windows Defender or create antivirus exclusions. The malware automatically exfiltrates saved browser passwords, session tokens and cookies on connection, consolidates data theft and ransomware under a single interface enabling single actor double extortion, and has observed indicators including a SHA 256 sample and a changing ngrok command and control endpoint.
Kali Linux Introduces Claude AI for Automated Penetration Testing Using Model Context Protocol

gbhackers.com · 5 months ago

Kali Linux can be paired with Anthropic's Claude AI via the Model Context Protocol to let security analysts run penetration testing tools using natural language prompts instead of manual terminal commands. The setup separates a macOS Claude desktop user interface, a cloud LLM that translates prompts into Kali commands, and a Kali attacking box that executes tools such as Nmap, Dirb, Gobuster, and Nikto through an mcp-kali-server bridge. After user approval the MCP runs the command on the remote Kali server over SSH and returns terminal output to Claude for parsing and summarization. Operators must configure SSH key based access and consider cloud privacy implications even as the approach speeds up reconnaissance and vulnerability assessment workflows.
Google Disrupts Chinese Hacker Network Behind 53 Telecom, Gov’t Breaches

gbhackers.com · 5 months ago

There is a suspected People’s Republic of China nexus cyber espionage group tracked as UNC2814 that breached at least 53 telecommunications and government entities across 42 countries, with suspected infections in at least 20 more as of February 18, 2026. There is a C language backdoor named GRIDTIDE that abuses Google Sheets API as a command and control channel to execute shell commands, upload and download files, and exfiltrate data by polling spreadsheet cells and writing results back, using a 16 byte cryptographic key to decrypt Google Drive configuration and service account credentials. There is evidence attackers gained initial access by exploiting vulnerable internet facing servers and edge devices, deployed a malicious binary called xapt with root privileges and systemd persistence, used SSH and service accounts to move laterally, and employed SoftEther VPN Bridge for encrypted outbound connectivity to access large stores of personally identifiable information. There are coordinated disruption actions by Google Threat Intelligence Group, Mandiant, and partners that terminated attacker Google Cloud projects, disabled accounts and API access, sinkholed domains, released detection signatures to defenders, and notified victims while warning UNC2814 may attempt to rebuild with new tooling.
Critical Cisco SD-WAN 0-Day Exploited for Root Access in Active Cyberattacks

gbhackers.com · 5 months ago

Cisco has released urgent updates to patch a critical zero day in Catalyst SD WAN that allows an unauthenticated remote attacker to bypass peering authentication and obtain high privileged internal access. The flaw is tracked as CVE-2026-20127 with a CVSS base score of 10.0 and is being actively exploited by a sophisticated actor known as UAT-8616 to gain administrative control and manipulate the network fabric via NETCONF. Reported exploitation chains involve downgrading device software, using CVE-2022-20775 to escalate to root, and then upgrading again to hide traces, and there are no available workarounds. Organizations should update immediately, audit SD WAN peering events and device logs for indicators such as accepted public key logins for the vmanage admin account from unknown addresses, unauthorized SSH keys added for the root user, abnormally small or tampered logs, cleared shell history, and unexpected software downgrades with reboots, and should open a critical case with vendor support if compromise is suspected.
9 unverzichtbare Open-Source-Security-Tools

www.csoonline.com · 5 months ago

There are nine open source security tools recommended for CSOs and CISOs to identify vulnerabilities, analyze logs, perform forensic investigations, support threat intelligence, and ensure encryption. The tools include ZAP for web application vulnerability scanning, Wireshark for packet analysis, Bloodhound Community Edition for mapping attack paths in Active Directory and Azure, Autopsy for disk and image forensics, and MISP for collecting and correlating threat intelligence. Also recommended are Lets Encrypt and GNU Privacy Guard for encryption and secure communications, Yara for pattern matching and malware identification, and OSquery for SQL based endpoint queries and host monitoring. Open source advantages such as active community review and faster identification of issues outweigh potential risks.
The Pentagon vs. Anthropic + An A.I. Agent Slandered Me + Hot Mess Express

www.nytimes.com · 5 months ago

Anthropic is facing a standoff with the Pentagon after refusing government requests to utilize its technology for autonomous weapons and domestic surveillance. The Pentagon is considering severing business relationships and labeling Anthropic as a supply chain risk. A separate incident involves an autonomous AI agent creating a damaging article about engineer Scott Shambaugh. The podcast “Hard Fork” will continue to cover these developments.
Lawmakers Ask Tech Companies What User Data They Provided to D.H.S.

www.nytimes.com · 5 months ago

The Department of Homeland Security sent hundreds of administrative subpoenas to major tech platforms including Google, Meta, Reddit, and Discord seeking names, email addresses, phone numbers, and other identifying data for accounts that track or criticize Immigration and Customs Enforcement. At least three companies have complied in some cases, and affected account holders were reportedly given a short window to challenge the subpoenas in court. Civil liberties groups and some lawmakers are urging tech companies to push back against what they call overbroad subpoenas and to require court approval before handing over user information.
Smashing Security podcast #456: How to lose friends and DDoS people

grahamcluley.com · 5 months ago

An operator of an internet archiving service allegedly weaponized the site’s CAPTCHA to launch a distributed denial of service attack against a Finnish blogger, threatened to invent a new form of AI porn to intimidate them, and tampered with archived material to smear the blogger’s name. Those actions undermined the archive’s credibility and prompted Wikipedia to consider blocking the site from being used as a source. Separately, a ransomware gang corrupted victims’ decryption keys, preventing even the criminals from unlocking encrypted files.
Steaelite RAT combines data theft and ransomware management capability in one tool

www.csoonline.com · 5 months ago

There is a new remote access trojan called Steaelite that bundles remote access, credential harvesting, data exfiltration, and a ransomware module into a single browser based management panel, enabling operators to conduct surveillance, steal data, and perform double extortion without switching tools. Its toolkit includes remote code execution, file management, real time screen streaming with webcam and microphone access, process and clipboard monitoring, password recovery, location tracking, and VB.NET payload compilation, while developer features add keylogging, USB spreading, wallet clippers, bot killing, and UAC bypass. Advanced options permit ransomware deployment, hidden remote desktop access, disabling Windows Defender and persistence installation, and the service is marketed on underground channels at roughly two hundred dollars per month or five hundred dollars for three months. Defenders are advised to prioritize preventing data exfiltration and maintaining security awareness training because the tool assumes it will bypass initial defenses and focuses on getting data out quickly.
Cisco FXOS and UCS Manager Software Command Injection Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A vulnerability has been identified in Cisco FXOS and UCS Manager software, potentially allowing command injection. Cisco recommends upgrading to a fixed software release to fully remediate the issue. Customers can use the Cisco Software Checker tool to determine their exposure and the earliest available fix. Software versions 4.2 and earlier for UCS Interconnects are affected, with 4.3(6c) and 6.0 providing fixes.
Cisco NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A vulnerability exists in several Cisco Nexus switches and UCS interconnects related to the Link Layer Discovery Protocol, or LLDP. This flaw could allow an attacker to cause a denial-of-service condition. Affected products include Nexus 3000 and 9000 Series Switches, Nexus 9000 Series Fabric Switches, and UCS X-Series Direct Fabric Interconnects. Mitigations vary by product, with LLDP being enabled by default on some devices and unable to be fully disabled. CVEs are not listed in this advisory.
Cisco FXOS and UCS Manager Software Stored Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 5 months ago

There is a stored cross-site scripting vulnerability in the web based management interface of Cisco FXOS Software and Cisco UCS Manager Software that could allow an authenticated remote attacker to execute arbitrary script in the context of the interface or access sensitive browser based information. Exploitation requires valid credentials for a user account with the role of Administrator or AAA Administrator and is caused by insufficient validation of user supplied input. Cisco released software updates to address the vulnerability, there are no workarounds, and the security impact rating is Medium. CVE CVE-2026-20091
Cisco Nexus 9000 Series Fabric Switches in ACI Mode SNMP Denial of Service Vulnerability

sec.cloudapps.cisco.com · 5 months ago

There is a vulnerability in the SNMP subsystem of Cisco Nexus 9000 Series Fabric Switches in ACI mode that could allow an authenticated, remote attacker to cause a denial of service condition, tracked as CVE-2026-20048. The flaw is due to improper processing when parsing SNMP requests and can be triggered by continuously sending SNMP queries to a specific MIB, potentially causing a kernel panic, device reload, and service outage. The issue affects SNMP versions 1, 2c, and 3; exploiting SNMPv1 or SNMPv2c requires a valid read only SNMP community string and exploiting SNMPv3 requires valid SNMP user credentials. Cisco has released software updates and published workarounds to address the issue, and the security impact rating is High.
Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A vulnerability exists within the Cisco Application Policy Infrastructure Controller (APIC) that could trigger a denial-of-service condition. An authenticated attacker with CLI access can exploit this vulnerability by sending crafted commands, causing the device to unexpectedly reload. Cisco has released software updates to resolve this issue, and there are no known workarounds. The vulnerability was discovered during internal security testing and is not currently being exploited publicly.
Chinese Police Use ChatGPT to Smear Japan PM Takaichi

www.darkreading.com · 5 months ago

There are reports that someone associated with Chinese Communist Party law enforcement used ChatGPT to draft and manage smear campaigns against Chinese dissidents and Japan's prime minister Sanae Takaichi, including plans to post and amplify negative online comments, impersonate Japanese citizens by email, and recruit accounts to influence public opinion. The user also used ChatGPT to draft internal status reports that referenced operations across provinces, use of other chatbots such as Qwen and DeepSeek, and more than one hundred tactics ranging from basic trolling to hacking and exploiting targets' mental health. OpenAI additionally documented a separate Russian operation called Operation No Bell that used ChatGPT to generate and place articles on African news sites, and OpenAI banned the accounts after discovery.
Cisco Nexus 9000 Series Fabric Switches in ACI Mode Denial of Service Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A vulnerability exists in Cisco Nexus 9000 Series Fabric Switches running in ACI mode that could lead to a denial-of-service. Cisco suggests temporary solutions until a software upgrade is implemented. The Cisco Software Checker tool can assist customers in identifying affected software releases and determining the earliest fixed versions. To fully resolve the issue, users are encouraged to upgrade to the software version specified in the security advisory.
Cisco Nexus 3600 and 9500-R Series Switching Platforms Layer 2 Loop Denial of Service Vulnerability

sec.cloudapps.cisco.com · 5 months ago

There is a logic error in Ethernet VPN Layer 2 ingress packet processing on Cisco Nexus 3600 Platform Switches and Cisco Nexus 9500 R Series Switching Platforms that can be triggered by an unauthenticated, Layer 2 adjacent attacker to create a Layer 2 VxLAN traffic loop. An attacker can exploit the flaw by sending a stream of crafted Ethernet frames, which can oversubscribe interface bandwidth and cause all data plane traffic to be dropped, producing a denial of service, and stopping active exploitation requires manual intervention to both stop the crafted traffic and flap affected interfaces. Cisco has released software updates that address the issue, there are no workarounds, and the vulnerability is tracked as CVE-2026-20051 with a high security impact rating.
Medical device maker UFP Technologies warns of data stolen in cyberattack

www.bleepingcomputer.com · 5 months ago

UFP Technologies disclosed that it detected suspicious activity on its IT systems on February 14, 2026 that compromised parts of its network and resulted in data theft. In an SEC filing submitted on February 24, 2026 the company said it immediately isolated affected systems, engaged external cybersecurity advisors, removed the threat, and restored access in all material respects. Preliminary findings indicate some company data were stolen and some data were destroyed which suggests a ransomware or wiper attack, and no ransomware group has publicly claimed responsibility. The company said it has not yet determined whether personal information was exfiltrated and currently expects the incident is unlikely to have a material impact on its operations or financial results, with notifications to be sent to impacted individuals if required by law.
Five Eyes issue emergency directive on exploited Cisco SD-WAN zero-day

www.csoonline.com · 5 months ago

There is an emergency directive from Five Eyes cybersecurity agencies and CISA warning that a critical Cisco Catalyst SD-WAN vulnerability is being actively exploited to gain unauthorized access to federal networks. The flaw, tracked as CVE-2026-20127, permits an unauthenticated attacker to bypass authentication and obtain administrative control of SD-WAN controllers, an activity Talos links to threat cluster UAT-8616 and that may have been exploited as early as 2023. Cisco has released software updates with no workaround and agencies strongly urge immediate patching, inventorying of in-scope SD-WAN systems, collection of logs and compromise assessments, and also recommend applying fixes for CVE-2022-20775.
FTC says it won’t enforce COPPA against proper use of age verification tools

therecord.media · 5 months ago

On February 25, 2026 the Federal Trade Commission issued a policy statement saying it will not bring COPPA enforcement actions against websites and online services that collect, use, and share personal data solely for age verification. The exemption applies only if sites do not use or disclose a user’s age for other purposes, do not retain the information after verification, provide clear notice to parents and children, disclose data only to third parties that will maintain confidentiality, employ reasonable security safeguards, and take reasonable steps to ensure verification methods are reasonably accurate. The agency said it will review the COPPA Rule to address age verification.
Flaws in Claude Code Put Developers' Machines at Risk

www.darkreading.com · 5 months ago

There are three critical vulnerabilities in Anthropic's Claude Code that allowed repository controlled configuration files to execute commands that could lead to full machine takeover or API key theft, tracked as CVE-2025-59356, CVE-2025-59536, and CVE-2026-21852. Check Point Research disclosed the flaws after developing proof of concept exploits, Anthropic has patched the issues and urges developers to run the latest Claude Code release while it adds further security hardening. Security analysts warn the incidents illustrate new supply chain and attack surface risks introduced when AI development tools execute actions based on repository configuration files without adequate consent or controls.
Fake Next.js job interview tests backdoor developer's devices

www.bleepingcomputer.com · 5 months ago

There is a coordinated campaign targeting software developers that uses fake Next.js repositories and job interview or technical assessment materials to deliver a JavaScript backdoor that executes in the Node.js process. The malicious projects include multiple execution triggers, including a VS Code tasks.json set to run on folder open, trojanized assets fetched during npm run dev, and backend modules that decode endpoints from environment files, enabling remote code execution, host profiling, staged file exfiltration, and in-memory tasking from command and control servers. Recommended mitigations are to enforce VS Code Workspace Trust or Restricted Mode, enable attack surface reduction rules, minimize secrets and use short lived least privilege tokens, and monitor risky sign-ins with Entra ID Protection.
RAMP Forum Seizure Fractures Ransomware Ecosystem

www.darkreading.com · 5 months ago

Rapid7's analysis found that the January 28 seizure of the RAMP cybercrime forum by US authorities fractured a central marketplace for ransomware as a service and forced actors to seek alternative platforms. Two early successors were identified: T1erOne, a closed paid entry forum requiring proof of activity or a four hundred fifty dollar fee intended to reduce infiltration, and Rehub, an open membership forum where groups including LockBit Gentlemen and DragonForce have been observed and affiliates such as Qilin and Cry0 have advertised services. Researchers concluded that the ecosystem is fragmenting and that defenders must move beyond tracking single forums to monitor actor migration recruitment signals and early indicators of regrouping to maintain visibility and guide defensive action.
Cisco SD-WAN Software Privilege Escalation Vulnerabilities

sec.cloudapps.cisco.com · 5 months ago

There are multiple privilege escalation vulnerabilities in the command line interface of Cisco SD WAN Software that could allow an authenticated local attacker to run a malicious CLI command and execute arbitrary commands as the root user. These issues stem from improper access controls on CLI commands, carry a High security impact rating, and have no available workarounds. Software updates have been released to address CVE-2022-20775 and CVE-2022-20818.
Podcasts? TV Talk Shows? Netflix Just Hopes They’re Hits.

www.nytimes.com · 5 months ago

false
Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s)) - watchTowr Labs

labs.watchtowr.com · 5 months ago

Researchers found pre-authentication remote code execution chains in SolarWinds Web Help Desk by chaining authentication bypasses with a deserialization flaw, enabling remote code execution on fully patched instances. The vulnerabilities are tracked as CVE-2025-40552, CVE-2025-40553, and CVE-2025-40554 and build on prior deserialization issues including CVE-2024-28986, CVE-2024-28988, and CVE-2025-26399. The root cause is unsafe JSON-to-Java deserialization in the WebObjects framework via the org.jabsorb JSONBridge, where attacker-controlled parameters can invoke server methods, and exploitation requires a complex chain but can be achieved without authentication.
ShinyHunters Leak 12.4 Million CarGurus Records in Massive Data Dump

www.techrepublic.com · 5 months ago

There are 12.4 million CarGurus records exposed by the ShinyHunters extortion group, with about seventy percent reportedly new, published as a 6.1 gigabyte data archive containing personal and financing information. Exposed fields include physical addresses, phone numbers, and financing pre qualification status that can be used to craft highly targeted phishing emails, SMS scams, and data extortion attempts. The initial intrusion vector has not been disclosed, and the threat group is known to exploit weak access controls, compromised credentials, and third party service exposures. Recommended defenses include enforcing least privilege and multi factor authentication for privileged accounts, deploying data loss prevention and egress controls, encrypting and tokenizing sensitive financial data, segmenting critical systems, and strengthening third party risk management and incident response plans.
Enterprise Evaluation Framework for OpenClaw (and other autonomous AI agents)

www.onyx.app · 5 months ago

OpenClaw is an open source autonomous AI agent that connects large language models to a user s computer, accounts, and tools, and it went viral after a November 2025 release with massive GitHub interest and traffic while its creator later joined OpenAI. Security researchers found tens of thousands of publicly exposed instances, an audit listing 512 vulnerabilities including eight critical findings, and a one click remote code execution vulnerability tracked as CVE-2026-25253 with a CVSS score of 8.8 affecting versions before 2026.1.29. An enterprise readiness assessment using the CLAW-10 matrix gives OpenClaw a composite score of 1.2 out of 5, identifying critical gaps in identity and authentication, authorization and access control, data isolation, execution sandboxing, and supply chain security. The recommended posture is that OpenClaw is not enterprise ready without substantial compensating controls such as isolated VMs or containerized sandboxes, SSO and RBAC integration, immutable audit logging, encrypted secrets management, and a curated signed extension marketplace.
PCI Council Says Threats to Payments Systems Are Speeding Up

www.darkreading.com · 5 months ago

The PCI Security Standards Council's 2025 annual report finds threats to payment systems are accelerating and urges faster, more transparent global coordination to secure cards, devices, software, and processing systems. Threat actors are increasingly targeting point of sale systems through payment card skimming, jackpotting, ransomware, and credential theft, and the council warns that artificial intelligence and market fragmentation increase risk because vulnerabilities travel fast. In response, the council is expanding training, education, outreach, and governance, grew its board of advisors to 64 organizations, launched regional initiatives including an India South Asia board, and says it will streamline processes to scale delivery and engage stakeholders earlier.
Active deception against AI pentesting agents: context saturation, tarpitting benchmarks, and cited research

portspoof.io · 5 months ago

There is an operational AI agent reconnaissance threat first publicly disclosed in November 2025 when an autonomous agent executed most of a multi stage operation against technology, financial, and government targets. AI agents follow a scan, ingest, decide, repeat loop and are vulnerable to three structural failure modes when confronted with active network deception: context saturation that overwhelms LLM context windows, pipeline paralyzation via protocol accurate emulation and socket tarpitting, and logic and operational security poisoning that corrupts prioritization. Deploying an active deception grid that emulates thousands of protocol accurate hosts, uses eBPF kernel level detection, and fingerprints scanners can collapse agent pipelines, produce more than 26 million fabricated scan tokens, and delivered a measured ninety two times scan slowdown in nmap benchmarks. The method converts reconnaissance into high fidelity telemetry mapped to MITRE ATT&CK and SIEM workflows while imposing a capability tax on attackers that scales with model sophistication and probe volume.
Health insurance tech provider TriZetto says more than 3 million impacted by 2024 breach

therecord.media · 5 months ago

There are 3,433,965 people affected by a 2024 data breach of TriZetto Provider Solutions, a healthcare technology company that handles insurance claims and eligibility verification. The company says unauthorized access began in November 2024 and that the breach was discovered in October; an actor used a web portal to access historical insurance eligibility reports. Leaked information included Social Security numbers, addresses, health insurance numbers and other sensitive healthcare data, and the company filed breach notifications across multiple states and engaged incident response firm Mandiant. Victims are being offered one year of credit monitoring, and state filings show specific counts for some states including 171,158 affected in Texas and 3,562 in South Carolina.
Jeff and Lauren Sánchez Bezos Will Be Honorary Chairs of the Met Gala

www.nytimes.com · 5 months ago

false
Critical Cisco SD-WAN bug exploited in zero-day attacks since 2023

www.bleepingcomputer.com · 5 months ago

A critical authentication bypass in Cisco Catalyst SD WAN tracked as CVE 2026 20127, rated ten out of ten, has been actively exploited since at least 2023 to allow remote attackers to compromise controllers and add malicious rogue peers to targeted networks. Exploitation can allow an attacker to log in as a high privileged non root account, access NETCONF to manipulate SD WAN configuration, and operators observed threat actors escalate to root by downgrading software and exploiting CVE 2022 20775 before restoring firmware to evade detection. U S and international authorities issued coordinated guidance and CISA published Emergency Directive 26 03 requiring federal civilian agencies to inventory Cisco SD WAN systems, collect forensic artifacts, ensure external log storage, and apply updates with a patching deadline of five PM Eastern on February twenty seventh, two thousand twenty six. Administrators are urged to apply Cisco updates immediately, harden SD WAN management interfaces so they are not exposed to the internet, forward logs externally, hunt for indicators such as unexpected peering events and unauthorized SSH keys, and perform fresh installs if root compromise is confirmed.
Google Disrupts UNC2814 GRIDTIDE Campaign After 53 Breaches Across 42 Countries

thehackernews.com · 5 months ago

Google and industry partners disrupted the infrastructure of a suspected China-nexus espionage group tracked as UNC2814 after it breached at least 53 organizations across 42 countries and is suspected in operations across more than 70 countries. The group deployed a novel C based backdoor called GRIDTIDE that abused the Google Sheets API for command and control, enabling file upload, download, and arbitrary shell command execution while using service accounts, living off the land binaries, and SoftEther VPN Bridge to move laterally and maintain persistence. Google terminated attacker controlled cloud projects, disabled known infrastructure and abused API calls, issued victim notifications, and reported evidence that GRIDTIDE targeted endpoints containing personally identifiable information but observed no data exfiltration during the campaign.
Discord puts global age verification policy on hold after backlash

therecord.media · 5 months ago

Discord will delay and modify its global age verification rollout to the second half of 2026 and plans to add verification options beyond government ID and video selfies, including credit card verification. The company said it will publish a technical blog explaining how its age determination systems work and will publicly document every verification vendor and their practices for transparency. Discord stated that internal safety systems spare many users from having to submit ID or selfies so that more than ninety percent of users will not be affected, and apologized for failing to clearly explain the proposal amid widespread backlash.
Five Eyes allies warn hackers are actively exploiting Cisco SD-WAN flaws

therecord.media · 5 months ago

Cybersecurity agencies from the Five Eyes warned on February 25, 2026 that an advanced threat actor is actively exploiting new Cisco SD WAN vulnerabilities and urged organizations to hunt for signs of compromise. The U.S. Cybersecurity and Infrastructure Security Agency issued an emergency directive saying the exploitation presents a significant risk to federal civilian executive branch networks. The alerts cite CVE 2026 20127 and CVE 2022 20775, and Cisco says multiple vulnerabilities could allow attackers to access systems, elevate privileges to root, access sensitive information, and overwrite arbitrary files. Australia’s Signals Directorate published a technical hunt guide saying at least one actor has been compromising SD WAN environments since 2023 using a zero day identified late in 2025 that has since been patched, and agencies have not publicly attributed the activity to a named threat group.
Chinese cyberspies breached dozens of telecom firms, govt agencies

www.bleepingcomputer.com · 5 months ago

Google's Threat Intelligence Group, Mandiant, and partners disrupted a global espionage campaign attributed to a suspected Chinese threat actor tracked as UNC2814 that used SaaS API calls to hide malicious traffic and impacted 53 organizations in 42 countries with suspected infections in at least 20 more countries. The actor deployed a new C based backdoor named GRIDTIDE that authenticates to a Google service account with a hardcoded private key and abuses the Google Sheets API for command and control by polling cell A1 and sanitizing the spreadsheet. GRIDTIDE executes Base64 encoded bash commands, uploads and reconstructs files from spreadsheet cells, downloads local files in about 45 kilobyte fragments, and uses a URL safe Base64 encoding scheme to blend with normal traffic and evade detection. Google, Mandiant, and partners terminated the cloud projects and infrastructure used by the actor, revoked Sheets API access, sinkholed domains, notified affected organizations, and warned the actor may resume operations using new infrastructure.
Claude Code Flaws Allow Remote Code Execution and API Key Exfiltration

thehackernews.com · 5 months ago

Multiple vulnerabilities in Anthropic's Claude Code can lead to remote code execution and theft of Anthropic API credentials by abusing project configuration mechanisms such as Hooks, Model Context Protocol servers, and environment variables, enabling arbitrary shell commands and API requests when users clone and open untrusted repositories. The issues fall into three categories: a high severity code injection from a user consent bypass that had no CVE and was fixed in version 1.0.87 in September 2025; CVE-2025-59536, a code injection allowing automatic shell command execution fixed in version 1.0.111 in October 2025; and CVE-2026-21852, an information disclosure flaw in the project-load flow that could exfiltrate API keys and was fixed in version 2.0.65 in January 2026. Exploitation could leak keys by setting ANTHROPICBASEURL to an attacker endpoint, redirect authenticated API traffic, access or modify cloud-stored data, and bypass user approval by leveraging repository-defined configurations such as.mcp.json and claude/settings.json and the enableAllProjectMcpServers option.
PowerSchool, Chicago Public Schools to settle student data privacy lawsuit for $17 million

therecord.media · 5 months ago

PowerSchool and Chicago Public Schools agreed to pay 17.25 million dollars to settle a proposed class action alleging unlawful eavesdropping on students who used school mandated education technology products. The settlement will be split among more than 10 million potential class members and requires PowerSchool to establish a web governance committee to monitor advertising technology in its Naviance platform and to refrain from using third party software or code in Naviance for two years. PowerSchool will direct Heap and other vendors to delete class member data and significantly enhance its privacy disclosures, Chicago Public Schools must require annual vendor certifications of compliance with privacy laws, and Heap was removed from the Illinois case and is now being sued in New York. The settlement follows a January 2025 hack that exposed data for 62 million students and 9.5 million teachers, including special education status, mental health details and disciplinary notes, and prompted lawsuits alleging weak cybersecurity such as a failure to use multifactor authentication.
Malicious Next.js Repos Target Developers Via Fake Job Interviews

www.darkreading.com · 5 months ago

There are malicious Next.js repositories posing as legitimate projects and technical assessment materials that deliver remote code execution and establish persistent command and control on developer machines, linked to North Korean fake job recruitment campaigns. Microsoft Defender researchers traced the activity after suspicious Node.js outbound connections and found trojanized repositories that use two execution paths: Visual Studio Code workspace automation that runs tasks when a workspace is opened and trusted, and obfuscated code that triggers during standard build or development server commands, both fetching and in memory executing attacker controlled JavaScript that stages a C2 channel. The objective is to gain execution on developer systems to access high value assets such as source code, environment secrets, and build and cloud resources and to poison the software supply chain. Recommended defenses include enforcing strict IDE trust policies, deploying attack surface reduction rules to constrain risky script execution behaviors, and prioritizing visibility into unexpected Node.js execution patterns and anomalous outbound connections from developer endpoints.
The Blast Radius Problem: Stolen Credentials Are Weaponizing Agentic AI

www.securityweek.com · 5 months ago

A 2025 threat index tracking 400,000 vulnerabilities found that 56 percent required no authentication before exploitation and identified 300,000 ChatGPT credentials on the dark web, likely stolen by infostealers. Attackers are using artificial intelligence to discover weak access points, craft convincing deepfakes, run immediate scams, and, if they obtain API keys for agentic AI, expand the blast radius of a compromise from data theft to potential control of systems. The index also reports a fourfold increase in supply chain and third party breaches over five years and warns that stronger access controls, visibility into exposed credentials, and mapping of critical assets and dependencies are needed to prevent cascading compromises.
One Identity Appoints Michael Henricks as Chief Financial and Operating Officer

gbhackers.com · 5 months ago

One Identity has appointed Michael Henricks as Chief Financial and Operating Officer effective February 25, 2026. Henricks brings more than 30 years of experience in technology, business services, and financial services and most recently served as Chief Executive Officer and previously Chief Financial Officer at Momentive Software, and his remit will extend beyond traditional CFO duties to strategic planning and operational-financial integration. He will oversee global finance operations, financial planning, and operational efficiency as One Identity scales to support more than 11,000 organizations and over 500 million identities while maintaining a reported 97 percent customer satisfaction rate.