Blahalla

SHub Reaper impersonates Apple, Google, and Microsoft in one MacOS attack chain

www.csoonline.com · 5 months ago

A newly disclosed macOS infostealer campaign called SHub Reaper impersonates Apple, Google, and Microsoft at different stages of a single attack chain to trick users into executing malicious AppleScript through Script Editor and evade Terminal paste protections. The attack uses fake Apple security alerts to lure victims into launching Script Editor with pre populated malicious scripts, then performs environment and anti analysis checks, deploys additional payloads, and establishes persistence via LaunchAgents that masquerade as legitimate vendor files. Once active, it harvests browser credentials, password managers, Keychain data, cryptocurrency wallets including MetaMask and Phantom, messaging applications, and user documents. Defensive guidance recommends monitoring unexpected Script Editor and osascript activity and spawned processes, investigating suspicious LaunchAgents and typo squatted domains, and implementing strict web filtering.
GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos

thehackernews.com · 5 months ago

GitHub is investigating unauthorized access to roughly 4,000 internal repositories after threat actor TeamPCP listed the platform’s source code and internal organization data for sale for no less than 50,000 dollars. GitHub says there is currently no evidence of impact to customer information stored outside its internal repositories and will notify customers if any impact is discovered. TeamPCP’s Mini Shai Hulud campaign also compromised the durabletask PyPI package by publishing malicious versions 1.4.1, 1.4.2, and 1.4.3 after obtaining a PyPI token from a compromised GitHub account; the package contains a dropper that fetches a second stage payload and installs a Linux-only infostealer able to harvest cloud credentials, password manager vaults, SSH keys, Docker credentials, VPN configurations, and other secrets. The malware propagates using stolen tokens via AWS SSM and kubectl exec, uses a mechanism that retrieves backup command and control data from public commit messages, and any machine or pipeline that installed an affected package version should be treated as fully compromised.
GitHub hit by a compromised VSCode extension

xcancel.com · 5 months ago

GitHub's internal repositories were breached by a malicious Visual Studio Code extension. Microsoft had previously closed a request to add update cooldowns as not planned but may reconsider the control following the breach. A new request has been opened in the Visual Studio Code project to pursue update cooldowns again.
GraphWorm Malware Abuses Microsoft OneDrive for Stealthy C2 Operations

gbhackers.com · 5 months ago

There is new Webworm activity during 2025 showing a shift from Asian targets to government entities across Europe and activity in South Africa, and the group has introduced a OneDrive based backdoor called GraphWorm that uses the Microsoft Graph API for command and control. GraphWorm creates a unique victim identifier from system attributes, places each victim in a dedicated OneDrive directory with job and result subfolders, encrypts communications with AES 256 CBC and Base64, uses the createUploadSession endpoint for large file exfiltration, and supports proxy configuration to evade monitoring. The actor also deployed EchoCreep using Discord for C2, leveraged custom proxy tools including WormFrp ChainWorm SmuxProxy and WormSocket, abused misconfigured cloud storage and GitHub repositories for staging, and exploited known flaws including CVE-2017-7692 in SquirrelMail for initial access in at least one observed case.
Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack

www.securityweek.com · 5 months ago

There are over 320 NPM packages affected by a fresh Mini Shai Hulud supply chain attack after a maintainer account named atool with access to the antv namespace was compromised and used to publish malicious package versions that propagated to popular downstream packages and CI environments. The install time payload reads GitHub Actions runner memory to extract masked CI CD secrets, harvests credentials from more than 130 file paths covering cloud providers, Kubernetes, HashiCorp Vault, cryptocurrency wallets and developer tools, and exfiltrates stolen data via GitHub repositories and a fallback server while also dropping persistent backdoors and downloading Python code to enable remote execution. Researchers tracked over one thousand malicious package versions across ecosystems with NPM representing the overwhelming majority, and the malware can abuse registry APIs to validate tokens, enumerate and modify packages, add preinstall hooks, bump versions and republish under compromised identities, with additional compromises observed on PyPI and in a GitHub Action and attribution linked to TeamPCP.
Fox Tempest Linked to Malware-Signing Service Abusing Microsoft Artifact Signing

gbhackers.com · 5 months ago

Fox Tempest operated a large scale malware signing as a service that abused Microsoft's Artifact Signing platform to generate fraudulent but valid short lived code signing certificates that made trojanized installers appear trusted. The service created more than one thousand certificates and hundreds of Azure tenants, moved from a web portal to preconfigured virtual machines for customers, and monetized tiered pricing while enabling threat clusters including Vanilla Tempest and Storm variants to distribute payloads such as Rhysida ransomware, the Oyster backdoor, Lumma Stealer, and Vidar infostealer. Microsoft revoked the certificates and disrupted the operation with its Digital Crimes Unit and partners in May 2026, and recommended layered defenses including cloud delivered protection, Safe Links and Safe Attachments, tamper protection, attack surface reduction rules, SmartScreen browser protections, and use of Security Copilot for hunting and response.
Caught Off Guard: Securing AI After It Hits Production

www.securityweek.com · 5 months ago

Enterprises rushing AI projects into production are forcing security teams into reactive mode because security is often left out of early development and successful experiments are moved to production without oversight. To improve readiness, organizations should use data driven discussions to engage application owners, increase security agility to operate across complex hybrid and multi cloud environments, and strengthen operational workflows to integrate AI data and alerts quickly. They should future proof existing application and API security stacks so AI layer protections can be added without rebuilding, practice proactive hygiene including continuous scanning for vulnerabilities and sensitive data exposures, and deploy contextual awareness capabilities to detect runtime attacks, abuse, fraud, and DDoS against the AI layer in near real time. Taken together, these strategic steps can help security teams respond more quickly and appropriately when AI applications are thrust into production with little warning.
Fake Tax Assessment Pages Spread Windows Malware

gbhackers.com · 5 months ago

A campaign tracked as TAXTRIDENT is using fake Indian income tax assessment pages to trick Windows users into downloading ZIP archives or script downloaders that deliver a signed ClientSetup installer or a signed ManageEngine UEMS agent. One delivery path drops a ZIP with a signed ClientSetup executable that creates a hidden client directory, installs services and drivers such as a MANC service and fake svchost processes, writes YTSysConfig configuration files, and opens persistent command and control channels, while alternate paths use an AssessmentOrder.vbs downloader or PHP-named endpoints that return VBScript and stage further payloads. Defenders are advised to hunt for behavioral indicators including script execution from unusual sources, misleading file extensions, unexpected service or driver creation, UAC policy changes, and outbound connections to unknown servers rather than relying solely on file hashes.
Exploit released for new PinTheft Arch Linux root escalation flaw

www.bleepingcomputer.com · 5 months ago

A publicly available proof of concept exploit targets a recently patched Linux local privilege escalation vulnerability named PinTheft and can grant local attackers a root shell on Arch Linux. PinTheft abuses an RDS zerocopy double free that can be converted into a page cache overwrite via iouring fixed buffers and requires the RDS kernel module to be loaded, iouring enabled, a readable SUID root binary, and x8664 support for the payload. Administrators are urged to install the latest kernel updates or mitigate risk by unloading or blacklisting the RDS module, and PinTheft is still awaiting assignment of a CVE identifier for tracking.
Typosquatting Is No Longer a User Problem. It's a Supply Chain Problem

thehackernews.com · 5 months ago

AI-driven typosquatting has shifted from a user problem to a supply chain problem by embedding lookalike domains inside legitimate third-party scripts so attackers can exfiltrate data without any user misstep or server breach. Large language models now generate thousands of convincing domain variants in minutes and full campaign deployment can take under ten minutes, making manual vetting ineffective. Traditional defenses such as firewalls, WAFs, EDR, and content security policies lack visibility into what approved scripts do at runtime, allowing malicious behavior in the browser to go undetected. Effective detection requires runtime behavioral monitoring and deobfuscation that traces what scripts actually access and transmit, with payment and authentication pages as the highest priorities.
Real-World ICS Security Tales From the Trenches

www.securityweek.com · 5 months ago

There are persistent, real-world ICS risks where threat actors establish long-term footholds using undocumented n-day vulnerabilities and attempt lateral movement from IT into OT, necessitating full-scope investigations to remove persistence. Operational errors and misconfigurations have caused live outages and exposures, including a vulnerability scan that stopped turbines, unauthorized contractor software installs at secure facilities, and unpatched systems with default credentials reachable from the internet. Shadow IT, legacy unsupported devices, and ineffective firewall deployments have left thousands of OT devices discoverable and increased attack surface, prompting urgent calls for comprehensive inventories, segmentation, and coordinated remediation.
Tracking TamperedChef Clusters via Certificate and Code Reuse

unit42.paloaltonetworks.com · 5 months ago

There are three distinct TamperedChef style clusters tracked as CL CRI 1089, CL UNK 1090 and CL UNK 1110, accounting for more than four thousand samples and about one hundred unique variants observed since 2023. These threats masquerade as legitimate productivity applications such as PDF editors and calendar apps, are distributed via malvertising and one click downloads, and commonly use valid code signing certificates, frequent binary rebuilds and long dormant periods to evade detection. Operators deliver remote access trojans, information stealers and proxy tooling after activation, and some clusters show vertical integration where the same actors control marketing and code signing. Defenders can link and track these campaigns using certificate reuse, code reuse and infrastructure overlaps, and telemetry shows global distribution with thousands of unique instances.
Virtual Event Today: Threat Detection & Incident Response Summit

www.securityweek.com · 5 months ago

A virtual Threat Detection and Incident Response Summit runs today from 11 AM to 4 PM Eastern Time. Sessions focus on cutting through alert fatigue, leveraging artificial intelligence and unified platforms to accelerate investigations, and applying actionable threat intelligence to improve threat detection and incident response.
GitHub Confirms Hack Impacting 3,800 Internal Repositories

www.securityweek.com · 5 months ago

GitHub confirmed that the TeamPCP hacking group accessed and exfiltrated roughly 3,800 internal repositories after a GitHub employee installed a poisoned VS Code extension. The attackers claimed theft of source code and internal organizations and offered the allegedly stolen data for sale for at least fifty thousand dollars. GitHub rotated critical secrets, prioritized highest-impact credentials, is analyzing logs and monitoring for follow-on activity, and said it will publish a full incident report later. Security researchers warn that VS Code extensions can access all data on a developer machine, making developer workstations a primary target in supply chain attacks.
These 5 charts show how ChatGPT is flooding our lives

www.washingtonpost.com · 5 months ago

There are five clear trends since ChatGPT’s release in late 2022: a surge in e-books, a rise in self‑represented lawsuits, an explosion of AI-generated music, a spike in low-quality scientific papers, and a growing share of AI-written web text. The number of e-books published each week has nearly tripled and by the end of 2025 more than half of new books contained AI-generated text, while in 2025 self-represented litigants made up about 17 percent of federal non-prisoner filings compared with a historical average of 11 percent. Deezer estimates more than 40 percent of new tracks are fully AI-generated, about 75,000 AI songs are uploaded daily, and arXiv tightened its rules in January 2026 after rejection rates climbed from roughly 4 percent to about 10 to 12 percent due to low-quality submissions and fake citations. Recent research by Imperial College London, the Internet Archive and Stanford found that as much as a third of new web content in a given month may be partly or wholly AI-generated.
Congrats, new grads! Welcome to job market hell.

www.washingtonpost.com · 5 months ago

There is mounting evidence that the Class of 2026 with computer science degrees is entering a more precarious job market as artificial intelligence and broader economic shifts have reduced hiring from traditional big technology employers. Data from a leading university show a noticeable drop in the share of new graduates taking jobs at the largest tech firms compared with a few years ago and report a typical starting salary around one hundred forty thousand dollars for recent computer science bachelor recipients, while researchers are divided on how much of the weakness is due to AI versus longer running industry and economic changes. Graduates are responding by widening career searches, pursuing interdisciplinary and hardware focused programs, relying more on internships and networks, and taking roles outside Silicon Valley as health care retail and other sectors seek data and AI skills.
Why some security fixes never reach your vulnerability dashboard

www.csoonline.com · 5 months ago

On April 22, 2026 a trojanized Bitwarden CLI package appeared on npm for roughly 90 minutes, with version 2026.4.0 executing an obfuscated loader that stole AWS, Azure, GCP, GitHub and npm tokens from developer machines that ran npm install. The incident was assigned CVE-2026-42994 nine days later, and CVE identifiers are framed as retroactive incident markers rather than actionable patch instructions, with related identifiers including CVE-2025-68664 in LangChain Core, CVE-2022-23812 for node ipc protestware, and CVE-2020-10148 for the SolarWinds backdoor. Many supply chain campaigns and agentic threats, including a self propagating npm worm from 2025 into 2026 and campaigns that enroll AI agents into third party networks, frequently escape artifact centric tracking because they mutate at runtime, are distributed through informal channels, or are quietly fixed without advisories. Security programs are advised to treat traditional vulnerability dashboards as increasingly incomplete and instead adopt behavioral identifiers, demand registry transparency for takedowns, and push vendors to disclose silent fixes to better cover model mediated and agent related risks.
Pardus Linux Vulnerability Lets Local Attackers Gain Silent Root Access

gbhackers.com · 5 months ago

There is a critical privilege escalation chain tracked as CVE-2026-5140 and rated CVSS 9.3 in the Pardus Linux update mechanism that allows any local unprivileged user to gain full root access without authentication. The chain affects the pardus-update package and combines three flaws: permissive Polkit policies permitting authorization bypass, a CRLF injection in configuration handling that fails to strip carriage return characters, and unsafe handling of attacker controlled APT source paths that let malicious repository files be copied into system sources and used to install packages that grant persistent root. Administrators should enforce admin authentication in Polkit policies, sanitize input to remove both carriage return and newline characters, validate APT source locations to trusted directories, and audit systems for unauthorized sources and unusual privilege escalations.
When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax

blog.doyensec.com · 5 months ago

There is an extended filename syntax in CFITSIO that functions as a mini language and can cause the library to perform complex file, network, and transformation operations when parsing filenames. There are four practical attack primitives demonstrated which include an arbitrary local file copy via the outfile clause that occurs before validation, forced downloads that let CFITSIO fetch remote resources and save them to attacker chosen local paths creating a persistent SSRF gadget, and HTTP request injection by embedding newline characters into filenames to add headers and reach cloud metadata services. There is also a chain that fabricates a minimal FITS image from arbitrary bytes using raw data and image selection features and then exfiltrates local files to a legacy root protocol server. Reproducible demonstrations were provided in a Docker playground, the findings were shared with NASA HEASARC on January 22, 2026, and recommended mitigations include using literal open routines instead of the extended filename syntax, making the feature opt in, sanitizing filenames, and restricting where the feature is used.
FBI warns students and staff that ShinyHunters may come knocking after Canvas breach

www.bitdefender.com · 5 months ago

On May 15, 2026 the FBI's Internet Crime Complaint Center issued an advisory warning that the ShinyHunters extortion gang breached an online learning management system used by educational institutions across the United States. Reporting and company confirmation indicate the platform was Canvas and that Instructure quietly confirmed on May 12, 2026 that it had reached an agreement with the attackers and paid a ransom after receiving digital confirmation of data destruction. The FBI warns extortionists commonly use harassment tactics including threatening texts and phone calls, swatting, false claims of compromising material, and spearphishing using stolen student and staff information, and advises victims not to engage and to await official guidance from their educational institution. Users are urged to enable multi factor authentication, avoid clicking suspicious links or unsolicited attachments, and recognize that ransom payments are likely to incentivize further attacks on learning platforms.
Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit

thehackernews.com · 5 months ago

Microsoft released a mitigation for a BitLocker bypass named YellowKey after its public disclosure. The zero-day is tracked as CVE-2026-45585 with a CVSS score of 6.8 and affects Windows 11 versions 24H2, 25H2, and 26H1 for x64 systems as well as Windows Server 2025 including Server Core. The flaw allows an attacker with physical access to place specially crafted FsTx files on a USB drive or EFI partition, boot into the Windows Recovery Environment, and trigger a shell with unrestricted access by holding the control key, and recommended mitigations include removing the autofstx.exe auto recovery utility from the WinRE BootExecute value after mounting and updating the WinRE image, and switching from TPM only protectors to TPM plus PIN to require a startup PIN.
GitHub confirms breach of 3,800 repos via malicious VSCode extension

www.bleepingcomputer.com · 5 months ago

GitHub confirmed that about 3,800 internal repositories were breached after an employee installed a malicious Visual Studio Code extension, and the extension has been removed and the compromised device secured. The activity appears to have involved exfiltration of internal repositories only, and there is no evidence so far that customer data outside the affected repositories was impacted. The TeamPCP cybercrime group claimed access and advertised roughly 4,000 private repositories for sale for at least fifty thousand dollars, and GitHub said it is continuing incident response and investigation.
Void Botnet Leverages Ethereum for Resilient C2

gbhackers.com · 5 months ago

A newly identified botnet named Void leverages Ethereum smart contracts as a resilient command and control channel, removing reliance on domains or centralized servers and making takedown efforts more difficult. Discovered in March 2026 and attributed to an operator using the alias TheVoidStl, the Rust based malware periodically polls public RPC endpoints every three to five minutes and supports a dual mode architecture that can switch between on chain encrypted commands and a centralized web control panel for near real time tasking. Operators can deploy executables, DLLs, MSI packages, and PowerShell scripts with in memory execution, reverse shell access, reverse proxying, self update and self delete functions, and the platform exposes detailed telemetry for each compromised host. Defenders are advised to prioritize proactive measures such as bot mitigation, behavioral detection, and network traffic analysis because traditional mitigation techniques targeting servers or domains are less effective against blockchain based command and control.
Microsoft shares mitigation for YellowKey Windows zero-day

www.bleepingcomputer.com · 5 months ago

A newly disclosed Windows BitLocker zero day called YellowKey allows access to protected drives and is being tracked as CVE-2026-45585. Exploitation involves placing specially crafted FsTx files on a USB drive or the EFI partition, rebooting into the Windows Recovery Environment, and triggering an unrestricted shell by holding down the CTRL key. Mitigations include removing the autofstx.exe entry from the Session Manager BootExecute registry value and reestablishing BitLocker trust for WinRE, switching BitLocker from TPM only to TPM plus PIN to require a preboot PIN, and enabling Require additional authentication at startup with Configure TPM startup PIN set to require a startup PIN via Intune or Group Policy. The researcher who published the proof of concept previously disclosed other Windows zero days including BlueHammer tracked as CVE-2026-33825.
Interpol's 'Operation Ramz' Pioneers Cross-Region Collabs in Middle East

www.darkreading.com · 5 months ago

There are 13 countries in the MENA region that collaborated with Interpol and cybersecurity firms in a five-month Operation Ramz to investigate cybercrime, identifying nearly 583 suspected cybercriminals and notifying nearly 4,000 victims. Investigations led to the seizure of 53 servers and dozens of cell phones, the arrest of 201 suspects, takedowns of malicious infrastructure including a phishing-as-a-service provider in Algeria, and disruption of an investment fraud ring in Jordan that exploited trafficking victims. Private threat intelligence partners including Group-IB, Kaspersky, the Shadowserver Foundation, Team Cymru, and TrendAI supported the operation, and Interpol described it as the first large-scale cross-region cybercrime collaboration in the Islamic region.
New NGINX Vulnerability Exposes Servers to Malicious Code Execution

gbhackers.com · 5 months ago

A new high severity vulnerability has been disclosed in the NGINX JavaScript module that can allow remote attackers to crash servers and in specific conditions execute arbitrary code on vulnerable systems. The flaw involves the njs module when the js fetch proxy directive is used together with client controlled NGINX variables, enabling exploitation by crafted requests. F5 published a security advisory identified as K000161307 that details the issue and impacted configurations. Administrators are advised to review any use of js fetch proxy with client controlled variables and apply vendor mitigations or updates promptly to prevent crashes or code execution.
Trapdoor Android Ad Fraud Ring Abuses 455 Apps for Fake Clicks

gbhackers.com · 5 months ago

A large-scale Android ad fraud campaign named Trapdoor built an ecosystem of 455 malicious apps and 183 command and control domains that at its peak generated about 659 million bid requests per day and whose associated apps were downloaded more than 24 million times. The operation distributes seemingly legitimate utility apps that install secondary payloads which deploy invisible WebViews loading attacker controlled HTML5 domains and execute scripted tap and swipe gestures from files such as move.txt and click.txt to generate automated ad clicks while abusing mobile install attribution to selectively activate only when installs originate from attacker controlled ad campaigns. To evade detection the campaign checks for rooted devices, debugging environments, and VPN use, employs native code packing, string encryption, code virtualization, and SDK impersonation, and researchers at HUMAN Satori Threat Intelligence have identified and disrupted the operation and deployed advertising security protections although the actors continue to release new apps and rotate infrastructure.
FreePBX Security Flaw Lets Attackers Access User Portals

gbhackers.com · 5 months ago

A critical vulnerability in FreePBX allows unauthenticated attackers to access User Control Panel portals when hard coded template credentials are left unchanged. It is tracked as CVE-2026-46376 with a CVSS v4 base score of 9.1 and stems from hard coded credentials introduced during optional UCP template setup. The issue affects the userman module in FreePBX 16 versions before 16.0.45 and FreePBX 17 versions before 17.0.7 and can be exploited remotely without authentication. Administrators should update to patched versions, change or randomize template credentials, restrict Administrator Control Panel access with VPN or MFA, and limit UCP and ACP exposure using firewall rules.
DevilNFC Malware Traps Android Users in NFC Relay Attacks

gbhackers.com · 5 months ago

DevilNFC is an Android malware family that uses kiosk mode to trap victims during NFC relay attacks and is linked to Spanish-speaking operators while a related family called NFCMultiPay shows Brazilian Portuguese links, signaling a regional shift toward locally developed tooling. A single APK operates as an NFC reader on unrooted victim phones and as a system-level card emulator on rooted attacker devices by hooking NFC communications, locks the device in a full-screen kiosk interface to prompt card taps and PIN entry, and intercepts SMS one-time passwords for real-time exfiltration to attacker servers and Telegram channels. NFCMultiPay uses a Java-only, non-root approach that relies on two devices and a cloud relay, replaces REST polling with MQTT over TCP port 1883 to reduce latency, and both families show signs of AI-assisted development and reuse of open source tools. Observed indicators of compromise include IP addresses 185.203.116.18 and 47.253.167.219, MD5 hashes caa5e8cf3275339d251210072ebe88c2 and 35dd9c3a56e88a39bf6c8fdad46b0398, and the package name com.devilnfc.reader.
Mini Shai-Hulud Attack Hits npm Ecosystem, Compromising Over 600 Packages

gbhackers.com · 5 months ago

A large scale supply chain attack against the npm ecosystem used a new Mini Shai Hulud variant to compromise more than 600 package versions across hundreds of packages, primarily targeting the antv ecosystem during a 27 minute window on May 19, 2026. Attackers forged Sigstore provenance by generating valid Fulcio certificates and Rekor entries with stolen credentials and CI tokens, then executed malware via phantom optional dependencies and obfuscated preinstall payloads that harvest GitHub and npm tokens, cloud credentials, Vault and CI secrets, and modify local project files for persistence. Exfiltration used encrypted channels including session based peer to peer over HTTPS with AES 256 GCM and RSA OAEP and fallback GitHub repositories, and researchers recommend avoiding affected updates, pinning dependencies, disabling install lifecycle scripts, rotating credentials if affected packages were installed on May 19, 2026, and monitoring CI and package publishing activity.
Single-Letter Go Module Typosquat Drops DNS-Based Backdoor

gbhackers.com · 5 months ago

A software supply chain attack targeted Go developers by publishing a single-letter typosquatted module that impersonated the widely trusted shopspring decimal library and preserved normal arithmetic behavior while embedding a stealthy backdoor. The malicious module remained benign for years before a v1.3.3 release on August 19, 2023 introduced an init function that starts a background goroutine which polls a command and control channel via DNS TXT records every five minutes and executes returned text as system commands. Because Go’s module proxy caches published modules indefinitely, the compromised version remains retrievable even after repository removal, creating ongoing risk to builds, CI pipelines, and production systems; impacted projects should audit dependencies, replace the typosquatted module with the legitimate package, rotate credentials, and rebuild environments from trusted sources.
PoC Exploit Released for DirtyDecrypt Linux Kernel Vulnerability

gbhackers.com · 5 months ago

There is a public proof of concept exploit for DirtyDecrypt also called DirtyCBC that turns a theoretical local privilege escalation into a practical copy paste path to root on kernels with RxGK enabled. The bug in rxgkdecryptskb decrypts before verifying the MAC and lacks a proper copy on write guard, allowing attacker controlled ciphertext to be written into aliased page cache pages and to poison readable SUID binaries or privileged files to escalate to root. Affected systems are kernels built with CONFIGRXGK enabled, notably Fedora, Arch Linux and rolling openSUSE builds, and the issue is associated with CVE 2026 31635 while related hardening work is tracked under CVE 2026 43284 and CVE 2026 43500. Mitigations include applying April 2026 and May 10 2026 kernel commits that copy RxRPC packets to avoid in place decrypt, or temporarily unloading and blacklisting esp4 esp6 and rxrpc until patched, plus monitoring for module loads and suspicious UID changing activity.
Hackers Exploit MSHTA to Deploy LummaStealer and Amatera Malware

gbhackers.com · 5 months ago

There is a surge in the abuse of the legacy Microsoft HTML Application Host mshta.exe as a living off the land loader to deliver commodity malware such as LummaStealer and Amatera because MSHTA remains enabled by default in Windows despite Internet Explorer being retired. Attack chains use multi stage fileless techniques where MSHTA fetches remote HTA scripts that execute VBScript or JavaScript and then stage additional payloads via PowerShell WScript or msiexec, with social engineering lures such as fake downloads pirated software clipboard paste CAPTCHA tricks and Discord phishing used to initiate infections. Recommended mitigations include avoiding untrusted or pirated downloads not executing unknown copied commands monitoring mshta.exe command line activity restricting or disabling MSHTA where feasible and deploying layered endpoint detection and behavior monitoring.
We audited 12K n8n templates: most have critical vulnerabilities

blog.aironclaw.com · 5 months ago

A static analysis of 12,750 n8n workflow templates found 34,880 findings including 14 critical and 6,174 high severity, and 716 workflows exposed pre authentication vulnerabilities such as server side request forgery and SQL and NoSQL injection. Six end to end attack chains were reproduced covering SSRF, SQL injection, remote code execution, prompt injection, and unauthenticated webhooks, with examples including a Telegram bot workflow that allowed shell injection and file exfiltration via crafted messages and an email CV parsing workflow that wrote attacker controlled content to the operator filesystem. About 2,488 workflows, roughly 19.5 percent of the corpus, were assessed as immediately exploitable by remote attackers, and pervasive issues included active workflows with no error handling, prompt injection in AI agents, exposed public webhooks, and hardcoded secrets.
GitHub Source Code Reportedly Compromised, TeamPCP Claims Breach

gbhackers.com · 5 months ago

A threat actor group known as TeamPCP claims it breached GitHub internal systems and exfiltrated sensitive source code and proprietary data, and is offering the alleged dataset for sale on underground forums for over fifty thousand dollars. The group says it accessed roughly four thousand private internal repositories and published partial file listings and screenshots as proof, while GitHub has acknowledged the incident, opened an investigation into unauthorized access to internal repositories, and stated it has no evidence so far that customer data outside internal repositories was affected. TeamPCP is tracked as UNC6780 by Google Threat Intelligence Group and has a history of supply chain and CI/CD abuses, including a prior compromise of the Trivy vulnerability scanner tied to CVE-2026-33634, and further updates are expected as GitHub's investigation progresses.
Grafana GitHub Breach Exposes Source Code via TanStack npm Attack

thehackernews.com · 5 months ago

An investigation found no evidence that customer production systems or the Grafana Cloud platform were compromised, and the scope of the incident is limited to Grafana Labs GitHub repositories, which included public and private source code as well as internal operational repositories and business contact names and email addresses. The breach originated from the TanStack npm supply chain attack linked to threat actor TeamPCP and was detected on May 11, 2026 after a stolen GitHub workflow token allowed attackers to download repositories despite Grafana rotating many tokens. Grafana received an extortion demand on May 16, 2026, declined to pay, and has since rotated automation tokens, implemented enhanced monitoring, audited commits for signs of malicious activity, and strengthened its GitHub security posture while reports surfaced that the attackers listed stolen materials for sale.
GitHub investigates internal repositories breach claimed by TeamPCP

www.bleepingcomputer.com · 5 months ago

GitHub is investigating unauthorized access to its internal repositories after the TeamPCP hacker group claimed to have accessed approximately four thousand private code repositories and offered them for sale. GitHub said it currently has no evidence that customer information stored outside the impacted repositories is affected and that affected customers will be alerted through established incident response channels if impact is discovered. TeamPCP posted its claim on a hacking forum demanding at least fifty thousand dollars and said it may leak the data if no buyer is found. The group has been linked to prior supply chain attacks including compromises of the Trivy vulnerability scanner and other developer platforms that led to cascading compromises and widespread malware distribution.
Veilgate - Deception proxy

veilgate.dev · 5 months ago

There is an open source deception reverse proxy called VeilGate designed to defend web targets from autonomous AI pentest agents by avoiding outright blocking and instead observing, challenging, or trapping requests. It provides three modes: observe to score each request, challenge to require proof of work, and trapit to act as a honeypot that feeds fake vulnerabilities. The project was developed because modern AI agents and readily available open source pentest tools can bypass traditional WAF blocking and probe single page applications in both blackbox and greybox assessments.
What It'll Take to Make AI BOMs Usable in a Modern Security Program

www.darkreading.com · 5 months ago

Standards and tools for AI bills of materials are maturing, but most vendors and software teams cannot yet produce AI BOMs and many security teams lack the visibility or processes to consume them. CISOs should start by scoping AI systems to map internal models, embedded AI in purchased software, and training data provenance, and then integrate AI BOM data into asset management, SIEM, and incident response workflows to quickly identify systems using a vulnerable model version. Provenance and cryptographic methods such as checksums, hashes, digital signatures, and attestation are essential because poisoned training data can backdoor models long before deployment, and agencies have recommended these integrity controls. Automating AI BOM generation in CI and CD pipelines and MLOps with cryptographic validation is critical to scale, and early research and tooling show automation can substantially reduce manual oversight while making BOMs machine readable for governance.
Microsoft disrupts malware code-signing service used by ransomware gangs

www.csoonline.com · 5 months ago

Microsoft disrupted the infrastructure behind a large malware code signing service used by ransomware affiliates, seizing the operation, revoking more than 1,000 abused code signing certificates, and taking hundreds of attacker virtual machines offline on Azure. The operation, identified as Fox Tempest, used stolen identities and impersonated organizations to obtain certificates through Azure Artifact Signing and offered malware signing as a service for fees reportedly between five thousand and nine thousand dollars. Researchers linked the service to ransomware affiliates working with gangs such as INC, Qilin, Akira, and Rhysida, and found a variant named Vanilla Tempest used signed fake installers of enterprise software including AnyDesk, Microsoft Teams, PuTTY, and Webex to deliver backdoors, infostealers, and ransomware via SEO poisoning and malvertising. Security experts warned that illicit code signing at scale undermines Windows protections such as SmartScreen by reducing or eliminating download warnings, and that signing is increasingly sold as a modular service within the cybercrime ecosystem.
Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector

www.securityweek.com · 5 months ago

Vulnerability exploitation became the most common access vector for data breaches in 2025, causing 31 percent of breaches while credential abuse accounted for 13 percent, and analysts examined about 31,000 incidents with more than 22,000 confirmed breaches. AI is accelerating the weaponization of known vulnerabilities and shrinking the window for defense from months to hours, while remediation slowed with median full patching rising to 43 days and organizations remediating only 26 percent of entries on the CISA Known Exploited Vulnerabilities catalog. Ransomware featured in 48 percent of confirmed breaches as third party involvement rose to 48 percent of breaches, 62 percent of breaches involved a human element, and widespread shadow use of generative AI and increased employee use of AI raised additional exposure.
SVD-2026-0505: Third-Party Package Updates in Splunk Enterprise - May 2026

advisory.splunk.com · 5 months ago

There are multiple vulnerabilities in third party packages used by Splunk Enterprise that have been remedied in Splunk Enterprise versions 10.2.3, 10.0.6, 9.4.11, 9.3.12 and higher. Upgrades include golang net to version 0.52.0 in the spl2-orchestrator binary, the Go compiler to go1.25.8 in the splunk-edge binary, and the expr lang library to version 1.17.8. Listed CVEs include CVE-2025-68156, CVE-2025-22872, CVE-2025-47911, CVE-2025-58190, CVE-2026-27141, CVE-2025-68121, CVE-2025-61732, CVE-2025-61731 and CVE-2025-61726.
SVD-2026-0516: Third-Party Package Updates in Splunk Add-on for Tomcat App - May 2026

advisory.splunk.com · 5 months ago

Splunk remedied multiple common vulnerabilities in third party packages used by the Splunk Add-on for Tomcat with a release dated May 20, 2026. Apache Log4j was upgraded to version 2.25.3 to address CVE-2025-68161, and Apache Commons Lang was upgraded to version 3.18.0 to address CVE-2025-48924. Operators should upgrade the Splunk Add-on for Tomcat to version 3.3.1 or higher to apply the fixes.
SVD-2026-0515: Third-Party Package Updates in Splunk User Behavior Analytics - May 2026

advisory.splunk.com · 5 months ago

Splunk remedied multiple vulnerabilities in third party packages for Splunk User Behaviour Analytics versions 5.4.5 and higher by upgrading, removing, or patching numerous components. Remediated packages include Apache Spark, jackson mapper and jackson databind, Hive, Apache Parquet Avro, idna, urllib3, requests, setuptools, OpenSSL and compat openssl, redis, postgresql JDBC, H2 Database, protobuf, kubernetes, logback core, axios, xml crypto, multer, Splunk heavy forwarder, selenium, OpenJDK, netty, lz4 java, jose4j, Python, node.js, Apache Tika, docker and containerd components, cri dockerd, underscore js, and others. Addressed CVEs include CVE-2017-15095, CVE-2017-17485, CVE-2017-7525, CVE-2017-7656, CVE-2017-7657, CVE-2017-7658, CVE-2018-11307, CVE-2018-12022, CVE-2018-12023, CVE-2018-14718, CVE-2018-14719, CVE-2018-14720, CVE-2018-14721, CVE-2018-19360, CVE-2018-19361, CVE-2018-19362, CVE-2018-5968, CVE-2018-7489, CVE-2019-0205, CVE-2019-0210, CVE-2019-10172, CVE-2019-12086, CVE-2019-14379, CVE-2019-14439, CVE-2019-14540, CVE-2019-14892, CVE-2019-14893, CVE-2019-16335, CVE-2019-16869, CVE-2019-16942, CVE-2019-16943, CVE-2019-17267, CVE-2019-17531, CVE-2019-20330, CVE-2019-20444, CVE-2019-20445, CVE-2020-10650, CVE-2020-10672, CVE-2020-10673, CVE-2020-11619, CVE-2020-11620, CVE-2020-13949, CVE-2020-14060, CVE-2020-14061, CVE-2020-14062, CVE-2020-14195, CVE-2020-24616, CVE-2020-24750, CVE-2020-25649, CVE-2020-35490, CVE-2020-35491, CVE-2020-36179, CVE-2020-36180, CVE-2020-36181, CVE-2020-36182, CVE-2020-36183, CVE-2020-36184, CVE-2020-36185, CVE-2020-36186, CVE-2020-36187, CVE-2020-36188, CVE-2020-36189, CVE-2020-36518, CVE-2020-36242, CVE-2020-8840, CVE-2020-9546, CVE-2020-9547, CVE-2020-9548, CVE-2021-20190, CVE-2021-28165, CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090, CVE-2021-37136, CVE-2021-37137, CVE-2022-25647, CVE-2022-3171, CVE-2022-3509, CVE-2022-3510, CVE-2022-3996, CVE-2022-40149, CVE-2022-40150, CVE-2022-42003, CVE-2022-42004, CVE-2022-4450, CVE-2022-45868, CVE-2022-46337, CVE-2023-0215, CVE-2023-0216, CVE-2023-0217, CVE-2023-0286, CVE-2023-0401, CVE-2023-1370, CVE-2023-22946, CVE-2023-2976, CVE-2023-34453, CVE-2023-34454, CVE-2023-34455, CVE-2023-3635, CVE-2023-39410, CVE-2023-43642, CVE-2023-44487, CVE-2023-5590, CVE-2024-12797, CVE-2024-1597, CVE-2024-21634, CVE-2024-25638, CVE-2024-29131, CVE-2024-29371, CVE-2024-29857, CVE-2024-35195, CVE-2024-36114, CVE-2024-3651, CVE-2024-37891, CVE-2024-47081, CVE-2024-47561, CVE-2024-5535, CVE-2024-55549, CVE-2025-24855, CVE-2025-27553, CVE-2025-30065, CVE-2025-4565, CVE-2025-46762, CVE-2025-47273, CVE-2025-49146, CVE-2025-49844, CVE-2025-11226, CVE-2025-58057, CVE-2025-7338, CVE-2025-66516, and CVE-2026-25639.
SVD-2026-0508: Third-Party Package Updates in Splunk AppDynamics Analytics Agent - May 2026

advisory.splunk.com · 5 months ago

Splunk remedied multiple high severity vulnerabilities in third party packages used by the Splunk AppDynamics Analytics Agent by issuing upgrades in release 26.4.0 to address the issues. Upgrades include lz4 java to 1.8.1 for CVE-2025-12183; libpng to 1.6.54 for CVE-2025-64505, CVE-2025-64506, CVE-2025-64720, CVE-2025-65018, CVE-2025-66293, CVE-2026-22695, and CVE-2026-22801; OpenJDK to 17.0.18u8 for CVE-2025-53057, CVE-2025-53066, CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, and CVE-2026-21945; elasticsearch to 8.19.9 for CVE-2025-37731, CVE-2025-68384, and CVE-2025-68390; logback core to 1.5.32 for CVE-2024-12798 and CVE-2024-12801; Netty to 4.1.132.Final for CVE-2026-33871 and CVE-2026-33870; and Jetty to 12.1.6 for CVE-2026-1605 and CVE-2025-11143. Customers should upgrade the Splunk AppDynamics Analytics Agent to version 26.4.0 or higher to receive these fixes.
SVD-2026-0512: Third-Party Package Updates in Splunk AppDynamics Private Synthetic Agent (PSA) - May 2026

advisory.splunk.com · 5 months ago

There are multiple remediations in third party packages in Splunk AppDynamics Private Synthetic Agent version 26.4.0 and higher, with upgrades and removals across packages including alpine, axios, chromium, cryptography, openssl, node.js, netty, jetty, OpenJDK, pypdf, pillow, cups, and others. The updates address a large set of CVEs including CVE-2024-27308, CVE-2024-32650, CVE-2025-11143, CVE-2025-11187, CVE-2025-11468, CVE-2025-12084, CVE-2025-13151, CVE-2025-13836, CVE-2025-14174, CVE-2025-15282, CVE-2025-1948, CVE-2025-55130, CVE-2025-55131, CVE-2025-55132, CVE-2025-58436, CVE-2025-58060, CVE-2025-59464, CVE-2025-59465, CVE-2025-59466, CVE-2025-6075, CVE-2025-62718, CVE-2025-64505, CVE-2025-64506, CVE-2025-64720, CVE-2025-66199, CVE-2025-67735, CVE-2025-68160, CVE-2025-69277, CVE-2026-0865, CVE-2026-0965, CVE-2026-0967, CVE-2026-0968, CVE-2026-1225, CVE-2026-1584, CVE-2026-1605, CVE-2026-1861, CVE-2026-21637, CVE-2026-21710, CVE-2026-21712, CVE-2026-21713, CVE-2026-21714, CVE-2026-21715, CVE-2026-21716, CVE-2026-21717, CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945, CVE-2026-22690, CVE-2026-22691, CVE-2026-22732, CVE-2026-22735, CVE-2026-22737, CVE-2026-22795, CVE-2026-22796, CVE-2026-2441, CVE-2026-24515, CVE-2026-24688, CVE-2026-25210, CVE-2026-25541, CVE-2026-25639, CVE-2026-25833, CVE-2026-25834, CVE-2026-25835, CVE-2026-25990, CVE-2026-26007, CVE-2026-2648, CVE-2026-2649, CVE-2026-2650, CVE-2026-2673, CVE-2026-27024, CVE-2026-27025, CVE-2026-27026, CVE-2026-27456, CVE-2026-27628, CVE-2026-27699, CVE-2026-28351, CVE-2026-28804, CVE-2026-3061, CVE-2026-3062, CVE-2026-3063, CVE-2026-32141, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-33055, CVE-2026-33056, CVE-2026-33870, CVE-2026-33871, CVE-2026-34073, CVE-2026-34871, CVE-2026-34872, CVE-2026-34873, CVE-2026-34874, CVE-2026-34875, CVE-2026-34876, CVE-2026-34877, CVE-2026-3536, CVE-2026-3537, CVE-2026-3538, CVE-2026-3539, CVE-2026-3540, CVE-2026-3541, CVE-2026-3542, CVE-2026-3543, CVE-2026-3544, CVE-2026-3545, CVE-2026-3731, CVE-2026-39892, CVE-2026-40175, CVE-2026-40192, CVE-2026-41324, CVE-2026-42308, CVE-2026-42309, CVE-2026-42310, and CVE-2026-42311. Users are advised to upgrade Splunk AppDynamics Private Synthetic Agent to version 26.4.0 or higher to obtain these fixes.
SVD-2026-0504: Denial of Service through coldToFrozen.sh Script in Splunk Enterprise

advisory.splunk.com · 5 months ago

A vulnerability tracked as CVE-2026-20240 allows a low-privileged Splunk user without the admin or power roles to cause a denial of service by exploiting the coldToFrozen.sh script in the splunkarchiver app to rename critical Splunk directories and render instances non functional. The issue is caused by missing input validation that permits arbitrary file paths and affects Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12 and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129. The recommended remediation is to upgrade to the listed fixed releases and, as a mitigation, disable the Splunk Archiver app if frozen bucket archiving is not required.
SVD-2026-0513: Third-Party Package Updates in Splunk AppDynamics Java Agent - May 2026

advisory.splunk.com · 5 months ago

Splunk remedied multiple vulnerabilities in third party packages used by the Splunk AppDynamics Java Agent with the release of version 26.4.0 and later. An upgrade of libarchive to version 3.5.3-9.el97 addresses CVE-2026-5121, CVE-2026-4111, and CVE-2026-4424 and is rated high severity. An upgrade of log4j-core to version 2.25.4 addresses CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480 and is rated medium severity. Users should upgrade the Splunk AppDynamics Java Agent to version 26.4.0 or later.
SVD-2026-0509: Third-Party Package Updates in Splunk AppDynamics Database Agent - May 2026

advisory.splunk.com · 5 months ago

There are multiple vulnerabilities remediated in third party packages for Splunk AppDynamics Database Agent, fixed in version 26.4.0 published on May 20, 2026. Upgrades include openssl to 3.5.6 netty to 4.1.132.Final musl to 1.2.5-r23 openjdk to 17.0.18u8 log4j-core to 2.25.4 and busybox to 1.37.0-r30 to address high and low severity issues. The addressed CVEs are CVE-2025-15467 CVE-2026-28387 CVE-2025-69420 CVE-2025-69421 CVE-2026-2673 CVE-2026-28388 CVE-2026-28389 CVE-2026-28390 CVE-2026-31790 CVE-2025-69419 CVE-2025-11187 CVE-2025-15468 CVE-2025-66199 CVE-2026-31789 CVE-2026-22795 CVE-2026-22796 CVE-2025-68160 CVE-2025-69418 CVE-2026-33871 CVE-2026-33870 CVE-2026-40200 CVE-2026-6042 CVE-2026-21945 CVE-2026-21932 CVE-2026-21933 CVE-2026-21925 CVE-2026-34478 CVE-2026-34480 CVE-2026-34477 CVE-2025-46394 and CVE-2024-58251. Customers are advised to upgrade the Splunk AppDynamics Database Agent to version 26.4.0 or higher.
SVD-2026-0514: Third-Party Package Updates in Splunk AppDynamics Machine Agent - May 2026

advisory.splunk.com · 5 months ago

There are updates to Splunk AppDynamics Machine Agent in version 26.4.0 and higher that remediate multiple vulnerabilities in third party packages. Remediations include upgrades to plexus-utils to address CVE-2025-67030; apache log4j to address CVE-2026-34480, CVE-2026-34477, and CVE-2026-34478; curl to address CVE-2024-11053, CVE-2024-7264, CVE-2024-9681, and CVE-2025-14819; jetty to address CVE-2025-11143 and CVE-2026-1605; logback-core to address CVE-2026-1225; musl to address CVE-2026-40200 and CVE-2026-6042; netty to address CVE-2026-33871, CVE-2025-67735, and CVE-2026-33870; OpenJDK to address CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, and CVE-2026-21945; and OpenSSL upgrades addressing CVE-2024-13176, CVE-2024-41996, CVE-2025-11187, CVE-2025-15467, CVE-2025-15468, CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2025-9232, CVE-2026-22795, and CVE-2026-22796. Users should upgrade to version 26.4.0 or higher to apply the fixes.