Blahalla

Google Releases Emergency Chrome Patch Addressing Three Major Security Flaws

gbhackers.com · 5 months ago

Google has released an emergency update for Chrome, addressing three high-severity security vulnerabilities affecting Windows, Mac, and Linux users. One vulnerability involves an out-of-bounds read error in the Media component, while another is a more dangerous out-of-bounds read and write issue in the Tint component. A third flaw involves an inappropriate implementation within Chrome’s DevTools. These vulnerabilities are CVE-2026-3061, CVE-2026-3062, and CVE-2026-3063.

OT-Security: Warum der Blick auf Open Source lohnt

www.csoonline.com · 5 months ago

false

Russian group uses AI to exploit weakly-protected Fortinet firewalls, says Amazon

www.csoonline.com · 5 months ago

A Russian-speaking threat actor used commercial generative AI services to compromise over 600 Fortinet Fortigate firewalls across more than 55 countries between January 11 and February 18. The attackers exploited exposed management ports and weak credentials, bypassing basic security measures. They successfully compromised Active Directory, extracted credentials, and targeted backup infrastructure, demonstrating that AI amplifies the impact of attacks even by less-skilled actors. Experts emphasize the importance of implementing fundamental cybersecurity practices such as multifactor authentication and network segmentation to defend against such threats.

Android mental health apps with 14.7M installs filled with security flaws

www.bleepingcomputer.com · 5 months ago

Security researchers have identified significant vulnerabilities in ten mental health mobile applications with over 14.7 million combined downloads. These apps, which assist users with conditions like depression and anxiety, contain a total of 1,575 security flaws, including 54 rated as high-severity. Vulnerabilities include improper data validation, insecure data storage, and the use of weak encryption methods, potentially exposing sensitive therapy records. Several apps also lack root detection, increasing the risk of data compromise on compromised devices.

Pentagon Summons Anthropic Chief in Dispute Over A.I. Limits

www.nytimes.com · 5 months ago

false

Anthropic Accuses 3 Chinese Companies of Harvesting Its Data

www.nytimes.com · 5 months ago

Anthropic, a San Francisco based artificial intelligence start-up, alleges that three Chinese companies improperly obtained data from its Claude chatbot. DeepSeek, Moonshot, and MiniMax reportedly used approximately 24,000 fraudulent accounts to generate over 16 million conversations. This data was then used to train their own chatbots, violating Anthropic's terms of service. Similar accusations have been made against DeepSeek by OpenAI, raising national security concerns about China’s development of artificial intelligence technologies.

Spitting Cash: ATM Jackpotting Attacks Surged in 2025

www.darkreading.com · 5 months ago

ATM jackpotting attacks surged in 2025, resulting in over $20 million in losses for banks nationwide. Federal authorities have indicted 93 individuals, including members of the Tren de Aragua group, for deploying malware to manipulate ATMs and steal cash. The malware, often Ploutus, exploits vulnerabilities in the eXtensions for Financial Services (XFS) software layer, allowing attackers to bypass bank authorization. Security experts attribute the rise in attacks to outdated systems, weak physical security, and readily available tools and information.

More Than Dashboards: AI Decisions Must Be Provable

www.darkreading.com · 5 months ago

false

Spain arrests suspected hacktivists for DDoSing govt sites

www.bleepingcomputer.com · 5 months ago

Spanish authorities have arrested four alleged members of the hacktivist group Anonymous Fénix for conducting distributed denial-of-service attacks against government ministries, political parties, and public institutions. The group targeted sites in Spain and South America, with activity peaking after floods in Valencia. Members used social media platforms to spread anti-government messages and recruit volunteers. Authorities seized accounts on X and YouTube and shut down a Telegram channel following the arrests.

Microsoft Copilot Ignored Sensitivity Labels, Processed Confidential Emails

www.techrepublic.com · 5 months ago

Microsoft 365 Copilot improperly processed and summarized confidential emails, including legal memos, business agreements, and protected health information, despite configured sensitivity labels and data loss prevention policies. A code error in the “Work” tab allowed the AI to access emails from users’ Sent Items and Drafts folders, bypassing intended restrictions. This incident highlights a lack of independent AI governance controls, where all security measures resided within the same platform as the AI, creating a single point of failure. Organizations potentially face breach notification obligations under HIPAA and GDPR due to the incident.

Iran's MuddyWater Targets Orgs With Fresh Malware as Tensions Mount

www.darkreading.com · 5 months ago

Iran’s MuddyWater threat group is conducting a new cyber campaign, Operation Olalampo, targeting organizations in the Middle East and Africa. The campaign uses spear-phishing emails to deliver custom malware, including the Char backdoor controlled by a Telegram bot and the GhostFetch downloader. Researchers observed the use of artificial intelligence in the malware’s development, including debug strings containing emojis. MuddyWater, also known as TA450, has been steadily evolving its tactics and demonstrates continued dedication to expanding operations.

Binance Employees Find $1.7 Billion in Crypto Was Sent to Iranian Entities

www.nytimes.com · 5 months ago

Internal investigators at Binance discovered that more than 1,500 accounts on the platform were accessed by individuals in Iran over the past year. Approximately $1.7 billion flowed from Binance accounts to Iranian entities linked to terrorist groups, potentially violating global sanctions. Following the discovery, four employees involved in the investigation were fired or suspended, citing protocol violations. These findings emerged months before the founder of Binance received a pardon, raising questions about the company’s efforts to combat illegal activity.

Enigma Cipher Device Still Holds Secrets for Cyber Pros

www.darkreading.com · 5 months ago

The Enigma cipher machine, initially designed for businesses, was later adopted by Nazi Germany to protect communications during World War II. Polish cryptographers initially broke the code in 1932, sharing the information with British Intelligence before the war. The device's history highlights the dangers of overconfidence, a lack of security testing, and vulnerabilities created by user error. Cybersecurity professionals can learn valuable lessons about supply chain risks and the importance of proactive security measures from the Enigma’s story.

UK regulator fines porn company $1.8 million for failing to verify user ages

therecord.media · 5 months ago

British regulators have fined the porn company 8579 LLC £1.35 million, or $1.82 million, for failing to verify user ages. The Online Safety Act requires sites hosting pornography to implement rigorous age assurance methods, including photo ID and credit card checks. Ofcom is imposing a daily penalty of £1,000 for each day the company lacks an effective system. The regulator also issued a separate £50,000 fine for failing to respond to information requests.

Conduent Breach Surges to Over 25M, Could Be Largest in US History

www.techrepublic.com · 5 months ago

A data breach at government IT contractor Conduent has impacted an estimated 25 million Americans, potentially making it the largest in US history. The breach, discovered in January 2025, involved sensitive information like Social Security numbers, medical records, and health insurance details, affecting residents in multiple states including Texas and Oregon. Conduent is facing lawsuits for failing to adequately protect data and delayed notification, reporting a 25 million dollar charge related to breach notification. The company claims to have secured its networks and is working with law enforcement, but the full scope of the exposure remains under investigation.

APT28 Targeted European Entities Using Webhook-Based Macro Malware

thehackernews.com · 5 months ago

A Russia-linked threat actor, known as APT28, has launched a campaign called Operation MacroMaze, targeting European entities between September 2025 and January 2026. The attacks begin with spear-phishing emails containing documents with malicious macros that act as a beacon, alerting the attacker when opened. Subsequent payloads are delivered via Visual Basic Script and batch scripts, utilizing techniques like keyboard simulation and headless browser execution to evade detection. Data exfiltration is accomplished through Microsoft Edge, using standard HTML functionality to minimize detectable artifacts.

Microsoft says bug in classic Outlook hides the mouse pointer

www.bleepingcomputer.com · 5 months ago

Microsoft is investigating an issue impacting the classic Outlook desktop client where the mouse pointer disappears for some users. The problem, also affecting some OneNote and Microsoft 365 app users, makes the application difficult to use. Temporary workarounds include clicking emails, switching to PowerPoint and returning, or restarting the computer. Microsoft is asking administrators to submit diagnostic data to assist in resolving the problem.

600+ FortiGate Devices Hacked by AI-Armed Amateur

www.darkreading.com · 5 months ago

A financially motivated threat actor, believed to be based in Russia, has compromised over 600 FortiGate firewall instances across more than 55 countries. The attacker, lacking advanced technical skills, utilized generative AI tools throughout the operation, exploiting exposed management ports and weak credentials, including single-factor authentication. The attacker targeted Veeam Backup & Replication servers to steal credentials and compromise recovery capabilities, and moved on to easier targets when encountering resistance. Organizations are advised to restrict internet access to management interfaces, change default credentials, implement multi-factor authentication, and monitor for suspicious activity.

Backed by Anthropic, a Super PAC Group Begins an Ad Blitz in Support of A.I. Regulation

www.nytimes.com · 5 months ago

A new advertising campaign is urging New Jersey residents to contact their representatives regarding artificial intelligence regulation. The ads warn that Congress could leave people vulnerable to A.I.-related harm and oppose a bill blocking state protections against A.I. scams. The campaign, costing $300,000, is funded by Public First Action, a super PAC backed by the A.I. start-up Anthropic, which supports strict A.I. regulation. This effort reflects a growing political conflict over A.I. policy before the midterm elections.

Ad tech firm Optimizely confirms data breach after vishing attack

www.bleepingcomputer.com · 5 months ago

Ad tech firm Optimizely recently experienced a data breach resulting from a voice phishing attack. Threat actors gained access to Optimizely's systems and stole basic business contact information, but were unable to escalate privileges or access sensitive data. The company suspects the attackers are linked to the ShinyHunters extortion operation, which has targeted numerous other organizations using similar tactics. Optimizely is warning customers to be cautious of potential follow-up phishing attempts leveraging the stolen data.

Another exposed Supabase DB strikes: 20k+ attendees and FULL write access

obaid.wtf · 5 months ago

The Arts Council of Pakistan Karachi experienced a significant data exposure due to a publicly accessible Supabase database. This database contained personal information of over 20,000 attendees, including names, email addresses, phone numbers, and payment details. The vulnerability stemmed from intentionally disabled Row-Level Security and a publicly exposed API key, which had been present since September 2025. The exposed data could be exploited for scams, unauthorized ticket access, or sale on anonymous forums. The vulnerability has been mitigated by replacing the data with a synthetic dataset, and the Arts Council has been notified.

Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb

thehackernews.com · 5 months ago

Cybersecurity researchers have identified a new cryptojacking campaign utilizing social engineering to distribute malware-laced software bundles. The malware, which mines Monero using the XMRig miner, demonstrates worm-like capabilities by spreading through removable media and employs a logic bomb set to deactivate on December 23, 2025. The attackers leveraged a legitimate Windows driver using a Bring Your Own Vulnerable Driver technique, exploiting CVE-2020-14979 to enhance mining performance. A separate report indicates attackers are using a large language model to generate exploits targeting the React2Shell vulnerability, CVE-2025-55182.

Russian-speaking hackers used gen AI tools to compromise 600 firewalls, Amazon says

therecord.media · 5 months ago

A Russian-speaking hacking group compromised over 600 Fortinet FortiGate firewall devices in more than 55 countries earlier this year. The attackers used commercial generative AI tools to automate tasks and generate attack plans, allowing a group with low to medium skills to operate at a large scale. The campaign exploited weak security configurations and exposed administrative access points on the firewalls to steal device configurations and potentially prepare for ransomware attacks. Researchers noted the attackers’ reliance on AI-generated code often failed when encountering basic defenses.

Air Côte d'Ivoire confirms cyberattack following ransomware claims

therecord.media · 5 months ago

Air Côte d’Ivoire confirmed a cyberattack that began February 8, impacting parts of its information system. The INC ransomware gang claims to have stolen 208 GB of data and demanded a ransom, which has not been paid. Authorities in France, Côte d’Ivoire, and international experts are investigating the incident and working to mitigate the potential consequences for passengers, employees, and service providers. The INC ransomware gang has previously targeted government entities and airlines worldwide.

Global data protection authorities warn generative AI companies against replicating real people

therecord.media · 5 months ago

Data protection authorities from 61 countries have issued a warning to organizations developing generative AI systems. The warning addresses concerns about the creation of realistic images and videos depicting identifiable individuals without their consent. Recent incidents, including Grok AI generating nonconsensual images, prompted the action. Regulators are urging companies to implement safeguards against the creation of harmful content, including defamatory depictions and nonconsensual intimate imagery, and face potential fines and service blocking for noncompliance.

How likely is a man-in-the-middle attack?

www.certkit.io · 5 months ago

Adversary in the middle attacks account for less than four percent of incidents in the Verizon 2025 Data Breach Investigations Report, and most of those are real time phishing proxies such as Evilginx rather than network interception using stolen TLS private keys. Credential abuse represents twenty two percent of incidents, ransomware forty four percent, and phishing sixteen percent. Because modern TLS deployments use forward secrecy, a stolen private key cannot decrypt recorded past sessions for the vast majority of connections, about ninety four percent of the web, though a stolen key can still allow targeted impersonation if the attacker can get in the middle. In practice the main risks are endpoint compromises, DNS and BGP hijacks, and malicious pre installed root certificates, so organizations should focus security budgets on credential hygiene, endpoint protection, phishing defenses and ransomware preparedness while still encrypting and rotating keys and using short lived certificates.

Over 200K Australian Driver’s Licences Exposed in youX Cyber Breach

www.techrepublic.com · 5 months ago

A data breach at the Australian fintech platform youX has exposed sensitive borrower information, including over 200,000 driver’s license numbers. The attacker claims to have exfiltrated data from nearly 444,538 individuals, including names, addresses, loan applications, and financial records. The compromised data originated from around 800 broker organizations and more than 8,000 password hashes were accessed. Authorities are advising affected individuals to change passwords, enable multi-factor authentication, and consider obtaining new driver's license numbers.

US Healthcare Diagnostic Firm Says 140,000 Affected by Data Breach

www.securityweek.com · 5 months ago

A data breach has impacted nearly 140,000 people linked to healthcare diagnostic companies Vikor Scientific, now Vanta Diagnostics, KorPath, and Korgene. The breach originated from Catalyst RCM, a revenue cycle management provider, which experienced a compromise of its secure file management system. Stolen data included names, dates of birth, payment card details, medical information, and health insurance information. The Everest ransomware group claimed responsibility, publishing data allegedly stolen from the affected companies.

People Loved the Dot-Com Boom. The A.I. Boom, Not So Much.

www.nytimes.com · 5 months ago

false

When identity isn’t the weak link, access still is

www.bleepingcomputer.com · 5 months ago

Traditional security models often rely too heavily on identity verification, creating vulnerabilities as employees access systems from diverse devices and locations. Attackers are exploiting these weaknesses by reusing stolen credentials or compromising endpoints, bypassing multi-factor authentication. To improve security, organizations should implement continuous access verification that assesses both user and device conditions after initial authentication. Solutions like Infinipoint enable device-based access controls, self-service remediation, and proportionate enforcement to maintain trust and reduce disruption.

Ukrainian Gets 5 Years in US Prison for Aiding North Korean IT Fraud

www.securityweek.com · 5 months ago

A Ukrainian national has been sentenced to five years in prison for assisting North Korean IT workers in fraudulent activities. He operated a website that sold stolen US identities, enabling the workers to gain employment with US companies and access the financial system. Didenko also arranged for laptop farms to be hosted in multiple states, facilitating the operation. He forfeited over one million four hundred thousand dollars and faces restitution payments exceeding forty six thousand dollars.

GrayCharlie Hacks WordPress Sites, Spreads NetSupport RAT and Stealc Malware

gbhackers.com · 5 months ago

A financially motivated threat actor known as GrayCharlie is compromising WordPress sites to distribute malware. Attackers inject malicious JavaScript that tricks visitors into installing NetSupport RAT, often followed by Stealc and SectopRAT, using fake browser updates or ClickFix social engineering tactics. GrayCharlie operates a large infrastructure on providers like MivoCloud and HZ Hosting Ltd., and has recently targeted US law firms, possibly through a supply-chain compromise involving SMB Team. Security professionals are advised to block associated IP addresses and domains and monitor for suspicious activity.

⚡ Weekly Recap: Double-Tap Skimmers, PromptSpy AI, 30Tbps DDoS, Docker Malware & More

thehackernews.com · 5 months ago

Cybersecurity threats significantly increased in 2025, with a surge in DDoS attacks, malicious bot activity, and e-commerce fraud impacting technology, telecommunications, and financial sectors. Malicious actors are exploiting trusted tools like Docker Hub and npm packages to deploy malware such as njRAT, Pulsar RAT, XWorm, and Prometei, frequently using techniques like process hollowing. Telegram is facing accusations of harboring criminal activity while a tax refund scam resulted in a prison sentence. New security tools are emerging to aid in configuration audits and Cobalt Strike interaction but require careful usage.

Autonomous AI Agents Provide New Class of Supply Chain Attack

www.securityweek.com · 5 months ago

Researchers have identified a new type of supply chain attack leveraging autonomous AI agents. Threat actors are using platforms like Clawhub and Moltbook to distribute malicious AI skills that compromise user data and financial assets. One active attack, involving the "bob-p2p" skill, tricks agents into storing private keys in plaintext and redirecting payments. This new attack class combines supply chain poisoning with social engineering, targeting algorithms instead of humans, and represents a repeatable and scalable threat.

On the Security of Password Managers

www.schneier.com · 5 months ago

New research has uncovered vulnerabilities in popular password managers like Bitwarden, Dashlane, and LastPass. These vulnerabilities allow unauthorized access to data and vaults if an attacker gains control of the server or compromises administrative access. The findings highlight security risks associated with account recovery features and shared vaults. Password Safe, a local encryption tool with no cloud component, is presented as an alternative.

Hacker stiehlt Daten von Tausenden RTL-Mitarbeitern

www.csoonline.com · 5 months ago

A cybercriminal known as LuneBF claims to have stolen data from over 27,000 employees of the RTL Group, a media company. The hacker reportedly accessed the company's intranet site and is offering the data for sale in the darknet, providing a sample of 100 records as proof. Leaked information includes names, email addresses, postal addresses, and phone numbers. Security experts warn of potential phishing attacks and risks to investigative journalists due to the exposed data.

How Exposed Endpoints Increase Risk Across LLM Infrastructure

thehackernews.com · 5 months ago

The increasing use of Large Language Models (LLMs) and their associated infrastructure is expanding the attack surface for cybercriminals. LLM endpoints, often built for rapid development and internal use, frequently lack proper security controls and excessive permissions. Compromised endpoints can provide access to sensitive data, enable automated data exfiltration, and allow abuse of internal tools due to the implicit trust placed in them. Organizations must prioritize endpoint privilege management, adopt zero-trust principles, and regularly rotate credentials to mitigate these risks.

New Arkanix stealer blends rapid Python harvesting with stealthier C++ payloads

www.csoonline.com · 5 months ago

Researchers have discovered a new infostealer called Arkanix, which combines Python and C++ code to maximize its reach and effectiveness. The malware harvests a wide range of data, including credentials, browser data, cryptocurrency, and banking assets, and is offered through a malware-as-a-service model. The Python version gathers broad data while the C++ variant focuses on persistence and post-exploitation actions like collecting RDP connection details and utilizing the ChromElevator browser data extractor. The developers likely leveraged large language models to accelerate development, suggesting a focus on quick financial gain.

Romanian Hacker Pleads Guilty to Selling Access to US State Network

www.securityweek.com · 5 months ago

A Romanian man, Catalin Dragomir, has pleaded guilty to selling unauthorized access to a US state government network. Dragomir gained access to the Oregon emergency management department’s network in 2021, advertised the access for $3,000 in Bitcoin, and provided samples of stolen personal information to a buyer. He is also accused of hacking and selling access to ten other US networks, causing over $250,000 in losses, and faces up to seven years in prison. Dragomir has agreed to pay restitution to his victims and will be sentenced in May.

CISA: Recently patched RoundCube flaws now exploited in attacks

www.bleepingcomputer.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has identified two Roundcube Webmail vulnerabilities as actively exploited and has ordered federal agencies to patch them quickly. These flaws include a critical remote code execution vulnerability, CVE-2025-49113, and a cross-site scripting vulnerability, CVE-2025-68461. Roundcube is a web-based email client commonly used with cPanel, and there are currently over 46,000 instances accessible online. Roundcube vulnerabilities have previously been targeted by hacking groups, including Winter Vivern and APT28.

Hundreds of FortiGate Firewalls Hacked in AI-Powered Attacks: AWS

www.securityweek.com · 5 months ago

Over 600 FortiGate firewall instances have been compromised in a recent attack campaign spanning 55 countries. The threat actor exploited exposed ports and weak credentials, rather than known vulnerabilities, using AI tools to aid in planning, tool generation, and execution. Attackers leveraged open-source tools to extract credentials, move laterally, and target Veeam servers, suggesting preparation for a ransomware attack. AWS attributes the attacks to a financially motivated, Russian-speaking group with moderate technical skills that heavily relies on AI assistance.

I made Mistral believe Donald Trump runs OpenAI, here's how

dadaam.github.io · 5 months ago

There are attacks against Retrieval Augmented Generation where injecting a handful of malicious documents into a knowledge base can make a large language model confidently produce targeted false answers. A study called PoisonedRAG showed that inserting five malicious texts into multi million document datasets produced very high attack success rates across models in both blackbox and whitebox settings, and independent experiments on a custom Wikipedia dataset found Mistral eight billion fell for the attack about seventy five percent of the time while Claude Sonnet four point six resisted most attempts but displayed a novel failure mode. Agentic RAG that allows autonomous agents to act on retrieved data magnifies the threat because poisoning can lead to corpus scale indirect prompt injection across many conversations. Some mitigations exist such as signed only data and RAGForensics, but they are not widely deployed and most organizations remain unprotected.

Have you tried turning it off and on again? On bricking OT devices (part 2)

www.midnightblue.nl · 5 months ago

Researchers have discovered three critical vulnerabilities affecting Ivanti’s Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. These flaws, including a command injection vulnerability and a path traversal vulnerability, could allow an unauthenticated attacker to potentially execute arbitrary code or access sensitive data. Exploitation requires network access to the EPMM server. The vulnerabilities have been assigned CVE identifiers CVE-2024-22060, CVE-2024-22061, and CVE-2024-22062.

Ukraine says cyberattacks on energy grid now used to guide missile strikes

therecord.media · 5 months ago

Ukrainian cybersecurity officials report a shift in Russian cyberattack strategies targeting the nation’s energy grid. Instead of immediate disruption, attackers are now prioritizing intelligence gathering, including mapping facilities and tracking repair efforts. These cyber operations are used to guide missile strikes and assess the effectiveness of previous attacks, reflecting a long-term strategic approach. Sandworm, a Kremlin-linked hacking group, is reportedly involved in this intelligence-gathering shift.

Ransomware gangs advancing Moscow’s geopolitical aims, Romanian cyber chief warns

therecord.media · 5 months ago

Romanian authorities report a rise in ransomware attacks targeting critical infrastructure, potentially linked to Russian geopolitical aims. These attacks, claimed by groups like Qilin and Gentlemen, coincide with Romania’s support for Ukraine and Moldova. Officials estimate that roughly 80% of cyber incidents in Romania are connected to criminal actors with Russian backing. Romania recently signed a memorandum with Ukraine and Moldova to improve regional cybersecurity cooperation in response to ongoing Russian cyber threats.

Recent RoundCube Webmail Vulnerability Exploited in Attacks

www.securityweek.com · 5 months ago

The US cybersecurity agency CISA has issued a warning about active exploitation of RoundCube Webmail vulnerabilities. Specifically, attackers are targeting CVE-2025-49113, a critical remote code execution flaw with a CVSS score of 9.9, and CVE-2025-68461, a high-severity cross-site scripting vulnerability with a CVSS score of 7.2. The vulnerability CVE-2025-49113 allows attackers to inject data into email sessions, while CVE-2025-68461 enables code execution within a user’s browser. Federal agencies are directed to patch these vulnerabilities within three weeks.

Starkiller Phishing Kit Clones Real Login Pages to Evade MFA Protections

gbhackers.com · 5 months ago

A new phishing framework called Starkiller is enabling sophisticated credential theft by proxying real login pages and bypassing multi-factor authentication. The framework, operated by a group called Jinkusu and sold as a commercial service, utilizes a headless Chrome instance and reverse proxy to serve genuine website content while capturing user credentials. Starkiller features URL masking, live session monitoring, and automated alerts, alongside a community forum for support and development. Security experts warn this escalation in phishing infrastructure poses a significant threat, making phishing the dominant initial access vector for modern breaches.

Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers

www.csoonline.com · 5 months ago

Attackers are actively exploiting critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) to gain unauthorized control of mobile device management infrastructure and install persistent backdoors. The vulnerabilities, CVE-2026-1281 and CVE-2026-1340, allow unauthenticated attackers to execute arbitrary code without user credentials. More than 4,400 EPMM instances are currently exposed online, potentially compromising device policies, credentials, and metadata across entire mobile fleets. Ivanti has released emergency patches, but the vulnerabilities stem from unsafe Bash script handling and require reinstallation after software updates.

Mississippi Hospital System Closes All Clinics After Ransomware Attack

www.securityweek.com · 5 months ago

A ransomware attack has forced the University of Mississippi Medical Center to close approximately three dozen clinics and postpone elective procedures. The attack impacted numerous systems, including the electronic health record platform, requiring staff to revert to manual record-keeping. Officials are investigating whether patient data was compromised and are working with the FBI to restore systems. The FBI prioritizes resuming patient care and is assisting in the investigation.

Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

thehackernews.com · 5 months ago

Cybersecurity researchers have identified a widespread supply chain attack, codenamed SANDWORMMODE, leveraging 19 malicious npm packages to steal credentials and cryptocurrency keys. These packages exhibit worm-like propagation and target AI coding assistants by injecting malicious code to harvest API keys from providers like Anthropic and OpenAI. The malware also includes a kill switch and a polymorphic engine to evade detection, and uses a weaponized GitHub Action to harvest CI/CD secrets. Users are advised to remove the listed packages immediately and rotate their tokens and secrets.