Blahalla

CISA Admin Reportedly Exposes AWS GovCloud Credentials in Public GitHub Repository

gbhackers.com · 5 months ago

A contractor-maintained public GitHub repository named Private-CISA exposed administrative AWS GovCloud access keys, plaintext usernames and passwords, internal tokens, and credentials for CISA development infrastructure, with researchers disclosing the exposure on May 15, 2026. The repository, created November 13, 2025, showed disabled secret scanning and poor repository hygiene, and some of the exposed AWS credentials were reportedly still valid and granted high-level access when tested. Keys reportedly remained active for up to 48 hours after removal, raising concerns about lateral movement, supply chain injection, and privilege escalation, and CISA says it is investigating with no evidence to date of systems compromise.
Microsoft to Retire Teams Together Mode to Improve Performance

gbhackers.com · 5 months ago

Microsoft will retire the Together mode feature in Microsoft Teams effective June 30, 2026. Product Manager Katarina Tranker confirmed on the Microsoft 365 Insider blog that Teams will shift to simplified meeting layouts designed to improve performance, usability, and consistency across devices. The change is intended to streamline meeting experiences and prioritize cross device performance improvements.
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials

thehackernews.com · 5 months ago

Threat actors compromised the popular GitHub Actions workflow actions-cool/issues-helper and moved every existing tag to point to an imposter commit that injects malicious code to harvest CI and CD credentials and exfiltrate them to an attacker-controlled server. The imposter commit downloads the Bun JavaScript runtime, reads memory from the GitHub Actions Runner.Worker process to extract secrets, and makes outbound HTTPS calls to an attacker-controlled domain to transmit the stolen data. Fifteen tags for a second action, actions-cool/maintain-one-comment, were also poisoned, GitHub has disabled access to the repository, and the exfiltration domain was observed in the Mini Shai-Hulud campaign, suggesting the activity may be related. Workflows that reference these actions by tag are at risk on their next run, while workflows pinned to a known-good full commit SHA are unaffected.
SEPPmail Gateway Flaws Expose Organizations to RCE and Email Traffic Interception

gbhackers.com · 5 months ago

There are multiple critical vulnerabilities in the SEPPmail Secure E Mail Gateway that can lead to remote code execution and interception of sensitive email traffic, putting widely deployed appliances at risk especially in the DACH region. The flaws include CVE 2026 2743 which allows pre authenticated remote code execution via arbitrary file write in the Large File Transfer feature, CVE 2026 7864 for sensitive information exposure through an unauthenticated debug endpoint, CVE 2026 44127 for local file inclusion to read arbitrary files, and CVE 2026 44128 for unauthenticated remote code execution via Perl code injection in the GINA v2 interface. Demonstrations show attacks chaining path traversal in file uploads to overwrite system logging configuration and trigger a reverse shell, and injecting Perl into the GINA interface to execute commands, resulting in full gateway compromise, email decryption, credential access, and persistent backdoors. Organizations are advised to upgrade to patched versions 15.0.2.1 15.0.3 or 15.0.4 or later, disable unused features such as LFT and GINA v2, restrict external access to management and API endpoints, and monitor logs for unusual file writes or API activity.
Mythos Preview Automates PoC Exploit Creation for Vulnerability Research

gbhackers.com · 5 months ago

The Mythos Preview model from Anthropic, evaluated by Cloudflare under Project Glasswing, can automatically construct working proof of concept exploits by chaining multiple low severity bugs into a single high severity attack chain. There are two key capabilities: exploit chain construction that reasons about combining attack primitives such as use after free and return oriented programming into multi stage exploits, and automated proof generation where the model writes exploit code, compiles and runs it in a sandbox, reads output, and iterates until successful. Cloudflare observed the model operated without standard safety restrictions in the research environment and produced inconsistent organic refusals, warning that these emergent guardrails are not sufficient and that public releases will require externally enforced safeguards. While the capability can reduce speculative findings and speed triage when paired with a working PoC, the same automation could accelerate offensive operations, and Cloudflare said all discoveries in the project were triaged and remediated under its vulnerability management process.
Compromised Nx Console VS Code Extension Steals Developer and Cloud Secrets

gbhackers.com · 5 months ago

A malicious build of the Nx Console VS Code extension nrwl.angular-console v18.95.0 was published to the Visual Studio Code Marketplace on May 18, 2026 and, while live for roughly eleven minutes, executed a hidden task that fetched a 498 kilobyte obfuscated payload from an orphan commit, immediately risking widespread compromise due to auto‑updates and frequent installs. The payload is a multi‑stage credential stealer and supply chain poisoning toolkit that hunts for secrets across GitHub, npm, AWS, HashiCorp Vault, Kubernetes, 1Password, filesystem and memory, integrates with Sigstore to produce forged provenance for signed npm packages, and explicitly targets AI coding assistant credentials stored by Claude Code. It daemonizes for persistence, exfiltrates harvested secrets via encrypted HTTPS, GitHub API abuse and DNS tunneling, and on macOS drops a Python backdoor that registers a LaunchAgent to poll GitHub using signed commit messages as a dead‑drop command and control channel. Anyone who installed v18.95.0 should assume full compromise and immediately remove the extension, rotate exposed tokens and keys, audit npm publishing logs for suspicious signed releases, and hunt for the macOS LaunchAgent and dropped backdoor while tightening token governance and monitoring for anomalous Sigstore and OIDC activity.
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account

thehackernews.com · 5 months ago

Cybersecurity researchers have uncovered a software supply chain attack that used a compromised npm maintainer account named atool to push trojanized versions to hundreds of packages in the AntV ecosystem and related projects, including the echarts for react wrapper which sees about 1.1 million weekly downloads. The attacker published 639 malicious versions across 323 unique packages, including 558 versions across 279 AntV packages, embedding a stealer that harvests more than 20 credential types such as cloud provider keys, GitHub and npm tokens, SSH keys and database connection strings, and that attempts Docker container escape before compressing, encrypting and exfiltrating the data. The campaign employs automated npm propagation that validates stolen tokens, downloads package tarballs, injects payloads and preinstall hooks, increments versions and republishes under the compromised identity, and security firms link the tradecraft to the Mini Shai Hulud campaign and a financially motivated actor called TeamPCP whose open sourced framework has spawned copycat packages and further spread.
SIEM-Kaufratgeber

www.csoonline.com · 5 months ago

Die kontextuellen Daten, die SIEM-Lösungen liefern, sind eine grundlegende Komponente moderner Security-Stacks. PeopleImages.com, Yuri A | shutterstock.com Protokoll-Daten zu auditieren, zu überprüfen und zu managen, ist alles andere als eine glamouröse Aufgabe, aber ein entscheidender Aspekt, um ein sicheres Unternehmensnetzwerk aufzubauen. Schließlich schaffen Event Logs oft eine sekundäre Angriffsfläche für Cyberkriminelle, die damit ihre Aktivitäten verschleiern wollen. Vorgängen wie diesen treten Netzwerksicherheitsexperten mit Tools aus dem Bereich Security Information and Event Management (SIEM) entgegen: Diese Werkzeuge bieten im Regelfall einen zusätzlichen Schutzschirm für Logs, indem sie sie auf einen Server oder Service auslagern und so verhindern, dass sie manipuliert oder gelöscht werden. In diesem Ratgeber lesen Sie: welche Kriterien bei SIEM-Tools wichtig sind, was bei diesen Lösungen mit Blick auf die Kosten zu beachten ist, und welche SIEM-Anbieter und -Lösungen führend sind. Das richtige SIEM-Tool auswählen Eine passende SIEM-Lösung auszuwählen, ist essenziell, um geschäftskritische Systeme und Dienste zu überwachen. Aber auch, um: Daten für Authentifizierungszwecke bereitzustellen, die Threat Detection zu unterstützen, und SOAR -Plattformen Kontext zu liefern. Die folgenden Bereiche, beziehungsweise Kriterien, sollten Sie mit Blick auf SIEM-Angebote unbedingt vor einem Kauf durchdenken. Betriebsmodell Um Funktionen schneller zu iterieren und hinzuzufügen, steht das Gros moderner SIEM-Lösungen inzwischen in einem Software-as-a-Service ( SaaS )-Modell zur Verfügung. Die unendliche Kapazität der Cloud erleichtert es den Anbietern dabei auch, Machine-Learning ( ML )-Funktionen zu integrieren, die Referenzdaten in rauen Mengen benötigen, um Anomalien erkennen zu können. Es besteht grundsätzlich Einigkeit darüber, dass der SaaS-Ansatz dazu beigetragen hat, SIEM-Lösungen voranzubringen. Dennoch sind einige Unternehmen darauf angewiesen, SIEM-Tools On-Premises zu betreiben. In der Regel, weil sie Compliance-Vorschriften einhalten und in diesem Zuge Protokolle (und die damit zusammenhängenden Daten) in ihrer lokalen Infrastruktur vorhalten müssen. Deshalb gibt es immer noch einige SIEM-Optionen für den Einsatz vor Ort, darunter auch solide Open-Source -Lösungen. Analytics Eine SIEM-Lösung ist nur so gut wie die Informationen, die sie liefert: Log- und Event-Daten aus der Infrastruktur zu sammeln, ist nutzlos, wenn es nicht dazu beiträgt, Probleme zu erkennen und informierte(re) Entscheidungen zu treffen. Deswegen setzen moderne SIEM-Systeme auf Machine Learning, um Anomalien in Echtzeit zu erkennen und ein präzises Frühwarnsystem für potenzielle Angriffe sowie Anwendungs- und Netzwerkfehler zu etablieren. Wie Ihre spezifischen Anforderungen an die Analysefähigkeiten einer SIEM-Lösung aussehen, hängt von mehreren Faktoren ab: Welche Systeme sollen überwacht werden? Welche Skills stehen in der Organisation mit Blick auf Dashboards, Reportings und Untersuchungen zur Verfügung? Haben Sie bereits in eine Analytics-Plattform investiert und möchten diese integrieren? Die Antworten auf diese Fragen können Sie dabei unterstützen, SIEM-Optionen einzugrenzen. Sollten Sie weder auf entsprechende Skills, noch Lösungen zurückgreifen können, empfiehlt sich möglicherweise eine SIEM-Lösung mit einer umfangreichen Dashboard-Bibliothek, beziehungsweise ein Managed Service. Protokolle Wie ein SIEM-System Daten verarbeitet, ist ein weiterer, wichtiger Aspekt mit Praxisbezug. Häufig extrahieren Software-Agenten Protokoll- und Ereignisdaten von Servern und Workstations, während Netzwerkhardware und Cloud-Anwendungen sie über eine Integration oder eine API direkt an das SIEM „übergeben“ können. Eine grundlegende Frage ist in diesem Zusammenhang, ob das SIEM auch wichtige, externe Event-Informationen akkurat identifizieren kann. Im Idealfall sollte das SIEM ausgereift genug sein, um Event-Daten aus den gängigsten Systemen zu parsen und dabei so genau sein, dass keine Anpassungen erforderlich sind und wichtige Details wie Event-Levels oder betroffene Systeme herausgefiltert werden. Um zu vermeiden, dass Log-Einträge nicht korrekt geparst werden, empfiehlt sich zudem eine Lösung, die flexible Möglichkeiten bietet, Event-Daten zu verarbeiten, nachdem sie erfasst wurden. Warnmeldungen Ein wesentlicher Vorteil moderner SIEM-Lösungen ist die Möglichkeit, Systeme in Echtzeit zu überwachen. Allerdings ist das Feature überflüssig, wenn das SIEM selbst, beziehungsweise seine Alerts, nicht von einem menschlichen Experten ausgewertet werden. Mit Blick auf die Warnmeldungen und Benachrichtigungen besteht die Herausforderung vor allem darin, beim Volumen der Alerts Maß zu halten: Zu viele Warnmeldungen werden von den Benutzern entweder deaktiviert oder ignoriert. Zu wenige Alerts bergen die Gefahr, dass kritische Bedrohungen unter den Tisch fallen. Auch mit Blick auf dieses Kriterium empfehlen sich flexible SIEM-Lösungen, die es ermöglichen, Alerts zu konfigurieren, zum Beispiel über Regeln, Schwellenwerte oder verschiedene Warnmethoden (SMS, E-Mail, Push-Nachrichten und Webhooks). Rollenbasierter Zugriff Rollenbasierte Zugriffskontrollen sind für große, weltweit tätige Unternehmen mit unterschiedlichen Business-Segmenten und Applikationsteams unerlässlich. Dabei ist es nicht bloß ein Komfort-Feature, Admins, Entwickler und Datenanalysten nur Zugriff auf die Event-Logs zu gewähren, die sie benötigen. Vielmehr entspricht das dem Least-Privilege-Prinzip, das in einigen Branchen auch regulatorisch durchgesetzt wird. Den Zugriff der Benutzer auf SIEM-Event-Daten beschränken zu können, begrenzt zudem den Impact kompromittierter Konten und trägt letztlich zum Schutz des gesamten Netzwerks bei. Schließlich bieten Event-Daten oft tiefe und detailreiche Einblicke in Applikations- und Service-Funktionalitäten, oder gar die Netzwerkkonfigurationen von Devices. Diese Informationen könnten Cyberkriminelle nutzen, um Systeme auszuspähen und zu infiltrieren. Compliance Diverse, regulatorische Rahmenwerke, beispielsweise die DSGVO oder HIPAA, setzen nicht nur voraus, dass SIEM- oder ähnliche Systeme eingesetzt werden, sondern schreiben teilweise auch vor, wie die Lösung konfiguriert sein sollte. Sie sollten sich deshalb mit den für Ihre Organisation relevanten Anforderungen im Detail vertraut machen. Dabei können unter anderem relevant sein: Aufbewahrungsfristen, Verschlüsselungsanforderungen, digitale Signaturen und Berichtspflichten. Dabei sollten auch mögliche Audit-Elemente nicht unberücksichtigt bleiben: Die SIEM-Lösung Ihrer Wahl sollte die erforderlichen Dokumentationen und Reportings ausgeben können, die die Auditoren zufriedenstellen. Event-Korrelation Die Möglichkeit, Protokolle aus unterschiedlichen (und/oder integrierten) Systemen in einer einzigen Ansicht zu korrelieren, ist ebenfalls ein guter Grund dafür, ein SIEM-System zu implementieren. Dieses sollte in der Lage sein, Log-Events von jeder Anwendungskomponente (Datenbank, Applikationsserver) zu verarbeiten (selbst wenn sie auf mehrere Hosts verteilt sind), und diese in einem Data Stream zu korrelieren. Das macht nachvollziehbar, wie die Events der Komponenten miteinander zusammenhängen. In vielen Fällen können korrelierte Ereignisprotokolle eingesetzt werden, um ( Privilege-Escalation -)Angriffe zu erkennen und ihren Impact über die verschiedenen Netzwerksegmente hinweg zu tracken. Das wird auch deswegen immer wichtiger, weil Unternehmen zunehmend auf die Cloud oder Container-basierte Infrastrukturen setzen. Ökosysteme Ein SIEM mit einem robusten, ausgereiften Ökosystem ermöglicht es, verschiedene Funktionen zu verbessern, beziehungsweise zu erweitern. Wenn das SIEM direkt (oder über Plugins) in andere Systeme integriert werden kann, erleichtert das die Arbeit erheblich. Neben den Systemverbesserungen, die durch ein SIEM-Ökosystem erzielt werden können, gibt es noch weitere Business Benefits. So kann eine moderne, ausgereifte SIEM-Lösung: die Nachfrage nach Schulungen steigern, Support auf Community-Basis fördern, und den Einstellungsprozess vereinheitlichen. API-Interaktion Ein Ökosystem wird nicht allen Anforderungen gerecht: Falls Ihr Unternehmen Software entwickelt oder in DevOps-Initiativen investiert hat, kann die Möglichkeit, programmgesteuert mit einer SIEM-Lösung zu interagieren, einen wesentlichen Unterschied machen. Statt wertvolle Entwicklungszeit in Logging-Funktion zu stecken, kann das SIEM-System Ereignisdaten aus benutzerdefiniertem Code aufnehmen, korrelieren und analysieren. Künstliche Intelligenz (KI) SIEM scheint ein maßgeschneiderter Anwendungsfall für KI-gestützte Analysen, entsprechend scheuen sich die Anbieter nicht, entsprechende Funktionen in ihre Lösungen zu implementieren. Die fokussieren sich im Allgemeinen auf die Bereiche Analytics und Alerts. KI-fähige SIEM-Systeme können mit Cloud-Daten-Feeds einer Vielzahl von Anbietern und Quellen integriert werden. Das ermöglicht, Event-Daten automatisiert mit Kontext auszustatten und dafür zu nutzen, um: Ereignisse zu bewerten, Angriffsketten zu identifizieren und Incident-Response-Pläne zu erstellen. Mit Blick auf KI-fähige SIEM-Lösungen kann auch das Thema Betriebsmodell eine Rolle spielen: Einige On-Premises-Angebote erfordern unter Umständen, KI-Workloads an Cloud-Services auszulagern. SIEM-Kosten Wenn es um Security Information and Event Management geht, sollten Sie den Gürtel nicht unbedingt enger schnallen, schließlich möchte wohl niemand im Angriffsfall am falschen Ende gespart haben. Natürlich sind die Kosten auch im Fall von SIEM-Lösungen ein Faktor, bei der Berechnung gilt es allerdings auf Feinheiten zu achten. SIEM-Lösungen, die in Form eines Cloud-Service angeboten werden, stehen fast immer in einem Abo-Modell zur Verfügung. Dabei können jedoch auch Nutzungsgebühren anfallen, beispielsweise für: das Volumen der Event-Daten oder die Anzahl der überwachten Endpunkte. Achten Sie bei Plattformen, die mit einer Open-Source-Lizenz angeboten werden, zudem auf versteckte Kosten (beispielsweise für Support) und stellen Sie sicher, dass die gewählte Lösung sämtliche relevanten, geschäftlichen Anforderungen erfüllt. Wenn Sie Ihr persönliches SIEM-Kandidatenfeld auf diejenigen eingegrenzt haben, die die benötigten Funktionen bieten, vergleichen Sie die voraussichtlich anfallenden Abonnement- und Nutzungsgebühren im Detail. SIEM-Anbieter & -Lösungen Der Markt für SIEM-Lösungen ist reich an Optionen. Um Ihnen den Einstieg in die Tool-Recherche zu erleichtern, haben wir einige, wichtige SIEM-Anbieter, respektive -Produkte, für Sie zusammengestellt: Datadog Cloud-SIEM ist eine ausgereifte SIEM-Suite, die sämtliche wichtigen Bereiche umfasst und mehr als 800 Integrationen sowie über 350 vorgefertigte Detection-Regeln bietet. Elastic Logstash ist keine echte SIEM-Plattform, das Open-Source-Tool (in erster Linie für die DevOps-Welt konzipiert) ermöglicht es aber, Log-Events aus einer Vielzahl von Quellen zu analysieren und zu verarbeiten. Exabeam LogRhythm SIEM ist einem Zusammenschluss der Sicherheitsanbieter Exabeam und LogRythm entsprungen und zeichnet sich in erster Linie durch ein umfassendes Ökosystem und vorgefertigte Compliance-Frameworks aus. Fortinet FortiSIEM ermöglicht Asset-Erkennung und rollenbasierten Zugriff, sowie User and Entity Behavior Analytics (UEBA), und kann sowohl integriert werden, um Events zu erfassen, als auch, um automatisiert auf diese zu reagieren. Huntress Managed SIEM ist ein solides, modernes Managed SIEM von einem aufstrebenden Anbieter, dessen Analysten und Security Engineers interne Teams entlasten können. IBM QRadar SIEM ist in der Lage, Datenmengen und Funktionen im Enterprise-Format zu bewältigen, verfügt über eine integrierte Analytics-Engine, KI-Funktionen und bietet Support für mehr als 500 Integrationen. LogPoint SIEM & SOAR setzt UEBA für Threat Modeling und Machine Learning ein, unterstützt automatisierte Übersetzungen sowie wichtige Compliance-Standards und korreliert Ereignisse auch mit dem MITRE ATT&CK-Framework. Microsoft Sentinel ist in der Lage, Ereignisse sowohl von lokalen, als auch von Cloud- Ressourcen einzuspeisen, zu korrelieren und zu analysieren, dabei hilft inzwischen auch die KI in Form von Microsofts Security Copilot. OpenText Enterprise Security Manager kann alle Anforderungen an ein Enterprise-SIEM erfüllen, bietet zahlreiche Integrationen mit Drittanbieter-Systemen und umfassenden Support für Automatisierung. NetWitness bietet ebenfalls diverse Enterprise-SIEM-Funktionen, zeichnet sich aber vor allem durch seine integrierten Encryption-Tools aus, die Support für verschlüsselte Event-Daten (oder Netz-Traffic) bieten. SentinelOne Singularity AI SIEM setzt auf State-of-the-Art-Techniken, um Daten zu erfassen und zu filtern, liefert robuste Analysen und verspricht intuitive Automatisierungen. SolarWinds Security Event Manager bietet zwar weder ML-basierte Datenanalysen, noch kann es in Sachen Integrationen mit den anderen hier aufgeführten Optionen mithalten, dafür bietet es USB Device Monitoring und beeindruckende Compliance-Reporting-Fähigkeiten. Splunk bietet seine SIEM-Plattform, die sich insbesondere durch ihr Ökosystem (beziehungsweise ihren App Store) auszeichnet, in zwei Versionen an: Splunk Enterprise für den On-Premises-Einsatz und Splunk Cloud als SaaS-Modell. Trellix Enterprise Security Manager stellt Benutzern umsetzbare Warnmeldungen zur Verfügung und legt den Fokus auf Flexibilität, wenn es um Architektur und Integrationen geht. Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.
Schwachstellen managen: Die besten Vulnerability-Management-Tools

www.csoonline.com · 5 months ago

There are six vulnerability management solutions highlighted as setting new standards: Qualys VMDR, Orca Security, Detectify, Kenna Security Vulnerability Management, Flexera Software Vulnerability Management, and Tenable.io. Qualys VMDR delivers cloud based scanning, passive network discovery and integrated patch deployment across on premises, cloud and endpoints. Orca uses side scanning to map cloud assets and prioritize risk, Detectify focuses on attack surface management with continuous internet facing and application monitoring plus crowdsourced researcher findings, and Kenna aggregates alerts from many scanners and applies real time threat intelligence and risk based SLAs while being part of Cisco. Flexera concentrates on vulnerabilities in third party software and automates patch prioritization and Tenable.io combines active and passive scanning, cloud connectors and machine learning to make vulnerability data actionable for remediation.
Security-Infotainment: Die besten Hacker-Dokus

www.csoonline.com · 5 months ago

Sie fühlen sich leer ohne Security-Dashboard? Diese Dokumentationen überbrücken den Schmerz bis zum nächsten Arbeitstag. Foto: Gorodenkoff, shutterstock.com Wenn Sie in Ihrer Profession als Sicherheitsentscheider voll aufgehen, brauchen Sie möglicherweise auch zwischen den Arbeitstagen ihre tägliche Dosis Cybersecurity. Falls Ihnen die zahlreichen Annäherungen Hollywoods an das Thema viel zu weit von der Realität entfernt sind, können Sie auf ein Füllhorn hochwertiger Dokumentationen zurückgreifen. Die sind nicht nur informativ, (meist) sehr nah an der Realität und unterhaltsam, sondern teilweise auch historisch wertvoll und in einigen Fällen kostenlos in voller Länge verfügbar. Doku-Highlights für Sicherheitsentscheider Nachfolgend haben wir diverse sehenswerte Dokumentationen in Zusammenhang mit Cybersecurity und Hacker-Kultur für Sie zusammengestellt. Viel Spaß! Hackers, Wizards of the Electronic Age (1985) Kurz und knapp: frühe Doku über die Hacker Community unter anderem mit Steve Wozniak kostenlos in voller Länge verfügbar Hackers in Wonderland (2000) Kurz und knapp: porträtiert UK- und US-Hacker beleuchtet Hacktivismus kostenlos in voller Länge verfügbar Secret History of Hacking (2001) Kurz und knapp: fokussiert frühe Hacking-Techniken mit John Draper, Steve Wozniak und Kevin Mitnick kostenlos in voller Länge verfügbar Hackers Are People Too (2008) Kurz und knapp: von Hackern kreiert will mit Stereotypen aufräumen beleuchtet auch die Rolle der Frauen in der Community We Are Legion: The Story of the Hacktivists (2012) Kurz und knapp: beleuchtet das Hacker-Kollektiv Anonymous zahlreiche O-Töne von Mitgliedern und Experten auf diversen Filmfestivals ausgezeichnet DEFCON: The Documentary (2013) Kurz und knapp: stellt das 20-jährige Jubiläum der Hacking-Konferenz DEFCON in den Fokus bis zu dieser Doku herrschte auf der Konferenz striktes Kameraverbot O-Töne von Teilnehmern und Verantwortlichen Citizenfour (2014) Kurz und knapp: thematisiert Edward Snowden und den NSA-Skandal enthält Interviews mit Snowden aus dem Jahr 2013 entstand unter Beteiligung von Glenn Greenwald Digital Amnesia (2014) Kurz und knapp: wirft ein Schlaglicht auf digitale Daten und den Umgang mit diesen mit Beteiligung von Experten des Internet Archive kostenlos in voller Länge verfügbar Deep Web (2015) Kurz und knapp: thematisiert den Darknet-Marktplatz Silk Road beleuchtet dabei auch die Verhaftung und den Prozess von Gründer Ross Ulbricht O-Töne von zahlreichen Beteiligten A Good American (2015) Kurz und knapp: erzählt die Geschichte des Ex-NSA-Direktors Bill Binney klärt auf, wie ein Computerprogramm 9/11 hätte verhindern können Regie führte der Österreicher Friedrich Moser War for the Web (2015) Kurz und knapp: wirft einen Blick auf die physische Infrastruktur hinter dem Internet zeigt, wie Unternehmen und Regierungen hinter den Kulissen um die Vorherrschaft kämpfen beleuchtet dabei auch Fragen wie Data Ownership, Datenschutz und Security Cyber War (2016) Kurz und knapp: zeigt, wie Regierungen im Kampf gegen kriminelle Hacker aufrüsten dabei kommen auch unlautere Mittel wie Spionage zur Sprache viele prominente O-Töne Down the Deep Dark Web (2016) Kurz und knapp: bietet Insider-Einblicke in das Darknet beleuchtet dabei auch legitime Einsatzzwecke will mit Vorurteilen und Stereotypen aufräumen Zero Days (2016) Kurz und knapp: erzählt die Geschichte des Stuxnet-Virus analysiert ausgiebig die Folgen des Angriffs bietet zahlreiche Insider-Einblicke und O-Töne Facebook: Cracking the Code (2017) Kurz und knapp: beleuchtet die Security-Kultur und -Probleme bei Facebook geht dabei auch auf die Nutzung von User-Daten, Ad-Gebahren und Fake News ein zahlreiche O-Töne von Experten Kim Dotcom: Caught in the Web (2017) Kurz und knapp: erzählt die Geschichte von Megaupload-Gründer Kim Schmitz beleuchtet dabei seinen Kampf gegen die US-Regierung und die Entertainment-Branche zahlreiche O-Töne von Beteiligten, auch Kim selbst The Defenders (2018) Kurz und knapp: analysiert vier schlagzeilenträchtige Cyberattacken nimmt dabei die Perspektive der Verteidiger ein produziert vom Sicherheitsanbieter Cybereason The Great Hack (2019) Kurz und knapp: thematisiert den Skandal um Facebook und Cambridge Analytica nimmt dabei die Perspektive verschiedener Beteiligter auf aufwändig produziert HAKMTL (2019) Kurz und knapp: kanadische Hacker stellen die Datenschutz-Versprechen von Unternehmen auf die Probe dabei liegt ein Fokus auf Überwachungstechnologien interessante Insider-Einblicke und O-Töne WannaCry: The Marcus Hutchins Story (2019) Kurz und knapp: erzählt die Geschichte des IT-Experten, der WannaCry durch Zufall stoppte und anschließend in Zusammenhang mit einem Banking-Trojaner verhaftet wurde dabei kommt auch Hutchins selbst zu Wort KnowBe4: The Making of a Unicorn (2020) Kurz und knapp: erzählt die Gründungsgeschichte des Security-Unternehmens KnowBe4 mit Beteiligung von Chief Hacking Officer Kevin Mitnick produziert vom Cybercrime Magazine MY.DOOM: Earth’s Deadliest Computer Viruses (2021) Kurz und knapp: thematisiert den Computervirus MyDoom aus dem Jahr 2004 analysiert dabei auch seine Auswirkungen kostenlos in voller Länge verfügbar Biggest Heist Ever, Der große Bitcoin-Raub (2024) Kurz und knapp: thematisiert den Hackerangriff auf die Hong Konger Kryptobörse Bitfinex aus dem Jahr 2016 beleuchtet den Werdegang von Ilya Lichtenstein und Heather Morgan, die für den Angriff verurteilt wurden diverse O-Töne von Ermittlern, Freunden, Betroffenen, und auch von Ilya Lichtenstein selbst Most Wanted: Teen Hacker (2025) Kurz und knapp: beleuchtet die Cybercrime-Karriere des finnischen Hackers Julius Kivimäki enthält Interviews mit Strafverfolgungsbehörden und Opfern des Cyberkriminellen auch Kivimäki selbst kommt zu Wort Joybubbles (2026) Kurz und knapp: erzählt die Geschichte des blinden Telefonhackers Joe Engressia aus dessen eigener Perspektive ursprünglich als Kickstarter-Projekt gestartet erfolgreiche Premiere auf dem Sundance Film Festival 2026 Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.
New Age of Collisions: Reading Arbitrary Files Pre-Auth as root in cPanel (CVE-2026-29205)

slcyber.io · 5 months ago

There is a pre authentication path traversal in cPanel CalDAV that allows reading arbitrary files as root by abusing the managed attachment GET handler and an ineffective privilege drop, tracked as CVE-2026-29205. The flaw occurs because raw URIs are validated before percent decoding so encoded slashes bypass structural checks, and a temporary ReducedPrivileges object is destroyed before file reads, restoring root privileges. Exploitation requires creating a mailbox directory containing the string -attachment- which can be induced by sending mail to a valid virtual email address using a plus alias so that Dovecot autocreates a Maildir folder, and researchers observed roughly a ten percent success rate when spraying common usernames against exposed cpdavd ports. A patch and advisory have been released, and the research also references a related authentication bypass tracked as CVE-2026-41940 and prior cPanel research CVE-2023-29489.
Dozens of Polymarket Bets Show Signs of Insider Trading, The Times Finds

www.nytimes.com · 5 months ago

There are dozens of long shot bets on Polymarket that have defied the odds, with reporting and data analyses finding recurring patterns of well timed, high value wagers tied to major geopolitical and military events. Federal investigators and prosecutors have opened probes and brought charges, including an indictment in the Southern District of New York accusing a U.S. servicemember of placing bets on a raid he participated in that yielded substantial profits. Independent researchers and watchdog groups report that defense related long shot wagers have paid off far more often than expected, prompting Polymarket to publish enhanced market integrity rules and to deploy new detection tools and analytics partnerships. Lawmakers and regulators are increasing scrutiny of prediction markets and considering new oversight and enforcement measures to prevent the misuse of nonpublic or classified information.
Meta Reassigns 7,000 Employees to Focus on A.I.

www.nytimes.com · 5 months ago

Meta is reallocating about 7,000 employees into new AI-focused roles and cutting some managerial positions as part of an organizational restructuring announced May 18, 2026. The announcement came two days before the company plans to lay off roughly 10 percent of its workforce, or about 8,000 employees, with notifications scheduled for May 20, 2026. Company leaders framed the changes as efforts to improve AI workflows and engineering productivity while funding large increases in compute and infrastructure spending.
After Elon Musk’s Court Loss Comes the Long Hot A.I. Summer

www.nytimes.com · 5 months ago

A federal jury unanimously rejected Elon Musk's lawsuit against OpenAI and Sam Altman, ruling the claims were time barred after a three week trial. The verdict clears OpenAI and its leadership of liability, reducing legal uncertainty that analysts say will ease the company’s path to fundraising and a possible public offering and is expected to accelerate AI development. The trial featured testimony from Musk, Altman and other tech executives and drew protests outside the courthouse, underscoring public concern about the pace and risks of artificial intelligence.
Five Takeaways From the Blockbuster Trial Pitting Elon Musk Against OpenAI

www.nytimes.com · 5 months ago

A jury rejected Elon Musk's lawsuit as time barred after less than two hours of deliberation, concluding he had waited too long to sue. Three weeks of testimony nevertheless produced illuminating details about interactions, decisions, and communications between Mr. Musk and OpenAI. Witness accounts and documents highlighted the early dynamics and disputes that underpinned the legal clash. The verdict underscored the limits on delayed legal claims while revealing substantive context about the disagreement.
How Storm-2949 turned a compromised identity into a cloud-wide breach

www.microsoft.com · 5 months ago

Storm-2949 turned stolen Microsoft Entra ID credentials into a cloud wide breach that exfiltrated data from Microsoft 365 applications and multiple Azure services. The actor used targeted social engineering to abuse the Self Service Password Reset process and trick users into approving multifactor authentication prompts, then used Microsoft Graph API enumeration and privileged Azure role based access control to retrieve App Service publishing profiles, Key Vault secrets, storage account keys and SQL credentials without deploying malware. The threat actor manipulated management plane operations and administrative features such as Kudu, VM Run Command and VM access extensions to execute commands, download large volumes of files and database contents, and remove firewall rules to evade detection.
INTERPOL ‘Operation Ramz’ seizes 53 malware, phishing servers

www.bleepingcomputer.com · 5 months ago

Operation Ramz, coordinated by INTERPOL across 13 Middle East and North Africa countries, led to 201 arrests and identified another 382 suspects. Authorities seized 53 servers used for phishing, malware, and online fraud, recovered nearly 8,000 intelligence packages that revealed at least 3,867 confirmed victims, and disrupted malicious infrastructure. INTERPOL collaborated with private cybersecurity firms including Kaspersky, Group-IB, The Shadowserver Foundation, Team Cymru, and TrendAI, and authorities highlighted cases such as a disabled malware-infected server in Oman, a dismantled investment scam in Jordan involving trafficked workers, and the shutdown of a phishing-as-a-service platform in Algeria.
Is 2026 the Year AI Bills of Materials Get Real?

www.darkreading.com · 5 months ago

AI bills of materials extend traditional software BOMs to catalog models, datasets, training history, licensing, hyperparameters, deployment context, retrieval sources, tool integrations, and governance artifacts so organizations can assess AI behavior and risk. Regulators and standards bodies in the United States, Europe, and the G7 are increasingly requiring or recommending AI BOM elements, and the EU AI Act is scheduled to take effect in August 2026, raising expectations for documentation of high risk systems. Practical adoption remains limited because many organizations lack data lineage and provenance, while rapid growth in model repositories and reports of malicious or backdoored models are expanding the AI attack surface and increasing the urgency for usable AI BOM tooling.
Microsoft Exchange Zero-Day Under Attack, No Patch Available

www.darkreading.com · 5 months ago

A zero day tracked as CVE-2026-42897 stems from a cross site scripting vulnerability that can execute arbitrary JavaScript in Outlook Web Access when a specially crafted email is opened under certain interaction conditions and is being actively exploited. The flaw affects on premises Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition and can allow attackers to access victims' mailboxes and session tokens, read and send email as the victim, and plant forwarding rules that can survive password resets, enabling business email compromise and follow on ransomware. Microsoft assigned the issue a CVSS score of 8.1 while the NIST National Vulnerability Database lists a 6.1 severity, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. Microsoft provided mitigations including enabling the Exchange Emergency Mitigation Service, which is enabled by default for many installations, and an updated on premises mitigation tool while it develops a security update with no timetable for release.
SHub macOS infostealer variant spoofs Apple security updates

www.bleepingcomputer.com · 5 months ago

A new SHub macOS infostealer variant called Reaper uses the applescript URL scheme to open Script Editor with a malicious AppleScript that displays a fake Apple security update referencing XProtectRemediator, downloads and executes a shell payload, and installs a backdoor. It fingerprints hosts for virtual machines and VPNs, skips systems using a Russian keyboard, prompts for the macOS password to access Keychain items, and exfiltrates browser data, cryptocurrency wallet extensions and desktop wallets, password manager extensions, iCloud and Telegram data, developer configuration files, and targeted documents using a Filegrabber with size limits. To evade detection and persist, the malware clears quarantine attributes, uses ad hoc code signing on modified application bundles, injects a malicious app.asar into wallet applications, and registers a LaunchAgent impersonating a Google software update that beacons to command and control and can fetch and execute additional payloads.
'Claw Chain' Vulnerabilities Threaten OpenClaw Deployments

www.darkreading.com · 5 months ago

Four chainable vulnerabilities in the OpenClaw AI agent framework, patched for all versions prior to April 23, 2026, allow attackers to gain initial access, steal credentials, escalate privileges, and establish persistent backdoors. The flaws include CVE-2026-44112 with a CVSS score of 9.6, a time of check time of use race condition in the OpenShell sandbox that enables system configuration modification and persistence; CVE-2026-44115 with a CVSS of 8.8 that exposes API keys and tokens; CVE-2026-44118 with a CVSS of 7.8 that permits privilege escalation via improper session validation; and CVE-2026-44113 with a CVSS of 7.8, another TOCTOU allowing improper access to configuration files and secrets. Security vendor Cyera reported the vulnerabilities, dubbed the Claw Chain, and warned that an attacker can chain them from a single supply chain style foothold such as a malicious plug in, a manipulated prompt, or other external data source and then use the agent's legitimate capabilities to move through credential theft, privilege escalation, and persistence while evading conventional detection. The report urges organizations to apply least privilege, governance, and visibility when deploying agentic AI because OpenClaw requires intrusive access to files, input devices, and services, and earlier OpenClaw bugs have included CVE-2026-25253, CVE-2026-24763, CVE-2026-25157, and CVE-2026-25475.
The quiet death of behavioral anti-bot and the pivot to hardware ZKPs

world.org · 5 months ago

A forensic investigation found that a sophisticated layer seven campaign fully bypassed an industry leading enterprise web application firewall that relied on machine learning based behavioral analysis and cursor entropy. Multimodal large language models can now solve dynamic captchas and convincingly spoof human interaction metrics, driving the adversary cost to generate human like traffic to near zero. As a result, software only anti sybil measures are mathematically ineffective and the root of trust must be anchored in physical hardware. Hardware devices acting as trusted execution environments that process biometric data locally and emit zero knowledge proofs of unique personhood while keeping raw images on device are emerging as the primary mitigation, prompting a projected architectural overhaul for high security endpoints in 2026.
CISA Admin Leaked AWS GovCloud Keys on Github

krebsonsecurity.com · 5 months ago

There was a public GitHub repository named Private-CISA maintained by a contractor that exposed credentials for several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. The archive contained administrative AWS GovCloud keys, plaintext usernames and passwords, tokens, logs, and files detailing how CISA builds, tests and deploys software, as well as access to the agency’s internal artifactory that could enable persistent supply chain compromise. The repository was created on November 13, 2025, was flagged by GitGuardian on May 15, 2026, and was taken offline after notification, yet the exposed AWS keys remained valid for about 48 hours; the maintainer had disabled GitHub secrets detection and used easily guessed passwords. CISA says it is investigating, reports no indication that sensitive data was compromised, and the contractor was associated with Nightwing.
Here’s the latest.

www.nytimes.com · 5 months ago

NULL
Here’s what was on the jury’s list for a decision.

www.nytimes.com · 5 months ago

A nine-member jury in Oakland was given a special verdict form asking whether OpenAI and its founders breached a charitable trust, whether they were unjustly enriched, whether Microsoft aided and abetted a breach, and whether those claims were barred by the applicable statute of limitations. After roughly two hours of deliberation the jurors returned a unanimous advisory verdict that Elon Musk’s claims were time barred, and the judge accepted the advisory verdict and dismissed the case. The three-week trial centered on when donors learned about OpenAI’s shift toward a for-profit affiliate and whether Microsoft’s large investments changed the charity’s course.
Microsoft May security patch fails for some due to boot partition size glitch

www.csoonline.com · 5 months ago

There are Windows 11 devices where the May Security Update fails to install because the EFI System Partition lacks sufficient free space, typically around ten megabytes or less. On affected machines the update can pass initial phases but then fail during the reboot phase at about thirty five to thirty six percent, leaving systems unpatched. Microsoft advised changing a Windows registry setting to force the update or rolling back and waiting for a future fix, while consultants recommended increasing the ESP to about one and a half gigabytes and testing any registry workaround on pilot devices with registry backups. Security and IT experts warned this failure undermines trust in the update process and urged adding ESP free space checks to endpoint health reporting, updating gold images, and treating boot partition cleanup or resizing as routine lifecycle engineering to avoid large-scale exposure.
Shai-Hulud Worm Clones Spread After Code Release

www.darkreading.com · 5 months ago

Shai Hulud source code was published publicly and multiple clones have appeared in NPM packages, indicating the worm is already spreading beyond the original campaign. Clones included a near verbatim copy with replaced command and control endpoints, Axios typosquats, and a distributed denial of service botnet payload, showing attackers can quickly swap C2 and signing keys and mass produce varied infostealer payloads. Researchers warn this represents a new automated supply chain attack paradigm that weaponizes developer identity and the implicit trust in CI CD pipelines, creating populations of variants that evade single signature defenses. Recommended mitigations include blocking lifecycle scripts by default, enforcing a release cooldown, detecting trust downgrades, treating CI CD as an attack surface, rotating credentials on developer workstations and CI runners that touched affected packages, and auditing which dependencies require install time code execution.
What to Know About Elon Musk’s Trial Against OpenAI

www.nytimes.com · 5 months ago

A federal jury in Oakland, California, unanimously rejected Elon Musk's lawsuit against OpenAI and its CEO Sam Altman on May 18, 2026, finding the claims were barred by the statute of limitations after a three week trial. Jurors deliberated for about two hours before returning the verdict, ending a trial that exposed internal disputes over OpenAI's shift from a nonprofit and included testimony from prominent technology figures. The decision removes a major legal cloud over OpenAI, easing uncertainty about its planned public offering and its role in the global race to develop and commercialize advanced artificial intelligence.
Grafana Rejects Ransom Demand After GitHub Breach Exposes Codebase Theft

www.techrepublic.com · 5 months ago

Grafana confirmed that an unauthorized actor used a compromised GitHub access token to access its GitHub environment and download parts of the company codebase. The company says its investigation found no evidence that customer data, personal information, customer systems, or operations were accessed or affected, and it revoked the compromised token and deployed additional security controls. After the theft the actor attempted to extort Grafana, which declined to pay following law enforcement guidance, and no stolen data had been publicly leaked at the time of reporting. Security reporting indicates a relatively new extortion group calling itself CoinbaseCartel has claimed responsibility and experts warn the incident highlights a rise in credential based attacks against developer environments and software supply chains.
5 Steps to Managing Shadow AI Tools Without Slowing Down Employees

www.bleepingcomputer.com · 5 months ago

There are five recommended steps to manage shadow AI tools without slowing employees: build a full inventory, write a practical policy, create a fast lane for new tool requests, use monitoring as a shared safety layer, and make secure behavior easy. Discover which AI tools are running by auditing OAuth connections, scanning browser extensions, checking AI features inside approved vendors, and surveying employees to record who is using what and what data is exposed. Policies should list approved tools, specify data categories that must never be entered into AI, require verified data training opt-outs, and define a short, structured intake with clear evaluation criteria. Browser-native monitoring combined with just-in-time coaching and plain-language training makes the secure choice the easy choice and helps shadow AI usage decline over time.
AudioHijack: adversarial audio attacks on generative voice models transfer from open weights to Microsoft and Mistral production systems

spectrum.ieee.org · 5 months ago

New research shows imperceptible audio manipulations can hijack large audio language models, achieving average success rates between 79 percent and 96 percent and working regardless of the user instructions. The manipulations are shaped to sound like natural reverberation so humans cannot hear them, and adversarial clips developed against open models were found to transfer to commercial systems from Microsoft and Mistral while models from OpenAI and Anthropic were harder to attack. Six attack categories were demonstrated, including refusing user requests, returning false information, inserting malicious links, swapping persona, claiming it cannot process audio, and triggering unauthorized tool use, and attacks can be delivered via poisoned online audio, music, voice notes, transcription feeds, or live voice chats. Common defenses had limited effect, with few shot prompting reducing success by about seven percent and self reflection catching about twenty eight percent, while monitoring internal attention patterns was most effective but can be evaded by reduced attention manipulation.
ShinyHunters Stole 275 Million Student Records. The Ransom Deadline Is May 12.

www.hitechies.com · 5 months ago

A ransomware group called ShinyHunters claims to have stolen data from Canvas, a learning management system used by approximately 275 million students and teachers across 8,809 schools. The breach occurred on April 25, and a ransom deadline of May 12 has been set. The group previously targeted Ticketmaster, Salesforce, and Instructure itself, and threatens to release private messages and student records if their demands are not met. Institutions are advised to change passwords, enable multi-factor authentication, and prepare for potential data publication.
Leaked Shai-Hulud malware fuels new npm infostealer campaign

www.bleepingcomputer.com · 5 months ago

A Shai-Hulud supply chain campaign compromised dozens of TanStack and Mistral AI packages and quickly spread to other projects, publishing at least 84 malicious versions across 42 TanStack packages and affecting hundreds of npm and PyPI packages. The attackers chained a risky pull request target workflow, GitHub Actions cache poisoning, and OIDC token theft from runner memory to publish malicious packages with valid SLSA provenance, and abused an orphan commit referenced as an optional dependency so npm would fetch and execute attacker code. The payload is a credential-stealing worm that harvests GitHub Actions OIDC tokens, personal access tokens, npm publish tokens, cloud and Kubernetes credentials, SSH keys, IDE configs and other secrets, exfiltrates data over the Session P2P network, embeds persistence in Claude Code hooks and VS Code auto-run tasks, self-propagates through stolen CI credentials, and in some locales includes a probabilistic destructive wipe routine.
What the jury had to weigh to decide the case.

www.nytimes.com · 5 months ago

NULL
INTERPOL Operation Ramz Disrupts MENA Cybercrime Networks with 201 Arrests

thehackernews.com · 5 months ago

There was a first of its kind INTERPOL coordinated cybercrime crackdown across the Middle East and North Africa called Operation Ramz that ran from October 2025 to February 2026, involved 13 countries, and resulted in 201 arrests plus the identification of 382 additional suspects. The operation disrupted phishing and malware infrastructure, identified 3,867 victims, and led to the seizure of 53 servers, including the takedown of a phishing as a service platform in Algeria, seizures of devices containing banking data in Morocco, and the disabling of a compromised residential server in Oman that contained critical vulnerabilities and malware. Investigators also found devices in Qatar being used without the owner’s knowledge, uncovered a Jordanian fraud scheme that exploited trafficked individuals, and relied on private sector intelligence that flagged over 5,000 compromised accounts to support enforcement actions.
Apple’s Siri Revamp May Add Auto-Deleting Chats

www.techrepublic.com · 5 months ago

Apple is reportedly developing a standalone Siri app that would let users choose how long AI conversations are saved with options such as 30 days, one year, or forever. The retention controls are expected to be part of a privacy-focused push at WWDC 2026, which begins on June 8, 2026. The enhanced Siri is reported to use Google Gemini models, a detail that could complicate Apple’s privacy messaging, and IT leaders will need to assess how conversation history and retention settings align with mobile device management and data governance.
Banned Nvidia AI Chips Keep Reaching China Despite US Crackdown

www.techrepublic.com · 5 months ago

There are alleged networks using encrypted messages, front companies, and third country intermediaries to divert restricted Nvidia GPUs and other US technology to China and Russia despite export controls. Court filings name individuals including Matthew Kelly, Stanley Yi Zheng, and Tommy Shad English and show tactics such as avoiding explicit mention of China, while other prosecutions allege smuggling of 400 Nvidia A100 chips through Malaysia and Thailand and a separate case involving a 2.5 billion dollar server shipment. The Bureau of Industry and Security has increased enforcement but faces challenges tracking diversion routes, reporting nearly 420 million dollars in penalties and forfeitures and high profile fines including a 252 million dollar penalty against Applied Materials and a 95 million dollar settlement by Cadence.
Did You Mean to Share That Selfie? What to Know About Instagram Instants.

www.nytimes.com · 5 months ago

Instagram rolled out Instants, a feature and companion app that lets users capture unedited photos and send them to either their Close Friends or mutual followers where they disappear after being viewed or after 24 hours. Instants must be taken from the in-app camera or the Instants app, cannot be edited or uploaded from the gallery, include a brief undo window immediately after sending, and Instagram says recipients cannot screenshot or screen record shared Instants. The feature is pitched as a low pressure way to share candid moments, but early user reports and commentary highlight confusing UX patterns such as instant sending without a preview and difficulty knowing who has seen a sent Instant.
AI cyberattackers are getting better faster

www.csoonline.com · 5 months ago

There are new benchmarks from the UK AI Security Institute showing AI models can perform end to end, multi stage penetration tests that match human capabilities, with the difficulty of tasks the best models can complete doubling every eight months in November 2025 and accelerating to every 4.7 months by February 2026, and the latest Claude Mythos Preview and GPT 5.5 models demonstrating even greater capability. The time horizon benchmarks measure the longest task an AI can complete at an 80 percent success rate using estimated human work hours, require sustained multi step context and recovery from failures, and were capped at 2.5 million tokens which may limit longer running performance. The UK government warns these advances are translating into real risks for organizations with weak cyber defenses while also noting the same acceleration can improve defensive tools for proactive threat detection and automated response.
How to better protect your growing business in an AI-powered world

www.microsoft.com · 5 months ago

AI is rapidly reshaping work while increasing cyber risk, with AI automated phishing found to be 4.5 times more effective and attackers increasingly targeting identities and automating scams and malware. This shift makes cybersecurity a core business risk for growing companies because breaches and disruptions can cause financial loss and lasting damage to customer trust, and Microsoft reports it now processes more than 100 trillion security signals daily and blocks 4.5 million new malware files every day. Simple, built in protections that secure devices, identities, email, and cloud apps and that provide centralized visibility and automation help small and medium businesses reduce risk, and Microsoft highlights Microsoft 365 Business Premium as an example of an integrated, easy to manage solution.
Peter G. Neumann, Who Warned of Computer Security Risks, Dies at 93

www.nytimes.com · 5 months ago

Peter G. Neumann was a pioneering computer security expert who for decades criticized the industry’s lax attitudes toward computer security and individual digital privacy. He developed practical solutions and research contributions, including work on provably secure operating systems and early intrusion detection models while at SRI International and as editor and moderator of professional forums. His advocacy shaped public debate on security and privacy and influenced later tools and standards for detecting and mitigating systemic risks to users and infrastructure.
Fuel Tank Breaches Expand Scope of Iran's Cyber Offensive

www.darkreading.com · 5 months ago

Iranian hackers reportedly breached internet exposed automatic tank gauge systems that monitor fuel levels in storage tanks serving gas stations around the United States, altering display readings on the tanks without changing actual fuel quantities. The affected systems lacked password protections, illustrating long standing warnings that insecure ATG and other operational technology exposed to the internet can be tampered with to create cascading effects. There is no evidence of significant fuel supply disruption so far and definitive forensic attribution is lacking, but Iran is suspected because of past targeting of fuel infrastructure and the current conflict with the United States and Israel. Security experts urge removal of internet facing OT, stronger access controls, network segmentation, improved visibility, and resilience planning to reduce the blast radius of similar attacks.
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More

thehackernews.com · 5 months ago

On-premises Microsoft Exchange Server is being actively exploited via a spoofing cross-site scripting vulnerability tracked as CVE-2026-42897, and Microsoft has provided a temporary mitigation through its Exchange Emergency Mitigation Service while preparing a permanent fix. Cisco Catalyst SD-WAN Controller has been targeted by a sophisticated actor exploiting a critical authentication bypass tracked as CVE-2026-20182, with links to prior exploitation of CVE-2026-20127 and observed post compromise activity including adding SSH keys and modifying NETCONF to escalate privileges. A supply chain campaign attributed to TeamPCP poisoned popular npm packages including TanStack and node-ipc to deliver stealer malware, a malicious Hugging Face model repository distributed a Rust based information stealer, and the ShinyHunters group claimed an agreement with Instructure to return and delete stolen data after a breach. Other high priority vulnerabilities flagged this week include CVE-2026-42945, CVE-2026-41096, CVE-2026-42826, CVE-2026-46333, and CVE-2026-45185 among many others.
Grafana says stolen GitHub token let hackers steal codebase

www.bleepingcomputer.com · 5 months ago

Grafana Labs disclosed that attackers used a stolen GitHub access token to breach its GitHub environment and download the company source code. An extortion group calling itself CoinbaseCartel claimed responsibility by listing Grafana on its data leak site, and Grafana says its investigation found no evidence of customer data exposure, invalidated the compromised credentials, and implemented additional security measures. Grafana declined to pay the ransom following FBI guidance, and researchers link CoinbaseCartel to affiliates of ShinyHunters and Lapsus$ that commonly gain access via social engineering, phishing, and compromised credentials.
The down fall of bug bounties

shubs.io · 5 months ago

AI is changing security research and the economics of bug bounties by enabling skilled researchers to work faster while amplifying low-skill participants who submit AI-generated, low-value reports. This influx of poor submissions is overwhelming triage teams, slowing meaningful response times and eroding researchers' motivation, with one vulnerability submitted April 24 not receiving a human response until May 6, a 12 day delay. Platforms are deploying AI defenses and stricter controls, but many experienced hunters are reducing participation or abandoning programs they once regularly contributed to.
The Boring Stuff Is Dangerous Now

www.darkreading.com · 5 months ago

There are AI agents that can systematically map third party ecosystems, identify obscure vulnerable components, and chain them to reach high value targets, eliminating obscurity as a defensive barrier. There are widespread mandates for developers to use AI coding tools that are producing large volumes of code with recurring implementation errors and misconfigurations, increasing the attack surface. There will be a surge in vulnerability reports that can overwhelm security teams, so prioritization must shift to trust path risk and actual business impact rather than asset prestige. Organizations should track transitive dependencies, data flows and permissions, patch root causes, remediate recurring vulnerability patterns, and feed this intelligence back into AI coding tools to reduce future risk.
How to Reduce Phishing Exposure Before It Turns into Business Disruption

thehackernews.com · 5 months ago

Early phishing detection closes the gap between a phishing email that looks routine and the business exposure that can follow, enabling security operations teams to move from uncertainty to evidence faster, reduce response delays, and prevent a single clicked link from becoming credential theft, remote access, or operational disruption. A three step approach is to validate suspicious links and attachments in interactive sandboxes to reveal redirects and credential prompts, expand analysis into campaign context by linking related domains and repeated URL patterns, and push behavior based indicators and campaign intelligence into SIEM, TIP, SOAR, NDR, and firewall controls for detection and containment. In one sandbox case the full attack chain was exposed in roughly forty seconds, and teams using these methods report faster mean time to remediate, dramatically faster triage, fewer escalations, and reduced Tier 1 workload.
Millions Impacted Across Several US Healthcare Data Breaches

www.securityweek.com · 5 months ago

Several major U.S. healthcare data breaches were added to the Department of Health and Human Services breach tracker, with the largest affecting New York City Health and Hospitals and listed as impacting 1.8 million individuals; that breach was detected on February 2, 2026 and investigators found threat actors had access between November 2025 and February 2026 through a third party, exposing personal, health insurance, medical, biometric, and financial information. Other incidents added to the tracker include Erie Family Health Centers in Chicago with roughly 570,000 individuals affected after unauthorized access from December 10, 2025 to late January 2026, Florida Physician Specialists with about 276,000 affected after two days of access in November 2025, and breaches at Coastal Carolina Health Care and Western Orthopaedics each impacting about 110,000 people. The tracker also shows Nacogdoches Memorial Hospital listed at 2.5 million affected despite earlier reports of 250,000 and a small Arizona dermatology clinic whose initial 3 million figure was later updated to 500, and none of the newly added healthcare breaches appear to have been claimed by known cybercrime groups.
New image-based prompt injection attack targets multimodal AI models

www.csoonline.com · 5 months ago

There is a new image based prompt injection technique called CrossMPI developed by researchers at Xidian University that uses nearly imperceptible image perturbations to manipulate how large vision language models interpret both visual and textual inputs without changing the original text prompt. The attack targets intermediate fusion layers where visual and textual hidden states combine and achieved an average success rate of sixty six point three six percent across open source LVLMs including MiniGPT4, BLIP‑2, InstructBLIP, BLIVA, and Qwen2.5‑VL, outperforming prior baseline attacks by about forty one percentage points and showing strong black box transferability. Evaluated defenses such as random resizing, image rotation, JPEG compression, SmoothVLM, and partial image view methods reduced effectiveness in some cases with SmoothVLM lowering success rates below five percent in several scenarios and JPEG compression weakening high frequency artifacts, but none fully eliminated the threat. The research warns that enterprises deploying multimodal AI copilots, autonomous agents, and document processing systems could face increasing exposure because manipulated images can subvert sanitized textual inputs, although the study was conducted in controlled settings and did not report observed real world exploitation.
Gamaredon Deploys GammaDrop, GammaLoad in Phishing Campaigns

gbhackers.com · 5 months ago

There are multi stage phishing attacks by the Gamaredon threat group targeting Ukrainian government entities that deploy GammaDrop and GammaLoad downloaders and exploit CVE-2025-8088 a WinRAR directory traversal flaw that allows malicious files to be written outside intended extraction paths. The attacks use malicious RAR or ARJ archives containing decoy PDFs and hidden VBScript payloads placed via NTFS alternate data streams to drop GammaDrop into the Windows Startup folder for persistence while GammaDrop retrieves GammaLoad which executes as an HTA via mshta establishes RunOnce registry keys and beacons to Cloudflare Workers and fallback domains approximately every three and a half minutes while collecting basic system identifiers. There are at least twelve observed waves since September 2025 targeting institutions including the Security Service of Ukraine using rotated fast flux infrastructure and known relays in the 194.58.66.0/24 subnet and recommended mitigations include enforcing SPF DKIM and DMARC blocking known malicious IP ranges and patching WinRAR.