Blahalla

Gamaredon Deploys GammaDrop, GammaLoad in Phishing Campaigns

gbhackers.com · 5 months ago

There are multi stage phishing attacks by the Gamaredon threat group targeting Ukrainian government entities that deploy GammaDrop and GammaLoad downloaders and exploit CVE-2025-8088 a WinRAR directory traversal flaw that allows malicious files to be written outside intended extraction paths. The attacks use malicious RAR or ARJ archives containing decoy PDFs and hidden VBScript payloads placed via NTFS alternate data streams to drop GammaDrop into the Windows Startup folder for persistence while GammaDrop retrieves GammaLoad which executes as an HTA via mshta establishes RunOnce registry keys and beacons to Cloudflare Workers and fallback domains approximately every three and a half minutes while collecting basic system identifiers. There are at least twelve observed waves since September 2025 targeting institutions including the Security Service of Ukraine using rotated fast flux infrastructure and known relays in the 194.58.66.0/24 subnet and recommended mitigations include enforcing SPF DKIM and DMARC blocking known malicious IP ranges and patching WinRAR.
‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery

www.securityweek.com · 5 months ago

There are four vulnerabilities in the OpenClaw AI assistant that can be chained to steal credentials, bypass sandbox restrictions, escalate privileges, and install persistent backdoors on the underlying host. An attacker who gains code execution inside the OpenShell sandbox can exploit a race condition CVE-2026-44113 to read files outside the mount root, an exec allowlist analysis bug CVE-2026-44115 to run unapproved commands, and an MCP loopback flaw CVE-2026-44118 to manipulate ownership and gain owner-level privileges. A separate critical race condition CVE-2026-44112 with a CVSS score of 9.6 enables writing data outside the sandbox to modify configurations and plant backdoors, and the issues were reported on April 22, 2026 with patches issued the next day.
‘Patched’ Windows bug resurfaces 6 years later as working SYSTEM-level exploit

www.csoonline.com · 5 months ago

There is an elevation of privilege flaw in the Windows Cloud Filter driver cldflt.sys that researchers say remains exploitable six years after a 2020 patch, with a public proof of concept called MiniPlasma able to elevate a standard user to SYSTEM on many modern builds though success can vary because it relies on a race condition. The behavior reproduces CVE-2020-17103, which Microsoft patched in December 2020 and assessed as less likely to be exploited, but follow up testing found the original exploit chain still works on fully patched systems while some Insider builds show mitigation. The disclosure is part of a larger 2026 run of Windows vulnerability releases by the researcher Nightmare Eclipse that also touched on CVE-2026-33825 and other local privilege escalation and bypass techniques.
Gremlin Stealer Hides Payloads in .NET Resources to Evade Detection

gbhackers.com · 5 months ago

There is a newly identified Gremlin Stealer variant that conceals its core payload inside.NET resource sections, encoding payloads with a simple XOR scheme and decrypting them in memory to reveal command and control URLs and execution logic. The malware uses a staged execution model and multiple obfuscation layers including identifier renaming, string encryption, control flow obfuscation, and commercial packing with instruction virtualization to evade static analysis and detection. It targets payment card data, browser cookies, session tokens, cryptocurrency wallets and Discord tokens, adds a crypto clipper and WebSocket session hijacking, and compresses stolen data into ZIP archives labeled with victims public IPs before uploading them to attacker controlled infrastructure, where researchers observed a newly deployed exfiltration server that initially showed zero detections on VirusTotal. Organizations are advised to monitor unusual outbound traffic, inspect memory resident behavior, and deploy advanced endpoint detection and prevention tools to identify and block Gremlin activity.
Boulevard of Broken Dreams: 2 Decades of Cyber Fails

www.darkreading.com · 5 months ago

There is widespread breach jadedness as consumers and organizations have been repeatedly affected by massive incidents over many years, with breach counts and victim notices rising dramatically. One of the most destructive supply chain incidents was the exploitation of CVE-2023-34362, an SQL injection in Progress Software's MOVEit Transfer that exposed data on nearly 100 million people and was heavily leveraged by the Cl0p threat group. Operational failures have also caused major real world disruption, exemplified by a July 19, 2024 CrowdStrike Falcon Sensor update that triggered blue screen crashes on millions of Windows devices, grounding flights, delaying surgeries, and prompting changes to vendor kernel level access policies. Industry dependence on a small set of cloud and security vendors has amplified systemic risk, keeping legacy tools like the SIEM in place while driving calls for staged rollouts, kill switches, and resilience by design.
TanStack Supply Chain Attack (And How to Lock Down GitHub Actions)

www.copilotkit.ai · 5 months ago

In May 2026 the TanStack router repository was compromised through its GitHub Actions pipeline when a fork pull request poisoned the Actions cache, extracted OIDC tokens, and allowed the attacker to publish 84 malicious npm packages that downstream installs pulled before detection. The attack used no zero days and relied on known misconfigurations including cache collisions between forks and upstream pull requests, overly broad token permissions, and running build and publish in the same job. An audit of 20 repositories found widespread issues such as unpinned actions, missing permissions blocks, shell injection vectors, credential persistence, dangerous workflow triggers, absent static analysis, lack of Dependabot for actions, and fork PR cache poisoning, and those issues were fixed using a common checklist. Recommended mitigations include SHA pinning every action, enforcing least privilege permissions, preventing shell injection through environment variable indirection and safe JSON construction, disabling credential persistence and doing late credential injection, separating build and publish jobs, adding continuous workflow scanning with Zizmor, using Dependabot or Renovate for Actions updates, and applying pnpm hardening to quarantine new packages.
7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand

www.securityweek.com · 5 months ago

7-Eleven confirmed a data breach after the ShinyHunters group claimed to have stolen more than 600,000 Salesforce records and listed the company on its leak site. An intrusion into systems used to store franchisee documents was detected on April 8, and security incident notices say unspecified personal information provided during franchise applications was compromised while only two Maine residents were identified as impacted. The attackers demanded a ransom by April 21, later offering the stolen data for sale for 250,000 dollars, and ShinyHunters has been linked to similar thefts from Salesforce instances using phishing, abuse of third party integrations, or misconfigurations rather than flaws in Salesforce products.
Developer Workstations Are Now Part of the Software Supply Chain

thehackernews.com · 5 months ago

Supply chain attackers are shifting focus from injecting malicious code to stealing access from developer environments, with three campaigns targeting npm, PyPI, and Docker Hub in a 48 hour window that harvested API keys, cloud credentials, SSH keys, and tokens. Developer workstations concentrate contextual data such as local repositories, dot files, shell history, package configs, build scripts, and browser sessions, allowing attackers to map credentials to repositories, CI workflows, and cloud resources. Automation and AI driven tooling compress the time between discovery and impact by auto-merging dependency updates, running workflows, and exposing sensitive data in prompts and agent memory. Security teams are urged to treat developer machines as local supply chain boundaries by identifying usable credentials, limiting credential value and lifetime, detecting secrets before they enter Git or CI, and revoking and rotating access rapidly.
Critical NGINX Vulnerability Lets Hackers Launch Remote Code Execution Attacks

gbhackers.com · 5 months ago

A newly disclosed vulnerability in NGINX, tracked as CVE-2026-42945, is being actively exploited and affects both NGINX Open Source and NGINX Plus, potentially allowing unauthenticated attackers to crash worker processes or achieve remote code execution under specific conditions. Attackers send specially crafted HTTP requests to trigger a heap buffer overflow in the NGINX worker process, with full remote code execution possible only when conditions such as ASLR being disabled and a specific rewrite configuration are present. Censys and VulnCheck analysis identified roughly 5.7 million internet facing NGINX servers running potentially affected versions, so even a small percentage meeting exploitation criteria could produce substantial exposure. Organizations are advised to urgently review rewrite configurations, apply available patches or updates, enable modern protections like ASLR, and monitor for unusual HTTP request patterns.
Microsoft testing adjustable taskbar, Start menu in Windows 11

www.bleepingcomputer.com · 5 months ago

There are resizable taskbar and Start menu options rolling out to Windows Insiders in the Experimental channel with Windows 11 Insider Preview Build 26300.8493, letting users move the taskbar to the bottom, top, left, or right of the screen and enable smaller taskbar buttons. Start menu controls now allow users to toggle off Recommended and All content, customize the Start menu size, hide their name and profile picture, and Microsoft will still maintain a list of recently installed apps while improving how files are displayed and ordered for relevance. Microsoft is also testing a modern Run dialog with dark mode that removes the Browse button and must be turned on manually in settings, and says these changes form part of broader efforts to improve Windows 11 performance, reduce notifications, simplify settings, and make search more consistent.
Zero-Day Exploit Against Windows BitLocker

www.schneier.com · 5 months ago

There is a zero day exploit named YellowKey that reliably bypasses default Windows 11 BitLocker protections but requires physical access to the computer. It was published this week by a researcher using the alias Nightmare Eclipse and targets default BitLocker deployments where the decryption key is stored in a trusted platform module. The exploit undermines the mandatory disk encryption relied on by many organizations, including government contractors, and exposes devices to data theft when attackers obtain physical access.
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws

thehackernews.com · 5 months ago

There are security updates from Ivanti, Fortinet, SAP, VMware, and n8n that fix multiple critical and high-severity vulnerabilities that could allow information disclosure, unauthenticated code execution, SQL injection, remote code execution, and local privilege escalation. CVE identifiers include CVE-2026-8043, CVE-2026-44277, CVE-2026-26083, CVE-2026-34260, CVE-2026-34263, CVE-2026-41702, CVE-2026-42231, CVE-2026-42232, CVE-2026-44791, CVE-2026-44789, and CVE-2026-44790.
Paper Werewolf APT Spreads EchoGather RAT via Fake Adobe Installer

gbhackers.com · 5 months ago

A Russian language threat cluster known as Paper Werewolf launched targeted cyberattacks against industrial, financial, and transport organizations in March and April 2026, delivering a fake Adobe Reader installer that silently deployed the EchoGather remote access trojan. The attack chain begins with a phishing email carrying a PDF that directs victims to a ZIP archive containing a bogus installer which extracts and launches EchoGather while showing a decoy document. EchoGather harvests system details including local IP, host name, user name, process information and file paths, exfiltrates data over HTTPS, supports file upload and download and remote command execution, and researchers also uncovered a VB dot NET stealer called PaperGrabber that harvests documents, SSH keys, VPN configurations, certificates, Telegram session data and browser credentials then sends exfiltrated data in 10 megabyte chunks to attacker infrastructure. The actors further deployed JavaScript shellcode downloaders disguised as a Node dot js environment, a C plus plus downloader with anti virtualization checks, a VBScript MSBuild loader, and advanced Mythic implants that use RSA 4096 key exchange and AES and support more than 30 post exploitation commands including process injection, keylogging, SOCKS proxying, registry manipulation and screenshot capture.
Researcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE

www.securityweek.com · 5 months ago

There is a new exploit called MiniPlasma that targets a Windows Cloud Filter driver privilege escalation tracked as CVE-2020-17103 and rated CVSS 7.0. Project Zero reported the flaw in 2020 and Microsoft issued December 2020 updates, but the original proof of concept reportedly works unchanged, indicating the bug may still be present and allowing creation of registry keys in the DEFAULT user hive without access checks to elevate privileges. MiniPlasma has been shown to spawn a System shell on Windows 11 systems with May 2026 security updates installed, may not function on the latest Insider Preview Canary builds, and the researcher previously released similar exploits after criticizing Microsofts vulnerability response.
First Shai-Hulud Worm Clones Emerge

www.securityweek.com · 5 months ago

At least one threat actor began using clones of the Shai Hulud worm days after TeamPCP published the malware source code, and Shai Hulud had previously been used in supply chain attacks against the NPM ecosystem in September 2025 and November 2025 and resurfaced in April in campaigns impacting projects such as Trivy, Bitwarden, Checkmarx, SAP, and TanStack. A threat actor published four malicious NPM packages, including a direct clone named chalk template that contains the worm code, its own command and control server and private key, and that exfiltrates stolen credentials to a new code repository, while the other three packages used typo squatting to target Axios users and one turned infected machines into a DDoS botnet, together amassing over two thousand six hundred weekly downloads. Security researchers warn that rapid adaptation of the released source code and the variety of infostealer and propagation techniques indicate this is the first phase of a likely wave of supply chain attacks.
Hackers Abuse Cloudflare Storage to Exfiltrate Network Files

gbhackers.com · 5 months ago

A sophisticated cyber espionage campaign targeted multiple Malaysian organizations, with attackers operating from an Azure virtual machine at IP address 20.17.161.118 to orchestrate intrusions across government-linked networks. The campaign relied on custom tooling including purpose-built Python scripts, Laravel deserialization exploit chains, PHP webshells, and a private command and control framework, and used a list of 126 targeted credentials to gain administrator-level access. Attackers abused Cloudflare-hosted storage for data exfiltration using scripts such as genphotoupload.py to blend malicious uploads into legitimate cloud traffic and reduce detection. Researchers recovered Active Directory artifacts including SAM, SECURITY, and SYSTEM hives and NTDS dumps enabling offline credential extraction and long-term persistence, prompting containment recommendations to remove webshells, rotate domain credentials, and conduct deep forensic analysis.
Attacking Cloud Service Providers (ACSP) - An interactive textbook on control-plane intrusion and breaking cross-tenant isolation

senyuuri.github.io · 5 months ago

There is a semester-length interactive textbook called Attacking Cloud Service Providers that focuses on control-plane intrusion and breaking cross-tenant isolation, built from 275 real-world cloud service provider vulnerabilities across AWS, Azure, and GCP. It is intended for security engineers, vulnerability researchers, and red-teamers and teaches a six-part analytical lens covering plane, boundary, identity, shared resources, automation, and detection to reason about provider-side attacks and blast radius. The book contains 13 cumulative chapters covering cloud fundamentals, the CSP kill chain, identity federation, instance metadata and SSRF, control-plane network isolation, container and workload escape, storage and databases including ChaosDB, serverless and CI CD risks, AI ML service attack surfaces, cross-tenant synthesis, and logging and detection evasion.
Microsoft Acknowledges Windows 11 Update Failure Linked to Error 0x800f0922

gbhackers.com · 5 months ago

The May 12, 2026 cumulative update KB5089549 for Windows 11 versions 24H2 and 25H2 can fail to install and return error code 0x800f0922. The installation failure is frequently tied to limited free space on the EFI System Partition, with problems often occurring when about 10 megabytes or less remain. Microsoft has acknowledged the issue and is rolling out a Known Issue Rollback and targeted fixes, while some users report the update either rolls back automatically or, on systems where it completes, causes degraded network performance.
AI coding is fueling a secrets-sprawl crisis few CISOs are containing

www.csoonline.com · 5 months ago

Security researchers at Wiz and independent researcher Jameson O'Reilly discovered that Moltbook, an AI agent social network launched on January 28, 2026, had a misconfigured Supabase backend that exposed 1.5 million API authentication tokens, 35,000 email addresses, and private messages. AI assisted coding and vibe coding have accelerated secrets sprawl, with public code commits rising more than forty percent in 2025 and GitGuardian reporting a thirty four percent increase in leaked secrets on GitHub in 2025 to nearly 29 million exposed credentials, including 1.27 million AI related secrets, an eighty one percent year over year increase. Remediation should be treated as an incident response action that revokes and rotates exposed credentials, audits for unauthorized use, purges secrets from history, and follows with postmortems, yet GitGuardian found that sixty four percent of valid secrets identified in 2022 remained unrevoked in 2026, highlighting governance and ownership shortfalls. CISOs are advised to secure the full software development lifecycle and non human identities by enforcing credential vaulting, separation of duties, short lived credentials, automated rotation, clear ownership, and embedding security practices into developer workflows so identity governance shrinks secrets sprawl rather than relying solely on scanning.
Why the best security investment a board can make in 2026 isn’t another tool

www.csoonline.com · 5 months ago

There is a recurring pattern in boardrooms where security leaders present the threat landscape, boards fund another tool, and the same visibility gaps reappear because individual tools only illuminate separate corners of the environment. The highest-value security capability is visibility, meaning the ability to answer specific questions about assets, access and cross-system activity in minutes rather than relying on raw logs and delayed forensics. Attackers increasingly exploit the seams between tools, and the fastest-growing blind spot is unmanaged machine and automated credentials including service accounts, API keys, third-party integrations and AI agents. Boards should stop asking are we protected and instead ask what can we see, and invest in a complete, current inventory and the ability to reconstruct activity across systems before approving more detection tools.
MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems

thehackernews.com · 5 months ago

A proof of concept released by researcher Chaotic Eclipse enables SYSTEM privilege escalation on fully patched Windows systems by exploiting a zero day called MiniPlasma. The flaw impacts the Windows Cloud Files Mini Filter driver cldflt.sys in a routine named HsmOsBlockPlaceholderAccess and was originally reported to Microsoft by Google Project Zero researcher James Forshaw in September 2020, with the issue thought fixed under CVE-2020-17103 but reportedly still present. The researcher weaponized the original PoC to spawn a SYSTEM shell that has been reported to work reliably on Windows 11 systems updated with the May 2026 patches while noting success may vary because the bug is a race condition, and a related privilege escalation in the same component was tracked as CVE-2025-62221.
Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware

thehackernews.com · 5 months ago

Cybersecurity researchers discovered four malicious npm packages named chalk-tempalte, a scoped package published by the user deadcode09284814 called axios util, axois-utils, and color-style-utils that deliver information stealing malware and a Golang based DDoS botnet. Analysis shows axois-utils drops a Golang Phantom Bot capable of HTTP, TCP and UDP floods and establishes persistence on Windows and Linux, while chalk-tempalte contains a near identical clone of the recently leaked Shai Hulud worm that exfiltrates stolen credentials to a remote command and control server and pushes data to a public GitHub repository using a stolen token. The other two packages siphon SSH keys, environment variables, cloud credentials, system information, IP addresses and cryptocurrency wallet data, and users who installed these packages are advised to uninstall them, remove malicious configuration from development tools and coding agents, rotate secrets, search for repositories named A Mini Sha1 Hulud has Appeared and block network access to suspicious domains.
Hackers Hide PureLogs Infostealer in PawsRunner Loader

gbhackers.com · 5 months ago

A recent campaign begins with phishing emails delivering a TXZ archive disguised as an urgent invoice that contains a heavily obfuscated JavaScript which sets environment variables and launches PowerShell via conhost.exe to decrypt an AES encrypted, Gzip compressed payload and execute it in memory. The decoded.NET loader, tracked as PawsRunner, decrypts RC4 encrypted command and control URLs, downloads additional payloads using HttpClient and WebRequest, and uses steganography to extract hidden encrypted payloads embedded inside PNG images by looking for specific PNG chunk markers such as iTXt and IEND. The final payload is PureLogs, a.NET infostealer that uses.NET Reactor and Protobuf, decrypts a resource only assembly with TripleDES, then downloads AES 256 encrypted modules that run in memory and harvest a wide range of data including browser credentials, cookies, autofill entries, cryptocurrency wallets, password managers, VPN configurations, files, and messaging data. The campaign includes persistence and Windows 11 evasion techniques, commonly uses cat themed icons as a recurring trait, exfiltrates collected data to command and control servers over encrypted and Gzip compressed HTTP posts, and illustrates a growing trend of hiding malware inside legitimate files and images to bypass traditional detection.
Critical Marimo RCE Flaw Could Let Attackers Execute Malicious Code Remotely

gbhackers.com · 5 months ago

A newly disclosed critical vulnerability in the Marimo Python notebook framework allows attackers to execute arbitrary commands remotely without authentication by exposing a WebSocket endpoint that can be abused to spawn a system level shell and potentially lead to full infrastructure compromise. The flaw is tracked as CVE-2026-39987 and has prompted urgent concern from the cybersecurity community.
Grafana Confirms Breach After Hackers Claim They Stole Data

www.securityweek.com · 5 months ago

Grafana confirmed on May 18, 2026 that it suffered a data breach after the company was listed on a cybercrime leak site. The intrusion exploited a compromised token that granted access to the Grafana Labs GitHub environment and allowed attackers to download the company codebase, while Grafana says no personal or customer information was stolen and customer systems were not impacted. Attackers demanded a ransom to prevent the source code from being leaked but Grafana refused to pay, has reset compromised credentials, and is conducting a forensic investigation. Security firms link the group calling itself Coinbase Cartel to ShinyHunters, Scattered Spider, and Lapsus, reporting the cartel has been active since September 2025 and lists over one hundred victims.
Microsoft confirms Windows 11 security update install issues

www.bleepingcomputer.com · 5 months ago

The May 2026 Windows 11 security update KB5089549 fails to install on some systems, triggering 0x800f0922 errors and rolling back during reboot at about 35 to 36 percent. The problem is caused by insufficient free space on the EFI System Partition, particularly when about 10 megabytes or less remain, and logs show SpaceCheck insufficient free space, ServicingBootFiles failed error 0x70, and third party or OEM files using ESP space outside Microsoft boot directories. Mitigations include using Known Issue Rollback and, in enterprise environments, installing and configuring the supplied Group Policy and restarting devices to temporarily disable the change causing the issue.
n8n Security Flaws Could Let Attackers Achieve Remote Code Execution

gbhackers.com · 5 months ago

Critical vulnerabilities in the n8n workflow automation platform allow attackers with low privilege authenticated access to chain multiple flaws and achieve full remote code execution. The issues are tracked as CVE-2026-44789 affecting the HTTP Request node via prototype pollution, CVE-2026-44790 affecting the Git node allowing arbitrary file read through argument injection, and CVE-2026-44791 which bypasses a prior XML node patch and enables prototype pollution. n8n has released patches and advises upgrading to versions 1.123.43 or later, 2.20.7 or later, and 2.22.1 or later, and recommends restricting workflow creation and disabling vulnerable nodes where immediate patching is not possible.
OtterCookie Malware Steals Dev Secrets, SSH Keys, Cloud Credentials, and Tokens

gbhackers.com · 5 months ago

OtterCookie is a separate Node.js based remote access trojan that maintains persistent Socket.IO connections using Engine.IO v4 to monitor infected developer workstations in real time rather than relying on one time harvests. It continuously captures clipboard contents, keystrokes, screenshots, browser credentials, crypto wallet data, SSH keys, environment files, cloud credentials, and API tokens, and its infrastructure broadcasts live rosters of infected machines from servers including a Hetzner host at 195.201.104.53 with observed campaign IDs 902 to 906. The campaign spread through malicious npm packages and Vercel hosted payloads, with researchers attributing about 197 malicious packages and roughly 31,000 downloads during a late 2025 wave, and identifiers labeled uid and userKey appear to represent campaign batches rather than unique devices which can still link infections to specific waves.
Fast16 Malware Sabotages Nuclear Test Simulations by Altering Data

gbhackers.com · 5 months ago

Fast16 is a cyber‑espionage framework that sabotages nuclear weapons simulations by silently altering critical test data, using a highly selective hook engine to modify application behavior in real time and activating only under precise conditions tied to detonation modeling. It targets physics engines LS-DYNA and AUTODYN and manipulates outputs when material density exceeds thirty grams per cubic centimeter, employing three tampering mechanisms that can reduce calculated values to as little as one percent or scale pressure outputs down as much as forty two percent depending on version and parameters. The framework spreads laterally via shared drives and credential impersonation, maintains persistence with a kernel‑level driver and Image File Execution Options hijacking while avoiding systems with known security tools, and includes multiple tailored builds dating back to around two thousand five, prompting recommendations to monitor and audit kernel drivers, enforce strict application control, deploy advanced endpoint detection, and regularly validate simulation outputs against independent models.
Exploitation of Critical NGINX Vulnerability Begins

www.securityweek.com · 5 months ago

There are active in the wild attacks exploiting a critical NGINX heap buffer overflow tracked as CVE-2026-42945 and dubbed Nginx Rift, a flaw in the ngxhttprewritemodule that has existed for 16 years. The vulnerability can be exploited remotely without authentication via crafted HTTP requests when a specific rewrite configuration is present, causing a denial of service on default deployments and enabling remote code execution if Address Space Layout Randomization is disabled. Public proof of concept code appeared shortly after F5 released patches, and researchers observed exploitation on honeypots while estimating about 5.7 million internet exposed NGINX servers run potentially vulnerable versions though the truly exploitable subset is smaller. Organizations are urged to apply the available patches from F5 and review rewrite configurations to mitigate the issue.
Exploit available for new DirtyDecrypt Linux root escalation flaw

www.bleepingcomputer.com · 5 months ago

There is a recently patched local privilege escalation vulnerability in the Linux kernel rxgk module named DirtyDecrypt also known as DirtyCBC and a proof of concept exploit is now available that can grant attackers root access on some Linux systems. The flaw aligns with CVE-2026-31635 which was patched on April 25, 2026 and affects kernels built with the CONFIGRXGK option enabled, limiting impact primarily to distributions that closely follow mainline kernels such as Fedora Arch and openSUSE Tumbleweed. Users should install the latest kernel updates immediately or temporarily mitigate the risk by disabling the esp4 esp6 and rxrpc kernel modules understanding that this will break IPsec VPNs and AFS network file system functionality.
Linux Torvalds Warns AI Bug Report Spam Is Disrupting Linux Security Discussions

gbhackers.com · 5 months ago

Linus Torvalds warned that a flood of low value AI generated bug reports is overwhelming the private Linux security mailing list and disrupting real security work. Linux 7.1 security documentation now instructs that bugs found by AI or mass scanning tools should generally be treated as public unless they meet strict security criteria, and that reporters must add human value by verifying issues on a recent kernel, providing a tested reproducer, and proposing and testing patches. The guidance narrows private reporting to urgent issues that grant attackers unintended capabilities on correctly configured production systems, requests plain text concise reports, and warns against posting full exploit code publicly while encouraging responsible use of AI as a starting point rather than a finished report.
1 Million WordPress Websites Exposed by Avada Builder Security Vulnerabilities

gbhackers.com · 5 months ago

More than one million WordPress sites using Avada Builder were exposed to two vulnerabilities that allow arbitrary file reads and time based SQL injection. The flaws are tracked as CVE-2026-4782, an arbitrary file read affecting versions up to 3.15.2 that can let low level authenticated users retrieve files such as wp config php, and CVE-2026-4798, a high severity time based SQL injection affecting versions up to 3.15.1 that can be exploited by unauthenticated attackers when WooCommerce was previously installed and then deactivated. Wordfence released firewall protections for premium users on March 25, 2026 and for free users on April 24, 2026 while Avada released a partial fix on April 13, 2026 and a complete patch in version 3.15.3 on May 12, 2026. Administrators are urged to update to Avada Builder version 3.15.3 immediately to prevent data theft or full site compromise.
Pre-Stuxnet Fast16 Malware Tampered with Nuclear Weapons Simulations

thehackernews.com · 5 months ago

A new analysis confirms fast16 was a Lua based industrial sabotage malware engineered to tamper with uranium compression simulations used in nuclear weapons design. Researchers found fast16 hooks into LS DYNA and AUTODYN and enforces 101 tampering rules grouped to target different software builds, activating only during full scale blast and detonation runs and when simulated material density exceeds 30 grams per cubic centimeter. The malware spreads across local networks, avoids machines with certain security products, and appears to have been developed as early as 2005, predating known Stuxnet variants and indicating nation state level expertise.
Critical FunnelKit Vulnerability Puts 40,000+ WooCommerce Sites at Risk

gbhackers.com · 5 months ago

There is a critical vulnerability in FunnelKit’s Funnel Builder plugin that is being actively exploited, putting more than 40,000 WooCommerce sites at risk of payment data theft; the flaw affects all Funnel Builder versions prior to 3.15.0.3 and allows unauthenticated injection of arbitrary JavaScript into checkout pages. The issue stems from an insecure public checkout endpoint that permits requests to invoke internal methods without validating permissions, enabling attackers to alter the External Scripts setting and insert malicious script tags that execute on every checkout page. Observed campaigns disguise skimmers as legitimate analytics or Google Tag Manager code, use base64-encoded payloads to load external scripts, and establish WebSocket connections to retrieve and run payment skimmers that intercept and exfiltrate card numbers, CVVs, and billing details in real time. Immediate mitigations include updating Funnel Builder to version 3.15.0.3 or later, auditing and removing unfamiliar entries from the External Scripts setting, scanning sites with tools such as eComscan, and monitoring checkout behavior and logs for unauthorized changes.
Autonomous AI Penetration Testing with Consent-First Ethical Framework — Research Paper + Working Implementation

doi.org · 5 months ago

NULL
Crafted JPEGs Could Trigger PHP Memory Bugs for Exploitation

gbhackers.com · 5 months ago

There are two memory safety flaws in PHP's ext/standard image-handling functions: a heap memory disclosure in getimagesize() and a heap buffer overflow in iptcembed(). The getimagesize() issue, tracked as CVE-2025-14177 with a CVSS score of 6.3, is caused by improper handling of chunked reads of large JPEG APP segments that can overwrite buffer beginnings and leave tails uninitialized, enabling sensitive heap data leakage. The iptcembed() flaw results from allocating buffers based on fstat reported sizes while reading until EOF, allowing writes beyond allocated memory as demonstrated via FIFO streaming; both bugs have been patched by advancing buffer pointers and adding strict bounds checking, and teams are advised to validate image inputs, limit file sizes, and update PHP.
Hackers earn $1,298,250 for 47 zero-days at Pwn2Own Berlin 2026

www.bleepingcomputer.com · 5 months ago

The Pwn2Own Berlin 2026 contest concluded with security researchers collecting $1,298,250 after exploiting 47 zero-day flaws. The event ran at OffensiveCon from May 14 to May 16 and targeted fully patched web browsers, enterprise applications, local privilege escalation, servers, local inference, cloud native and container environments, virtualization, and large language model categories. DEVCORE won with 50.5 Master of Pwn points and $505,000 in rewards after chaining exploits against Microsoft SharePoint, Microsoft Exchange, Microsoft Edge, and Windows 11, while Cheng Da Tsai received the highest single prize of $200,000 for chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange. Vendors will have 90 days to issue patches before the Zero Day Initiative publicly discloses the flaws.
Grafana Labs Confirms Security Incident Involving GitHub Codebase Access

gbhackers.com · 5 months ago

Grafana Labs confirmed on May 17, 2026 that an unauthorized party obtained a compromised access token, accessed the company’s internal GitHub environment, and downloaded portions of the codebase. The company reported the breach was limited to its code environment with no evidence of customer data access or impact on customer systems, and it invalidated the token and launched a forensic investigation. The threat actor attempted to extort Grafana by threatening to release the stolen code, and Grafana refused to pay following FBI guidance against ransom payments. The incident highlights the risk posed by leaked credentials, the exposure of proprietary code for future vulnerability discovery, and the need for stricter credential management and repository monitoring.
Researchers Build First Public Apple M5 macOS Kernel Exploit with Mythos Preview

gbhackers.com · 5 months ago

Security researchers unveiled the first public macOS kernel memory corruption exploit targeting Apple M5 silicon that bypasses Memory Integrity Enforcement and compromises macOS 26.4.1 build 25E253 to achieve a full kernel compromise. The data only exploit starts from an unprivileged local user, uses only legitimate system calls to manipulate kernel memory structures and escalate to root while avoiding traditional code execution techniques, and it was developed using the AI assisted research system Mythos Preview with human refinement to bypass hardware mitigations. The team disclosed the findings to Apple in person on May 14, 2026, is holding technical details under embargo pending patches, and plans to publish a 55 page technical report after fixes are released, underscoring that hardware backed mitigations are not absolute as AI accelerates exploit discovery.
Malicious npm Packages Steal SSH Keys, Cloud Credentials, and Crypto Wallets

gbhackers.com · 5 months ago

A new supply chain attack in the npm ecosystem is stealing developer secrets by delivering infostealer malware through four malicious packages that collectively recorded over 2,600 weekly downloads. One package contains a near identical clone of the recently leaked Shai Hulud malware that harvests credentials, cryptocurrency wallets, and environment variables and exfiltrates them to attacker controlled servers. Other packages harvest SSH keys, cloud credentials for AWS, Google Cloud, and Azure, collect system and geolocation data, and one deploys a Go based phantom bot that establishes persistence and can turn infected machines into nodes for distributed denial of service attacks. Developers are advised to uninstall the packages, rotate any potentially exposed credentials, and scan for indicators such as the string A Mini Sha1 Hulud has Appeared to identify compromised environments.
Claude Code Vulnerability Allows Attackers to Run Commands Through Crafted Deeplinks

gbhackers.com · 5 months ago

A recently disclosed flaw in Claude Code allowed attackers to execute arbitrary system commands by invoking a single crafted deeplink, turning a convenience feature into a remote code execution vector. The issue was documented by security researcher Joernchen and has been fixed in Claude Code version 2.1.118. The vulnerability demonstrates how subtle command line interface parsing mistakes can enable remote code execution and highlights the risk of deeplink handling in developer tools.
Hackers Earn $1.3 Million at Pwn2Own Berlin 2026

www.securityweek.com · 5 months ago

Participants at Pwn2Own Berlin 2026 earned nearly 1.3 million dollars for demonstrating exploits across Windows, Linux, VMware, Nvidia, and multiple AI products. TrendAI’s Zero Day Initiative awarded 1,298,250 dollars for 47 unique vulnerabilities, with Devcore and StarLabs SG claiming nearly 750,000 dollars between them and the largest single payouts being 200,000 dollars for a Microsoft Exchange remote code execution and 200,000 dollars for a VMware ESX cross tenant code execution exploit. AI targets drew numerous rewards for hacks against LiteLLM, OpenAI Codex, LM Studio, Claude Code, NVIDIA Megatron Bridge, Chroma, and Ollama, while other bounties ranged from 2,500 dollars to 50,000 dollars for Red Hat Linux, Windows 11, NVIDIA components, and VMware. Eight attempts failed and some researchers who could not register disclosed their findings directly to vendors or began public disclosures.
Can Laws Stop Deepfakes? South Korea Aims to Find Out

www.darkreading.com · 5 months ago

There will be local elections in South Korea on June 3, 2026, and authorities will for the first time enforce two laws intended to curb AI generated deepfakes in political campaigns. Article 82-8 of the Public Official Election Act prohibits virtual sounds images and videos that are difficult to distinguish from reality for 90 days before an election and carries penalties of up to seven years imprisonment or fines between 10 million and 50 million Korean won. The AI Basic Act, effective January 2026, requires AI operators to clearly disclose generated content and allows administrative fines up to 30 million Korean won, and the National Police Agency has deployed a deepfake detection tool. Experts warn that regulation alone is unlikely to stop harm because deepfakes spread rapidly through encrypted messaging and other channels, so platform accountability detection infrastructure and media literacy are still needed.
New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released

www.bleepingcomputer.com · 5 months ago

A proof of concept exploit named MiniPlasma was released by a researcher called Chaotic Eclipse and allows local attackers to gain SYSTEM privileges on fully patched Windows systems. The exploit targets the cldflt.sys Cloud Filter driver and its HsmOsBlockPlaceholderAccess routine by abusing registry key creation through an undocumented CfAbortHydration API, reproducing a flaw originally reported to Microsoft by James Forshaw in September 2020 that was assigned CVE-2020-17103 and reportedly fixed in December 2020. Testing on a fully patched Windows 11 Pro system showed the exploit opened a SYSTEM command prompt, and independent analysis confirmed it works on current public Windows 11 builds but not on the latest Insider Canary build. The disclosure is part of a recent series of Windows zero day releases by the same researcher that include BlueHammer tracked as CVE-2026-33825 and other exploits.
Ansible security and compliance guide

slicker.me · 5 months ago

There are security architecture priorities for Ansible that recommend running the control node on a dedicated hardened bastion, restricting ansible.cfg permissions, pinning Ansible and collection versions, and tightly managing SSH keys with modern algorithms such as Ed25519. There are guidance and examples for secrets management that advise using Ansible Vault for repository encryption, separating secrets with multiple vault IDs, avoiding passing secrets via extra vars, and preferring runtime secret retrieval from dedicated secret managers via lookup plugins. There are privilege escalation controls emphasizing least privilege by default, limiting become usage to necessary tasks, restricting sudoers to specific commands, and using becomeuser to escalate to service accounts rather than root. There are recommendations to automate OS hardening and compliance with community collections and OpenSCAP, to run static analysis and CI gates with ansible-lint and Molecule, and to enforce RBAC and credential isolation in Automation Controller to reduce exposure.
Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing

www.bleepingcomputer.com · 5 months ago

Tycoon2FA now supports device code phishing and abuses Trustifi click tracking URLs to hijack Microsoft 365 accounts. Attackers obtain an OAuth device code, trick victims into entering it in Microsoft’s legitimate device login flow, then receive access and refresh tokens that register an attacker controlled device and grant unrestricted access to email calendar and cloud storage. The kit rebounded after a March takedown and now uses multiple obfuscation and anti analysis layers including a large vendor blocklist and redirects to legitimate pages for analysis environments, and defenders are advised to disable the OAuth device code flow when not needed restrict OAuth consent require admin approval for third party apps enable Continuous Access Evaluation and monitor authentication logs.
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE

thehackernews.com · 5 months ago

A heap buffer overflow in the ngxhttprewritemodule impacting NGINX Open and NGINX Plus versions 0.6.27 through 1.30.0 is being actively exploited in the wild and is tracked as CVE-2026-42945 with a CVSS score of 9.2. Successful exploitation can crash worker processes and may yield remote code execution, but reaching RCE requires a specific NGINX configuration and systems with Address Space Layout Randomization disabled, making RCE nontrivial in default deployments while the worker-crash denial of service remains an urgent risk. Threat intelligence also shows attacks targeting openDCIM flaws including CVE-2026-28515, CVE-2026-28517, and the related CVE-2026-28516, which can be chained to achieve remote code execution and have been probed by automated scanning that drops web shells.
Instrumenting QT6 desktop apps with Frida - Part 2: Building the Bypass Chain

blog.samanl33t.com · 5 months ago

There are three bypasses demonstrated against a Qt6 desktop app called HackPass using Frida: enabling premium features without a license, bypassing TLS pinning by turning on TOFU re-learning, and disabling the app hardening subsystem. The author shows Frida helper scripts that scan process memory for QObject instances, call QINVOKABLE methods such as setPremium and setAllowTofuLearning, and write QPROPERTY values via Qt's qtmetacall to flip the hardening enabled flag. A single chain script runs the sequence end to end, but the TLS bypass also requires clearing the app's stored TOFU certificate so the re-learn can pin a proxy certificate, and the premium flip is temporary unless repeated because the backend re-evaluates license status.
Grafana GitHub Token Breach Led to Codebase Download and Extortion Attempt

thehackernews.com · 5 months ago

An unauthorized party obtained a token that allowed access to Grafana's GitHub environment and enabled downloading of the company's codebase. Grafana's investigation found no customer data or personal information was accessed and reported no evidence of impact to customer systems or operations. The attacker attempted to extort the company by threatening to publish the stolen data, and Grafana declined to pay while involving the Federal Bureau of Investigation, invalidating the compromised credentials and implementing additional security measures. Reports indicate a group calling itself CoinbaseCartel claimed responsibility and is described as a data extortion crew linked to ShinyHunters Scattered Spider and LAPSUS, but Grafana did not disclose when the incident occurred or which repositories were accessed.