Blahalla

Attackers Weaponize RubyGems for Data Dead Drops

www.darkreading.com · 5 months ago

Threat actors are publishing RubyGems packages that act as dead drops by embedding scraped data from public facing UK government servers. Researchers report the campaign, dubbed GemStuffer, includes more than one hundred gems that scrape council calendar and agenda pages from Lambeth, Wandsworth, and Southwark and then upload the data as gem archives using hardcoded RubyGems credentials. Attackers later download the packages from RubyGems and extract the data without needing a command and control server, and the activity is characterized as noisy and possibly a test or proof of concept rather than a mature stealth operation. Recommended mitigations include auditing temporary folders for artifacts, identifying delivery vectors for any installed packages, and locking down which developer machines and CI jobs are permitted to publish to public registries to prevent unauthorized gem pushes.
Fortinet fixes two critical RCE flaws in FortiAuthenticator and FortiSandbox

www.csoonline.com · 5 months ago

There are two critical remote code execution vulnerabilities in Fortinet products, both with a CVSS severity score of 9.1, that allow unauthenticated attackers to execute arbitrary code. They are tracked as CVE-2026-44277 affecting FortiAuthenticator and CVE-2026-26083 affecting FortiSandbox. FortiAuthenticator users should upgrade to FortiAuthenticator versions 6.5.7, 6.6.9, or 8.0.3, and FortiSandbox users should upgrade to version 4.4.9 or 5.0.2 depending on their release. Both flaws were discovered internally with no evidence of exploitation in the wild yet, but organizations are urged to patch promptly because previous Fortinet flaws including CVE-2026-21643 and other authenticated vulnerabilities CVE-2025-53844, CVE-2025-53870, and CVE-2025-53680 have been patched or observed exploited recently.
Tables Turn on 'The Gentlemen' RaaS Gang With Data Leak

www.darkreading.com · 5 months ago

An OPSEC failure on or just before May 4, 2026 exposed The Gentlemen ransomware operation, with an anonymous group selling roughly sixteen gigabytes of its internal communications and tooling for ten thousand dollars in Bitcoin and releasing a forty four megabyte proof sample. Analysis shows The Gentlemen published sensitive data belonging to around three hundred thirty two organizations in the first five months of 2026, making it the second most productive ransomware group so far this year behind Qilin. The leak reveals a tight corporate style structure led by an administrator known as zeta88, operators qbit and quant who focus on reconnaissance and access, a generous ninety percent to ten percent payout split favoring lower level collaborators, and a mature toolset that leverages about thirty tools, known critical vulnerabilities, VPNs scanners remote access tools EDR evasion techniques including bring your own vulnerable driver tactics, and experimentation with large language models to assist code development. Researchers say the breach is a reputational hit but is unlikely to significantly disrupt the gang's operations or reveal any unique technical advantage that would markedly change the ransomware ecosystem.
On vendor disclosure timelines, bounty programme incentive misalignment, and the psychological contract

stuart-thomas.com · 5 months ago

There are two Apple vulnerabilities confirmed for remediation in Fall 2026, each described as locally or conditionally exploitable, mitigable now, and fixable with low complexity. There are ethical concerns raised about vendor disclosure timelines, arguing that honoring agreements in letter but not spirit delays remedies, that the 90 day norm exists for good reasons backed by Project Zero data, and that indefinite vendor windows often increase time to fix. There are also structural incentive problems where bounties marked pending review function like hush arrangements with variable payouts, which motivated publishing the disclosures ahead of the vendor window to put the rationale on the record.
New critical Exim mailer flaw allows remote code execution

www.bleepingcomputer.com · 5 months ago

There is a critical user-after-free vulnerability in Exim that can be triggered during TLS shutdown while handling BDAT chunked SMTP traffic and can enable unauthenticated remote code execution. It is tracked as CVE-2026-45185 and impacts Exim builds compiled with GnuTLS in versions 4.97 through 4.99.2 while OpenSSL-based builds are not affected. A patch is available in Exim version 4.99.3 and administrators should apply updates through their distribution package managers.
/sbin/ping -G sweepmax has no bounds check on macOS: deterministic BSS out-of-bounds write, confirmed by Apple

stuart-thomas.com · 5 months ago

A missing bounds check in the ping utility's -G sweepmax option allows the fill loop to write past the 65535 byte global buffer in BSS, producing a byte precise out of bounds write fully controllable by the sweepmax value. Testing on macOS 26.4.1 arm64e shows the write pattern is deterministic, with the byte at offset N set to N minus one modulo 256, and sweepmax 65637 overwrites a static socket file descriptor causing subsequent setsockopt calls to fail with EBADF and the process to exit with code 71 while sweepmax 65636 runs clean. At larger sweepmax values the loop reaches pointer type globals, enabling write what where primitives on x8664 and demonstrable state corruption on arm64e, but because ping is not setuid on macOS 11 and later the impact is local only; Apple confirmed the issue on April 16, 2026 and plans a fix for Fall 2026 consisting of adding a symmetric maxpayload bounds check.
Apple's smbd has no FSCTL_SRV_COPYCHUNK limit enforcement: 256 bytes in, 64 GiB disk I/O out

stuart-thomas.com · 5 months ago

Apple's smbd implementation fails to enforce the three MS-SMB2 limits for FSCTLSRVCOPYCHUNK, accepting 65,535 chunks instead of 256, accepting chunk sizes of 1,048,577 bytes instead of one mebibyte, and accepting total data of about 17 megabytes instead of 16 megabytes, with all tests returning a success status rather than the specification's invalid parameter status. An attacker with a single authenticated SMB session can send one small IOCTL that causes smbd to perform roughly sixty five thousand five hundred thirty five reads and writes of one mebibyte each, totaling about sixty four gibibytes of disk input output and leading to a denial of service because the allocator retry loop does not fail cleanly. Default macOS is not exposed when File Sharing is turned off, mitigations are available for systems with SMB sharing enabled, and disassembly shows the server copies the unbounded chunk count from the parsed structure and increments through a copy loop that only bails on zero rather than checking the required 256 chunk limit. The issue carries a CVSS version three point one score of six point five and was confirmed by Apple on April twenty fifth two thousand twenty six with a fix scheduled for Fall two thousand twenty six.
Fuel Prices Drive Sales of E.V.s, Just Not in the U.S.

www.nytimes.com · 5 months ago

There are widespread reports that gasoline prices jumped after the war in Iran, prompting many drivers to reconsider fuel costs and look at electric alternatives. Registrations of battery electric vehicles in major European markets rose sharply, with some datasets showing about a fifty one percent increase in March as pump prices climbed. In the United States consumers remain more hesitant because higher upfront EV prices, concerns about range and charging, and weaker incentives have kept electric market share far lower than in Europe and China.
Dark Reading Celebrates 20 Years as a Leading Authority on Cybersecurity, Highlighting the People, Events, Ideas, and Technologies Shaping the Modern Risk Landscape

www.darkreading.com · 5 months ago

There are celebrations marking Dark Reading's 20th anniversary, noting the brand was founded in May 2006 and is part of Informa TechTarget. The information says a special May 2026 content series will feature first‑person accounts, retrospectives on major cyber incidents and vendors, a 20th anniversary video, a special podcast episode, reader contests, and social media activations. The information emphasizes Dark Reading's role as a trusted source for cybersecurity professionals and highlights Informa TechTarget's cybersecurity audience network of more than 2.5 million decision makers.
Notable Researchers Join $4 Billion Effort to Build Self-Improving A.I.

www.nytimes.com · 5 months ago

Reports say Recursive Superintelligence, a London based startup founded by former DeepMind, OpenAI and other lab researchers including Tim Rocktäschel and Richard Socher, raised at least 500 million dollars in a financing round led by GV with participation from Nvidia. The company aims to automate the research pipeline so systems can design, train and evaluate successor models, pursuing recursive self improvement to speed AI development. The startup was incorporated in late December 2025 and reached a reported pre money valuation near four billion dollars within months, making it one of the fastest scaled frontier AI financings this cycle.
Microsoft’s Patch Tuesday Update Targets 120 Security Flaws

www.techrepublic.com · 5 months ago

Microsoft patched 120 vulnerabilities across Windows and other products, including 31 remote code execution flaws and 61 privilege elevation issues. No vulnerabilities were reported as actively exploited at release, but three high risk remote code execution flaws to watch are CVE-2026-35421, CVE-2026-40365, and CVE-2026-41096. Administrators are advised to prioritize deploying the May cumulative updates and security patches because attackers often reverse engineer fixes to build exploits against unpatched systems.
Google Launches New Android Security Features to Fight Scams, Theft

www.techrepublic.com · 5 months ago

Google is rolling out a major Android security upgrade in 2026 that includes verified financial calls which check incoming calls against installed banking apps and can automatically terminate fake bank calls, and banks can label numbers as inbound only to block outgoing impersonations. Android’s Live Threat Detection will expand to flag apps that secretly forward SMS messages, abuse accessibility permissions, or hide their app icons, with dynamic signal monitoring on Android 17 and Safe Browsing scanning APK downloads in Chrome. New spyware and forensic protections include Intrusion Logging to create encrypted forensic logs for investigating compromises, while theft protections will require biometric authentication to regain lost devices, hide quick settings, and add stronger limits on failed PIN attempts as the rollout expands globally. Additional privacy measures include temporary precise location sharing while an app is open, hiding one time passwords from most apps for up to three hours, Android OS verification to detect fake builds, and a public cryptographic ledger to verify official apps as Android 17 approaches release.
Foxconn Confirms North American Factories Hit by Cyberattack

www.securityweek.com · 5 months ago

Foxconn confirmed that some North American factories were hit by a cyberattack and that its cybersecurity team immediately activated response measures to ensure continuity of production and delivery. The Nitrogen ransomware group, active since late 2024, claims to have listed Foxconn on its leak site and to have stolen about eight terabytes of data comprising more than 11 million files, including confidential documents and schematics tied to customers such as Intel, Apple, Google, Dell, and Nvidia. Foxconn said affected factories are resuming normal production while the threat actor continues to pressure victims with file encryption and data theft.
Silicon Valley’s A.I. Lobbying Blitz Reaches a Fever Pitch

www.nytimes.com · 5 months ago

OpenAI and Anthropic have opened Washington offices, hired lobbyists and sharply increased political spending to influence federal lawmakers on AI policy and government procurement. Both reported their biggest lobbying quarters in the first quarter of 2026, with Anthropic spending about $1.6 million and OpenAI about $1.0 million, and Anthropic has filed to create a political action committee to make campaign contributions. Their Washington push centers on shaping procurement rules, acceptable defense uses and frontier-model regulation even as Anthropic is engaged in a legal dispute with the Department of Defense over a supply chain risk designation.
Microsoft Teams Vulnerability Allows Hackers to Perform Spoofing Attacks

gbhackers.com · 5 months ago

A newly discovered flaw in Microsoft Teams for Android, tracked as CVE-2026-32185, allows attackers with local access and active user interaction to exploit improperly secured files and carry out spoofing attacks that can expose sensitive corporate information. Microsoft rates the vulnerability Important with a CVSS 3.1 base score of 5.5 and identifies the root cause as CWE-552 where exposed files or directories are accessible to unauthorized parties, with successful exploitation having a high impact on confidentiality but not affecting integrity or availability. Microsoft released an official fix on May 12, 2026, updating Teams to build 1.0.0.2026092103 or later via the Google Play Store and rates exploitability as less likely, with no known active exploitation or public exploit code reported. The issue was responsibly reported by researcher Ofek Levin of Enclave.
Windows BitLocker zero-day gives access to protected drives, PoC released

www.bleepingcomputer.com · 5 months ago

A researcher published proof of concept exploits for two unpatched Windows vulnerabilities named YellowKey and GreenPlasma, with YellowKey functioning as a BitLocker bypass that can place specially crafted FsTx files on attached storage or the EFI partition, boot into the Windows Recovery Environment, spawn a command shell, and access volumes protected by TPM only BitLocker without credentials. GreenPlasma is a local privilege escalation vulnerability that allows creation of arbitrary memory section objects inside writable directory objects, which can be leveraged to manipulate privileged services or drivers and escalate to SYSTEM, although the leaked proof of concept is incomplete. The researcher previously disclosed BlueHammer which is tracked as CVE-2026-33825 and has criticized Microsofts coordinated disclosure process while promising further exploit leaks.
Google Enhances Android Mobile Security with New AI-powered Protections

gbhackers.com · 5 months ago

There is a major Android security upgrade in Android 17 rolling out through 2026 that deploys AI powered defenses to fight mobile fraud, stealthy spyware, and device theft. New features include verified financial calls that consult banking apps and terminate spoofed calls, Live Threat Detection that hunts malicious code in real time, and Chrome scanning of APKs before installation. Stolen device protections add a biometric mark as lost, default on theft detection lockdown, aggressive brute force throttling, and lock screen IMEI visibility to aid recovery, while Advanced Protection introduces persistent intrusion logging for forensic tracking. Privacy and integrity measures include cryptographic OS verification for Pixel devices, automatic three hour OTP cloaking to block apps from reading two factor messages, granular temporary permissions, hardware isolation via AISeal with pKVM, carrier options to disable 2G, and preparation for post quantum cryptography.
Microsoft Releases Cumulative Update for Windows 11, Version 25H2 and 24H2

gbhackers.com · 5 months ago

Microsoft released May 2026 Patch Tuesday cumulative updates KB5089549 for Windows 11 versions 25H2 and 24H2 raising builds to 26200.8457 and 26100.8457, and KB5087420 for version 23H2 updating build to 22631.7079. These mandatory updates fix multiple security issues including a heap based buffer overflow in Windows DNS tracked as CVE-2026-41096 and a flaw in Windows Message Queuing tracked as CVE-2026-34329, and expand automatic distribution of Secure Boot certificates using phased device targeting. The packages also resolve a boot manager problem that could force devices into BitLocker recovery, stabilize service discovery and connectivity, include updated Servicing Stack components and AI core component versions, and enhance Microsoft Defender SmartScreen to send file hashes for unsigned files. Administrators are advised to allow these updates to install automatically via Windows Update or Microsoft Update for Business to ensure systems receive the security fixes and servicing stack updates.
Microsoft, Palo Alto Networks Find Many Vulnerabilities by Using AI on Their Own Code

www.securityweek.com · 5 months ago

There are findings that Microsoft and Palo Alto Networks used frontier AI models to scan their own code and discovered numerous vulnerabilities. Microsoft's MDASH recovered 16 of the vulnerabilities addressed in the May 2026 Patch Tuesday updates, including four rated critical such as unauthenticated remote code execution flaws in the Windows kernel TCP IP stack and the IKEv2 service, and MDASH recovered 96 percent and 100 percent of confirmed vulnerabilities in two audited components while scoring 88 percent on the public CyberGym benchmark; MDASH is in limited private preview. Palo Alto Networks used Claude Mythos and other frontier models to scan more than 130 products, published 26 advisories covering 75 vulnerabilities with none rated critical and three high severity issues requiring specific configurations to exploit, and warned organizations may have only a three to five month window to outpace adversaries as AI scanning becomes widespread.
CVE-2026-0243 Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through IPv6 Crafted Packet (Severity: MEDIUM)

security.paloaltonetworks.com · 5 months ago

There is a denial of service vulnerability identified as CVE-2026-0243 that affects Prisma SD-WAN ION devices and can be triggered by an unauthenticated attacker on an adjacent network sending a specially crafted IPv6 packet. The weakness stems from unchecked input for a loop condition and carries a CVSS score of 4.9 with no known public exploitation. Affected builds include Prisma SD-WAN ION 6.5 versions earlier than 6.5.3-b15, 6.4 versions earlier than 6.4.3-b8, and 6.3 versions earlier than 6.3.6-b10, and the vendor recommends upgrading to the fixed builds or disabling IPv6 if it is not required.
CVE-2026-0242 Trust Protection Foundation: SQL Injection Vulnerability (Severity: MEDIUM)

security.paloaltonetworks.com · 5 months ago

There is a SQL injection vulnerability tracked as CVE-2026-0242 in Trust Protection Foundation that allows an authenticated attacker to execute arbitrary SQL commands against the product database, potentially disclosing sensitive data, altering database contents, and escalating privileges to full administrative control. The issue is rated medium severity with a CVSS score of 6.1 and the vendor reports no known malicious exploitation as of May 13, 2026. Affected releases include Trust Protection Foundation versions 25.3.0 through 25.3.2, 25.1.0 through 25.1.7, 24.3.0 through 24.3.5, and 24.1.0 through 24.1.12, and administrators are advised to upgrade to fixed versions 25.3.3, 25.1.8, 24.3.6, or 24.1.13 or later.
CVE-2026-0241 Trust Protection Foundation: Multiple Authorization Bypass Vulnerabilities (Severity: MEDIUM)

security.paloaltonetworks.com · 5 months ago

There is a medium severity authorization bypass vulnerability tracked as CVE-2026-0241 in Trust Protection Foundation that can allow attackers to bypass access controls and perform unauthorized actions on restricted resources. The issue affects Trust Protection Foundation versions 25.3.0 through 25.3.2, 25.1.0 through 25.1.7, 24.3.0 through 24.3.5, and 24.1.0 through 24.1.12, and the vendor recommends upgrading to patched releases such as 25.3.3, 25.1.8, 24.3.6, or 24.1.13. No specific configuration is required for exposure, no known workarounds exist, and the vendor reports no observed malicious exploitation as of the advisory published on May 13, 2026.
CVE-2026-0245 Prisma Access Agent: Information Disclosure Vulnerabilities (Severity: MEDIUM)

security.paloaltonetworks.com · 5 months ago

There is an information disclosure vulnerability tracked as CVE-2026-0245 in the Prisma Access Agent that allows a local user to access sensitive configuration data and credentials. The issue affects Prisma Access Agent on macOS and Windows versions from 24.0 up to but not including 26.2.1, while Linux, Android, Chrome OS, and iOS are not affected. The vendor rates the severity as medium with a CVSS score of 4.3, reports no known exploitation, and advises upgrading affected macOS and Windows installations to 26.2.1 or later with no known workarounds.
CVE-2026-0248 Prisma Access Agent: Improper Certificate Validation Vulnerability (Severity: MEDIUM)

security.paloaltonetworks.com · 5 months ago

There is an improper certificate validation vulnerability in the Prisma Access Agent for Android and Chrome OS that allows a man in the middle attacker to intercept VPN traffic, recorded as CVE-2026-0248. Affected versions include Prisma Access Agent on Android and Chrome OS earlier than 26.2.1, and the recommended remediation is to upgrade to version 26.2.1 or later; macOS, Windows, Linux and iOS builds are not affected. The issue is rated Medium with a CVSS score of 6.2, Palo Alto Networks reports no known active exploitation, and no workaround is available. The vulnerability was discovered internally and published on May 13, 2026.
PAN-SA-2026-0007 Chromium and Prisma Browser: Monthly Vulnerability Update (May 2026) (Severity: MEDIUM)

security.paloaltonetworks.com · 5 months ago

Palo Alto Networks incorporated Chromium security fixes into its products and issued a Prisma Browser update on May 13, 2026 to address multiple memory corruption, use after free, integer overflow, buffer overflow, policy bypass, and implementation vulnerability classes with severity rated medium and suggested urgency moderate. Affected Prisma Browser builds vary by vulnerability with fixes applied to builds 146.10.7.154, 146.16.6.165, 146.16.9.178, 147.15.6.102, 147.21.3.117, 147.28.2.138, and 148.6.3.96, and no special configuration is required for exposure. The CVEs addressed include CVE-2026-4439, CVE-2026-4440, CVE-2026-4441, CVE-2026-4442, CVE-2026-4443, CVE-2026-4444, CVE-2026-4445, CVE-2026-4446, CVE-2026-4447, CVE-2026-4448, CVE-2026-4449, CVE-2026-4450, CVE-2026-4451, CVE-2026-4452, CVE-2026-4453, CVE-2026-4454, CVE-2026-4455, CVE-2026-4456, CVE-2026-4457, CVE-2026-4458, CVE-2026-4459, CVE-2026-4460, CVE-2026-4461, CVE-2026-4462, CVE-2026-4463, CVE-2026-4464, CVE-2026-4673, CVE-2026-4674, CVE-2026-4675, CVE-2026-4676, CVE-2026-4677, CVE-2026-4678, CVE-2026-4679, CVE-2026-4680, CVE-2026-5272, CVE-2026-5273, CVE-2026-5274, CVE-2026-5275, CVE-2026-5276, CVE-2026-5277, CVE-2026-5278, CVE-2026-5279, CVE-2026-5280, CVE-2026-5281, CVE-2026-5282, CVE-2026-5283, CVE-2026-5284, CVE-2026-5285, CVE-2026-5286, CVE-2026-5287, CVE-2026-5288, CVE-2026-5289, CVE-2026-5290, CVE-2026-5291, CVE-2026-5292, CVE-2026-5876, CVE-2026-5881, CVE-2026-5884, CVE-2026-5886, CVE-2026-5893, CVE-2026-5909, CVE-2026-5914, CVE-2026-5919, CVE-2026-6305, CVE-2026-6361, CVE-2026-6921, CVE-2026-7343, CVE-2026-7359, CVE-2026-7361, CVE-2026-7363, CVE-2026-7981, CVE-2026-8018, CVE-2026-8022, CVE-2026-0237, CVE-2026-0236, and CVE-2026-0235.
CVE-2026-0238 Broker VM: Improper Input Validation in Broker VM Certificate and Key Fields (Severity: LOW)

security.paloaltonetworks.com · 5 months ago

A vulnerability identified as CVE-2026-0238 in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certificate and key fields. The issue affects Broker VM versions 30.0.0 through 30.0.23, requires no special configuration to be exposed, and administrators are advised to upgrade to 30.0.24 or later because no workarounds exist. Severity is rated low with suggested urgency moderate and a CVSS base score of 4.8, exploit maturity is unreported, and there is no known malicious exploitation.
CVE-2026-0244 Prisma SD-WAN: Improper Certificate Validation Vulnerability (Severity: MEDIUM)

security.paloaltonetworks.com · 5 months ago

There is an improper certificate validation vulnerability identified as CVE-2026-0244 in Prisma SD-WAN ION that can enable a man in the middle attacker to impersonate the controller. The issue is rated Medium with a CVSS base score of 5.2, requires no special configuration to be exposed, and the vendor reports no known malicious exploitation to date. Affected ION releases older than 6.5.3-b15, 6.4.3-b8, and 6.3.6-b10 should be upgraded to those builds or later, no effective workarounds are available, and recovery requires applying the vendor fixes.
CVE-2026-0240 Trust Protection Foundation: Sensitive Information Disclosure Vulnerability (Severity: MEDIUM)

security.paloaltonetworks.com · 5 months ago

CVE-2026-0240 is an information disclosure vulnerability in Trust Protection Foundation that allows an authenticated attacker to obtain sensitive vault data, impersonate any user, and modify configuration settings. Severity is rated medium with a base CVSS score of 7.4 and suggested urgency of moderate, exploitation maturity is unreported and Palo Alto Networks is not aware of active exploitation. Affected releases include Trust Protection Foundation versions 25.3.0 through 25.3.2, 25.1.0 through 25.1.7, 24.3.0 through 24.3.5, and 24.1.0 through 24.1.12 and users are advised to upgrade to versions 25.3.3, 25.1.8, 24.3.6, or 24.1.13 respectively; no known workarounds exist.
CVE-2026-0239 Chronosphere Chronocollector Information Disclosure Vulnerability (Severity: MEDIUM)

security.paloaltonetworks.com · 5 months ago

There is an information disclosure vulnerability tracked as CVE-2026-0239 in Chronosphere Chronocollector that allows an unauthenticated attacker with network access to the collector to retrieve sensitive information. The issue is rated medium with a CVSS score of 4.9 and a related base score of 7.1, requires no privileges or user interaction, and has low attack complexity with an adjacent network attack vector. Systems running Chronocollector versions earlier than 0.116.0 are affected, there are no known workarounds, and operators are advised to upgrade to version 0.116.0 or later, with the advisory published on May 13, 2026.
CVE-2026-0246 Prisma Access Agent: Local Privilege Escalation Vulnerability (Severity: MEDIUM)

security.paloaltonetworks.com · 5 months ago

There is a local privilege escalation vulnerability tracked as CVE-2026-0246 in the Prisma Access Agent that enables a locally authenticated non administrative user to escalate to root on macOS and Linux or to NT AUTHORITY SYSTEM on Windows and thereby execute arbitrary code and read sensitive information. Versions prior to 26.2.1 on Linux, macOS and Windows are affected, while Android, Chrome OS and iOS are not, and no special configuration is required for exposure. The issue is rated medium with a CVSS base score of 5.9, no known malicious exploitation has been observed, there are no known workarounds, and the recommended mitigation is to upgrade affected agents to version 26.2.1 or later.
CVE-2026-0247 Prisma Access Agent Endpoint DLP: Authorization Bypass Vulnerabilities (Severity: MEDIUM)

security.paloaltonetworks.com · 5 months ago

There are multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent that allow a local attacker to bypass authentication controls and execute privileged operations under CVE-2026-0247. Affected releases include Prisma Access Agent Endpoint DLP versions starting at 25.0 up to but excluding 26.2.1 on macOS and Windows, and exposure requires Endpoint DLP to be enabled; the vendor recommends upgrading to 26.2.1 or later. The issues are rated MEDIUM with a CVSS score of 5.9, are local with low attack complexity and low privileges required, there is no evidence of active exploitation and no known workarounds exist.
On-prem vs IaaS vs PaaS vs SaaS for self-hosted IAM (Keycloak case study)

www.cloud-iam.com · 5 months ago

There are five deployment models for Keycloak including on premises, IaaS, PaaS, cloud marketplace images, and SaaS, and the primary difference is who must manage operational complexity. Self managed deployments require teams to provision and maintain servers, production databases, Infinispan clustering, connection pooling, TLS and load balancers, plus perform upgrades, database migrations, and deep Keycloak troubleshooting to prevent outages. Marketplace and PaaS offerings reduce initial infrastructure work but still leave upgrades, migrations, cache configuration, extension compatibility, monitoring, and security patching as customer responsibilities. SaaS shifts database provisioning, caching, upgrades, patching, monitoring, high availability, and incident response to the provider so internal staff can focus on IAM configuration, federation, and application integration.
Webinar tomorrow: Why security alone won't stop modern attacks

www.bleepingcomputer.com · 5 months ago

Modern cyberattacks increasingly bypass defenses, disrupt operations, and delay recovery by using AI driven phishing, ransomware, SaaS abuse, business email compromise, trusted infrastructure, and highly personalized campaigns. Organizations that rely on prevention alone often struggle to contain incidents quickly and face prolonged downtime, higher recovery costs, and operational disruption. Combining prevention, detection, backups, and rapid recovery across environments is essential for cyber resilience, with SaaS backups and business continuity and disaster recovery planning highlighted as critical layers, and an upcoming webinar with Kaseya experts will examine practical steps to strengthen resilience.
Microsoft fixes BitLocker recovery issue only for Windows 11 users

www.bleepingcomputer.com · 5 months ago

There is a known issue causing some systems to boot into BitLocker recovery after installing the April 2026 Windows security updates, which Microsoft acknowledged on April 14, 2026. The problem occurs on devices using an unrecommended BitLocker Group Policy configuration and certain TPM validation settings, including invalid PCR7 configurations, and it can require users to enter their BitLocker recovery key. Microsoft released the KB5089549 cumulative update to fix the issue for Windows 11 25H2 only, while Windows 10 and Windows Server customers must wait for a future permanent resolution, and administrators are advised to remove the Configure TPM platform validation profile for native UEFI firmware configurations Group Policy and ensure BitLocker bindings use the PCR7 profile before deploying the April 2026 updates.
Apricorn stuffs a 2TB SSD into a hardware encrypted USB key

nerds.xyz · 5 months ago

Apricorn's Aegis Secure Key 3.0 replaces traditional flash with a mini SSD architecture that scales up to two terabytes and offers read speeds up to 210 megabytes per second and write speeds up to 220 megabytes per second. The device includes hardware based encryption, PIN keypad authentication that requires no software, tamper resistant construction, and a protection circuit that shuts the drive down if temperature or electrical conditions become unsafe and then powers back on after conditions stabilize without damaging stored data. The company has submitted the model for FIPS 140-3 Level 3 validation through the NIST Cryptographic Module Validation Program and pricing starts at 159 dollars for the 16 gigabyte model.
Sweet Security Launches Agentic AI Red Teaming to Counter ‘Mythos Moment’

www.securityweek.com · 5 months ago

There is a new platform called Sweet Attack from Sweet Security that uses runtime intelligence and continuous agentic AI red teaming to identify exploitable attack chains human teams may miss. The system indexes runtime topology, unencrypted Layer 7 exposure, deployed source code, identity paths, and live application behavior to maintain a context rich model of each customer environment, enabling agents to reason over real attack paths rather than theoretical ones. Sweet Attack continuously discovers shadow IT and shadow AI components and reevaluates attack paths as new runtime assets appear, providing prioritized remediation actions and reportedly enabled one customer to close exploitable chains within two hours. The product is designed to help defenders match the speed of AI assisted attackers and is available now to Sweet Security customers.
A stealth approach to Process Injection - EntryPoint Hijacking

ipurple.team · 5 months ago

EntryPoint Hijacking is a stealthy code injection technique that writes arbitrary code into a process and patches the EntryPoint of legitimate DLLs so the code executes when the loader invokes DllMain, avoiding creation of new threads and helping attackers evade EDRs. Public proofs of concept include EPI released in 2023 and LdrShuffle demonstrated at x33fcon 2025, both patching kernelbase.dll EntryPoint and using thread pool or remote injection via the PEB and NtQueryInformationProcess while restoring the EntryPoint quickly to reduce the detection window. Effective detection relies on continuous integrity checks of PEB loader structures and telemetry that flags conditions such as an EntryPoint address outside the DllBase range, the EntryPoint memory type changing from image to private, or an invalid OriginalBase, and tools like LdrShuffleDetect can scan periodically and alert on these anomalies while organizations should include this technique in purple team testing and forward endpoint telemetry to SIEM for early detection.
Microsoft fixes Windows Autopatch bug installing restricted drivers

www.bleepingcomputer.com · 5 months ago

A bug in Windows Autopatch caused driver updates that administrative policies had restricted to be deployed on a limited subset of Autopatch managed Windows 11 client devices in the European Union, affecting versions 25H2, 24H2 and 23H2. Impacted systems installed recommended driver updates without administrator approval and experienced unexpected behavior including reboots and, in some cases, system failures depending on the drivers installed. Microsoft applied a service side fix to resolve the issue and stated that no client side updates or further action from customers are required.
Hackers Claim 11M Files Stolen From Foxconn, Supplier to Apple and Nvidia

www.techrepublic.com · 5 months ago

Foxconn confirmed that some of its North American factories suffered a cyberattack after the ransomware group Nitrogen claimed to have stolen 11 million files, reportedly about eight terabytes, linked to projects for Apple, Nvidia, Google, Dell, and Intel. The leaked cache is said to include confidential instructions, project documentation, and technical drawings that could expose how components are built and integrated, raising risks of counterfeit production and competitive leakage. Foxconn said its cybersecurity team activated response measures and that affected factories are resuming normal production while declining to confirm whether customer information was taken.
Canvas Breach Hackers Reach Deal After Claiming 275M Records Stolen

www.techrepublic.com · 5 months ago

Hackers behind the Canvas breach claimed they stole data tied to nearly nine thousand schools and 275 million people and reached a deal with Canvas parent company Instructure to stop further publication or extortion. Instructure said the stolen data was returned and that it received digital confirmation that remaining copies were destroyed, while acknowledging there is no way to verify every copy was deleted and not confirming whether a ransom was paid. Exposed fields included usernames, email addresses, course names, enrollment information, and messages, while core learning data such as course content, submissions, and credentials were not compromised, and the company identified and temporarily disabled an exploited vulnerability in its Free for Teacher support tickets.
Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday

thehackernews.com · 5 months ago

A new multi model artificial intelligence system called MDASH is designed to autonomously discover, validate, and prove exploitable defects in complex codebases by orchestrating more than one hundred specialized AI agents across an ensemble of frontier and distilled models and distinct pipeline stages. MDASH is being tested by some customers in a limited private preview and uses auditor, debater, and prover agent roles to build threat models, flag candidate issues, validate findings, group semantically equivalent results, and produce validated, proven findings. The system reportedly identified sixteen vulnerabilities fixed in the May 2026 Patch Tuesday release, including CVE 2026 33824, a double free in ikeext.dll with a CVSS score of 9.8 that can lead to remote code execution, and CVE 2026 33827, a race condition in tcpip.sys affecting IPv6 and IPSec with a CVSS score of 8.1 that can also enable remote code execution.
What happens when China’s AI catches up to Mythos?

www.csoonline.com · 5 months ago

The Trump Xi summit opening in Beijing this week includes an unprecedented agenda item on artificial intelligence that can autonomously find and exploit vulnerabilities in major operating systems and browsers. Anthropic's Mythos Preview has demonstrated the ability to discover zero day vulnerabilities that survived decades of human review, prompting Project Glasswing and one hundred million dollars in usage credits to give defenders early access while the model risks leaking to unauthorized users. Recent data show the US performance lead over Chinese models has narrowed substantially, China leads in AI patents and research output, and the flow of AI talent to the United States has dropped sharply, eroding Washington's strategic buffer. Policymakers are weighing deconfliction channels, guardrails, and testing requirements for frontier cyber capable models even as private companies make unilateral access decisions, and experts warn diffusion of these tools to nonstate and criminal actors could sharply lower the cost and complexity of attacks.
Webinar Today: ROI for Cyber-Physical Security Programs

www.securityweek.com · 5 months ago

There is a live webinar on May 13, 2026 at 1 PM Eastern focused on measuring Return on Security Investment for cyber physical systems, hosted by SecurityWeek and Claroty. It explains that in cyber physical systems a single hour of downtime can exceed an entire annual security budget and teaches how to quantify impacts from unplanned downtime, regulatory fines, and equipment damage to translate technical risk into financial terms. It outlines strategies for presenting CPS projects to finance and operations and argues that dedicated OT security reduces manual audit hours and streamlines asset management, positioning OT teams as resilience drivers rather than cost centers.
Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation

thehackernews.com · 5 months ago

A China affiliated threat actor conducted a multi wave intrusion against an Azerbaijani oil and gas company between late December 2025 and late February 2026, repeatedly exploiting the same vulnerable Microsoft Exchange Server entry point. Bitdefender attributed the activity with moderate to high confidence to FamousSparrow also known as UAT 9244 and observed the deployment of Deed RAT also called Snappybee on December 25, 2025, TernDoor in late January and early February 2026, and a modified Deed RAT in late February 2026. Initial access was achieved via the ProxyNotShell chain, operators deployed web shells and an evolved DLL side loading technique that abused a legitimate LogMeIn Hamachi binary to load a malicious library, conducted lateral movement to broaden access, and repeatedly returned until the original vulnerability was patched and credentials rotated.
LatAm Vibe Hackers Generate Custom Hacking Tools on the Fly

www.darkreading.com · 5 months ago

There are two threat campaigns named Shadow-Aether-040 and Shadow-Aether-064 that heavily leveraged AI agents to conduct attacks across the full kill chain, dynamically generating custom hacking tools and scripts to support scanning, exploitation, and persistence. Shadow-Aether-040 compromised six government entities in Mexico between December 27, 2025 and January 4, 2026 and used an agentic command line interface that sent prompts to Anthropic's Claude, employing Shodan and VulDB to find vulnerabilities, deploying web shells, and likely creating an AI-assisted Python backdoor called implantehttp. Shadow-Aether-064 targeted financial organizations in Brazil, used similar AI-driven tooling to create custom backdoors capable of reverse tunnels and leveraged tools such as ProxyChains, SOCKS5, Chisel, CrackMapExec, Impacket, and Neo-ReGeorg to maintain access. Because these tools vary with each execution and evade signature-based detection, defenders are advised to enforce timely patching, implement zero trust access controls, and maintain comprehensive monitoring to reduce the effectiveness of AI-augmented campaigns.
China's 'FamousSparrow' APT Nests in South Caucasus Energy Firm

www.darkreading.com · 5 months ago

China-linked FamousSparrow targeted an Azerbaijani oil and gas company in the South Caucasus, marking the group’s first observed operations in Azerbaijan. The campaign ran from late December until the end of February and used a novel two-stage DLL sideloading mechanism that gated payload execution behind a specific application execution path to evade analysis and install remote access tools. Attackers gained initial access through a vulnerable Microsoft Exchange server, and the victim’s failure to patch allowed FamousSparrow to return for at least two subsequent intrusions, while operational technology networks were not affected.
Foxconn confirms cyberattack claimed by Nitrogen ransomware gang

www.bleepingcomputer.com · 5 months ago

Foxconn says some North American factories suffered a cyberattack and are resuming normal production after its cybersecurity team activated response measures. The Nitrogen ransomware operation claims to have stolen eight terabytes of data and more than eleven million documents containing confidential instructions, projects, and drawings belonging to customers including Apple, Intel, Google, Nvidia, and AMD. Security researchers report Nitrogen first surfaced in 2023 with a malware loader, later developed a ransomware strain using leaked Conti 2 builder code, and Coveware found a coding mistake in its ESXi malware that causes files to be encrypted with the wrong public key and become irreversibly corrupted. Foxconn has previously been targeted by ransomware groups including LockBit and DoppelPaymer in earlier incidents.
73 Seconds to Breach, 24 Hours to Patch: The Case for Autonomous Validation

www.bleepingcomputer.com · 5 months ago

There are reports that Anthropic’s Mythos model wrote one hundred eighty one working Firefox exploits in its first fourteen days inside a gated preview and surfaced thousands of zero days across major operating systems and browsers, with over ninety nine percent of those findings still unpatched. There are examples of AI enabled campaigns using known vulnerabilities and misconfigurations that hit two thousand five hundred sixteen devices across one hundred six countries in minutes, and the median time from a CVE publication to a working exploit has collapsed to roughly ten hours in 2026. There are measurements showing an attacker timeline that can complete a compromise in seventy three seconds while organizational patching and remediation processes can take around twenty four hours because time is lost in handoffs between tools and teams rather than inside any single product. There are three recommended pillars of cyber resilience Identify, Protect, and Validate, and defenders are urged to adopt continuous autonomous validation that combines breach and attack simulation with autonomous penetration testing to run the remediation loop at machine speed.
Microsoft’s new AI system finds 16 Windows flaws, including four critical RCEs

www.csoonline.com · 5 months ago

Microsoft unveiled a new AI driven vulnerability discovery system called MDASH that found 16 previously unknown Windows vulnerabilities, including four critical remote code execution flaws that were patched in the May 12, 2026 Patch Tuesday release. Two of the critical issues are tracked as CVE-2026-33827, a remote unauthenticated use after free in the Windows IPv4 stack reachable via specially crafted packets carrying the Strict Source and Record Route option, and CVE-2026-33824, a pre authentication double free in the IKEEXT service affecting RRAS VPN, DirectAccess, and Always On VPN, while two other critical flaws affected Netlogon and the Windows DNS Client with CVSS scores of 9.8. MDASH orchestrates over one hundred specialized AI agents across multiple frontier and distilled models to scan source code, validate findings, and construct triggering inputs before human review, and Microsoft plans a private preview for enterprise customers in June 2026. Analysts warn that agentic AI driven discovery will accelerate both defensive and offensive operations and that vulnerability management is shifting toward continuous AI assisted discovery and remediation, requiring stronger governance and remediation discipline.
Government to Scrutinize Instructure Over Canvas Disruption, Data Breach

www.securityweek.com · 5 months ago

There was an initial intrusion detected on April 29, 2026 that disrupted Canvas tools relying on API keys and prompted a restoration on May 3, 2026 before a second intrusion on May 7, 2026 that defaced login portals and forced the platform into maintenance mode. The extortion group ShinyHunters claimed to have stolen roughly 3.65 terabytes of data and asserted it included personal information for about 275 million students, teachers, and staff across nearly 9,000 institutions, while the company said exposed fields included names, email addresses, course and enrollment data and messages but not passwords, financial information, or government identifiers. The House Committee on Homeland Security has requested a briefing to probe the circumstances of both intrusions, the nature and volume of data accessed, the adequacy of containment and notifications, and coordination with federal law enforcement and CISA, and the company says it reached an agreement with the actor to recover and delete the stolen data and has temporarily disabled Free For Teacher accounts pending a security review.