Blahalla

Microsoft testing new Cloud Rebuild Windows 11 recovery feature

www.bleepingcomputer.com · 15 days ago

Microsoft has begun testing the Cloud Rebuild recovery feature in the latest Windows 11 Insider Preview builds released for users in the Experimental channel.

Fake Interview Phishing Campaign Impersonates Top Brands to Steal Gmail Credentials

gbhackers.com · 15 days ago

A sophisticated interview-themed phishing campaign that impersonates major global brands to harvest Gmail credentials. Attackers pose as recruiters offering marketing roles at well-known companies, leveraging personalized targeting and a layered redirection chain that uses legitimate platforms to mask malicious intent.

CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware

thehackernews.com · 15 days ago

Several versions of firmware released by Chinese network device manufacturer Tenda have been found to embed an undocumented authentication backdoor that enables administrative access to the devices' web management interfaces, the CERT Coordination Center (CERT/CC) warned Monday.

Windows Device ID Helped Authorities Track Scattered Spider Hacking Group Member

gbhackers.com · 15 days ago

Authorities used a persistent Windows Global Device ID, along with VPN telemetry and cloud service records, to connect the infrastructure used in a major extortion attack to a 19-year-old member of the Scattered Spider group, Peter Stokes.

Hackers Abuse Cross-Tenant Teams Chat to Deliver EtherRAT Through Malicious MSI Loader

gbhackers.com · 15 days ago

A coordinated social-engineering campaign observed in late June 2026 combined email phishing with an abused Microsoft Teams cross‑tenant chat to deliver a sophisticated EtherRAT implant via a malicious MSI loader. Initial access began with a targeted email masquerading as internal communication: an “Employee Survey” HTML message containing a PDF lure.

Critical BeyondTrust Authentication Flaws Expose Remote Support Appliances to Attacks

gbhackers.com · 15 days ago

BeyondTrust has disclosed multiple critical and high-severity vulnerabilities affecting its Remote Support (RS) and Privileged Remote Access (PRA) appliances. These flaws expose organizations to risks such as authentication bypass, denial-of-service attacks, and unauthorized data access. Tracked under advisory BT26-03, these vulnerabilities have a maximum CVSS v4 score of 9.

Google Gemini Live API Flaw Allows RCE via Unconstrained Ephemeral Tokens

gbhackers.com · 15 days ago

A significant security vulnerability in Google’s Gemini Live API has exposed applications to remote code execution (RCE) due to misconfigured ephemeral tokens. This flaw allows attackers to inject client-controlled setup frames and execute arbitrary code within AI voice sessions.

BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA

thehackernews.com · 15 days ago

BeyondTrust has released updates to address two critical security flaws affecting Remote Support (RS) and Privileged Remote Access (PRA) products that, if successfully exploited, could allow unauthenticated attackers to take control of susceptible devices. The vulnerabilities are listed below - CVE-2026-40138 (CVSS score: 9.

Cavern Manticore Malware Uses Low-Detection .NET Modules for Reconnaissance and Lateral Movement

gbhackers.com · 15 days ago

A newly identified Iran-linked threat group, tracked as Cavern Manticore, is deploying a sophisticated modular command-and-control (C2) framework built on a shared.NET foundation to conduct stealthy reconnaissance and lateral movement against Israeli government and IT organizations.

Insignary Closes SBOM Accuracy Gap With Binary-Level Clarity for Regulatory Risk

www.csoonline.com · 15 days ago

Most software composition analysis tools read what developers declare. Insignary Clarity’s patented binary-first platform analyzes what is actually built, shipped, and deployed, including the open-source components that never appear in any manifest. Insignary, Inc.

Microsoft Edge High-Severity Vulnerability Allows Remote Code Execution

gbhackers.com · 15 days ago

Microsoft has disclosed a high-severity remote code execution (RCE) vulnerability in its Chromium-based Edge browser, identified as CVE-2026-57992. This vulnerability could allow attackers to execute arbitrary code on affected systems under specific conditions. Publicly disclosed on July 3, 2026, it is classified as CWE-416 (Use-After-Free), which is a memory safety flaw.

AI agents fall for indirect prompt injection traps

www.csoonline.com · 15 days ago

Some autonomous AI agents fell victim to frauds, reinforcing how easily some high-end enterprise agents can be conned by schemes that would fool few, if any, humans, Zscaler found in a test of major LLMs.

Zscaler finds autonomous agents succumb to IPI traps

www.csoonline.com · 15 days ago

In a test of major LLMs, Zscaler found that some autonomous AI agents fell victim to frauds, reinforcing how easily some high-end enterprise agents can be conned by schemes that would fool few, if any, humans.

'BusySnake' Infostealer Slithers into Critical Infrastructure Networks

www.darkreading.com · 15 days ago

A threat group researchers call "Armored Likho" has gained access to government agencies and electrical power entities in Russia, Brazil, and Kazakhstan.

CitrixBleed-ing Again? NetScaler Vulnerability Under Attack

www.darkreading.com · 15 days ago

Attackers wasted little time targeting the latest memory disclosure flaw in Citrix's NetScaler products, after researchers published a proof-of-concept exploit (PoC).

Phishing poses as big-brand job interview to steal Google accounts

www.bleepingcomputer.com · 15 days ago

A phishing campaign is impersonating more than 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, in fake job interviews to steal Google account credentials from marketing professionals.

Fake IT support calls on Microsoft Teams push EtherRAT malware

www.bleepingcomputer.com · 15 days ago

Threat actors are abusing Microsoft Teams voice calls by impersonating corporate IT support staff to trick employees into installing the EtherRAT malware, giving attackers initial access to corporate networks.

Blogspot-Hosted Payloads Delivered in ‘Veil#Drop’ Attacks

www.securityweek.com · 15 days ago

Securonix says the sophisticated framework abuses compromised websites, Blogspot, PowerShell, and fileless techniques to evade detection and deploy the PureLog information stealer.

DHS Confirms Breach of Homeland Security Information Network

www.techrepublic.com · 15 days ago

DHS confirmed a breach of the Homeland Security Information Network, an unclassified platform used for security and emergency coordination.

Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations

thehackernews.com · 15 days ago

An Iranian hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS) has been wielding a previously undocumented modular command-and-control (C2) framework dubbed Cavern (aka Cav3rn) targeting Israeli organizations.

Vietnam arrests suspects behind HiAnime anime piracy service

www.bleepingcomputer.com · 15 days ago

Vietnamese authorities have arrested and are prosecuting seven suspects believed to have run HiAnime, the largest anime piracy streaming service before its shutdown in June.

16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems

thehackernews.com · 15 days ago

A use-after-free bug in Linux's KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel that runs it. Dubbed 'Januscape' and tracked as CVE-2026-53359, the flaw sits in the shadow MMU code that KVM shares across both Intel and AMD.

Azure CLI Password Spray Attack Exposes Microsoft 365 MFA Gap

www.techrepublic.com · 15 days ago

A password spray campaign targeting Azure CLI sign-ins exposed how narrow Conditional Access policies can leave Microsoft 365 accounts vulnerable even when MFA is enabled.

JadePuffer: The First Complete LLM-Driven Ransomware Attack

www.darkreading.com · 15 days ago

An "agentic threat actor" successfully exploited a Langflow flaw to steal data from a production database server and encrypt other systems.

Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure

thehackernews.com · 15 days ago

Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig. The vulnerability in question is CVE-2026-20896 (CVSS score: 9.

Alibaba’s A.I. Is a Hit, but Hard to Turn Into a Moneymaker

www.nytimes.com · 15 days ago

The Chinese company’s models have won over developers worldwide, but they are open source, so they can be used and modified freely.

Why A.I. Distillation Has Become a Hot Topic in the Race with China

www.nytimes.com · 15 days ago

U.S. companies complain that competitors in China are unfairly copying their A.I. systems using a technique that has been around for years.

5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management

www.microsoft.com · 15 days ago

Read five key learnings from the Frost & Sullivan 2025 Frost Radar™ for CSPM to learn how CSPM is evolving from point-in-time compliance to continuous risk management.

The Shift Toward Business-Aligned Risk Management

www.securityweek.com · 15 days ago

Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences.

Armored Likho APT Targeting Government, Electric Power Entities

www.securityweek.com · 15 days ago

The threat actor uses modular RATs and information stealers in financially motivated and cyber espionage campaigns.

The agentic blind spots in your zero trust program

www.csoonline.com · 15 days ago

Stephen Wilson, field chief technology officer for HashiCorp, an IBM company, likens AI agents to “really smart kindergartners.” “They know how to do something, but they have no clue as to why they should do it,” Wilson says.

Identity: The operational control plane for agentic AI

www.csoonline.com · 15 days ago

Existing security controls weren’t designed for AI agents. Static credentials and standing privileges aren’t sufficient for an emerging model where organizations need to rapidly authorize, limit, and revoke permissions from autonomous agents, sometimes more than once within a single workflow.

Operationalizing Agentic AI: from assisted to autonomous

www.csoonline.com · 15 days ago

Ever since ChatGPT made its public debut nearly four years ago, governance and security have largely lagged behind AI adoption. Eager to experiment with AI tools and find ways to improve their work and personal lives, users have uploaded corporate data, financial records, and even their own health information to large language models (LLMs).

New OST2 class: "Architecture 1901: From zero to QEMU - A Gentle introduction to emulators from the ground up!"

ost2.fyi · 15 days ago

This free class by Antonio Nappa of Fuzz Society builds up your knowledge from learning a toy 8-bit CPU architecture all the way to understanding how QEMU can emulate that architecture. Using this knowledge you can then understand how QEMU can emulate any architecture! Based on beta testing, this class takes an average of 8h47m to complete, and a median of 7h26m.

Insignary Closes SBOM Accuracy Gap With Binary-Level Clarity for Regulatory Risk

gbhackers.com · 15 days ago

Toronto, Canada, July 6th, 2026, CyberNewswire Most software composition analysis tools read what developers declare. Insignary Clarity’s patented binary-first platform analyzes what is actually built, shipped, and deployed, including the open-source components that never appear in any manifest. Insignary, Inc.

Software Is Now Written at the Speed of Thought. Security Isn't.

www.bleepingcomputer.com · 15 days ago

Every evolution in software development has reduced the friction between an idea and a deployable application. AI may remove the final barrier, but it also removes many of the moments where security decisions have traditionally taken place.

Microsoft Lays Off Thousands of Xbox Employees, Closes Game Studios

www.nytimes.com · 16 days ago

The layoffs were part of wider cuts at Microsoft, as the company prioritizes spending on artificial intelligence.

Max severity Adobe ColdFusion flaw now exploited in attacks

www.bleepingcomputer.com · 16 days ago

Attackers are now exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, the Canadian Center for Cyber Security (CCCS) warned on Thursday.

North Korean Hackers Target Open Source Developers in Supply Chain Attacks

www.securityweek.com · 16 days ago

The PolinRider campaign has compromised more than 100 legitimate open source packages and repositories to deliver a backdoor and information stealer to developers.

⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More

thehackernews.com · 16 days ago

A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary. Home devices became a routing cover. Clean code pulled dirt from a dependency. Identity shortcuts aged badly. AI systems trusted the wrong instructions.

Hackers Use Trusted Microsoft Domain and One-Time Codes to Hijack Corporate Accounts

gbhackers.com · 16 days ago

A rising phishing technique is exploiting a legitimate Microsoft authentication flow to hijack corporate accounts without stealing passwords. Attackers are weaponizing the OAuth 2.0 Device Authorization Grant commonly used to sign in input-constrained devices via a one-time user code to trick victims into approving access on Microsoft’s own domain.

Proof-of-Concept Exploit Released for Linux ‘Bad Epoll’ Root Access Vulnerability

www.securityweek.com · 16 days ago

Organizations are urged to patch after proof-of-concept code makes the Linux root escalation flaw easier to exploit.

Veeam Backup BinaryFormatter Flaw Enables Remote Code Execution

gbhackers.com · 16 days ago

A newly discovered deserialization vulnerability, tracked as CVE-2026-44963, affects Veeam Backup & Replication. This vulnerability allows authenticated domain users to execute remote code on backup servers by exploiting weaknesses in the handling of BinaryFormatter. The issue, detailed by SecureLayer7 Labs, is part of a concerning trend of flaws in Veeam’s.

Go-Based Gentlemen Ransomware Uses PsExec, WMIC, and PowerShell Remoting for Network Propagation

gbhackers.com · 16 days ago

Gentlemen, a Go-based ransomware-as-a-service (RaaS) active since mid-2025, has distinguished itself with a potent combination of modern cryptography, aggressive worm-like propagation, and a broad toolkit for remote execution.

This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom

www.csoonline.com · 16 days ago

A fully autonomous AI agent conducted an end-to-end cyber intrusion and extortion campaign after exploiting a vulnerable Langflow server, demonstrating how large language models could accelerate ransomware operations, according to research published by Sysdig.

How to Evaluate an AI SOC Platform in 2026: 6 Capabilities That Separate Leaders from Bolt-On AI solutions

thehackernews.com · 16 days ago

Building a shortlist for an AI SOC evaluation can be tough. SIEM, SOAR, and pureplay AI SOC vendors are all saying the same thing. But behind the identical label sit very different products, from chat assistants bolted onto a legacy SIEM to agent platforms that run detection, triage, investigation, and response on their own data foundation.

Critical Opera GX Vulnerability Lets Attackers Inject CSS Across Every Webpage

gbhackers.com · 16 days ago

A critical security vulnerability in Opera GX has been disclosed, revealing that attackers could exploit the browser’s GX Mods feature to inject malicious CSS across every webpage visited by a victim. This could enable cross-site data exfiltration and have a widespread impact on the browser.

Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments

www.securityweek.com · 16 days ago

Researchers uncovered two campaigns embedding indirect prompt injections in malicious websites to exploit autonomous AI agents browsing the web.

Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token

gbhackers.com · 16 days ago

A critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk. This breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

thehackernews.com · 16 days ago

A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensitive data from compromised hosts. The multi-stage campaign, codenamed Operation DragonReturn by Seqrite Labs, involves sending spear-phishing emails impersonating the Income Tax Department of India.