Blahalla

Nation-State Hackers Put Defense Industrial Base Under Siege

www.darkreading.com · 5 months ago

Nation-state hackers are increasingly targeting defense industrial base organizations through cyber espionage and attacks. Attackers, including those linked to China and Russia, are exploiting zero-day vulnerabilities in edge devices to gain initial access and establish persistent footholds within networks. Threat actors are also targeting defense workers through malicious job portals and credential theft. The Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities Catalog lists 26 vulnerabilities exploited in edge devices in 2025 and 35 in 2024.

BeyondTrust Gets Hit Again: Pre-Auth RCE in Remote Support Tools

foss-daily.org · 5 months ago

A critical pre-authentication remote code execution vulnerability, CVE-2026-1731, has been identified in BeyondTrust Remote Support and Privileged Remote Access tools. Attackers can execute commands as the site user without authentication or interaction by sending a crafted WebSocket request. This vulnerability exists in the same endpoint previously exploited by Chinese state actors, and impacts on-premise deployments, with roughly 8,500 internet-facing instances potentially vulnerable. Users should immediately apply patch BT26-02-RS for Remote Support or patch BT26-02-PRA for Privileged Remote Access or upgrade to version 25.1.1 or later.

EU can’t be ‘naive’ about enemies shutting down critical infrastructure, warns tech official

therecord.media · 5 months ago

European Union officials are urging increased vigilance and investment to protect critical infrastructure from cyberattacks and hybrid threats. Recent attacks targeting hospitals, energy networks, and democratic processes highlight Europe’s vulnerability due to its reliance on digital systems. The European Commission is proposing revisions to the Cybersecurity Act, including phasing out high-risk suppliers in critical infrastructure. Officials emphasized the need for stronger cyber capabilities and a domestic cyber industry to ensure Europe’s resilience against growing threats.

AI Agents 'Swarm,' Security Complexity Follows Suit

www.darkreading.com · 5 months ago

NULL

NATO must impose costs on Russia, China over cyber and hybrid attacks, says deputy chief

therecord.media · 5 months ago

false

Google Links China, Iran, Russia, North Korea to Coordinated Defense Sector Cyber Operations

thehackernews.com · 5 months ago

Several state-sponsored actors from China, Iran, North Korea, and Russia are actively targeting the defense industrial base. These groups employ various tactics, including exploiting secure messaging applications like Telegram and Signal, using fake job offers, and compromising edge devices. Malware families observed in these campaigns include MESSYFORK, GREYBATTLE, GALLGRAB, and TINYWHALE. Threat actors are also utilizing artificial intelligence for reconnaissance and employing operational relay box networks to evade detection.

Ransomware Groups Claimed 2,000 Attacks in Just Three Months

www.techrepublic.com · 5 months ago

Ransomware attacks have significantly increased, with monthly attacks surging to nearly 700 and a 52% rise in total attacks recorded in 2025. Ransomware groups claimed over 2,000 attacks in the last three months of 2025 and continue to operate at a high pace into 2026. The group Qilin, known for sophisticated tactics and a ransomware-as-a-service model, led all ransomware groups with 1,138 successful breaches in 2025. The US remains the top target for ransomware attacks, and organizations are advised to prioritize cybersecurity best practices to protect against this growing threat.

Four new reasons why Windows LNK files cannot be trusted

www.csoonline.com · 5 months ago

A cybersecurity researcher has discovered four new methods to manipulate Windows shortcut (.LNK) files, potentially allowing attackers to spoof destinations, hide command-line arguments, and execute unintended programs. These techniques exploit inconsistencies in how Windows handles conflicting metadata within LNK files, enabling attackers to launch malicious actions disguised as harmless shortcuts. One method involves manipulating the "ExtraData" section of LNK files to hide command-line arguments while still executing them, offering an alternative to exploiting CVE-2025-9491. Microsoft considers these behaviors UI issues rather than vulnerabilities.

China may be rehearsing a digital siege, Taiwan warns

therecord.media · 5 months ago

false

Brutus: Open-source credential testing tool for offensive security

www.helpnetsecurity.com · 5 months ago

Brutus is a new open-source credential testing tool designed to streamline penetration testing workflows. It addresses issues with existing tools like THC Hydra and Medusa, offering a single binary with zero external dependencies and native JSON support. Brutus supports 22 protocols and includes embedded SSH bad key testing leveraging Rapid7 and HashiCorp collections, identifying compromised keys from vendors such as F5, ExaGrid, and Array Networks. An experimental AI feature uses Claude’s vision to automate the discovery of unidentified web admin panels and test default credentials.

UAT-9921 Deploys VoidLink Malware to Target Technology and Financial Sectors

thehackernews.com · 5 months ago

A threat actor known as UAT-9921 is using a new modular malware framework called VoidLink to target technology and financial sectors. VoidLink, written in Zig, C, and GoLang, allows for stealthy access to Linux-based cloud environments and appears to leverage large language models in its development. The framework includes features for reconnaissance, lateral movement, and evasion of security tools, and it uses a role-based access control system. Researchers believe the malware may have been in development since 2025 and that the actors possess a degree of Chinese language proficiency.

Cisco Unified Communications Products Remote Code Execution Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A critical vulnerability exists in several Cisco Unified Communications products, including Unified CM, Unified CM SME, Unified CM IM&P, Unity Connection, and Webex Calling Dedicated Instance. The vulnerability allows an unauthenticated attacker to remotely execute commands by sending crafted HTTP requests to the device's web management interface. Successful exploitation could grant an attacker user-level access, potentially allowing privilege escalation to root. Cisco has released software updates to address the issue, and no workarounds are available.

Estonia spy chief calls on Europe to invest in its own offensive cyber capabilities

therecord.media · 5 months ago

Estonia’s foreign intelligence chief is urging European governments and industry to invest in offensive cyber capabilities, noting a reliance on non-European tools. He stated that Europe needs to develop its own technology for intelligence collection and potential cyber sabotage activities, as much of the current data collection relies on external solutions. The official also warned that Russia may rebuild forces along its borders and highlighted the importance of intelligence cooperation, while observing that cyber espionage remains the primary activity. He cautioned against disruption tactics that risk losing access to valuable information.

Turning IBM QRadar Alerts into Action with Criminal IP

www.bleepingcomputer.com · 5 months ago

Criminal IP, an AI-powered threat intelligence platform, has integrated with IBM QRadar SIEM and SOAR to enhance security operations. The integration provides real-time threat visibility from firewall traffic logs, automatically classifying IP addresses as high, medium, or low risk. Analysts can now investigate suspicious IPs directly within QRadar and automate threat enrichment through pre-built SOAR playbooks for IP and URL threat services. This combination improves detection accuracy, shortens investigation cycles, and prioritizes responses by incorporating external threat context.

In Other News: Google Looks at AI Abuse, Trump Pauses China Bans, Disney’s $2.7M Fine

www.securityweek.com · 5 months ago

Threat actors are increasingly leveraging artificial intelligence in various stages of attacks, including model extraction attempts, according to Google. The Cybersecurity and Infrastructure Security Agency highlighted challenges in securing operational technology communications due to legacy systems and limited support for modern cryptography. The Environmental Protection Agency found vulnerabilities at 277 public drinking water systems, while a Department of Defense employee was indicted for laundering money through romance scams. California regulators fined Disney 2.75 million dollars for California Consumer Privacy Act violations. A supply chain flaw exposed sensitive systems at approximately 200 airports worldwide.

US needs to impose ‘real costs’ on bad actors, State Department cyber official says

therecord.media · 5 months ago

U.S. cyber strategy is shifting from a defensive posture to a deterrence model, aiming to make hacking attacks too costly for adversaries. Officials are emphasizing proactive disruption and imposing consequences on malicious actors, mirroring a broader shift towards assertive cyber operations. The State Department’s Bureau of Cyberspace and Digital Policy is leading diplomatic efforts concerning technology and responses to intrusions, highlighting the importance of technical standards and supply chains. However, the U.S. is reducing involvement in some international cyber partnerships while simultaneously encouraging allied coordination.

BSI läutet Ende der klassischen Verschlüsselung ein

www.csoonline.com · 5 months ago

Germany's Federal Office for Information Security, or BSI, has established deadlines for phasing out conventional asymmetric encryption methods. The BSI advises combining traditional encryption with post-quantum cryptography in a hybrid approach, with stricter requirements beginning at the end of 2030 for systems with high security needs. Conventional signature methods will be discontinued from sole use by 2035. The updated technical guidelines, TR-02102, also provide recommendations for implementing TLS, IPsec and IKEv2, and SSH.

Europe must adapt to ‘permanent’ cyber and hybrid threats, Sweden warns

therecord.media · 5 months ago

European security officials warn that cyber and hybrid threats are now a permanent feature of the security environment. These threats combine military force, economic pressure, information operations, and cyber activity, often aiming to undermine public trust. Sweden is undertaking a significant rearmament and strengthening its civil defense and national cybersecurity through a "total defense" concept. The nation is also restructuring its cybersecurity agency to improve coordination and collaboration with the private sector, which manages much of the country’s critical infrastructure.

Phishing Campaigns Target Users with Fake Meeting Invites and Update Alerts via Zoom, Teams, and Google Meet

gbhackers.com · 5 months ago

Cybercriminals are using fake meeting invitations and software update alerts through Zoom, Microsoft Teams, and Google Meet to trick users. These phishing campaigns redirect victims to deceptive websites that mimic legitimate login pages and prompt them to download malicious software updates. These updates install legitimate remote monitoring and management tools, like Datto RMM, LogMeIn, or ScreenConnect, granting attackers complete remote access to compromised systems. Organizations are urged to monitor RMM tool usage and educate employees to prevent these attacks.

Check Point Announces Trio of Acquisitions Amid Solid 2025 Earnings Beat

www.securityweek.com · 5 months ago

false

CISA flags critical Microsoft SCCM flaw as exploited in attacks

www.bleepingcomputer.com · 5 months ago

A critical vulnerability has been identified in Microsoft’s Configuration Manager, known as CVE-2024-43468. This SQL injection flaw allows attackers to execute commands and gain high-level privileges without authentication. While Microsoft initially considered exploitation unlikely, proof-of-concept code has been released, demonstrating the vulnerability’s potential for abuse. The Cybersecurity and Infrastructure Security Agency has classified the vulnerability as actively exploited and is requiring federal agencies to patch systems by March 5th.

CVE-2025-64712 in Unstructured.io Puts Amazon, Google, and Tech Giants at Risk of Remote Code Execution

gbhackers.com · 5 months ago

A critical vulnerability, CVE-2025-64712, has been identified in the Unstructured.io library, used for converting unstructured data into a format suitable for artificial intelligence. This flaw allows for arbitrary file writes, potentially enabling remote code execution. The vulnerability stems from a path traversal issue when processing Microsoft Outlook email attachments, allowing attackers to overwrite system files if they can control attachment filenames. The widespread use of Unstructured.io across many enterprise environments, including Fortune 1000 companies, raises concerns about the potential impact of this security risk.

Dutch Carrier Odido Discloses Data Breach Impacting 6 Million

www.securityweek.com · 5 months ago

Dutch mobile carrier Odido has reported a data breach impacting over 6 million customers of both Odido and its subsidiary Ben. The breach occurred February 7th through 8th, resulting in the theft of personal information including names, addresses, bank account numbers, and passport information. While services were not impacted and passwords and call records remain secure, Odido is urging customers to be cautious of potential phishing attempts and unusual activity. The source of the breach and any associated CVEs remain unknown.

‘Something Big Is Happening’ + A.I. Rocks the Romance Novel Industry + One Good Thing

www.nytimes.com · 5 months ago

false

The foundation problem: How a lack of accountability is destroying cybersecurity

www.csoonline.com · 5 months ago

false

CISA orders federal agencies to patch exploited SolarWinds, Apple, Microsoft bugs within weeks

therecord.media · 5 months ago

The Cybersecurity and Infrastructure Security Agency is requiring federal agencies to quickly patch ten newly identified vulnerabilities impacting SolarWinds, Apple, Microsoft, and Notepad++. A critical vulnerability, CVE-2025-40536, affecting SolarWinds Web Help Desk, must be addressed by Sunday. Apple disclosed CVE-2026-20700, which may have been exploited in a targeted attack, and Notepad++ is responding to CVE-2025-15556 after a Chinese state-sponsored group exploited it. Microsoft's CVE-2026-21510, CVE-2026-21513, and CVE-2026-21514 are also included due to active exploitation. Experts anticipate a record number of vulnerabilities will be disclosed in 2026, potentially exceeding 70,000.

Google fears massive attempt to clone Gemini AI through model extraction

www.csoonline.com · 5 months ago

Google has detected and blocked a campaign involving over 100,000 prompts aimed at extracting the proprietary reasoning capabilities of its Gemini AI model, which is considered intellectual property theft. Threat actors, including groups from China, Iran, North Korea, and Russia, are increasingly integrating Gemini into their operations for activities like social engineering, vulnerability analysis, and intelligence gathering. Malware families like HONESTCUE are now embedding Gemini’s APIs directly into malicious code to bypass safety filters, and organizations should monitor API access and implement output controls to prevent model extraction. Experts warn that traditional cybersecurity defenses are insufficient against this rapidly evolving threat landscape.

Malicious Chrome Extensions Caught Stealing Business Data, Emails, and Browsing History

thehackernews.com · 5 months ago

Cybersecurity reports indicate a rise in malicious Chrome extensions targeting user data. Several campaigns, including CL Suite, VK Styles, and AiFrame, have been identified as stealing Meta Business Suite data, hijacking VKontakte accounts, and harvesting credentials and browsing history. These extensions disguise themselves as legitimate tools to collect sensitive information without user consent. Security experts recommend installing only necessary extensions, regularly auditing them, and utilizing browser profiles for increased protection.

Chrome Extensions Infect 500K Users to Hijack VKontakte Accounts

gbhackers.com · 5 months ago

A malicious Chrome extension campaign hijacked over 500,000 VKontakte accounts, using them to subscribe users to attacker-controlled groups and reset their settings monthly. The extensions, disguised as VK customization tools, utilized a multi-stage architecture with configuration data hidden within VK profile meta tags and hosted on GitHub. The attacker leveraged VK’s own infrastructure as a command-and-control system, manipulating CSRF cookies and tracking donation status for monetization. The extensions involved include IDs ceibjdigmfbbgcpkkdpmjokkokklodmc, mflibpdjoodmoppignjhciadahapkoch, lgakkahjfibfgmacigibnhcgepajgfdb, bndkfmmbidllaiccmpnbdonijmicaafn, and pcdgkgbadeggbnodegejccjffnoakcoh.

BeyondTrust Vulnerability Targeted by Hackers Within 24 Hours of PoC Release

www.securityweek.com · 5 months ago

Hackers are actively exploiting a critical vulnerability in BeyondTrust Remote Support and Privileged Remote Access products. The flaw, identified as CVE-2026-1731, allows for unauthenticated remote code execution and impacts thousands of deployments. Attack attempts began within 24 hours of a proof-of-concept exploit being released, with one IP address accounting for the majority of reconnaissance activity. This vulnerability is particularly concerning given BeyondTrust products' widespread use and history of exploitation by threat actors, including those linked to state-sponsored groups.

The democratization of AI data poisoning and how to protect your organization

www.csoonline.com · 5 months ago

AI models are now vulnerable to data poisoning attacks that require fewer malicious inputs than previously thought, with as few as 250 corrupted files capable of distorting model behavior. Attackers can easily inject harmful or biased data into training pipelines, potentially leading to model decay and the insertion of hidden backdoors, such as those capable of data exfiltration. Protecting AI systems involves establishing a clean, validated baseline model, implementing regular resets, and rigorously monitoring incoming data for anomalies, similar to web application filtering. Organizations should prioritize model integrity and assume attempts to manipulate AI behavior will occur.

npm’s Update to Harden Their Supply Chain, and Points to Consider

thehackernews.com · 5 months ago

Following the Sha1-Hulud incident, npm implemented changes including revoking classic tokens and defaulting to session-based tokens with multi-factor authentication for publishing. However, vulnerabilities remain, as attackers can still obtain short-lived tokens through MFA phishing and developers can create bypass tokens similar to the old system. To further improve security, it's recommended to adopt Open ID Connect, enforce MFA for local package uploads, and build packages from verifiable source code to minimize the risk of malicious artifacts. Chainguard Libraries for JavaScript builds from upstream source code, eliminating malware found in 98.5% of compromised packages.

Malicious Chrome AI Extensions Target 260,000 Users with Injected Iframes

gbhackers.com · 5 months ago

Security researchers have identified a coordinated campaign involving thirty malicious Chrome extensions disguised as AI assistants, impacting over 260,000 users. These extensions, which appeared legitimate in the Chrome Web Store, secretly inject iframes and extract data from browser tabs and Gmail accounts, sending it to external servers controlled by the tapnetic[.]pro domain. Attackers use "extension spraying" to evade detection and quickly republish replacements when extensions are removed. The malicious extensions leverage techniques like masquerading and data exfiltration.

CISA Warns of Exploited SolarWinds, Notepad++, Microsoft Vulnerabilities

www.securityweek.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning regarding several actively exploited vulnerabilities. A security bypass flaw, tracked as CVE-2025-40536, exists in SolarWinds Web Help Desk, potentially allowing unauthorized access and remote code execution. Additionally, a buffer overflow vulnerability in Apple, CVE-2026-20700, and an update integrity verification flaw in Notepad++, CVE-2025-15556, have been exploited in sophisticated attacks. A critical SQL injection vulnerability, CVE-2024-43468, in Microsoft Configuration Manager has also been added to the list, though prior exploitation reports are limited.

Iran Turns to Digital Surveillance Tools to Track Down Protesters

www.nytimes.com · 5 months ago

Iranian authorities are utilizing digital surveillance tools to identify and detain individuals involved in recent antigovernment protests. These tools include facial recognition technology, tracking phone data, and monitoring mobile devices and web traffic. Some citizens have reported receiving warning text messages, SIM card suspensions, and banking service interruptions as a result of this surveillance. The government's expanded digital surveillance capabilities have been implemented alongside internet blackouts to suppress dissent.

Why key management becomes the weakest link in a post-quantum and AI-driven security world

www.csoonline.com · 5 months ago

Security experts are warning that key management practices have become a critical vulnerability, overshadowing concerns about algorithms like RSA and ECC. Poor key management increases risk during breaches, hinders regulatory compliance, and impedes the ability to adapt to new cryptographic methods, especially with the rise of artificial intelligence. Organizations must prioritize establishing key inventories, shortening key lifetimes, and automating rotation to improve security posture and enable crypto agility. The threat isn’t just algorithm failure; it's the potential for attackers to exploit compromised keys to influence system behavior.

Microsoft fixes bug that blocked Google Chrome from launching

www.bleepingcomputer.com · 5 months ago

Microsoft has resolved a bug affecting its Family Safety parental control service that prevented users from launching Google Chrome and other web browsers. The issue stemmed from a web filtering tool that inadvertently blocked new versions of approved browsers, causing them to crash. A service-side fix was implemented in early February 2026 and should be available to all affected devices within the coming weeks. Users should connect their devices to the internet to receive the update, or enable activity reporting as a temporary workaround.

CISA Alerts Users to Notepad++ Flaw Allowing Code Execution

gbhackers.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has identified a critical vulnerability in Notepad++ that could allow attackers to execute malicious code. This flaw, tracked as CVE-2025-15556, affects the WinGUp updater component due to a lack of integrity checks when downloading code. Successful exploitation could allow adversaries to run arbitrary code, potentially installing malware or stealing data. Federal agencies must address this vulnerability by March 5, 2026, and users are advised to apply security patches immediately.

New XWorm RAT Campaign Leverages Phishing and CVE-2018-0802 Excel Exploit to Bypass Detection

gbhackers.com · 5 months ago

A new phishing campaign is distributing the XWorm Remote Access Trojan using malicious Excel attachments. The attack begins with themed phishing emails containing a file that exploits CVE-2018-0802, a memory corruption vulnerability in Microsoft’s Equation Editor. The malware downloads and executes a fileless.NET module within Msbuild.exe to avoid detection, ultimately establishing command-and-control communications over encrypted channels. XWorm’s modular design allows for a wide range of malicious activities including data theft, remote control, and DDoS attacks.

Pwning Supercomputers - A 20yo vulnerability in Munge

blog.lexfo.fr · 5 months ago

A critical vulnerability has been discovered in the Munge authentication daemon, used in High Performance Computing clusters. This heap buffer overflow, identified as CVE-2026-25506, allows attackers to leak the Munge secret key, potentially enabling them to forge credentials and impersonate users. The flaw stems from flawed handling of message data during authentication, and impacts versions up to 0.5.17. Exploitation is currently unstable and primarily affects fresh servers, but could be improved to achieve code execution.

OpenClaw 2026.2.12 Released to Patch Over 40 Security Vulnerabilities

gbhackers.com · 5 months ago

The OpenClaw team has released version 2026.2.12, addressing over 40 security vulnerabilities and stability issues. This update includes protections against Server-Side Request Forgery, specifically hardening URL handling with an explicit deny policy and hostname allowlists. Several vulnerabilities were patched, including an API authentication bypass, a sandbox path traversal, and the removal of a potentially malicious bundled component called soul-evil. The release also introduces a breaking change to the POST hooks agent endpoint, preventing session key overrides to prevent session hijacking.

Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability

thehackernews.com · 5 months ago

Threat actors are actively exploiting a critical security flaw in BeyondTrust products, specifically CVE-2026-1731, which allows for remote code execution. The U.S. Cybersecurity and Infrastructure Security Agency has added several vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2026-20700 affecting Apple devices, CVE-2025-15556 impacting Notepad++, CVE-2025-40536 concerning SolarWinds Web Help Desk, and CVE-2024-43468 related to Microsoft Configuration Manager. The Lotus Blossom threat actor group has been linked to the exploitation of CVE-2025-15556, delivering a backdoor called Chrysalis. Federal agencies have deadlines to address these vulnerabilities.

Chrome 145 Patches 11 Vulnerabilities

www.securityweek.com · 5 months ago

Google has released Chrome version 145, addressing eleven security vulnerabilities. Three of those are considered high severity, including a use-after-free issue in CSS, a heap buffer overflow in Codecs, and an inappropriate implementation in WebGPU. Several medium and low-severity vulnerabilities were also resolved, with Google awarding over 18000 dollars in bug bounties to researchers. The patched vulnerabilities include CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2316, CVE-2026-2317, and others.

OysterLoader Evasion Tactics Exposed: Advanced Obfuscation and Rhysida Ransomware Ties Uncovered

gbhackers.com · 5 months ago

OysterLoader, also known as Broomstick and CleanUp, is a multi-stage malware linked to the Rhysida ransomware group and used in malvertising and SEO-poisoning campaigns. The malware employs a four-stage infection process, utilizing techniques like API flooding, custom dynamic API resolution, and steganography to evade detection. It delivers payloads such as Rhysida ransomware and Vidar info-stealers, communicating through evolving command and control infrastructure including domains like grandideapay[.]com and cardlowestgroup[.]com. Security teams are advised to monitor for signed MSI installers, abnormal API behavior, and characteristic C2 patterns.

CISA Issues Urgent Warning on Microsoft Configuration Manager SQL Injection Vulnerability Under Active Exploitation

gbhackers.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has warned of a critical SQL injection vulnerability, CVE-2024-43468, affecting Microsoft Configuration Manager. Threat actors are actively exploiting the flaw, allowing them to execute commands on vulnerable servers without authentication. This vulnerability gives attackers access to sensitive configuration data and the ability to move within enterprise networks. Federal agencies are required to apply vendor mitigations by a specific date, and organizations are urged to patch immediately and monitor for suspicious activity.

AI-Driven Phishing and QR Code Quishing Surge in 2025 Spam and Phishing Report

gbhackers.com · 5 months ago

The 2025 spam and phishing landscape is seeing a surge in AI-generated phishing emails and QR code-based attacks, known as "quishing." Attackers are using generative AI to create highly personalized and convincing messages, mimicking brand styles and even deploying look-alike chatbot interfaces. A large-scale campaign is exploiting pirated games and cracked software to distribute malware, including RenEngine, HijackLoader, Lumma, and ACR Stealer, impacting hundreds of thousands of systems globally. Security measures should focus on enhanced user training, advanced detection techniques, and blocking of pirated software to combat these evolving threats.

5 key trends reshaping the SIEM market

www.csoonline.com · 5 months ago

false

next-mdx-remote Vulnerability Allows Arbitrary Code Execution in React SSR

gbhackers.com · 5 months ago

A security flaw has been discovered in the next-mdx-remote library, allowing for arbitrary code execution. The vulnerability, CVE-2026-0969, impacts versions 4.3.0 through 5.0.0 and stems from insufficient sanitization of MDX content when JavaScript expressions are enabled. HashiCorp has released version 6.0.0 to address the issue, disabling JavaScript expressions by default and introducing a safety layer for those needing to use them. Users are urged to upgrade and carefully configure security options to mitigate the risk.

China Revives Tianfu Cup Hacking Contest Under Increased Secrecy

www.securityweek.com · 5 months ago

China’s Tianfu Cup hacking competition has resumed under heightened government control and secrecy. The event, previously known for substantial prize money, now features a smaller prize pool of approximately $140,000. This year's competition included targets such as iPhone 17, Xiaomi 14 Ultra, Windows 11, and various cloud and virtualization products like VMware ESXi. A new feature involved using AI agents to identify vulnerabilities, and regulations require Chinese citizens to report zero-day vulnerabilities to the government, raising concerns about potential state-sponsored cyberespionage operations.

New ClickFix Attack Wave Targets Windows Systems to Deploy StealC Stealer

gbhackers.com · 5 months ago

A new cyber campaign is targeting Windows users through fake Cloudflare CAPTCHA verification pages, employing social engineering to trick them into running malicious PowerShell commands. This multi-stage attack delivers StealC, an information stealer that harvests credentials, cryptocurrency wallets, and system data, without writing files to disk. The process uses a combination of techniques including Donut-based shellcode and reflective PE loading to evade detection, ultimately injecting StealC into a legitimate Windows process. Threat actors are utilizing infrastructure at IP addresses including 91.92.240.219 and 91.92.240.190.