Blahalla

Crimenetwork Bust Reveals 22,000 Members and Over 100 Illicit Vendors

gbhackers.com · 5 months ago

Law enforcement dismantled the relaunched Crimenetwork online marketplace after arresting a 35 year old German national at his residence in Mallorca, Spain on a European Arrest Warrant. Investigators seized about 194,000 euros in physical and digital assets, recovered user databases and transaction logs, and found the site had grown to more than 22,000 registered users and over 100 active vendors trading stolen data, narcotics and forged identification. The marketplace used Bitcoin, Litecoin and Monero to process payments and generated more than 3.6 million euros in revenue while charging commissions and recurring vendor fees. The operation was a coordinated effort between German, Spanish, Moldovan and European agencies and follows a March 2026 conviction that resulted in a seven year ten month prison sentence and the confiscation of over ten million euros for the previous operator.

Resurrected ‘Crimenetwork’ Marketplace Taken Down, Administrator Arrested

www.securityweek.com · 5 months ago

German police shut down the second iteration of the German speaking Crimenetwork marketplace and arrested a 35 year old man suspected to be its administrator. The resurrected marketplace had grown to more than 22,000 users and over 100 sellers and facilitated trade in stolen information, drugs, and falsified documents using cryptocurrencies such as Bitcoin, Litecoin, and Monero. Investigators say the platform generated more than 3.6 million euros in revenue and law enforcement seized about 194,000 euros along with extensive user and transaction data for further analysis. The original Crimenetwork had been taken down in December 2024 after more than a decade of operation and investigators estimated that over 100 million dollars in cryptocurrency passed through it between 2018 and 2024.

ShinyHunters Exploits Canvas LMS Free Teacher Accounts in New Breach

gbhackers.com · 5 months ago

ShinyHunters exploited Canvas LMS Free‑For‑Teacher accounts in early May 2026 to access production tenant data across thousands of schools worldwide. The exposure window ran from April 30 to May 7 2026, the group claimed responsibility on May 3 and posted a ransom note threatening to leak data while claiming to hold 3.6 terabytes of data covering roughly 275 million users across about 9,000 schools. Instructure took Canvas services offline, permanently shut down the FFT program, rotated privileged API keys and is working with forensic investigators and law enforcement while stating it has found no evidence so far that passwords, dates of birth, government identifiers, or financial information were accessed, though names, email addresses, student ID numbers and some private messages were exfiltrated, increasing the risk of targeted phishing.

Fake OpenAI Privacy Filter Repo Hits #1 on Hugging Face, Draws 244K Downloads

thehackernews.com · 5 months ago

A malicious Hugging Face repository impersonated OpenAI's Privacy Filter open-weight model, copied the legitimate model card, and briefly reached the platform's top trending position with roughly 244,000 downloads before being disabled. The project provided Windows and cross-platform loaders that disabled SSL verification, used a public JSON paste service to retrieve commands, invoked PowerShell to download a second-stage downloader that elevated privileges and configured antivirus exclusions, and ultimately delivered a Rust-based information stealer that harvested screenshots, messaging data, cryptocurrency wallet information, FileZilla configurations, and browser data for exfiltration. Researchers identified multiple other repositories using the same Python loader and tied the shared infrastructure and payload behavior to broader supply chain operations and prior campaigns that deployed a modular remote access trojan attributed to the Silver Fox threat actor.

Windows CreateFileW API Flaw Could Let Attackers Lock SMB Files at Scale

gbhackers.com · 5 months ago

A newly disclosed technique called GhostLock abuses the Windows CreateFileW API to acquire exclusive deny share handles and lock large numbers of SMB files across enterprise network shares without writing or encrypting any data. A proof of concept shows a low privileged domain user can lock up to half a million files in under three minutes, triggering widespread sharing violations that disrupt enterprise resource planning systems and shared workflows while leaving no traditional forensic traces. Detection and response require ingesting storage session telemetry to alert on unusually high numbers of exclusive handles per session and coordinating with storage administrators to forcibly terminate the offending network session because revoking credentials alone will not release the locks.

Weaponized JPEG file Drops Trojanized ScreenConnect Malware

gbhackers.com · 5 months ago

Hackers are abusing a weaponized JPEG named sysupdate.jpeg that contains an obfuscated PowerShell script which, when executed, stages components from attacker infrastructure to install a trojanized ConnectWise ScreenConnect client and establish persistent remote access for surveillance and credential theft. The PowerShell loader compiles a unique launcher executable on the victim using csc.exe, performs a fileless UAC bypass via ComputerDefaults.exe and a crafted ms-settings protocol handler, and installs a malicious Windows service named OneDriveServers that deploys a modified ScreenConnect client connecting to legitserver.theworkpc.com and the hard coded IP 45.138.16.64. The trojanized ScreenConnect instance exposes dozens of operator capabilities including live screen viewing, continuous recording, microphone capture, clipboard and print interception, credential provider hooking to capture login credentials, account lifecycle control, and encrypted command and control using PBKDF2 HMAC SHA256 derived keys. Organizations are advised to block PowerShell execution from untrusted sources, harden UAC and registry policies, monitor ScreenConnect installations and unexpected services such as OneDriveServers, and inspect JPEG files for embedded non image content.

macOS Malware Abuses Google Ads and Claude Shared Chats to Deliver Payloads

gbhackers.com · 5 months ago

There is a sophisticated malvertising campaign targeting macOS users that leverages malicious Google Ads and legitimately shared Anthropic Claude chats to trick developers into executing an obfuscated installation command that delivers a MacSync malware variant. The installation command conceals the payload URL in base64 and pipes the downloaded content into the macOS zsh for immediate execution, with delivery and command and control infrastructure hosted on attacker controlled domains. The payload is identified as a MacSync variant with SHA-256 hash bbd98170ea66c8d13605cb88ad0e18602ef40c0745f7b2c979a8a342a31c1857. Recommended mitigations include enforcing policies against pasting terminal commands from untrusted sources, verifying downloads via official vendor sites, monitoring for anomalous zsh executions, and blocking known malicious command and control domains.

ODINI Malware Uses CPU Magnetic Signals to Exfiltrate Data from Air-Gapped Systems

gbhackers.com · 5 months ago

ODINI is malware that exfiltrates data from air-gapped systems by modulating low-frequency magnetic fields generated through deliberate CPU power consumption, demonstrating that Faraday cages and isolation can be bypassed. It encodes data by rapidly loading and unloading processor cores, transmits at speeds up to 40 bits per second to magnetic receivers placed up to 150 centimeters away, requires no elevated privileges, can operate from inside virtual machines, and evades traditional antivirus detection. Defenses include strict physical zoning to prevent nearby unauthorized sensors, active magnetic signal jamming, and costly ferromagnetic shielding such as mu-metal, each with practical trade-offs.

What It Costs to Hire a Hacker on the Dark Web in 2026

www.techrepublic.com · 5 months ago

Hacker for hire services on the dark web are widely available and are typically paid for with cryptocurrency, covering attacks from distributed denial of service to data theft, social account takeovers, and changing school grades. Distributed denial of service attacks range from ten dollars to two thousand five hundred dollars, with gaming targets typically fifty to two hundred dollars and high value targets such as financial institutions or government networks reaching up to five thousand dollars, and some providers charge by time for example seven dollars and fifty cents per hour thirty five dollars per day and two hundred fifty dollars for longer campaigns. Personal attacks range from ten dollars to over six hundred dollars, access to personal information averages six hundred dollars, a physical US identification card costs about one hundred fifty to one hundred sixty dollars and a European passport is advertised around three thousand eight hundred dollars. Website and database access averages one thousand two hundred dollars with small business compromises as low as six hundred dollars and advanced website crimes costing five thousand to fifty thousand dollars, computer and phone hacking averages nine hundred fifty dollars with phone or email access often five hundred to five thousand dollars and ransomware or large scale extortion typically demanding at least fifty thousand dollars, while social media account takeovers range twenty to five hundred dollars averaging two hundred thirty dollars, email account access averages two hundred forty one dollars and changing grades averages one thousand six hundred dollars.

New cPanel and WHM Vulnerabilities Expose Servers to Code Execution and DoS Attacks

gbhackers.com · 5 months ago

On May 8, 2026, researchers disclosed three severe security flaws affecting cPanel, WebHost Manager and the WP Squared platform that can enable arbitrary code execution, arbitrary file disclosure, and symlink based permission manipulation leading to denial of service and possible local privilege escalation. The flaws are tracked as CVE-2026-29202, a critical Perl code injection in the createuser API via the plugin parameter; CVE-2026-29201, an arbitrary file read in the feature::LOADFEATUREFILE adminbin call; and CVE-2026-29203, unsafe symlink handling that permits chmod on arbitrary files. The vendor released emergency patches and administrators are urged to update to version 11.136.0.9 or higher, apply listed backported fixes for older branches, update WP Squared to 11.136.1.10, and force and verify updates immediately to mitigate exploitation.

JDownloader Hack Spreads New Python RAT

gbhackers.com · 5 months ago

There was a supply chain attack on the official JDownloader website that redirected specific download links to malicious installers containing a heavily obfuscated Python based remote access trojan. Attackers exploited an unpatched content management system vulnerability to redirect the Download Alternative Installer for Windows and the Linux shell installer during a risk window from May 6 through May 7, 2026, and the site was taken offline on May 7 once developers were alerted. The Windows executables were signed with spoofed publisher names and the Linux installer contained injected code that installed a SUID root launcher and disguised the payload to evade detection. Eight malicious Windows installers and one compromised Linux installer were identified, and users who ran the compromised installers are advised to reinstall their operating systems and verify downloads by comparing SHA256 checksums and file sizes against the vendor’s incident report.

Top 10 Best Secure Code Review Services For Developers in 2026

gbhackers.com · 5 months ago

There are ten leading secure code review services for developers in 2026 that emphasize shifting security left by combining automated analysis with expert manual review to identify and remediate vulnerabilities earlier. Key trends include AI powered detection, stronger focus on software supply chain and open source component analysis, cloud native and container awareness, and deep integration of secure code review into CI CD pipelines to provide contextual, actionable remediation for developers. The market spans developer centric platforms offering real time feedback, pentesting as a service for collaborative offensive testing, and enterprise platforms that prioritize accuracy, low false positives, scalability, and compliance reporting.

Top 10 Best DevSecOps Companies For Secure SDLC 2026

gbhackers.com · 5 months ago

There is growing urgency to embed security across the software development life cycle as the DevSecOps market, valued at roughly USD 2.8 billion in 2024, is projected to reach USD 23.1 billion by 2033. Key 2026 trends driving adoption include accelerated release cycles, cloud native and container complexities, software supply chain attacks, AI and machine learning risks, and tighter data privacy regulations, making shift left security and continuous testing essential. A vendor comparison highlights Snyk, Checkmarx, GitLab, Veracode, Aqua, ArmorCode, SonarQube, Fortify, Lacework, and Contrast Security, noting varying coverage of SAST, DAST, SCA, IAST, infrastructure as code scanning, container and API security, and AI assisted features that make some platforms more developer focused and others better suited to large enterprises.

Over 500 Organizations Hit in Years-Long Phishing Campaign

www.securityweek.com · 5 months ago

Operation HookedWing is a years-long phishing campaign that has stolen more than two thousand user credentials across over five hundred organizations in aviation, travel, critical infrastructure, energy, financial, government, logistics, public administration, and technology sectors. The campaign, active since at least 2022, relied on GitHub domains, compromised servers, and other hosting platforms while using lures that impersonate human resources or colleagues and simulate Microsoft Outlook with full-screen loaders that personalize content for the victim. Background scripts inject PHP forms to capture email, password, IP address, geolocation, and organization domain in a single record, and investigators linked the activity to at least two dozen command and control servers and over one hundred GitHub domains as the actor expanded infrastructure and French language lures in 2024 and 2025.

Mythos, MOAK, CTEM and the End of CVE Chasing

www.cycognito.com · 5 months ago

false

Autonomous Vulnerability Hunting with MCP

blog.zsec.uk · 5 months ago

false

ShinyHunters / AT&T ransom payment traced on-chain — paper draft, seeking arXiv cs.CR endorsement

www.google.com · 5 months ago

NULL

Hackers abuse Google ads, Claude.ai chats to push Mac malware

www.bleepingcomputer.com · 5 months ago

Hackers are using Google Ads and shared chats within Claude.ai to distribute malware targeting Mac users. Malicious actors create sponsored search results that appear to lead to legitimate claude.ai download pages, but instead deliver instructions to install malware. The malware, a variant of MacSync, harvests browser credentials, cookies, and keychain contents before exfiltrating them to an attacker-controlled server. Attackers are selectively targeting victims based on keyboard locale and system information, though some variants skip this profiling stage.

Police shut down reboot of Crimenetwork marketplace, arrest admin

www.bleepingcomputer.com · 5 months ago

German authorities have shut down a rebooted version of the Crimenetwork cybercrime marketplace and arrested its administrator. The platform, which operated since 2012 and previously generated over 3.6 million euros, allowed for the sale of illegal goods and services. A 35-year-old man was arrested in Mallorca, Spain, for rebuilding the platform just days after the original shutdown. Police seized approximately 194,000 euros in assets and obtained user data for further investigation.

Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak

thehackernews.com · 5 months ago

Security researchers have identified critical vulnerabilities in the Ollama framework, a tool for running large language models locally. A heap out-of-bounds read flaw, CVE-2026-7482, allows unauthorized attackers to potentially leak sensitive data from process memory. Additionally, two unpatched vulnerabilities, CVE-2026-42248 and CVE-2026-42249, in the Windows update mechanism can be chained to achieve persistent code execution. Users are advised to update to the latest version, restrict network access, and disable automatic updates where possible.

Data in Use Protection: How MPC Keeps Inputs Hidden from the Cloud - Stoffel - MPC Made Simple

stoffelmpc.com · 5 months ago

false

We’ve calculated your chances of winning money on Polymarket

www.washingtonpost.com · 5 months ago

false

The compression of the exploit timeline: Why n-day gaps and 90-day embargoes are failing in practice.

blog.himanshuanand.com · 5 months ago

The security landscape is rapidly changing because of artificial intelligence, making traditional vulnerability disclosure timelines inadequate. Critical vulnerabilities are now being weaponized within days of public disclosure, requiring immediate patching. Security professionals should prioritize instant fixes, use AI defensively for code review and patch analysis, and implement continuous vulnerability management to counter this accelerating threat. Organizations that fail to adapt face increasingly rapid attacks.

Outrunning SHA256 with Physics

blog.floatingpragma.io · 5 months ago

NULL

Memory Poisoning AI Agents via ChromaDB

mamtaupadhyay.com · 5 months ago

A proof of concept demonstrates memory poisoning against AI agents that use persistent vector memory by showing how an attacker with write access to a ChromaDB directory can inject crafted entries with realistic metadata such as session identifiers, backdated timestamps, and authoritative source tags so the payload ranks at the top of retrieval results and is treated as fact without any prompt injection or jailbreak. The attack is hard to detect because the poisoned entry leaves no anomalous logs and appears identical to legitimate memories in retrieval output. The offline PoC built with ChromaDB, an all MiniLM L6 v2 embedding via fastembed on ONNX, and a pure Python HMAC defense shows two mitigations: HMAC signing of content and metadata to reject unsigned entries before they reach the LLM and source scoping to filter cross session injections at retrieval time.

Defence in Depth: A Practical Secure Corporate Network Topology

blogs.official-biswadeb941.in · 5 months ago

A practical enterprise security architecture guide outlines defense in depth strategies to secure corporate networks. Key focus areas include identifying and mitigating single points of failure, managing insider threats, and implementing layered controls within realistic budget constraints.

JDownloader site hacked to replace installers with Python RAT malware

www.bleepingcomputer.com · 5 months ago

The JDownloader website was compromised, with attackers modifying download links to distribute malicious Windows and Linux installers to users who downloaded installers from May 6 to May 7, 2026. The Windows installer acted as a loader that deployed a heavily obfuscated Python based remote access trojan capable of running modular Python code received from remote command and control servers. The modified Linux shell installer downloaded a disguised archive, extracted ELF binaries including a SUID root binary named systemd exec, copied the main payload to root user storage, created persistence via a script in /etc/profile.d, and launched the malware while masquerading as an upowerd process. Developers took the site offline, advised users to confirm installers are digitally signed by AppWork GmbH, and recommended reinstalling affected systems and resetting credentials for anyone who ran the malicious installers.

Technical Analysis of EagleSpy V6.0 (CraxsRAT Rebrand) Distributed Through Odysee and Telegram

odysee.com · 5 months ago

An individual operating through Odysee and Telegram is selling a malicious Android RAT named EagleSpy V6.0 that appears to be a rebranded version of CraxsRAT. An investigation found the buyer was financially scammed after payment and the seller blocked communication, and analysis of the malware infrastructure and repository revealed evidence of real victim infrastructure and compromised device information. Technical analysis confirmed capabilities including banking phishing overlays, crypto wallet credential theft, Telegram bot exfiltration, remote shell execution, keylogging, camera and microphone access, GPS tracking, ransomware components, DEX packing for antivirus evasion, and hidden update and backdoor mechanisms. The malware appears capable of targeting not only victims but potentially buyers and operators through embedded update systems and hidden control mechanisms, and reports have been submitted to platform abuse teams.

Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes (and More)

heyitsas.im · 5 months ago

There are more than twenty CVEs discovered by an autonomous LLM-based vulnerability-hunting harness, including remote unauthenticated out-of-bounds writes in the Linux kernel ksmbd identified as CVE-2026-31432 and CVE-2026-31433. These ksmbd issues arise when a compound sequence of SMB operations lets a first operation consume most of the kernel reply buffer and a following operation append variable-length metadata without proper bounds checking, causing memory corruption that reached adjacent kernel objects in lab testing and could enable a proof-of-concept remote code execution under weakened hardening. The system also found multiple other high-impact flaws such as CUPS CVE-2026-34980 and CVE-2026-34990 which chain from unauthenticated network access to root file overwrite, and Docker CVE-2026-34040 where crafted API requests can bypass body-inspecting authorization. The harness uses a multi-agent pipeline that seeds targets, generates hypotheses from docs and source, iterates on proofs of concept in sandboxed virtual machines, grades findings, and submits maintainer-facing reports while deliberately tuning models to be more exploratory or effectively "drunk" to improve discovery.

Fake OpenAI repository on Hugging Face pushes infostealer malware

www.bleepingcomputer.com · 5 months ago

A malicious repository on Hugging Face impersonated OpenAI's Privacy Filter project, briefly reached the platform's trending list with about 244,000 downloads, and was removed after researchers at HiddenLayer discovered it on May 7, 2026. Its loader.py script disabled SSL verification, decoded and fetched a payload that executed PowerShell to download a batch file which performed privilege escalation, added a final Rust based infostealer named sefirah to antivirus exclusions, and executed it. The infostealer harvests browser data including cookies and saved passwords, Discord tokens, cryptocurrency wallets and extensions, SSH FTP and VPN credentials, local files and wallet seeds, and screenshots, employs multiple anti analysis checks to evade detection, and affected users are advised to reimage machines, rotate credentials, replace wallets and invalidate browser sessions.

TCLBANKER Malware Leverages WhatsApp and Outlook Worm Features in Active Attacks

gbhackers.com · 5 months ago

A sophisticated Brazilian banking trojan named TCLBANKER is being distributed through a trojanized Logitech installer and can hijack victims' WhatsApp and Outlook accounts to self propagate. The campaign tracked as REF3076 delivers a malicious MSI bundled in a ZIP and abuses a signed Logi AI Prompt Builder application via DLL sideloading, loading a malicious screen retriever plugin that deploys two.NET Reactor protected payloads, a banking module and a worm module. The malware employs environment dependent payload decryption, extensive anti analysis checks, geofencing to restrict operations to Brazil, a full screen overlay for credential harvesting and vishing coordination, a WhatsApp worm that clones browser profiles and uses Selenium to send phishing messages, and an Outlook module that sends invoice themed phishing emails from victims' accounts. Operators host command and control and delivery infrastructure through a single Cloudflare Workers account, researchers link the operation to the MAVERICK SORVEPOTEL family, and multiple indicators of compromise are published for detection and mitigation.

Canvas hack exposes schools’ vulnerability to cyberattacks

www.washingtonpost.com · 5 months ago

A widespread breach of the Canvas education platform exposed personally identifying information from almost nine thousand schools and about 275 million people after a group calling itself ShinyHunters claimed responsibility. Instructure said attackers exploited an issue related to Free-for-Teacher accounts, forcing Canvas offline during finals and prompting many schools to delay deadlines and restrict access while they investigate. Security experts warned the incident underscores the systemic risk of a small number of edtech platforms holding vast student data, increasing the likelihood of sophisticated phishing, identity theft and ransom extortion. The breach follows other major education sector incidents and has renewed calls for stronger vendor security, clearer enforcement of student privacy laws and limits on classroom technology use.

Inside Ben Shapiro’s MAGA meltdown

www.washingtonpost.com · 5 months ago

false

cPanel, WHM Release Fixes for Three New Vulnerabilities — Patch Now

thehackernews.com · 5 months ago

There are three new vulnerabilities in cPanel and Web Host Manager that could allow privilege escalation, arbitrary code execution, and denial of service. They are tracked as CVE-2026-29201, an arbitrary file read via insufficient validation of the feature LOADFEATUREFILE adminbin call; CVE-2026-29202, insufficient validation of the plugin parameter in the createuser API that could lead to arbitrary Perl code execution as the affected user; and CVE-2026-29203, unsafe symlink handling that lets a user change permissions of arbitrary files via chmod, enabling denial of service or possible privilege escalation. Patches are available in multiple cPanel and WHM release versions and a direct update 110.0.114 was issued for customers on CentOS 6 or CloudLinux 6, and users are urged to update promptly; there is no evidence of exploitation in the wild, though a recently weaponized cPanel flaw CVE-2026-41940 was noted.

Vidar Infostealer Campaign Steals Passwords, Cookies, Crypto Wallets, and Device Data

gbhackers.com · 5 months ago

A multi-stage malware campaign is using the Vidar infostealer to steal passwords, browser cookies, cryptocurrency wallet information, and device data. Attackers are using a commonly abused software activation tool, MicrosoftToolkit.exe, to initiate the infection, followed by AutoIt scripting to disguise malicious activity and evade detection. The malware employs techniques such as file renaming, process reconnaissance, and memory analysis avoidance to maintain stealth, and communicates with command-and-control servers through legitimate services like Telegram and Steam. The malware then deletes files and terminates processes to erase traces of the attack.

NVIDIA Confirms GeForce Data Breach Exposed Users’ Personal Data

gbhackers.com · 5 months ago

GFN.AM, a regional partner of NVIDIA GeForce NOW, has confirmed a data breach affecting users of their cloud gaming platform. Unauthorized access to an internal database occurred on March 9, 2026, and was not discovered until May 2, 2026. Exposed information includes email addresses, account usernames, dates of birth, phone numbers for mobile operator registrants, and names for users utilizing Google single sign-on. While passwords were not compromised, the leaked personal data increases the risk of targeted phishing and social engineering attacks.

Seclens: Role-specific Evaluation of LLM's for security vulnerablity detection

arxiv.org · 5 months ago

A new framework, SecLens-R, has been developed to evaluate large language models for security vulnerability detection, addressing the limitations of current single-metric benchmarks. The framework incorporates the distinct priorities of different roles, such as chief information security officers and engineering leaders, by using role-specific weighting profiles. Evaluations of 12 language models across various settings revealed significant differences in performance based on stakeholder perspectives. The research highlights that vulnerability detection is a multi-objective problem, and stakeholder-aware evaluations offer more nuanced insights.

ShinyHunters Extorts Universities in New Instructure Canvas Hack

www.techrepublic.com · 5 months ago

ShinyHunters linked attackers defaced Canvas login portals, locking students out of coursework, quizzes, and grades during finals week and affecting approximately 330 educational institutions. The group claimed roughly 280 million student and staff records tied to more than 8,800 schools were stolen and issued extortion demands while Instructure confirmed data was accessed and placed Canvas into maintenance mode. Reports indicate the attackers exploited a vulnerability that allowed modification of institutional login pages, highlighting risks of centralized cloud based education platforms and prompting recommendations such as enforcing role based access controls, phishing resistant multifactor authentication, restricting API access, centralized logging, maintaining offline backups, and testing incident response plans.

Friday Squid Blogging: Giant Squid Live in the Waters of Western Australia

www.schneier.com · 5 months ago

false

Five new holes, one exploited, found in Ivanti Endpoint Manager Mobile

www.csoonline.com · 5 months ago

Security researchers have identified five vulnerabilities in Ivanti’s Endpoint Manager Mobile (EPMM) suite, prompting a warning from cybersecurity experts to prioritize patching and consider a shift away from legacy systems. One vulnerability, CVE-2026-6973, is actively exploited and allows remote code execution with administrative access. Experts recommend rotating administrative credentials after patching due to the possibility of existing compromises, and disabling Apple Device Enrolment if not in use. Ivanti is utilizing AI tools to proactively identify vulnerabilities, and organizations should review their security posture and consider a Zero Trust model. Other identified vulnerabilities include CVE-2026-5787, CVE-2026-5786, CVE-2026-5788, and CVE-2026-7821.

Securing CI/CD for an open source project: lessons from Cilium

cilium.io · 5 months ago

NULL

AWS Rex Is a Big Step for Agentic AI Security, But Not the Final Layer

www.techrepublic.com · 5 months ago

On May 4, 2026 AWS open sourced Trusted Remote Execution, known as Rex, which intercepts every system operation an AI generated script attempts and evaluates a Cedar policy set by the host owner before permitting the underlying system call. Rex targets hallucinated code, prompt injection, and overly eager task interpretation by bounding host operations instead of trying to bound agent outputs, and the project is available under the Apache 2.0 license. Rex does not implement data layer controls and therefore does not address human authorization, purpose limitation, minimum necessary access, deletion requests, jurisdictional restrictions, or tamper evident audit records, so organizations must pair runtime gating with identity and attribute based data layer controls and long lived audit trails to meet regulatory and audit requirements.

ShinyHunters Claims Second Attack Against Instructure

www.darkreading.com · 5 months ago

The cybercriminal group ShinyHunters has reportedly breached Instructure, the company behind the Canvas learning management system, twice. Instructure initially claimed the breach was contained but later acknowledged an ongoing incident impacting "free-for-teacher" accounts, leading to a temporary shutdown of those accounts and disruptions for students. ShinyHunters claims to have stolen 3.65 terabytes of data from nearly 9,000 institutions, including personal messages between students and teachers, impacting roughly 275 million individuals. The group is threatening to leak the data and has extended their deadline to May 12.

Google Play Scam Apps Hit 7.3M Downloads with Fake Call Logs

www.techrepublic.com · 5 months ago

NULL

TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms

thehackernews.com · 5 months ago

Security researchers have identified a new Brazilian banking trojan called TCLBANKER, tracked as REF3076, which targets 59 financial platforms and cryptocurrency services. The malware is a significant update to the Maverick trojan, utilizing a worm to spread through WhatsApp Web and Microsoft Outlook, hijacking authenticated sessions and sending phishing emails from compromised accounts. TCLBANKER employs advanced techniques like environment-gated payload decryption, DLL side-loading, and real-time social engineering to evade detection and steal credentials, often leveraging a signed Logitech program for initial delivery.

Insider Betting on Polymarket

www.schneier.com · 5 months ago

A non-profit group's research indicates unusual betting patterns on Polymarket, a platform for prediction markets. Long-shot bets regarding military and defense actions have a significantly higher win rate, approximately 52 percent, compared to other markets. This suggests potential insider trading is influencing outcomes, warping politics and military actions. Experts say this type of activity is concerning and should not be legal.

Active attack: Dirty Frag Linux vulnerability expands post-compromise risk

www.microsoft.com · 5 months ago

A new Linux vulnerability, dubbed “Dirty Frag,” allows attackers to gain root access after initial compromise. This exploit leverages weaknesses in kernel networking and memory handling components, specifically esp4, esp6 (CVE-2026-43284), and rxrpc (CVE-2026-43500), to improve the reliability of privilege escalation. Attackers could exploit this through compromised accounts, web shells, or container escapes, potentially leading to disabling security tools, accessing credentials, and establishing persistent access. Microsoft Defender is actively monitoring for this activity and providing detection coverage with signatures like Exploit:Linux/DirtyFrag.A and Potential exploitation of dirtyfrag vulnerability detected.

Millions of Windows PCs Face a Secure Boot Update Deadline in 2026

www.techrepublic.com · 5 months ago

NULL

NVIDIA confirms GeForce NOW data breach affecting Armenian users

www.bleepingcomputer.com · 5 months ago

NVIDIA has confirmed a data breach affecting GeForce NOW users in Armenia. The breach was caused by a compromise of infrastructure operated by a regional partner, GFN.am, and did not impact NVIDIA’s core network. Stolen information includes full names, email addresses, usernames, dates of birth, and 2FA/TOTP status. The threat actor, ShinyHunters, initially offered the database for sale on a hacker forum.

One in eight UK workers has sold their company passwords, and bosses think it’s fine

www.fortra.com · 5 months ago

A recent report reveals that roughly one in eight UK workers has sold their company passwords, or knows someone who has. Surprisingly, a significant portion of business leaders, including 81% of business owners, believe this practice is justifiable. Selling login credentials allows attackers easy access to sensitive data and systems, bypassing typical security measures. Experts recommend implementing stronger technical controls and reevaluating employee trust to mitigate this risk.