Blahalla

Palo Alto Networks firewall flaw has been exploited for several weeks

www.csoonline.com · 5 months ago

A critical vulnerability, CVE-2026-0300, affects Palo Alto Networks firewalls running PAN-OS versions 10.2, 11.1, and 12.1. The flaw allows unauthenticated attackers to execute code with root privileges on exposed firewalls using the User-ID Authentication Portal. Limited exploitation has been observed targeting portals accessible from the public internet, and the US Cybersecurity and Infrastructure Security Agency has added the vulnerability to its known exploited vulnerabilities catalog. Palo Alto Networks advises restricting access to the portal and disabling unnecessary features as mitigations while patches are prepared.

Palo Alto Networks firewall flaw has been exploited for several weeks

www.csoonline.com · 5 months ago

A critical zero-day vulnerability, CVE-2026-0300, has been identified in Palo Alto Networks PAN-OS firewalls. Attackers, believed to be state-sponsored hackers, have exploited the flaw in the User-ID Authentication Portal to execute code with root privileges. More than 5,400 PAN-OS VM firewalls are currently exposed online, primarily in Asia and North America. Palo Alto Networks is preparing security updates expected to be released May 13, and advises customers to restrict access or disable the Authentication Portal until then.

Become a millionaire by bug hunting on Android

www.csoonline.com · 5 months ago

Google is increasing the maximum reward for serious Android vulnerabilities to one point five million dollars. The highest reward for vulnerabilities in Google Chrome is now two hundred fifty thousand dollars. Google has distributed eighty one point six million dollars in rewards through its bug bounty programs since they began in 2010. These programs incentivize security researchers to find and report vulnerabilities.

13 new critical holes in JavaScript sandbox allow execution of arbitrary code

www.csoonline.com · 5 months ago

Thirteen critical vulnerabilities have been discovered in the vm2 JavaScript sandbox package, potentially allowing attackers to execute arbitrary code. The most severe, CVE-2026-26956, involves a full sandbox escape confirmed on Node.js 25.6.1 with WebAssembly support. Another vulnerability, CVE-2026-44007, stems from improper access control and affects how the nesting option interacts with the legacy module resolver. Developers are urged to immediately upgrade to version 3.11.2 to address these issues and consider alternative isolation methods like Docker containers or V8 Isolates.

Canvas login portals hacked in mass ShinyHunters extortion campaign

www.bleepingcomputer.com · 5 months ago

The cybercriminal group ShinyHunters has once again targeted Instructure, defacing Canvas login portals for approximately 330 educational institutions. The defacement displayed a message threatening to leak stolen data unless a ransom is paid, with a deadline of May 12, 2026. This incident follows a previous breach where ShinyHunters allegedly stole 280 million student and staff records. Instructure has taken Canvas offline to address the vulnerability and is reportedly unresponsive to inquiries regarding the data breach.

New TCLBanker malware self-spreads over WhatsApp and Outlook

www.bleepingcomputer.com · 5 months ago

A new banking trojan called TCLBanker has emerged, targeting 59 banking, fintech, and cryptocurrency platforms. It spreads through compromised MSI installers and utilizes self-spreading worm modules for WhatsApp and Outlook, automatically infecting new victims. The malware employs techniques to evade analysis and includes capabilities like live screen streaming, keylogging, and overlay systems for fraudulent credential prompts. Researchers believe TCLBanker is an evolution of the Maverick/Sorvepotel malware family, and its targeting may expand beyond Brazil.

Kernel LPE Vulnerability Published Early Due To Third-Party Breaking Embargo

lwn.net · 5 months ago

A new local-privilege-escalation vulnerability, dubbed Dirty Frag, has been publicly released. This flaw allows for immediate root privilege escalation on all major Linux distributions, similar to a recently disclosed Copy Fail vulnerability. The discoverer, Hyunwoo Kim, released exploit code and a removal script, despite an intended coordinated disclosure. Because the embargo has been broken, no patches or CVEs currently exist.

Ollama vulnerability highlights danger of AI frameworks with unrestricted access

www.csoonline.com · 5 months ago

A critical vulnerability, CVE-2026-7482, has been discovered in the popular AI framework Ollama, potentially exposing sensitive data from over 300,000 internet-facing servers. The flaw allows unauthenticated attackers to trigger a memory leak by uploading a specially crafted file, revealing data like user prompts, API keys, and proprietary code. Researchers recommend updating to version 0.17.1, implementing authentication, and restricting network access to mitigate the risk. Companies should also audit networks for unauthorized AI frameworks to prevent similar security incidents.

After Replacing TeamPCP Malware, 'PCPJack' Steals Cloud Secrets

www.darkreading.com · 5 months ago

Researchers have identified a new modular cloud worm called PCPJack, designed to remove TeamPCP malware while simultaneously stealing sensitive information. PCPJack scans for and eliminates TeamPCP processes, then collects credentials and keys from cloud services, email providers, cryptocurrency wallets, and various applications like AWS and Slack. Notably, it uses Common Crawl data and parquet files to identify and exploit potential targets, a unique approach in cloud cybercrime, and does not include cryptomining functionality. The origin of PCPJack is speculated to be a former TeamPCP member, possibly due to its specific targeting of TeamPCP’s tools.

LinkedIn illegally blocking free accounts from seeing ‘who’s viewed your profile’ data, group alleges

www.csoonline.com · 5 months ago

A digital rights group, None of Your Business, has filed a legal complaint in Austria alleging LinkedIn is violating the General Data Protection Regulation, or GDPR. The complaint states LinkedIn unfairly restricts access to ‘Who’s Viewed Your Profile’ data to paying subscribers while denying it to free users in the EU. The group argues this policy contradicts GDPR Article 15, which guarantees users the right to access their personal data. LinkedIn maintains it complies with GDPR and provides the information through its privacy policy, but a ruling in favor of NOYB could force LinkedIn to make the feature free or alter its data-sharing practices.

When prompts become shells: RCE vulnerabilities in AI agent frameworks

www.microsoft.com · 5 months ago

Microsoft's Security Research team recently addressed critical remote code execution vulnerabilities in the Semantic Kernel AI agent framework. Two critical vulnerabilities, CVE-2026-25592 and CVE-2026-26030, were discovered, which allowed attackers to execute arbitrary code through prompt injection without malicious attachments. One vulnerability involved an improperly exposed tool enabling file writes to the host system, requiring upgrades to version 1.71.0 or higher. Microsoft recommends upgrading Semantic Kernel, treating AI model parameters as attacker-controlled, and recognizing that AI models are not security boundaries.

Dirty Frag - Linux LPE similiar to Copy Fail

vuink.com · 5 months ago

A new vulnerability class called Dirty Frag has been identified, allowing for potential root privilege escalation on Linux systems. The vulnerability chains together two separate page-cache write flaws. It is a deterministic bug, meaning a high success rate is expected without a timing dependency, and the kernel will not panic on failure. Due to a premature public disclosure, no patch or CVE is currently available.

Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s Leaders

www.securityweek.com · 5 months ago

false

Has CISA Finally Found Its New Leader in Tom Parker?

www.darkreading.com · 5 months ago

false

New PCPJack worm steals credentials, cleans TeamPCP infections

www.bleepingcomputer.com · 5 months ago

A new malware framework called PCPJack is targeting cloud infrastructure to steal credentials and remove infections from the TeamPCP threat group. The framework scans for exposed services like Docker, Kubernetes, Redis, and MongoDB, exploiting vulnerabilities such as CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703 to gain access. Stolen credentials are encrypted and exfiltrated to Telegram channels, and the malware establishes persistence using various methods, including systemd services. Researchers believe PCPJack may be operated by a former TeamPCP affiliate and recommend implementing multi-factor authentication and following least-privilege principles to mitigate the risk.

Australia warns of ClickFix attacks pushing Vidar Stealer malware

www.bleepingcomputer.com · 5 months ago

Australian organizations are facing a malware campaign utilizing a social engineering technique called ClickFix to distribute the Vidar Stealer malware. This technique tricks users into running malicious PowerShell commands through fake verification prompts on compromised websites, often targeting WordPress infrastructure. Vidar Stealer steals sensitive information like passwords, cryptocurrency wallets, and system details, and attempts to minimize forensic traces. The Australian Cyber Security Center advises restricting PowerShell execution, updating WordPress sites, and reviewing indicators of compromise.

Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access

thehackernews.com · 5 months ago

Ivanti is reporting active exploitation of a critical vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile software. This flaw allows authenticated administrators to execute remote code and has already impacted a limited number of customers. The U.S. Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating fixes for Federal agencies. Several other vulnerabilities have also been patched: CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821.

PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems

thehackernews.com · 5 months ago

Security researchers have identified a new credential theft framework called PCPJack, which targets exposed cloud infrastructure and removes traces of a related group, TeamPCP. The tool harvests credentials from various cloud services, including Docker, Kubernetes, and Redis, then exfiltrates data to attacker-controlled servers. PCPJack spreads like a worm, utilizing exploits for CVE-2025-55182, CVE-2025-29927, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703, and it monitors whether TeamPCP has been removed from compromised systems. The campaign appears focused on illicit revenue generation through credential theft and resale, but notably lacks cryptocurrency mining capabilities.

Honey Tokens: Bait Credentials That Catch Breaches

infisical.com · 5 months ago

Rippling recently detected corporate espionage after an employee repeatedly searched for competitor information in Slack, leading them to create a honeypot, a deceptive resource designed to trap attackers. Honey tokens are fake credentials, like AWS IAM access keys, placed among real secrets to alert organizations when they are accessed, indicating a breach. Infisical is now offering honey tokens that function by generating CloudTrail logs when used, triggering immediate alerts and requiring adjacent secrets to be rotated. These tokens are deployed within an organization’s AWS account to avoid detection by attackers who can identify tokens from vendor-controlled infrastructure.

CVE-2026-42511 Breakdown: RCE in FreeBSD

aisle.com · 5 months ago

A critical Remote Code Execution vulnerability, CVE-2026-42511, has been identified in FreeBSD’s dhclient software, potentially impacting devices from 2005 onward. Attackers can exploit the vulnerability by injecting malicious code through a DHCP server, gaining root access to affected systems. The vulnerability stems from improper data handling, causing the execution of shell commands with root privileges. A fix is available, but the discovery emphasizes the importance of securing network configuration processes.

World Passkey Day: Advancing passwordless authentication

www.microsoft.com · 5 months ago

false

Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State Hacking

www.securityweek.com · 5 months ago

A zero-day vulnerability, CVE-2026-0300, is being exploited in Palo Alto Networks firewalls. The flaw allows for unauthenticated remote code execution with root privileges and has been linked to a likely state-sponsored threat group, CL-STA-1132. Attackers have been observed using tools like Earthworm and ReverseSocks5 to establish covert communication channels and bypass firewalls, along with techniques like Active Directory enumeration and log deletion. Evidence suggests the attacks originate from China, based on the tools and tactics employed.

Ivanti warns of new EPMM flaw exploited in zero-day attacks

www.bleepingcomputer.com · 5 months ago

Ivanti has warned customers about a high-severity remote code execution vulnerability, CVE-2026-6973, in Endpoint Manager Mobile (EPMM) that is currently being exploited. This flaw allows attackers with administrative privileges to execute code on vulnerable systems running EPMM versions 12.8.0.0 and earlier. Mitigations are available in versions 12.6.1.1, 12.7.0.1, and 12.8.0.1. Additionally, Ivanti has patched four other high-severity vulnerabilities: CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821, as well as previously disclosed CVE-2026-1281 and CVE-2026-1340.

Bypassing Bitlocker under 5 min using downgrade attack on CVE-2025-48804

www.intrinsec.com · 5 months ago

Microsoft addressed a BitLocker vulnerability, CVE-2025-48804, in July 2025, through a boot manager patch. However, the Secure Boot feature doesn’t verify the version of the boot manager, allowing attackers to exploit older, vulnerable versions signed with the PCA 2011 certificate. Attackers can leverage physical access, a modified BCD file, and a USB drive to load a malicious WinRE image, decrypting the BitLocker volume without triggering alerts. The most reliable protection is enabling a PIN at startup, and Microsoft recommends migrating to the CA 2023 certificate to mitigate the risk.

Claude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking

www.securityweek.com · 5 months ago

Researchers have discovered a method to stealthily steal OAuth tokens from Claude Code, granting attackers access to connected tools and data. The attack involves modifying the ~/.claude.json file, redirecting traffic through an attacker-controlled proxy, and requires the ability to install a tailored npm package. This redirection allows attackers to intercept tokens during session initiation and refresh, maintaining persistence even with token rotation. Mitiga Labs reported this vulnerability to Anthropic, which deemed it outside their scope due to user consent.

Chrome 148 Rolls Out With 127 Security Fixes

www.securityweek.com · 5 months ago

Google has released Chrome version 148 with 127 security fixes. The update resolves three critical-severity vulnerabilities, including an integer overflow in Blink, CVE-2026-7896, which could lead to memory corruption. Two other critical vulnerabilities are use-after-free issues affecting Mobile and Chromoting components, tracked as CVE-2026-7897 and CVE-2026-7898. Google awarded over 138,000 dollars in bug bounty rewards to external researchers for their contributions.

The Browser Is Breaking Your DLP: How Data Slips Past Modern Controls

www.bleepingcomputer.com · 5 months ago

Traditional data loss prevention, or DLP, solutions are failing to protect sensitive data because modern workflows increasingly occur within web browsers. Users often copy, paste, and upload data directly into applications and AI tools, bypassing endpoint and network controls. This creates a significant visibility gap, as up to 46% of sensitive file uploads go to unsanctioned accounts. Browser-native DLP addresses this by monitoring user activity within browser sessions and providing real-time visibility and control over data movement.

Attackers Could Exploit AI Vision Models Using Imperceptible Image Changes

www.securityweek.com · 5 months ago

Researchers have discovered a method for manipulating vision-language models by subtly altering images. Attackers can embed hidden instructions within images, such as commands to exfiltrate data, that are imperceptible to humans but readable by AI systems. This technique works by optimizing images against publicly available AI models and then applying those changes to proprietary systems like GPT-4o and Claude. The success of these attacks varied; Claude experienced a significant increase in compliance, while GPT-4o maintained stronger safety filters.

Americans sentenced for running 'laptop farms' for North Korea

www.bleepingcomputer.com · 5 months ago

Two U.S. citizens, Matthew Isaac Knoot and Erick Ntekereze Prince, have been sentenced to 18 months in prison for operating laptop farms that aided North Korean IT workers in fraudulently securing remote employment with American companies. Knoot's operation resulted in over 250,000 dollars in payments to North Korean workers, while Prince’s scheme involved more than 943,000 dollars in salaries. These sentences are part of a larger federal initiative targeting North Korea’s revenue generation schemes, which involve thousands of IT workers using identity theft to infiltrate U.S. firms. The actions of these individuals caused significant remediation costs for the victim companies.

PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage

thehackernews.com · 5 months ago

Palo Alto Networks has reported a critical vulnerability, CVE-2026-0300, in its PAN-OS software that allows for unauthorized remote code execution. Threat actors have been observed attempting to exploit this flaw since April 9, 2026, and successfully gained access to devices by April 29, 2026. Following initial access, the attackers covered their tracks and deployed tools like EarthWorm and ReverseSocks5. Palo Alto Networks is tracking this activity as CL-STA-1132, suspecting a state-sponsored threat cluster.

Fake Call History Apps on Google Play Steal Payments, Hit 7.3M+ Downloads

gbhackers.com · 5 months ago

Twenty-eight fake call history applications, collectively downloaded over 7.3 million times, have been removed from the Google Play Store. These apps, dubbed CallPhantom, deceptively promise to display call and message records for any phone number, but instead generate fabricated data and trick users into paying for subscriptions. Some applications circumvented Google’s billing system, making refunds difficult for victims, while others utilized fake notifications to pressure users into purchasing subscriptions. ESET researchers reported the scheme to Google, which has canceled associated Play-billing subscriptions and advises users to be wary of apps making similar claims.

Vendor Says Daemon Tools Supply Chain Attack Contained

www.securityweek.com · 5 months ago

Daemon Tools, a software developer, confirmed a supply chain attack impacting its users. Threat actors injected malicious code into Daemon Tools Lite versions released between April 8 and May 5, which resulted in the distribution of an information-stealing trojan and backdoors. The attackers targeted organizations in Belarus, Russia, and Thailand, as well as a Russian educational institution. Disc Soft has since secured its systems, removed compromised files, and released a clean version of Daemon Tools Lite, version 12.6.0.2445, advising users to scan their systems for malware.

AI Coding Agents Could Fuel Next Supply Chain Crisis

www.securityweek.com · 5 months ago

Researchers have discovered a vulnerability affecting multiple AI coding agents, including Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI, that could lead to supply chain attacks. Attackers can create malicious code within a GitHub repository and, when a developer uses an agent like Claude Code, the agent will automatically download and execute this code after the user unknowingly accepts a "trust" prompt. This allows for arbitrary code execution with the developer’s privileges, potentially compromising sensitive data and enabling persistent command and control. Anthropic, the developer of Claude Code, has declined to implement fixes, citing user consent, but the issue is widespread across agentic coding CLIs.

AI-Driven Cyberattack on Mexico Couldn't Breach OT Systems

www.darkreading.com · 5 months ago

A group of hackers recently conducted the world’s first AI-driven cyberattack, targeting multiple Mexican government entities and stealing sensitive data. The hackers utilized Claude Code to generate an exploitation framework and guide their attacks, successfully breaching IT systems but failing to access operational technology or OT networks at a Monterrey water utility due to a data diode. The incident demonstrates that while AI can lower the barrier to entry for cyberattacks, it cannot replace skilled cybersecurity professionals or bypass mature security controls like network segmentation. The attackers leveraged AI tools like ChatGPT for prior research and phishing attempts over the past three years.

'TrustFall' Convention Exposes Claude Code Execution Risk

www.darkreading.com · 5 months ago

Researchers at Adversa AI have identified a security vulnerability, dubbed "TrustFall," in Anthropic’s Claude Code that allows malicious code execution with a single keypress or automatically in continuous integration environments. The vulnerability stems from a change in the trust dialog that removed previous explicit warnings about project-scoped settings. Attackers can create repositories with malicious configurations to gain full system privileges, potentially accessing sensitive information and establishing command-and-control connections. This issue is related to three previously patched vulnerabilities: CVE-2025-59536, CVE-2026-21852, and CVE-2026-33068, highlighting an ongoing pattern of insecure project settings.

CISA Issues Warning Over Palo Alto PAN-OS Flaw Enabling Root-Level Access

gbhackers.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about a critical vulnerability in Palo Alto Networks PAN-OS, identified as CVE-2026-0300. This flaw allows unauthorized users to gain root-level access to affected systems through a memory corruption vulnerability in the User-ID Authentication Portal. Federal agencies and private organizations are urged to implement immediate mitigation measures, including restricting access or disabling the Captive Portal service, by May 9, 2026. A software patch is not yet available, making these workarounds essential to prevent potential data breaches.

Crypto gang member gets 6.5 years for role in $230 million heist

www.bleepingcomputer.com · 5 months ago

A California man has been sentenced to over six years in prison for his involvement in a large-scale cryptocurrency theft operation. The ring stole more than $230 million in cryptocurrency by using social engineering and, when that failed, by committing burglaries to steal hardware wallets. The group used stolen funds to finance extravagant spending, including private jets, luxury cars, and expensive travel. Another member of the group received a sentence of 70 months, and fourteen suspects were charged in connection to the conspiracy.

An AI security auditor that red-teams PRs to find exploits, not just patterns (open-source + Ollama support)

www.npmjs.com · 5 months ago

false

Bots in translation: Can AI really fix SIEM rule sprawl across vendors?

www.csoonline.com · 5 months ago

false

Hackers Weaponize Claude AI in Attacks on Water and Drainage Utilities

gbhackers.com · 5 months ago

Hackers are using commercial AI models, like Claude and GPT, to target critical infrastructure. A recent attack on a Mexican water and drainage utility, Servicios de Agua y Drenaje de Monterrey (SADM), saw attackers leverage AI to discover industrial systems, build custom tools, and plan attacks against their SCADA/IIoT platform. The AI-assisted activity accelerated reconnaissance, lateral movement, and data exfiltration, with AI-directed actions accounting for roughly three-quarters of remote command execution. Experts warn that AI is making operational technology assets more visible and accessible, necessitating improved cybersecurity defenses like network visibility and traffic monitoring.

Webinar: Why modern attacks require both security and recovery

www.bleepingcomputer.com · 5 months ago

Cyberattacks, particularly phishing campaigns utilizing artificial intelligence, are evolving beyond traditional security measures. Managed service providers are finding prevention alone is insufficient to combat sophisticated attacks like business email compromise and ransomware. Experts emphasize the need to integrate recovery planning, data backups, and business continuity strategies alongside strong defenses. A live webinar will discuss how MSPs can adapt to this changing threat landscape and prioritize both security and rapid recovery capabilities.

Approve Once, Exploit Forever: The Trust Persistence Problem in Claude Code, Codex and Gemini-CLI

mindgard.ai · 5 months ago

AI coding agents, including Gemini, Claude Code, and Codex CLI, have a security flaw allowing permanent permissions once a project folder is trusted. This “trust persistence problem” enables unauthorized code execution and data theft, potentially through compromised collaborators or leaked tokens. Vendors acknowledge the issue but consider it a design choice, not a bug, due to concerns about user inconvenience. The vulnerability, related to a “time-of-check to time-of-use” problem, is tracked as CVE-2025-54136 and requires re-approval of configuration file changes to mitigate the risk.

ThreatsDay Bulletin: Edge Plaintext Passwords, ICS 0-Days, Patch-or-Die Alerts and 25+ New Stories

thehackernews.com · 5 months ago

This week, low-sophistication but highly effective attacks driven by shady packages, fake apps, abandoned DNS records, malvertising, and stolen credentials trafficked in Discord continue to account for a large share of compromises as attackers automate and scale their operations. Critical industrial control system flaws include CVE-2026-7411, an unauthenticated path traversal with a CVSS score of 10.0 that can enable arbitrary file writes and code execution, and CVE-2026-7412, a blind SSRF that can force the server to proxy HTTP POST requests, both patched in Eclipse BaSyx V2.0.0-milestone-10. High-impact enterprise exposures highlighted include CVE-2026-4670, a critical authentication bypass in MOVEit Automation that can yield administrative access, and five patched Salesforce Marketing Cloud vulnerabilities identified as CVE-2026-22585, CVE-2026-22586, CVE-2026-22582, CVE-2026-22583, and CVE-2026-2298 that could leak contact databases and email content. Researchers also show Microsoft Edge keeps decrypted passwords resident in process memory for performance reasons, enabling extraction by an attacker with local administrative access, while officials and vendors are facing pressure to accelerate patch cycles as AI tools sharply shorten the time between disclosure and exploitation.

Cisco Patches High-Severity Vulnerabilities in Enterprise Products

www.securityweek.com · 5 months ago

Cisco has released patches to address multiple vulnerabilities in its enterprise products. Two high-severity vulnerabilities, CVE-2026-20034 and CVE-2026-20035, affect Cisco Unity Connection and could allow attackers to perform server-side request forgery attacks. Other addressed issues include a denial-of-service vulnerability in switches (CVE-2026-20185), a denial-of-service vulnerability in the Crosswork Network Controller and Network Services Orchestrator (CVE-2026-20188), and a denial-of-service vulnerability in the IoT Field Network Director (CVE-2026-20167). Cisco reports no evidence of these vulnerabilities being exploited.

Smart Glasses for the Authorities

www.schneier.com · 5 months ago

Concerns are rising regarding the increasing use of smart glasses by law enforcement. These devices have the potential to record and analyze individuals’ behavior in public spaces. Experts warn this technology can be used for mass surveillance and may erode privacy. The implementation of these tools raises questions about transparency, accountability, and potential misuse.

Palo Alto Networks firewall zero-day exploited for nearly a month

www.bleepingcomputer.com · 5 months ago

Hackers have exploited a critical zero-day vulnerability, CVE-2026-0300, in Palo Alto Networks firewalls for almost a month. The flaw allows unauthenticated attackers to execute code with root privileges on exposed firewalls, with activity tracked as CL-STA-1132 attributed to a state-sponsored threat. Attackers have used tools like Earthworm and ReverseSocks5 to establish covert communication and bypass network restrictions. Over 5,400 Palo Alto Networks VM-series firewalls are currently exposed online, and security patches are expected May 13.

Day Zero Readiness: The Operational Gaps That Break Incident Response

thehackernews.com · 5 months ago

Incident response readiness requires more than just a plan or contract. Organizations must focus on quickly granting responders access and visibility to critical systems. This includes pre-configuring access, establishing secure communication, and designating a single incident coordinator. Regular testing through exercises and drills is vital to validate preparedness and minimize potential damage.

Claude and SpaceX Join Forces to Enhance Large-Scale Compute Capacity

gbhackers.com · 5 months ago

false

Gemini CLI Vulnerability Could Have Led to Code Execution, Supply Chain Attack

www.securityweek.com · 5 months ago

A critical vulnerability in Gemini CLI, an open source AI agent, could have enabled attackers to execute commands and compromise the supply chain. The flaw, which received a CVSS score of 10/10, occurred when the tool ignored allowlists in, yolo mode, allowing the execution of malicious prompts injected into a GitHub issue. Attackers could have extracted internal secrets and gained write access to the repository, potentially pushing arbitrary code to downstream users. Google has since addressed the vulnerability and resolved a lax trust issue in headless mode.

Spring Vulnerabilities Open Door to Arbitrary File Access and GCP Secret Leaks

gbhackers.com · 5 months ago

Security researchers have identified four vulnerabilities affecting the Spring Cloud Config Server, ranging in severity from medium to critical. One critical vulnerability, CVE-2026-40982, allows unauthorized access to sensitive files through a directory traversal attack. A high-severity vulnerability, CVE-2026-40981, could expose Google Cloud Platform secrets if using Google Secrets Manager. Other vulnerabilities include a time-of-check-time-of-use flaw, CVE-2026-41002, and a logging issue that exposes sensitive data, CVE-2026-41004. Organizations are urged to update to patched versions, with specific fixes available for Spring Cloud Config Server versions 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x.