Blahalla

Veeam Backup BinaryFormatter Flaw Enables Remote Code Execution

gbhackers.com · 16 days ago

A newly discovered deserialization vulnerability, tracked as CVE-2026-44963, affects Veeam Backup & Replication. This vulnerability allows authenticated domain users to execute remote code on backup servers by exploiting weaknesses in the handling of BinaryFormatter. The issue, detailed by SecureLayer7 Labs, is part of a concerning trend of flaws in Veeam’s.

Go-Based Gentlemen Ransomware Uses PsExec, WMIC, and PowerShell Remoting for Network Propagation

gbhackers.com · 16 days ago

Gentlemen, a Go-based ransomware-as-a-service (RaaS) active since mid-2025, has distinguished itself with a potent combination of modern cryptography, aggressive worm-like propagation, and a broad toolkit for remote execution.

This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom

www.csoonline.com · 16 days ago

A fully autonomous AI agent conducted an end-to-end cyber intrusion and extortion campaign after exploiting a vulnerable Langflow server, demonstrating how large language models could accelerate ransomware operations, according to research published by Sysdig.

How to Evaluate an AI SOC Platform in 2026: 6 Capabilities That Separate Leaders from Bolt-On AI solutions

thehackernews.com · 16 days ago

Building a shortlist for an AI SOC evaluation can be tough. SIEM, SOAR, and pureplay AI SOC vendors are all saying the same thing. But behind the identical label sit very different products, from chat assistants bolted onto a legacy SIEM to agent platforms that run detection, triage, investigation, and response on their own data foundation.

Critical Opera GX Vulnerability Lets Attackers Inject CSS Across Every Webpage

gbhackers.com · 16 days ago

A critical security vulnerability in Opera GX has been disclosed, revealing that attackers could exploit the browser’s GX Mods feature to inject malicious CSS across every webpage visited by a victim. This could enable cross-site data exfiltration and have a widespread impact on the browser.

Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments

www.securityweek.com · 16 days ago

Researchers uncovered two campaigns embedding indirect prompt injections in malicious websites to exploit autonomous AI agents browsing the web.

Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token

gbhackers.com · 16 days ago

A critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk. This breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

thehackernews.com · 16 days ago

A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensitive data from compromised hosts. The multi-stage campaign, codenamed Operation DragonReturn by Seqrite Labs, involves sending spear-phishing emails impersonating the Income Tax Department of India.

France to Stop Certifying Non-Quantum-Safe Encryption

www.schneier.com · 16 days ago

France is accelerating its transition to post-quantum encryption: France’s cybersecurity agency ANSSI said on Tuesday it would stop certifying security products that lack quantum-resistant encryption, a move that will force government bodies and critical operators to shift away from older systems.

SilverFox Campaign Turns ValleyRAT Into Multi-Stage Malware With Rootkit Capabilities

gbhackers.com · 16 days ago

The SilverFox advanced persistent threat (APT) group has escalated its offensive toolkit by transforming ValleyRAT from a conventional remote access trojan into an eight-stage malware chain culminating in a kernel-mode rootkit.

Single points of failure fail. The SaaS layer is not an exception

www.csoonline.com · 16 days ago

Higher education has consolidated its entire academic operation into a handful of massive SaaS platforms. The LMS manages instruction, grading and communication. The SIS owns enrollment, records and financial aid. Identity and productivity live in a small number of cloud providers. These are not peripheral tools, they are the operational infrastructure of the institution.

FIFA World Cup Phishing Scam Uses Fake Reward Pages to Steal Credit Card Data

gbhackers.com · 16 days ago

A sophisticated email phishing campaign exploiting the global excitement around the 2026 FIFA World Cup is deceiving fans with counterfeit reward pages designed to harvest credit card information rather than deliver promised prizes.

Microsoft Warns Windows 11 Enterprise Devices May Boot to Black Screen After Updates

gbhackers.com · 16 days ago

Microsoft has issued a warning to enterprise administrators about a critical issue affecting Windows 11 systems. This problem may cause devices to boot to a black screen or experience severe shell failures following recent cumulative updates.

IBM WebSphere Application Server Hit by Critical XSS and Path Traversal Vulnerabilities

gbhackers.com · 16 days ago

IBM has disclosed several security vulnerabilities in its WebSphere Application Server that put enterprise environments at risk of cross-site scripting (XSS) and path-traversal attacks. These vulnerabilities could allow attackers to compromise administrative sessions and access sensitive data.

Playing Around With ADIDNS RPC Internals

blog.paradoxis.nl · 16 days ago

Porting the functionality of dnscmd.exe into (slightly) more OPSEC safe Beacon Object Files (BOFs) so you can get domain admin rights when you manage to impersonate a user that is a member of the DnsAdmins group, or if using dnscmd.exe simply isn’t an option.

PHP TLS Flaw Lets Remote Server Trigger DoS and Crash Entire FPM Process

gbhackers.com · 16 days ago

A newly disclosed high-severity vulnerability in PHP, tracked as CVE-2026-12184, poses a significant risk to web applications by allowing a remotely triggerable denial-of-service (DoS) condition. This vulnerability can cause entire PHP-FPM process pools to crash. Details of the issue are outlined in the GitHub advisory GHSA-mhmq-mmqj-2v39.

Hackers Use RedLine C2 Infrastructure to Target South Korean Maritime Industry

gbhackers.com · 16 days ago

A single RedLine Stealer command-and-control (C2) indicator has revealed a focused spear-phishing campaign targeting the South Korean maritime industry, exposing a cluster of attacker-owned domains and mail infrastructure used to distribute credential-stealing payloads.

AI isn’t closing the skills gap — it’s exposing the validation gap

www.csoonline.com · 16 days ago

If you wanted to become a basketball star, how would you get started? You wouldn’t read a book on basketball and take an online course. You’d set up a hoop in your driveway, join a local team to train, and play in real matches. So why do we expect cybersecurity professionals to learn their skills from theory and static training? The cybersecurity industry talks constantly about the “skills gap.

New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions

thehackernews.com · 16 days ago

Researchers at Shandong University have shown a fast new way to pull data off computers that are cut off from every network. The technique, called TrojPix, tweaks on-screen pixels in ways the eye cannot see, so that the video cable carrying them radiates a faint radio signal a nearby receiver can decode.

New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS

thehackernews.com · 16 days ago

Cybersecurity researchers have flagged a novel Java-based remote access trojan (RAT) called QuimaRAT that's capable of targeting Windows, Linux, and macOS environments. According to LevelBlue, the cross-platform malware is advertised under a malware-as-a-service (MaaS) model, costing anywhere between $150 for one month to $1,200 for lifetime access.

1 Year of This Popular Antivirus is on Sale for $20

www.techrepublic.com · 16 days ago

Bitdefender Antivirus Plus protects one PC for a full year with no monthly fees, and it even comes with a VPN.

Malicious Agent Skills Can Steal Credentials, Exfiltrate Source Code, and Install Backdoors

gbhackers.com · 16 days ago

Malicious AI agent skills can be packaged to steal credentials, exfiltrate source code, and install backdoors while still bypassing many current skill-auditing systems. The paper finds that static scanners are especially weak against payload-preserving evasions, while runtime behavior auditing is far more resilient.

Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages

thehackernews.com · 16 days ago

Researchers found a flaw in Opera GX, the gaming-focused version of the Opera browser, that let a malicious website silently install a browser add-on and use it to lift specific data from the pages a victim visits. In a proof of concept, they reconstructed a signed-in user's full Gmail address from a single visit, with no click.

7 cyber risk assessment gotchas to avoid

www.csoonline.com · 16 days ago

A cyber risk assessment helps security teams identify, estimate, and prioritize potential threats and vulnerabilities to key enterprise digital and physical assets. Yet, despite its importance, many CISOs fall victim to several types of “gotchas” that prevent them from fully achieving their risk assessment goals.

SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing

thehackernews.com · 16 days ago

Scanners meant to catch malicious add-on "skills" for AI coding agents can be fooled by a few simple changes that leave the malware working, according to a new study from researchers at the Hong Kong University of Science and Technology.

Hackers Use Server-Side Geofencing to Deliver Ousaban Banking Trojan in Spain and Portugal

gbhackers.com · 16 days ago

A targeted campaign that delivers the Ousaban banking Trojan to users in Spain and Portugal using sophisticated server-side geofencing and multi-stage delivery. The adversary begins with a socially engineered phishing PDF that impersonates a corrupted document and coerces victims into visiting a malicious webpage through an “Atualizar” (Update) prompt.

ModSecurity Security Flaws Enable WAF Rule Evasion With Crafted HTTP Requests

gbhackers.com · 16 days ago

ModSecurity, a widely used open-source web application firewall (WAF), has multiple security vulnerabilities that allow attackers to bypass detection with specially crafted HTTP requests. These vulnerabilities, identified as CVE-2026-52761 and CVE-2026-52747, affect ModSecurity versions up to 3.0.15. They have been addressed in version 3.0.16.

Bad Epoll Linux Kernel UAF Flaw Lets Unprivileged Attackers Gain Root on Linux and Android

gbhackers.com · 16 days ago

A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-46242 and dubbed “Bad Epoll,” exposes a critical race-condition use-after-free (UAF) flaw in the epoll subsystem that allows unprivileged users to escalate privileges to root across Linux systems and potentially Android devices.

SSH Attackers Use Single Exec Commands to Bypass Interactive Honeypot Analysis

gbhackers.com · 16 days ago

SSH attackers are increasingly abusing single non-interactive exec commands over SSH to bypass traditional honeypot analysis, effectively turning post-authentication activity into short, automated probes rather than interactive shell sessions that deception systems were designed to study. Recent measurements on eleven LLM-backed SSH honeypots show that 99.

Gaslight Stealer Embeds Fake System Messages to Mislead AI Malware Analysts

gbhackers.com · 16 days ago

A new macOS stealer, tracked as Gaslight and attributed to North Korean operators, demonstrates a worrying evolution in malware design: deliberate prompt-injection to mislead AI-driven security tools.

FatFs Vulnerabilities Let Attackers Execute Code via Crafted USB and SD Card Images

gbhackers.com · 16 days ago

A newly disclosed set of vulnerabilities in the widely used FatFs file system library is raising significant concerns across the embedded systems ecosystem. Researchers are warning that specially crafted USB drives and SD card images can trigger memory corruption and, in some cases, allow for remote code execution.

Wikipedia Is Battling for the Soul of the Internet

www.nytimes.com · 16 days ago

The internet’s largest stockpile of free knowledge is under threat from MAGA, A.I. and foreign autocrats. A bibliophile ex-ambassador is here to help.

Flipper Zero firmware development continues with community help

www.bleepingcomputer.com · 17 days ago

Flipper Devices says development of the Flipper Zero firmware will continue, albeit with a smaller internal team and greater reliance on community contributions.

How Meta’s Threads Became as Popular as X

www.nytimes.com · 17 days ago

The social platform that Meta once positioned as a rival to Elon Musk’s X now has 500 million users. It increasingly resembles Reddit.

JadePuffer ransomware used AI agent to automate entire attack

www.bleepingcomputer.com · 18 days ago

Researchers identified what they believe is the first documented case of a ransomware operation, JadePuffer, conducted entirely by a large language model (LLM) agent.

U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case

thehackernews.com · 18 days ago

A U.S. government entity paid about $1 million to keep stolen files from being leaked, according to a new case study by Rakesh Krishnan for Ransom-ISAC, built on a leaked negotiation chat and the blockchain trail the payment left. The odd part: the group that took the money calls itself Kairos, but it may not be a ransomware gang at all.

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

thehackernews.com · 18 days ago

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider.

Parrot 7.3 released With new menu system and smoother day-to-day use

gbhackers.com · 18 days ago

Parrot 7.3 arrives focused on refinement rather than a tool glut, rebuilding all editions to deliver perceptible gains on modern hardware and a smoother desktop experience.

Armored Likho APT Deploys BusySnake Stealer Against Government and Power Sector Targets

gbhackers.com · 18 days ago

A focused phishing campaign operated by a previously unreported APT we’ve named Armored Likho (also tracked under the provisional alias Eagle Werewolf).

Avalon Malware Uses Legal Document Lure to Deliver CrownX Ransomware Capabilities

gbhackers.com · 18 days ago

A previously undocumented malware framework, tracked as Avalon, that uses a spoofed legal-document lure and a multi-stage, fileless-oriented chain to deliver a ransomware component internally labeled CrownX.

TimbreStealer Malware Targets Mexico Companies With Advanced Evasion Techniques

gbhackers.com · 18 days ago

A new campaign linked to the TimbreStealer information stealer that specifically targets Mexican companies, employing layered evasion and sophisticated runtime tricks to frustrate detection and analysis.

Verified X Sponsored Ad Spreads Mac Malware While ConsentFix Hijacks Microsoft 365 Accounts

gbhackers.com · 18 days ago

A Mac-targeting ClickFix campaign amplified through a verified X sponsored ad, and a novel browser-based hijack technique called ConsentFix that exfiltrates Microsoft 365 session tokens without traditional malware.

Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices

thehackernews.com · 18 days ago

Security firm runZero has disclosed seven vulnerabilities in FatFs, a small filesystem library that lets a device read and write the FAT and exFAT formats used on USB drives and SD cards. The flaws matter because FatFs is nearly everywhere.

New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android

thehackernews.com · 18 days ago

A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access take full control of a machine as root. It affects Linux desktops, servers, and Android, and a fix is out. Bad Epoll sits in the same small stretch of kernel code where Anthropic's most powerful AI model, Mythos, recently found a different bug.

New Avalon Malware Framework Packs CrownX Ransomware Capabilities

thehackernews.com · 18 days ago

Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by means of a multi-stage phishing chain capable of bypassing traditional security controls.

NetNut proxy network disrupted, 2 million infected devices cut off

www.bleepingcomputer.com · 18 days ago

A joint operation involving Google has disrupted NetNut, a residential proxy network that gave access to millions of compromised Android devices, including smart TVs and streaming boxes.

North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

thehackernews.com · 18 days ago

Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup polyfill tooling to facilitate remote access and data theft.

Microsoft 365 users fall victim to one-in-a-million password spray attack

www.csoonline.com · 18 days ago

Microsoft users have been hit by a massive, automated password spray attack. Among those targeted by the attack were clients of security company Huntress. It reported that the attackers made 81 million attempts to log into its customers’ accounts between June 12 and 26, and succeeded in at least 78 cases.

In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting

www.securityweek.com · 19 days ago

Noteworthy stories that might have slipped under the radar: Anonymous-linked Canadian hacker jailed, researcher drops zero-days in open source projects, Venezuelans sentenced in the US over ATM jackpotting.

ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit

www.bleepingcomputer.com · 19 days ago

A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an extensive toolkit designed to compromise Microsoft 365.