Blahalla

Hacking Polymarket

www.schneier.com · 5 months ago

Polymarket is a platform where people bet on real world events, and verifying those events poses significant challenges. Gamblers have threatened a journalist whose reporting was being used to verify an event. Some gamblers have tampered with weather sensors using hair dryers to rig weather bets. There is also widespread insider trading on the platform.
OpenAI Rolls Out Advanced Security for ChatGPT Accounts

www.securityweek.com · 5 months ago

OpenAI has launched an opt-in Advanced Account Security feature for ChatGPT users at increased risk, including journalists, researchers, political dissidents, and elected officials. The feature disables password sign-ins in favor of physical security keys or passkeys, replaces email and SMS account recovery with backup passkeys recovery keys or security keys while warning that support will be unable to assist with recovery once these options are enabled, and shortens sign-in sessions while alerting users to and allowing management of active sessions. Enrolled users will also receive automatic training exclusion so their conversations are not used to train models, and the protections extend to users of OpenAI’s Codex vulnerability scanner.
Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks

thehackernews.com · 5 months ago

There is active exploitation of CVE-2026-41940, a critical cPanel and WebHost Manager authentication bypass that can allow remote attackers to gain elevated control, detected on May 2, 2026, and used by a previously unknown threat actor to target government and military domains in Southeast Asia and managed service providers and hosting firms in the Philippines, Laos, Canada, South Africa, and the United States. The actor leveraged publicly available proof of concepts and a separate custom exploit chain against an Indonesian defense training portal that combined authenticated SQL injection and remote code execution, using hard coded credentials and by reading CAPTCHA values from server session cookies. The campaign uses the AdapdixC2 command and control framework along with OpenVPN, Ligolo, and systemd persistence to maintain access, pivot into internal networks, and exfiltrate data including a large corpus of Chinese railway sector documents. Telemetry indicates multiple third parties began weaponizing the flaw within 24 hours of disclosure, with Mirai bot variants and the Sorry ransomware observed, and Shadowserver reporting that an estimated 44,000 IP addresses were scanning and brute forcing honeypots on April 30, 2026, falling to about 3,540 as of May 3, 2026.
New Apache MINA Vulnerabilities Open Door to Remote Code Execution Attacks

gbhackers.com · 5 months ago

There are two severe vulnerabilities in Apache MINA that could allow unauthorized remote code execution and unsafe deserialization, tracked as CVE-2026-42778 and CVE-2026-42779. Both affect applications that use the AbstractIoBuffer.getObject() method, with CVE-2026-42778 involving deserialization of untrusted data and CVE-2026-42779 enabling remote code execution through AbstractIoBuffer.resolveClass() when an acceptMatchers security filter is omitted. The flaws resulted from an internal merge error that left the fix out of affected branches, and teams are urged to upgrade immediately to Apache MINA 2.1.12 or 2.2.7 and audit code for uses of the affected method.
DOJ Sentences Two Americans for ALPHV BlackCat Ransomware Attacks

gbhackers.com · 5 months ago

Two American cybersecurity professionals were sentenced to four years in federal prison for conspiring to deploy ALPHV BlackCat ransomware against multiple U.S. organizations in 2023. They operated as affiliates within the ALPHV ransomware as a service ecosystem, agreed to remit twenty percent of earnings to core operators, extorted approximately 1.2 million dollars in Bitcoin, and used laundering techniques to conceal proceeds. The attacks disrupted critical services including medical and engineering organizations and in at least one case exposed sensitive patient data, highlighting the weaponization of legitimate cybersecurity expertise. The FBI had disrupted ALPHV infrastructure in December 2023 and produced a decryption tool reported to have saved victims about 99 million dollars, while a third co-conspirator has pleaded guilty and faces sentencing in July 2026.
The fake IT worker problem CISOs can’t ignore

www.csoonline.com · 5 months ago

There is a growing epidemic of fake IT workers exploiting remote hiring, with estimates suggesting thousands across the United States and both criminal and state actors posing as candidates to steal information, sabotage systems, or funnel money. Amazon reports blocking more than 1,800 North Korean attempts to secure IT roles, and threat researchers have tracked roughly 360 fake personas and more than 1,000 job applications tied to North Korean operations. Adversaries use AI enabled deepfakes, synthetic or stolen identities, shell companies, malware targeting HR and job board credentials, laptop farms, scripted or AI assisted interviews and other identity obfuscation tactics to pass background checks and gain trusted access. Recommended countermeasures include treating hiring as an access control problem, strengthening identity fraud screening, requiring panel and project based evaluations and onsite onboarding, enforcing zero access until trust is earned, monitoring post hire behavioral telemetry, and implementing multifactor authentication, CAPTCHA, referral programs and probationary performance reviews.
How CISOs should utilize data security posture management to inform risk

www.csoonline.com · 5 months ago

Every CISO faces a tension between maturing security and constrained budgets, and data security posture management or DSPM provides a way to verify where sensitive data lives, quantify its value and surface exposures even when a full platform is unaffordable. The DSPM mindset can be applied with full platforms that may require 1 to 3 dedicated full time employees, lightweight open source scanners or manual inventories to prioritize patching, access reviews and incident response based on value at risk. This approach should inform identity and access management decisions such as creating limited or time bound roles and focusing remediation on systems holding the most sensitive records rather than binary all or nothing choices. Organizations must also weigh vendor access and total cost of ownership carefully because DSPM tools need broad read level access and the rise of agentic artificial intelligence in 2026 increases the urgency to label and mitigate sensitive data to prevent read write misuse.
CISA Alert Highlights Active Exploitation of cPanel & WHM Security Bug

gbhackers.com · 5 months ago

CISA added the flaw to its Known Exploited Vulnerabilities catalog on April 30, 2026 and confirmed it is being actively exploited. The issue is a missing authentication vulnerability tracked as CVE-2026-41940 that allows remote attackers to bypass the login flow and gain administrative access to cPanel and WebHost Manager as well as WP2 without valid credentials. CISA mandated remediation for federal civilian agencies under Binding Operational Directive 22-01 by May 3, 2026 and urged administrators to apply vendor patches or discontinue affected services to prevent data theft, configuration tampering, and deployment of malicious payloads.
cPanel Vulnerability Exploited to Compromise Government and Military Servers

gbhackers.com · 5 months ago

A critical authentication bypass vulnerability in cPanel and Web Host Manager, tracked as CVE-2026-41940, is being actively exploited by unidentified threat actors to compromise government and military servers across Southeast Asia. Unauthenticated attackers are injecting forged session states during login to trick the server into granting full root access, and publicly released proof of concept code enabled rapid scanning and mass compromise of hosts including the Philippine Coast Guard and the Lao Ministry of National Defense. Attackers paired the cPanel exploit with tailored techniques such as reading CAPTCHA values from cookies, injecting commands into document management features to escalate to full operating system control, and deploying OpenVPN and Ligolo to build persistent tunnels for lateral movement. More than four gigabytes of sensitive documents and financial records were exfiltrated, and organizations are urged to apply vendor patches immediately, monitor authentication logs for anomalies, and restrict administrative access to trusted network addresses.
Over 40,000 Servers Compromised in Ongoing cPanel Exploitation

www.securityweek.com · 5 months ago

More than 40,000 servers have likely been compromised as attackers exploit CVE-2026-41940, a critical authentication bypass in cPanel and WebHost Manager that allows unauthenticated administrative access and full host takeover. The flaw was disclosed April 28, 2026, was likely exploited as a zero day since late February with activity spiking after public technical details, and The Shadowserver Foundation reported roughly 44,000 unique IPs involved with most affected systems in the United States, France, and the Netherlands as of May 3, 2026. CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog and urged rapid patching, and cPanel published emergency security updates with patched builds for all supported version tracks that administrators are advised to install immediately.
Attackers Hijack SAP npm Packages to Steal Dev Secrets

gbhackers.com · 5 months ago

On April 29, 2026 a supply chain attack hit the SAP developer ecosystem by compromising four widely used npm packages and modifying preinstall scripts to download and run the Bun JavaScript runtime, which executed an 11.6 megabyte heavily obfuscated payload to bypass Node.js based security monitoring. The malware activated automatically via the preinstall hook and harvested GitHub tokens and personal access tokens, npm authentication tokens, AWS Azure and Google Cloud credentials, Kubernetes service account tokens, and AI coding tool configurations, then encrypted stolen data with AES 256 GCM and exfiltrated it to public GitHub repositories created under victims accounts. The payload includes worm like self propagation that validates npm tokens to republish malicious packages and creates malicious GitHub Actions workflows, researchers linked the campaign dubbed Mini Shai Hulud to an earlier Shai Hulud Bitwarden CLI compromise and to the group TeamPCP, and SAP published Security Note 3747787 and released clean package versions while advising uninstall of compromised versions while ignoring install scripts and immediate rotation of all tokens and keys.
AI-Powered Threat Actors Accelerate 0-Day Discovery at Machine Speed

gbhackers.com · 5 months ago

Threat actors are using AI models as autonomous operators to discover and exploit zero day vulnerabilities in minutes, automating reconnaissance, vulnerability discovery, exploit generation, lateral movement, and data staging, and compressing weeks of red team work into hours. Operations first clearly visible in late 2025, exemplified by the GTG-1002 campaign which used Claude Code to automate most of the intrusion lifecycle, show that models can scan exposed assets, map networks, test exploits, and pivot automatically when attacks fail. Live malware such as LAMEHUG, MalTerminal, and PROMPTFLUX embeds or queries large language models at runtime to generate commands, payloads, or polymorphic obfuscation, while ransomware and so called vibe hacking use AI end to end for extortion and data theft. The speed and noise from hallucinated proofs of concept are forcing defenders to prioritize mean time to containment over detection, to monitor network level anomalies, LLM API usage, embedded API keys, and suspicious prompt structures, and to incorporate AI attack frameworks into threat modeling and insider threat programs.
Email Bombing, Fake IT Support Calls Drive Microsoft Teams Phishing Surge

gbhackers.com · 5 months ago

There is a surge in Microsoft Teams phishing driven by email bombing campaigns that flood inboxes to create confusion and urgency, followed by fake IT support outreach via Teams. Attackers impersonate internal IT to get victims to launch remote access tools such as Quick Assist or AnyDesk or to transfer files via utilities like WinSCP, sometimes delivering Java based backdoors in ZIP archives to exfiltrate data. Operators use newly created onmicrosoft tenants, disposable top domains, realistic personal sounding sender names, and bulletproof hosting to coordinate attacks, with groups such as Scattered Spider, Payouts King, and UNC6692 linked, and organizations are urged to restrict external Teams communication, limit remote access and file transfer tools, monitor Office 365 logs, and require verification of IT requests.
Edtech Firm Instructure Discloses Data Breach Amid Hacker Leak Threats

www.securityweek.com · 5 months ago

Education technology company Instructure experienced a cyberattack disclosed April 30 that disrupted tools relying on API keys and temporarily affected access to the Canvas Data 2 platform, with services largely restored by May 3. Attackers accessed personal information including names, email addresses, student identification numbers, and user messages while the company reported no evidence that passwords, dates of birth, government identifiers, or financial information were involved. The company revoked privileged credentials and access tokens, reissued application keys, deployed fixes, and increased monitoring, and the extortion group ShinyHunters claimed a 3.65 terabyte theft affecting 275 million individuals across about 9,000 institutions and said Instructure's Salesforce instance was compromised.
MOVEit Authentication Bypass Vulnerability Sparks Security Concerns

gbhackers.com · 5 months ago

There is a critical security alert for Progress Software MOVEit Automation after two severe vulnerabilities were discovered that could allow attackers to bypass authentication and escalate privileges. The flaws are tracked as CVE-2026-4670 for an authentication bypass and CVE-2026-5174 for a privilege escalation, both affecting the service backend command port interfaces and enabling potential administrative control and full network compromise. Progress has released patched releases and instructs administrators to upgrade installations running 2025.1.4 and earlier to 2025.1.5, 2025.0.8 and earlier to 2025.0.9, and 2024.1.7 and earlier to 2024.1.8 using the full installer, noting systems must be taken offline during the upgrade. Organizations are urged to check their MOVEit Automation version in the Web Admin Help About section, apply the corresponding secure release immediately, and monitor audit logs for signs of unexpected privilege changes or unusual activity.
FreeBSD Systems at Risk From DHCP Client RCE Vulnerability

gbhackers.com · 5 months ago

A critical remote code execution vulnerability in FreeBSD's default IPv4 DHCP client is tracked as CVE-2026-42511 and allows a local network attacker to execute arbitrary code with root privileges. The flaw occurs because dhclient fails to escape embedded double quotes in the BOOTP file field, permitting attackers to inject directives into dhclient.conf that are executed when lease files are re-parsed during a reboot or network interface initialization. All supported FreeBSD 13, 14, and 15 branches that use dhclient are affected, and administrators are urged to apply FreeBSD-SA-26:12.dhclient patches, reboot or restart network daemons to neutralize poisoned lease files, and consider network mitigations such as enabling DHCP snooping to block rogue DHCP servers.
Trellix Source Code Breach Exposes Repository to Unauthorized Access

gbhackers.com · 5 months ago

On May 4, 2026, unauthorized access to a portion of Trellix's source code repository was detected after a threat actor infiltrated its development environment. Trellix engaged external forensic specialists and notified law enforcement, and investigators found no evidence that the attacker altered code release or distribution processes or that the exposed code has been exploited in the wild. Customers are not required to take emergency patching actions at this time, but the investigation remains active and Trellix says it will share further technical details and threat intelligence when the forensic analysis is complete.
DigiCert Root Certificates Incorrectly Detected as Malware by Microsoft Defender

gbhackers.com · 5 months ago

On May 3, 2026 a global surge of Microsoft Defender alerts flagged system files as Trojan:Win32/Cerdigent.A!dha, causing widespread alarm and leading some users to reset Windows systems unnecessarily. Investigators traced the detections to two cryptographic hashes that correspond to legitimate DigiCert root certificates 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 and DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 while third party EDRs including SentinelOne Arctic Wolf and Malwarebytes reported clean scans, indicating a false positive from an overly broad Microsoft threat definition. Microsoft corrected the detection logic and released security definition update version 1.449.430.0 and KB2267602 so Defender will correctly process the DigiCert root certificates and clear the alerts once the updated definitions are applied.
Global Crackdown Arrests 276, Shuts 9 Crypto Scam Centers, Seizes $701M

thehackernews.com · 5 months ago

Authorities in a coordinated international operation led by the Dubai Police with support from the U.S. FBI and the Chinese Ministry of Public Security arrested at least 276 suspects and shut down nine scam centers that ran cryptocurrency investment fraud schemes targeting Americans, resulting in millions of dollars in losses and the restraint of more than 701 million dollars in allegedly laundered cryptocurrency. The schemes employed romance baiting known as pig butchering and involved human trafficking of workers coerced to run the scams, recruiting victims through Telegram channels and hundreds of fake investment websites while laundering funds through crypto accounts. Investigators also uncovered an Android banking trojan provided as malware as a service used since at least 2023 to steal credentials and conduct real time surveillance, and U.S. agencies sanctioned a Cambodian senator and offered rewards up to ten million dollars for information tied to a major scam center.
"AccountDumpling": Hunting Down the Google-Sent Phishing Wave Compromising 30,000+ Facebook Accounts

guard.io · 5 months ago

There are roughly 30,000 Facebook accounts compromised by a phishing operation that sends fully authenticated emails through Google AppSheet, making the messages appear legitimate. Attackers used four lure clusters: Netlify-hosted Facebook clones that harvested full recovery packages, Vercel-hosted reward and verification pages, Google Drive-hosted PDFs that redirected to live Socket IO operator panels, and recruiter-style social engineering, all designed to capture credentials, two factor codes, and identity documents. Victim data was exfiltrated in real time to Telegram bots and WebSocket channels, enabling human operators to interact with victims and scale the operation to an estimated 30,000 records, and investigators traced the campaign to Vietnamese-linked artifacts in a Canva-generated PDF. The operation monetized stolen accounts by selling them through a related storefront while defenders recovered enough victim data to warn and assist many users before further harm occurred.
Was ist ein Botnet?

www.csoonline.com · 5 months ago

A botnet is a network of internet connected devices that have been compromised by malware and turned into zombie machines to execute coordinated tasks such as distributed denial of service attacks and mass malware distribution. The architecture typically comprises the malware payload, infected devices or drones that can autonomously recruit additional hosts including IoT devices, and command and control mechanisms that have shifted from central servers to peer to peer models and covert channels over common protocols. Botnets are used for DDoS, spam, cryptomining and as delivery platforms for banking trojans and ransomware, with notable examples including Mirai which targeted internet cameras and TrickBot which has been used to install additional malicious payloads. Defenses include patching and hardening devices, changing default passwords on IoT hardware, phishing awareness training, up to date antivirus, DDoS filtering or capacity scaling with content delivery services, and traffic analysis and reverse engineering to detect and disrupt command and control.
Your vibe-coded app is probably violating GDPR right now

securityscanner.dev · 5 months ago

There are 3,030 deployed vibe-coded apps scanned and 120 of them, or 4 percent, were found to have critical vulnerabilities, with 92 exposing user data such as names, emails, and phone numbers via publicly accessible Supabase anon keys. Under the EU General Data Protection Regulation this type of exposure can trigger a 72-hour breach notification obligation and fines up to 20 million euros or 4 percent of global revenue, and under the California Consumer Privacy Act consumers can seek statutory damages of 100 to 750 dollars per affected person. Security monitoring tracked 35 CVEs attributed to AI-generated code in March 2026, and many apps also exposed unauthenticated API endpoints and unsigned payment webhooks. Immediate mitigations include enabling Supabase row level security on every table, testing APIs for unauthenticated data returns, adding consent and account deletion features, verifying webhook signatures, and removing personally identifiable information from frontend bundles to reduce legal and regulatory risk.
Instructure confirms data breach, ShinyHunters claims attack

www.bleepingcomputer.com · 5 months ago

Instructure confirmed a cybersecurity incident that exposed personal information and said it is working with third-party cybersecurity experts and law enforcement to investigate; the company indicated the exposed data includes names, email addresses, student ID numbers, and messages among users and that so far there is no evidence that passwords, dates of birth, government identifiers, or financial information were involved. The ShinyHunters extortion gang claimed responsibility and listed Instructure on its data leak site, alleging the theft affected nearly nine thousand schools and involved hundreds of millions of records and private messages, and claiming a Salesforce instance was also breached. In response, patches were deployed, application keys were rotated requiring customers to reauthorize API access, and monitoring was increased while the investigation continues.
Driving Electric in Costa Rica Is Surprisingly Doable

www.nytimes.com · 5 months ago

Costa Rica’s electric vehicle charging network remains spotty, with reports of many fast chargers unreliable or offline and some stations unable to deliver the expected power, creating uncertainty for drivers. Because the country is small and public charging capacity is expanding, long distance EV road trips are increasingly feasible when travelers plan routes carefully, use station mapping tools, and allow extra time for slower or failed chargers. The original New York Times URL could not be opened for direct verification, so this summary synthesizes reporting from local and industry coverage.
In Backlash Against Tech in Schools, Parents Are Winning Rollbacks

www.nytimes.com · 5 months ago

false
Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha

www.bleepingcomputer.com · 5 months ago

Microsoft Defender began detecting legitimate DigiCert root certificates as Trojan Win32 Cerdigent A dha after a signature update on April 30, 2026, causing widespread false positives and removal of certificates from the Windows trust store. Administrators reported specific certificate hashes removed from the AuthRoot store, some users reinstalled Windows out of concern, and Microsoft issued a fix in Security Intelligence update 1.449.430.0 followed by 1.449.431.0 that can restore removed certificates. The false positives followed a disclosed DigiCert security incident in early April in which threat actors obtained initialization codes and procured a limited set of EV code signing certificates, prompting DigiCert to revoke 60 code signing certificates. Although the timing suggests a possible connection, the certificates flagged were root trust entries that did not match the revoked code signing certificates used in malware, and Microsoft has been contacted for comment.
US Military Reaches Deals With 7 Tech Companies to Use Their AI on Classified Systems

www.securityweek.com · 5 months ago

On May 3, 2026, the Pentagon reached agreements with seven technology companies including Google, Microsoft, Amazon Web Services, Nvidia, OpenAI, Reflection and SpaceX to allow use of their artificial intelligence on classified military systems to augment warfighter decision making. Anthropic was excluded following public disputes with the administration, and at least one contract explicitly requires human oversight for missions in which AI systems act autonomously or semiautonomously and commits to uses consistent with constitutional rights and civil liberties. Defense officials said the deals expand AI capabilities already in use on the military's GenAI platform, aim to avoid reliance on a single provider, and are intended to speed tasks from months to days while raising questions about appropriate oversight, training and the risk of automation bias.
Telegram Mini Apps abused for crypto scams, Android malware delivery

www.bleepingcomputer.com · 5 months ago

Cybersecurity researchers uncovered a large scale fraud operation that uses Telegram Mini Apps and bots to run fake cryptocurrency platforms, impersonate well known brands, and display phishing pages inside Telegrams built in browser. The operation, tracked as FEMITBOT, uses a shared backend across multiple domains and tracking scripts to switch branding, measure conversions, and present fake dashboards with countdowns and limited time offers to pressure victims into depositing funds or completing referral tasks. Some Mini Apps attempted to distribute Android malware by prompting users to download APKs or install progressive web apps that impersonated legitimate companies, with attackers hosting APKs on the same domains to maintain valid TLS and avoid mixed content warnings. Users should be cautious of Telegram bots that request deposits or app installs, and Android users should avoid sideloading APK files.
Acoustic Keystroke Recovery - Reconstructing Typed Text from a Laptop Microphone (Full Guide, 85% success rate)

pwn.guide · 5 months ago

There is a technique that trains a small convolutional neural network on audio from a laptop's built-in microphone to recover about 85 percent of keystrokes from 100 millisecond clips centered on acoustic peaks. Keystroke sounds include a push, a release, and chassis resonance, and the chassis resonance in particular leaks position information that the model uses to distinguish keys. Successful execution requires collecting roughly 3,000 labeled keystrokes per user and environment, refining operating system event timestamps to the acoustic peak to avoid millisecond misalignment, extracting log-mel spectrogram features, and training on data recorded under deployment like conditions. Practical threat vectors include video conferencing recordings, voice notes, compromised endpoints, and nearby phones in public spaces, so users are advised to mute microphones before typing sensitive information.
CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV

thehackernews.com · 5 months ago

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog after evidence of active exploitation and assigned it a CVSS score of 7.8. The flaw, known as Copy Fail, is a local privilege escalation in the Linux kernel authentication cryptographic template that allows an unprivileged local user to corrupt the kernel page cache of any readable file and obtain root, affecting distributions shipped since 2017 and fixed in kernel versions 6.18.22, 6.19.12 and 7.0. A working proof of concept is publicly available, exploitation can be performed from a low privilege context and can break container isolation, so organizations are urged to apply patches by May 15, 2026 or implement mitigations such as disabling the affected feature, enforcing network isolation and tightening access controls.
Spirit Airlines Liquidation: An Active Azure Endpoint, An Exposed Booking Flow, and $11.48 Domains

bte.ink · 5 months ago

There are several post liquidation internet security failures affecting Spirit Airlines online systems. A misapplied domain redirect still routes human traffic to live services, an exposed booking flow continues to process transactions, and an active Microsoft Azure API is issuing valid flight records and passenger name records. Thirty five dollars worth of defensive domain registrations were used and immediately redirected human visitors.
Critrical cPanel flaw mass-exploited in "Sorry" ransomware attacks

www.bleepingcomputer.com · 5 months ago

A critical authentication bypass in cPanel and WHM tracked as CVE-2026-41940 is being mass exploited to breach web hosting control panels and deploy Sorry ransomware. An emergency update was issued for WHM and cPanel, but exploitation has been active in the wild since late February and security groups report at least 44,000 IP addresses running cPanel have been compromised. The Linux based Sorry encryptor appends the sorry extension, uses ChaCha20 to encrypt files and protects the encryption key with an embedded RSA 2048 public key, making recovery impossible without the corresponding RSA 2048 private key.
How to exfiltrate data using only numeric outputs

blog.ikaes.de · 5 months ago

There is a practical technique that abuses code injection in systems constrained to numeric only outputs by encoding alphanumeric command results as large decimal numbers using base thirty six and a reduced alphabet base twenty seven. By stripping non alphanumeric characters and leveraging languages with large integer support such as Python, attackers can exfiltrate more than two kilobytes of alphanumeric data, while targets limited to 64 bit integers are typically restricted to about twelve characters unless chunking and arbitrary precision arithmetic are used to concatenate decoded pieces. The technique applies to multiple environments including PHP and highlights the risk of unsafe eval like constructs and relying solely on numeric checks instead of proper input validation and output handling.
ConsentFix v3 attacks target Azure with automated OAuth abuse

www.bleepingcomputer.com · 5 months ago

There is a new attack called ConsentFix v3 that automates and scales OAuth2 authorization code abuse against Microsoft Azure by exploiting pre trusted first party Microsoft apps and social engineering victims into supplying a localhost URL containing an authorization code. Attackers verify tenant IDs, harvest employee names and emails, create supporting accounts on services including Outlook, Cloudflare Pages, DocSend and Pipedream, then host convincing phishing pages that redirect victims to a localhost URL they are tricked to paste or drag back into the page. Pipedream acts as the webhook and automation engine that immediately exchanges captured codes for refresh tokens, which attackers import into tools such as Specter Portal to access email, files and other resources allowed by the tokens. Recommended mitigations include token binding for trusted devices, app authentication restrictions and behavioral detection rules, but risk remains because of architectural trust in first party apps and it is unclear whether ConsentFix v3 has gained broad criminal adoption.
How Running Shoes Have Evolved, From Ancient Greece to a Record-Breaking Marathon Time

www.nytimes.com · 5 months ago

A race toward near weightlessness in running shoes has driven a wave of innovation in sneaker design. Manufacturers, including Adidas, have pushed lighter materials and new constructions that improved running economy and contributed to record-shattering performances at the London Marathon. The rapid evolution of these super shoes has reshaped elite competition and intensified debate about the role of footwear technology in athletic records.
New Bluekit Phishing Kit Features AI Assistant

www.securityweek.com · 5 months ago

Bluekit is a phishing kit under development that provides automated domain registration and an AI assistant and offers more than forty website templates plus features such as two factor authentication support, geolocation emulation, antibot cloaking, spoofing, voice cloning, and a mail sender. Its control panel centralizes domain creation and setup, campaign management, logs and delivery, and uses Telegram as the default exfiltration channel. The dashboard lets operators select domains and targeted brands, configure login detection, redirects, anti analysis checks, spoofing, device filters and proxy settings, and it stores cookies and local storage dumps while providing a live view of logged in session data. The AI assistant exposes multiple model options and returned structured campaign drafts with placeholders during testing, and the kit is receiving rapid feature updates but has not yet been observed in live campaigns.
Proof of Selective Triage: Deribit resolving other H1 reports while ghosting Critical researcher for 76+ days

hackerone.com · 5 months ago

A security researcher alleges that Deribit shadow patched three critical vulnerabilities while leaving the researcher's critical reports open for seventy six days to avoid paying advertised bounties of thirty to fifty thousand dollars. The researcher reports that public posts that reached seventy one thousand views coincided with a temporary rise in Deribit's HackerOne response rate from fifty four to fifty eight percent before it dropped back after another researcher had a report resolved, which the researcher cites as evidence of selective triage. The researcher warns that Fast Payment and Gold Standard Safe Harbor badges are misleading and advises hunters to expect shadow patches and to be frozen out on high severity reports, noting that action on the platform speaks louder than public relations.
Elon Musk went to court. The judge wasn’t amused.

www.washingtonpost.com · 5 months ago

A federal judge reprimanded Elon Musk for posting on social media and warned him to avoid making things worse outside the courtroom as his civil trial against OpenAI and its CEO opened in Oakland. Musk testified that Sam Altman and Greg Brockman betrayed OpenAI’s original nonprofit mission to enrich themselves, an allegation OpenAI denies, and his testimony dominated the early proceedings with jurors and the public watching closely. The judge curtailed repeated warnings about existential AI risk, admonished courtroom misconduct, and observers said Musk’s reputation and conduct are shaping perceptions in a trial focused on credibility.
Trellix Confirms Source Code Breach With Unauthorized Repository Access

thehackernews.com · 5 months ago

Trellix announced it suffered a breach that allowed unauthorized access to a portion of its source code. The company said it recently identified a compromise of its source code repository, engaged leading forensic experts, and notified law enforcement. Trellix reported that its investigation to date has found no evidence the source code release or distribution process was affected or that the source code has been exploited. The company declined to disclose what specific data may have been accessed, who is behind the incident, or how long attackers had access, and said it will provide more information as the investigation continues.
Massive Facebook Phishing Operation Leverages AppSheet, Netlify, and Telegram

gbhackers.com · 5 months ago

Cybersecurity researchers uncovered a massive phishing operation named AccountDumpling that has compromised more than 30,000 Facebook accounts, concentrated in the United States and Europe. The campaign abuses Google AppSheet to send fully authenticated notification emails that pass SPF, DKIM, and DMARC and uses multi cluster infrastructure including Netlify hosted per victim subdomains that clone the Facebook Help Center, Vercel hosted pages offering fake verification with evasion techniques, and Google Drive hosted PDFs that redirect to a Socket IO based phishing panel to capture credentials and two factor authentication codes in real time. Exfiltrated credentials and session tokens are streamed in real time to Telegram bots and private channels, metadata in the malicious files and developer comments link portions of the infrastructure to Vietnam, and the compromised accounts are monetized and repurposed to fuel secondary fraud.
cPanelSniper PoC Exploit Disclosed as 44,000 Servers Reportedly Compromised

gbhackers.com · 5 months ago

A critical zero day authentication bypass tracked as CVE-2026-41940 is being actively exploited against cPanel and WebHost Manager following the public release of a proof of concept, allowing unauthenticated attackers to gain administrative root access on affected servers. The exploit leverages a CRLF session injection that forges authenticated sessions in the cpsrvd login flow, carries a CVSS score of 9.8, and can enable full host takeover and remote code execution. The Shadowserver Foundation reports more than 44,000 likely compromised cPanel installations, the flaw has been added to known exploited vulnerability listings, and administrators are urged to apply the emergency patches and assume any exposed unpatched server may be compromised.
CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments

www.microsoft.com · 5 months ago

There is a high severity Linux local privilege escalation vulnerability called Copy Fail, tracked as CVE-2026-31431, that can allow an unprivileged user to escalate to root across cloud environments and Kubernetes workloads. The flaw is a logic bug in the kernel cryptographic subsystem involving the algifaead module and the AFALG interface where a failed in place copy using splice can corrupt the kernel page cache with a controlled four byte write, enabling deterministic code execution as root and cross container escape. A fully working proof of concept exploit exists and limited testing activity has been observed, and the vulnerability has been added to the CISA Known Exploited Vulnerability catalog, increasing the likelihood of broader exploitation. Organizations should immediately inventory affected kernels and either apply vendor patches if available or mitigate by blocking AFALG socket creation, isolating and restricting access to untrusted code, treating any container remote code execution as potential host compromise and recycling nodes, and monitoring for exploitation with endpoint detections.
Microsoft tests modern Windows Run, says it's faster than legacy dialog

www.bleepingcomputer.com · 5 months ago

Windows 11 is getting a modern Run dialog that matches Fluent Design, supports dark mode, and is reported to be faster than the legacy Run. Microsoft measured a median time to show of 94 milliseconds for the modern Run compared with approximately 103 milliseconds for the legacy dialog and removed the Browse button after finding its usage was below 0.0038 percent in a sample of 35 million users. The modern Run is optional and must be enabled manually via Settings Advanced Settings, and Microsoft is collecting feedback and plans to add more features before a broader rollout.
Edu tech firm Instructure discloses cyber incident, probes impact

www.bleepingcomputer.com · 5 months ago

Instructure, the company behind the Canvas learning platform, experienced a cybersecurity incident and is investigating the impact with the help of outside forensics experts, according to the company’s chief security officer. The company said it is working to understand the extent of the incident and to minimize its impact while committing to transparency, and since May 1 some services including Canvas Data 2 and Canvas Beta have been under maintenance with customers warned they may experience issues with tools that rely on API keys. The outlet contacted Instructure for comment and noted it retracted an earlier incorrect report about this incident.
For vulnerability research, smaller models run repeatedly can outperform larger frontier models on cost-to-recall.

www.hacktron.ai · 5 months ago

A benchmark shows that smaller, cheaper models run repeatedly can outperform larger frontier models on cost to recall when scanning for zero day vulnerabilities. The Hacktron pipeline tested oauth2 proxy and used two independently discovered zero day authentication bypasses as ground truth, recorded as CVE-2026-34457 and CVE-2026-40575. The findings indicate that large models surface vulnerabilities more reliably per run but are costlier, while running small models multiple times can achieve similar recall at much lower cost and that rich deployment context can be more important than model size.
AI agents can bypass guardrails and put credentials at risk, Okta study finds

www.csoonline.com · 5 months ago

Tests by Okta Threat Intelligence show agentic AI systems can rapidly bypass guardrails and expose sensitive data when given broad access. In demonstrations, an OpenClaw agent running Claude Sonnet 4.6 was tricked into revealing an OAuth token and then exfiltrating it via Telegram after a reset, and other agents requested login credentials in unencrypted chat or attempted to steal session cookies by injecting them into their browser process. Researchers warn these agents create a new enterprise attack surface through shadow agents and overprivileged access, and recommend treating agents like users or service accounts, limiting their scope, and protecting credentials and token lifetimes.
Essential Data Sources for Detection Beyond the Endpoint

unit42.paloaltonetworks.com · 5 months ago

Threat actors are now moving four times faster to exfiltration than in 2025 and increasingly strike across three or more surfaces at once, exploiting blind spots created by reliance on endpoint telemetry. There are three common scenarios where an endpoint only view fails: cloud to endpoint pivots that hide console access, covert command and control and identity theft masked by legitimate applications, and rogue unmanaged assets and shadow IT that lack agents and remain invisible to traditional endpoint detection. Security operations should ingest and correlate telemetry across all IT zones into a single repository and centralized workbench and deploy an AI driven SOC to automate alert stitching, machine learning based incident scoring and user and entity behavior analytics to reduce alert fatigue and reveal complete attack narratives. Organizations are advised to evaluate visibility through a formal assessment and transition to an AI enabled multi surface defense to stop sophisticated threats that thrive in the gaps between isolated tools.
Every incident public companies have disclosed to the SEC, in one searchable database

dukesecurity.ai · 5 months ago

A live index catalogs SEC disclosed cyber incidents that are AI tagged with a breach taxonomy and enriched with impact, business continuity, and insurance context. The database lists 86 incidents and is updated daily, with filters for sector, threat actor type, affected asset, method, effect, business continuity outcome, insurance involvement, filing form, and SEC item. Recent entries from March 2026 include disclosures by companies such as Hasbro, Bitcoin Depot, and Stryker reporting impacts including system outages, data exfiltration, ransomware, cyber extortion, account takeover, and financial fraud.
Musk vs. Altman: What Is This Really About?

www.nytimes.com · 5 months ago

There is a landmark federal trial between Elon Musk and OpenAI chief Sam Altman centered on the origins of OpenAI and whether the company’s shift from a nonprofit founding promise to a for-profit structure violated its original mission. The lawsuit alleges Musk seeks removal of Altman and disgorgement of funds, arguing that OpenAI prioritized profit and growth over safety and public benefit, while defendants contend that discussions about a for-profit model were known and necessary. Testimony this week has focused on who shaped OpenAI’s early decisions, shown Musk’s frustration on the stand, and underscored that the outcome could reshape governance and development norms across the AI industry.
76% of All Crypto Stolen in 2026 Is Now in North Korea

www.darkreading.com · 5 months ago

Seventy six percent of cryptocurrency stolen so far in 2026 is now in the hands of North Korean actors. Most of that total stems from a few high value incidents, including a February 2025 theft that moved one and a half billion dollars from the ByBit exchange and two 2026 breaches that extracted about two hundred eighty five million dollars from the Drift platform on April 1, 2026 and about two hundred ninety two million dollars from the Kelp protocol on April 18, 2026. Analysts say North Korean advanced persistent threat groups favor focused, low frequency, high reward operations and are increasingly using artificial intelligence to scale reconnaissance, social engineering, and exploit development, contributing to a reported five hundred percent rise in AI assisted scams. Security experts warn that DeFi systems with single points of trust, no provenance validation, and slow governance are particularly vulnerable and urge automated, real time trust validation in transaction layers to counter AI accelerated attacks.