Blahalla

Malicious TanStack Package Abuses Postinstall Script to Steal Developer Secrets

gbhackers.com · 5 months ago

A malicious npm package named tanstack impersonated the TanStack ecosystem and used a hidden postinstall script to steal developer secrets by reading environment files and system metadata. On April 29, 2026, the attacker published versions 2.0.4 through 2.0.7 with postinstall hooks that exfiltrated files such as.env and.env.local and sent them to an attacker controlled Svix webhook endpoint while masking data under misleading field names. Developers should assume compromise if those versions appear in lock files or node modules, immediately rotate exposed credentials, review cloud logs and CI pipelines, use dependency scanning and lockfile integrity checks, and verify package scope and publisher before installing to reduce name squatting risks.
Teenager alleged to be Scattered Spider hacker arrested in Finland, faces US extradition

www.bitdefender.com · 5 months ago

A 19 year old suspect allegedly using the handle Bouquet was arrested at Helsinki Airport and now faces US extradition after a sealed six count federal complaint charging wire fraud, conspiracy, and computer intrusion was filed. Prosecutors allege he took part in at least four Scattered Spider attacks dating back to March 2023, including a May 2025 incident against a multibillion dollar luxury retailer that reportedly resulted in two compromised administrator accounts, the exfiltration of 100 gigabytes of data, and an eight million dollar ransom demand. The group is described as favoring social engineering against IT help desks rather than zero day exploits, and recommended defenses include strict help desk identity verification, moving away from SMS based multifactor authentication, and adopting phishing resistant options such as hardware security keys.
CISA says ‘Copy Fail’ flaw now exploited to root Linux systems

www.bleepingcomputer.com · 5 months ago

CISA warned that threat actors have started exploiting the Copy Fail Linux vulnerability in the wild. The flaw is tracked as CVE-2026-31431 and affects the Linux kernel algifaead cryptographic algorithm interface, enabling unprivileged local users to gain root privileges by writing four controlled bytes to the page cache of any readable file. Researchers published a 100 percent reliable Python proof of concept that can root Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, SUSE 16 and any distribution with a vulnerable kernel built since 2017. CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to apply patches by May 15, 2026 under Binding Operational Directive 22-01, and security teams were urged to prioritize patches; another root privilege escalation tracked as CVE-2026-41651 was patched in April 2026.
How Dark Reading Lifted Off the Launchpad in 2006

www.darkreading.com · 5 months ago

There are several reasons Dark Reading successfully launched in May 2006 and grew into a leading cybersecurity publication. Top editorial talent and a rapid, story-a-day content strategy assembled by founders and early hires like Terry Sweeney, Tim Wilson, and Kelly Jackson Higgins attracted a focused professional audience and advertisers despite the lack of a print edition. Early coverage of spam-based malware, denial-of-service attacks, and major breaches including the TJX incident helped build readership and credibility. Strong leadership, sharp editing, and people management are credited with sustaining the site through twenty years of cybersecurity change.
Botnet Hijacks ADB-Exposed Android Devices to Target Minecraft Servers

gbhackers.com · 5 months ago

A Mirai-derived botnet called xlabsv1 is converting Android devices with exposed Android Debug Bridge on TCP port 5555 into a rentable DDoS-for-hire platform focused on Minecraft and other game servers. The operators scan for devices such as Android TV boxes, smart TVs and cheap routers, push architecture-specific payloads and hide processes while profiling each device’s upstream bandwidth to tier infected hosts for monetized high-bandwidth floods, including a RakNet-tuned attack mode. Defenders are urged to audit and close open TCP 5555, disable ADB where not required, monitor for connections to known xlabsv1 infrastructure and tokens, and apply gaming-protocol aware DDoS mitigation.
Exploitation of ‘Copy Fail’ Linux Vulnerability Begins

www.securityweek.com · 5 months ago

There are active exploitations of a recently disclosed Linux kernel vulnerability tracked as CVE-2026-31431 and called Copy Fail, which has existed since 2017 and broadly impacts Linux distributions. The flaw in the kernel authencs AEAD template lets an authenticated attacker with code execution modify in memory cache pages of readable setuid root binaries to escalate privileges to root, enabling container breakout and multi tenant compromise. CISA added the bug to its Known Exploited Vulnerabilities list and urged federal agencies to patch within two weeks, and Microsoft reported limited in the wild exploitation mainly tied to proof of concept testing while warning that a working PoC has been published and the bug has broad applicability. Organizations should identify affected hosts, prioritize patching, isolate susceptible systems, tighten access controls, and review logs for indicators of exploitation.
Microsoft confirms April Windows updates cause backup failures

www.bleepingcomputer.com · 5 months ago

Microsoft confirmed that the April 2026 Windows security updates added the kernel driver psmounterex.sys to the vulnerable driver blocklist, causing third party backup applications that rely on that driver to fail when mounting or managing disk image backups. The change protects against a high severity buffer overflow vulnerability tracked as CVE-2023-43896, but impacted systems may experience VSS timeouts, failures to mount images, Event Viewer Code Integrity errors including Event ID 3077, and errors such as VSSEBADSTATE. Microsoft advised against uninstalling or pausing the update and recommended installing updated application versions that include drivers with the required protections.
276 Arrested as Authorities Dismantle Crypto Scam Centers Targeting Americans

gbhackers.com · 5 months ago

At least nine overseas cryptocurrency scam centers were dismantled and 276 people were arrested in a coordinated operation led by the FBI with Dubai Police and the Chinese Ministry of Public Security targeting transnational pig butchering investment frauds aimed at American victims. These schemes cultivated trust through fake social media personas, directed victims to fraudulent cryptocurrency investment platforms and custom apps that spoofed legitimate exchanges to display fabricated portfolio growth, then seized and laundered the funds. Federal charges unsealed in San Diego name defendants including Thet Min Nyi, Wiliang Awang, Andreas Chandra, and Lisa Mariam on wire fraud and money laundering counts that carry maximum penalties of up to 20 years in prison. The FBI reports that its Operation Level Up has proactively notified roughly nine thousand potential victims and is credited with preventing an estimated five hundred sixty two million dollars in losses as of April 2026, and authorities urge victims to report incidents to the FBI Internet Crime Complaint Center and verify investment platforms through official registries.
CISA Flags Linux Kernel Vulnerability as Threat Actors Launch Attacks

gbhackers.com · 5 months ago

CISA added high severity Linux kernel vulnerability CVE-2026-31431 to its Known Exploited Vulnerabilities catalog on May 1, 2026 and confirmed active exploitation in the wild. The flaw is an incorrect resource transfer between spheres, classified as CWE-699, that allows a local attacker with initial low-level access to escalate privileges to root. Under Binding Operational Directive 22-01 federal civilian agencies were ordered to remediate the vulnerability by May 15, 2026, and system administrators are urged to apply vendor kernel patches immediately or isolate affected systems if patches are not yet available. Organizations should monitor endpoint logs for anomalous privilege changes because proof of concept exploits are publicly available and threat actors are likely to chain this local privilege escalation into wider compromises.
Hacking Polymarket

www.schneier.com · 5 months ago

Polymarket is a platform where people bet on real world events, and verifying those events poses significant challenges. Gamblers have threatened a journalist whose reporting was being used to verify an event. Some gamblers have tampered with weather sensors using hair dryers to rig weather bets. There is also widespread insider trading on the platform.
OpenAI Rolls Out Advanced Security for ChatGPT Accounts

www.securityweek.com · 5 months ago

OpenAI has launched an opt-in Advanced Account Security feature for ChatGPT users at increased risk, including journalists, researchers, political dissidents, and elected officials. The feature disables password sign-ins in favor of physical security keys or passkeys, replaces email and SMS account recovery with backup passkeys recovery keys or security keys while warning that support will be unable to assist with recovery once these options are enabled, and shortens sign-in sessions while alerting users to and allowing management of active sessions. Enrolled users will also receive automatic training exclusion so their conversations are not used to train models, and the protections extend to users of OpenAI’s Codex vulnerability scanner.
Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks

thehackernews.com · 5 months ago

There is active exploitation of CVE-2026-41940, a critical cPanel and WebHost Manager authentication bypass that can allow remote attackers to gain elevated control, detected on May 2, 2026, and used by a previously unknown threat actor to target government and military domains in Southeast Asia and managed service providers and hosting firms in the Philippines, Laos, Canada, South Africa, and the United States. The actor leveraged publicly available proof of concepts and a separate custom exploit chain against an Indonesian defense training portal that combined authenticated SQL injection and remote code execution, using hard coded credentials and by reading CAPTCHA values from server session cookies. The campaign uses the AdapdixC2 command and control framework along with OpenVPN, Ligolo, and systemd persistence to maintain access, pivot into internal networks, and exfiltrate data including a large corpus of Chinese railway sector documents. Telemetry indicates multiple third parties began weaponizing the flaw within 24 hours of disclosure, with Mirai bot variants and the Sorry ransomware observed, and Shadowserver reporting that an estimated 44,000 IP addresses were scanning and brute forcing honeypots on April 30, 2026, falling to about 3,540 as of May 3, 2026.
New Apache MINA Vulnerabilities Open Door to Remote Code Execution Attacks

gbhackers.com · 5 months ago

There are two severe vulnerabilities in Apache MINA that could allow unauthorized remote code execution and unsafe deserialization, tracked as CVE-2026-42778 and CVE-2026-42779. Both affect applications that use the AbstractIoBuffer.getObject() method, with CVE-2026-42778 involving deserialization of untrusted data and CVE-2026-42779 enabling remote code execution through AbstractIoBuffer.resolveClass() when an acceptMatchers security filter is omitted. The flaws resulted from an internal merge error that left the fix out of affected branches, and teams are urged to upgrade immediately to Apache MINA 2.1.12 or 2.2.7 and audit code for uses of the affected method.
DOJ Sentences Two Americans for ALPHV BlackCat Ransomware Attacks

gbhackers.com · 5 months ago

Two American cybersecurity professionals were sentenced to four years in federal prison for conspiring to deploy ALPHV BlackCat ransomware against multiple U.S. organizations in 2023. They operated as affiliates within the ALPHV ransomware as a service ecosystem, agreed to remit twenty percent of earnings to core operators, extorted approximately 1.2 million dollars in Bitcoin, and used laundering techniques to conceal proceeds. The attacks disrupted critical services including medical and engineering organizations and in at least one case exposed sensitive patient data, highlighting the weaponization of legitimate cybersecurity expertise. The FBI had disrupted ALPHV infrastructure in December 2023 and produced a decryption tool reported to have saved victims about 99 million dollars, while a third co-conspirator has pleaded guilty and faces sentencing in July 2026.
The fake IT worker problem CISOs can’t ignore

www.csoonline.com · 5 months ago

There is a growing epidemic of fake IT workers exploiting remote hiring, with estimates suggesting thousands across the United States and both criminal and state actors posing as candidates to steal information, sabotage systems, or funnel money. Amazon reports blocking more than 1,800 North Korean attempts to secure IT roles, and threat researchers have tracked roughly 360 fake personas and more than 1,000 job applications tied to North Korean operations. Adversaries use AI enabled deepfakes, synthetic or stolen identities, shell companies, malware targeting HR and job board credentials, laptop farms, scripted or AI assisted interviews and other identity obfuscation tactics to pass background checks and gain trusted access. Recommended countermeasures include treating hiring as an access control problem, strengthening identity fraud screening, requiring panel and project based evaluations and onsite onboarding, enforcing zero access until trust is earned, monitoring post hire behavioral telemetry, and implementing multifactor authentication, CAPTCHA, referral programs and probationary performance reviews.
How CISOs should utilize data security posture management to inform risk

www.csoonline.com · 5 months ago

Every CISO faces a tension between maturing security and constrained budgets, and data security posture management or DSPM provides a way to verify where sensitive data lives, quantify its value and surface exposures even when a full platform is unaffordable. The DSPM mindset can be applied with full platforms that may require 1 to 3 dedicated full time employees, lightweight open source scanners or manual inventories to prioritize patching, access reviews and incident response based on value at risk. This approach should inform identity and access management decisions such as creating limited or time bound roles and focusing remediation on systems holding the most sensitive records rather than binary all or nothing choices. Organizations must also weigh vendor access and total cost of ownership carefully because DSPM tools need broad read level access and the rise of agentic artificial intelligence in 2026 increases the urgency to label and mitigate sensitive data to prevent read write misuse.
CISA Alert Highlights Active Exploitation of cPanel & WHM Security Bug

gbhackers.com · 5 months ago

CISA added the flaw to its Known Exploited Vulnerabilities catalog on April 30, 2026 and confirmed it is being actively exploited. The issue is a missing authentication vulnerability tracked as CVE-2026-41940 that allows remote attackers to bypass the login flow and gain administrative access to cPanel and WebHost Manager as well as WP2 without valid credentials. CISA mandated remediation for federal civilian agencies under Binding Operational Directive 22-01 by May 3, 2026 and urged administrators to apply vendor patches or discontinue affected services to prevent data theft, configuration tampering, and deployment of malicious payloads.
cPanel Vulnerability Exploited to Compromise Government and Military Servers

gbhackers.com · 5 months ago

A critical authentication bypass vulnerability in cPanel and Web Host Manager, tracked as CVE-2026-41940, is being actively exploited by unidentified threat actors to compromise government and military servers across Southeast Asia. Unauthenticated attackers are injecting forged session states during login to trick the server into granting full root access, and publicly released proof of concept code enabled rapid scanning and mass compromise of hosts including the Philippine Coast Guard and the Lao Ministry of National Defense. Attackers paired the cPanel exploit with tailored techniques such as reading CAPTCHA values from cookies, injecting commands into document management features to escalate to full operating system control, and deploying OpenVPN and Ligolo to build persistent tunnels for lateral movement. More than four gigabytes of sensitive documents and financial records were exfiltrated, and organizations are urged to apply vendor patches immediately, monitor authentication logs for anomalies, and restrict administrative access to trusted network addresses.
Over 40,000 Servers Compromised in Ongoing cPanel Exploitation

www.securityweek.com · 5 months ago

More than 40,000 servers have likely been compromised as attackers exploit CVE-2026-41940, a critical authentication bypass in cPanel and WebHost Manager that allows unauthenticated administrative access and full host takeover. The flaw was disclosed April 28, 2026, was likely exploited as a zero day since late February with activity spiking after public technical details, and The Shadowserver Foundation reported roughly 44,000 unique IPs involved with most affected systems in the United States, France, and the Netherlands as of May 3, 2026. CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog and urged rapid patching, and cPanel published emergency security updates with patched builds for all supported version tracks that administrators are advised to install immediately.
Attackers Hijack SAP npm Packages to Steal Dev Secrets

gbhackers.com · 5 months ago

On April 29, 2026 a supply chain attack hit the SAP developer ecosystem by compromising four widely used npm packages and modifying preinstall scripts to download and run the Bun JavaScript runtime, which executed an 11.6 megabyte heavily obfuscated payload to bypass Node.js based security monitoring. The malware activated automatically via the preinstall hook and harvested GitHub tokens and personal access tokens, npm authentication tokens, AWS Azure and Google Cloud credentials, Kubernetes service account tokens, and AI coding tool configurations, then encrypted stolen data with AES 256 GCM and exfiltrated it to public GitHub repositories created under victims accounts. The payload includes worm like self propagation that validates npm tokens to republish malicious packages and creates malicious GitHub Actions workflows, researchers linked the campaign dubbed Mini Shai Hulud to an earlier Shai Hulud Bitwarden CLI compromise and to the group TeamPCP, and SAP published Security Note 3747787 and released clean package versions while advising uninstall of compromised versions while ignoring install scripts and immediate rotation of all tokens and keys.
AI-Powered Threat Actors Accelerate 0-Day Discovery at Machine Speed

gbhackers.com · 5 months ago

Threat actors are using AI models as autonomous operators to discover and exploit zero day vulnerabilities in minutes, automating reconnaissance, vulnerability discovery, exploit generation, lateral movement, and data staging, and compressing weeks of red team work into hours. Operations first clearly visible in late 2025, exemplified by the GTG-1002 campaign which used Claude Code to automate most of the intrusion lifecycle, show that models can scan exposed assets, map networks, test exploits, and pivot automatically when attacks fail. Live malware such as LAMEHUG, MalTerminal, and PROMPTFLUX embeds or queries large language models at runtime to generate commands, payloads, or polymorphic obfuscation, while ransomware and so called vibe hacking use AI end to end for extortion and data theft. The speed and noise from hallucinated proofs of concept are forcing defenders to prioritize mean time to containment over detection, to monitor network level anomalies, LLM API usage, embedded API keys, and suspicious prompt structures, and to incorporate AI attack frameworks into threat modeling and insider threat programs.
Email Bombing, Fake IT Support Calls Drive Microsoft Teams Phishing Surge

gbhackers.com · 5 months ago

There is a surge in Microsoft Teams phishing driven by email bombing campaigns that flood inboxes to create confusion and urgency, followed by fake IT support outreach via Teams. Attackers impersonate internal IT to get victims to launch remote access tools such as Quick Assist or AnyDesk or to transfer files via utilities like WinSCP, sometimes delivering Java based backdoors in ZIP archives to exfiltrate data. Operators use newly created onmicrosoft tenants, disposable top domains, realistic personal sounding sender names, and bulletproof hosting to coordinate attacks, with groups such as Scattered Spider, Payouts King, and UNC6692 linked, and organizations are urged to restrict external Teams communication, limit remote access and file transfer tools, monitor Office 365 logs, and require verification of IT requests.
Edtech Firm Instructure Discloses Data Breach Amid Hacker Leak Threats

www.securityweek.com · 5 months ago

Education technology company Instructure experienced a cyberattack disclosed April 30 that disrupted tools relying on API keys and temporarily affected access to the Canvas Data 2 platform, with services largely restored by May 3. Attackers accessed personal information including names, email addresses, student identification numbers, and user messages while the company reported no evidence that passwords, dates of birth, government identifiers, or financial information were involved. The company revoked privileged credentials and access tokens, reissued application keys, deployed fixes, and increased monitoring, and the extortion group ShinyHunters claimed a 3.65 terabyte theft affecting 275 million individuals across about 9,000 institutions and said Instructure's Salesforce instance was compromised.
MOVEit Authentication Bypass Vulnerability Sparks Security Concerns

gbhackers.com · 5 months ago

There is a critical security alert for Progress Software MOVEit Automation after two severe vulnerabilities were discovered that could allow attackers to bypass authentication and escalate privileges. The flaws are tracked as CVE-2026-4670 for an authentication bypass and CVE-2026-5174 for a privilege escalation, both affecting the service backend command port interfaces and enabling potential administrative control and full network compromise. Progress has released patched releases and instructs administrators to upgrade installations running 2025.1.4 and earlier to 2025.1.5, 2025.0.8 and earlier to 2025.0.9, and 2024.1.7 and earlier to 2024.1.8 using the full installer, noting systems must be taken offline during the upgrade. Organizations are urged to check their MOVEit Automation version in the Web Admin Help About section, apply the corresponding secure release immediately, and monitor audit logs for signs of unexpected privilege changes or unusual activity.
FreeBSD Systems at Risk From DHCP Client RCE Vulnerability

gbhackers.com · 5 months ago

A critical remote code execution vulnerability in FreeBSD's default IPv4 DHCP client is tracked as CVE-2026-42511 and allows a local network attacker to execute arbitrary code with root privileges. The flaw occurs because dhclient fails to escape embedded double quotes in the BOOTP file field, permitting attackers to inject directives into dhclient.conf that are executed when lease files are re-parsed during a reboot or network interface initialization. All supported FreeBSD 13, 14, and 15 branches that use dhclient are affected, and administrators are urged to apply FreeBSD-SA-26:12.dhclient patches, reboot or restart network daemons to neutralize poisoned lease files, and consider network mitigations such as enabling DHCP snooping to block rogue DHCP servers.
Trellix Source Code Breach Exposes Repository to Unauthorized Access

gbhackers.com · 5 months ago

On May 4, 2026, unauthorized access to a portion of Trellix's source code repository was detected after a threat actor infiltrated its development environment. Trellix engaged external forensic specialists and notified law enforcement, and investigators found no evidence that the attacker altered code release or distribution processes or that the exposed code has been exploited in the wild. Customers are not required to take emergency patching actions at this time, but the investigation remains active and Trellix says it will share further technical details and threat intelligence when the forensic analysis is complete.
DigiCert Root Certificates Incorrectly Detected as Malware by Microsoft Defender

gbhackers.com · 5 months ago

On May 3, 2026 a global surge of Microsoft Defender alerts flagged system files as Trojan:Win32/Cerdigent.A!dha, causing widespread alarm and leading some users to reset Windows systems unnecessarily. Investigators traced the detections to two cryptographic hashes that correspond to legitimate DigiCert root certificates 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 and DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 while third party EDRs including SentinelOne Arctic Wolf and Malwarebytes reported clean scans, indicating a false positive from an overly broad Microsoft threat definition. Microsoft corrected the detection logic and released security definition update version 1.449.430.0 and KB2267602 so Defender will correctly process the DigiCert root certificates and clear the alerts once the updated definitions are applied.
Global Crackdown Arrests 276, Shuts 9 Crypto Scam Centers, Seizes $701M

thehackernews.com · 5 months ago

Authorities in a coordinated international operation led by the Dubai Police with support from the U.S. FBI and the Chinese Ministry of Public Security arrested at least 276 suspects and shut down nine scam centers that ran cryptocurrency investment fraud schemes targeting Americans, resulting in millions of dollars in losses and the restraint of more than 701 million dollars in allegedly laundered cryptocurrency. The schemes employed romance baiting known as pig butchering and involved human trafficking of workers coerced to run the scams, recruiting victims through Telegram channels and hundreds of fake investment websites while laundering funds through crypto accounts. Investigators also uncovered an Android banking trojan provided as malware as a service used since at least 2023 to steal credentials and conduct real time surveillance, and U.S. agencies sanctioned a Cambodian senator and offered rewards up to ten million dollars for information tied to a major scam center.
"AccountDumpling": Hunting Down the Google-Sent Phishing Wave Compromising 30,000+ Facebook Accounts

guard.io · 5 months ago

There are roughly 30,000 Facebook accounts compromised by a phishing operation that sends fully authenticated emails through Google AppSheet, making the messages appear legitimate. Attackers used four lure clusters: Netlify-hosted Facebook clones that harvested full recovery packages, Vercel-hosted reward and verification pages, Google Drive-hosted PDFs that redirected to live Socket IO operator panels, and recruiter-style social engineering, all designed to capture credentials, two factor codes, and identity documents. Victim data was exfiltrated in real time to Telegram bots and WebSocket channels, enabling human operators to interact with victims and scale the operation to an estimated 30,000 records, and investigators traced the campaign to Vietnamese-linked artifacts in a Canva-generated PDF. The operation monetized stolen accounts by selling them through a related storefront while defenders recovered enough victim data to warn and assist many users before further harm occurred.
Was ist ein Botnet?

www.csoonline.com · 5 months ago

A botnet is a network of internet connected devices that have been compromised by malware and turned into zombie machines to execute coordinated tasks such as distributed denial of service attacks and mass malware distribution. The architecture typically comprises the malware payload, infected devices or drones that can autonomously recruit additional hosts including IoT devices, and command and control mechanisms that have shifted from central servers to peer to peer models and covert channels over common protocols. Botnets are used for DDoS, spam, cryptomining and as delivery platforms for banking trojans and ransomware, with notable examples including Mirai which targeted internet cameras and TrickBot which has been used to install additional malicious payloads. Defenses include patching and hardening devices, changing default passwords on IoT hardware, phishing awareness training, up to date antivirus, DDoS filtering or capacity scaling with content delivery services, and traffic analysis and reverse engineering to detect and disrupt command and control.
Your vibe-coded app is probably violating GDPR right now

securityscanner.dev · 5 months ago

There are 3,030 deployed vibe-coded apps scanned and 120 of them, or 4 percent, were found to have critical vulnerabilities, with 92 exposing user data such as names, emails, and phone numbers via publicly accessible Supabase anon keys. Under the EU General Data Protection Regulation this type of exposure can trigger a 72-hour breach notification obligation and fines up to 20 million euros or 4 percent of global revenue, and under the California Consumer Privacy Act consumers can seek statutory damages of 100 to 750 dollars per affected person. Security monitoring tracked 35 CVEs attributed to AI-generated code in March 2026, and many apps also exposed unauthenticated API endpoints and unsigned payment webhooks. Immediate mitigations include enabling Supabase row level security on every table, testing APIs for unauthenticated data returns, adding consent and account deletion features, verifying webhook signatures, and removing personally identifiable information from frontend bundles to reduce legal and regulatory risk.
Instructure confirms data breach, ShinyHunters claims attack

www.bleepingcomputer.com · 5 months ago

Instructure confirmed a cybersecurity incident that exposed personal information and said it is working with third-party cybersecurity experts and law enforcement to investigate; the company indicated the exposed data includes names, email addresses, student ID numbers, and messages among users and that so far there is no evidence that passwords, dates of birth, government identifiers, or financial information were involved. The ShinyHunters extortion gang claimed responsibility and listed Instructure on its data leak site, alleging the theft affected nearly nine thousand schools and involved hundreds of millions of records and private messages, and claiming a Salesforce instance was also breached. In response, patches were deployed, application keys were rotated requiring customers to reauthorize API access, and monitoring was increased while the investigation continues.
Driving Electric in Costa Rica Is Surprisingly Doable

www.nytimes.com · 5 months ago

Costa Rica’s electric vehicle charging network remains spotty, with reports of many fast chargers unreliable or offline and some stations unable to deliver the expected power, creating uncertainty for drivers. Because the country is small and public charging capacity is expanding, long distance EV road trips are increasingly feasible when travelers plan routes carefully, use station mapping tools, and allow extra time for slower or failed chargers. The original New York Times URL could not be opened for direct verification, so this summary synthesizes reporting from local and industry coverage.
In Backlash Against Tech in Schools, Parents Are Winning Rollbacks

www.nytimes.com · 5 months ago

false
Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha

www.bleepingcomputer.com · 5 months ago

Microsoft Defender began detecting legitimate DigiCert root certificates as Trojan Win32 Cerdigent A dha after a signature update on April 30, 2026, causing widespread false positives and removal of certificates from the Windows trust store. Administrators reported specific certificate hashes removed from the AuthRoot store, some users reinstalled Windows out of concern, and Microsoft issued a fix in Security Intelligence update 1.449.430.0 followed by 1.449.431.0 that can restore removed certificates. The false positives followed a disclosed DigiCert security incident in early April in which threat actors obtained initialization codes and procured a limited set of EV code signing certificates, prompting DigiCert to revoke 60 code signing certificates. Although the timing suggests a possible connection, the certificates flagged were root trust entries that did not match the revoked code signing certificates used in malware, and Microsoft has been contacted for comment.
US Military Reaches Deals With 7 Tech Companies to Use Their AI on Classified Systems

www.securityweek.com · 5 months ago

On May 3, 2026, the Pentagon reached agreements with seven technology companies including Google, Microsoft, Amazon Web Services, Nvidia, OpenAI, Reflection and SpaceX to allow use of their artificial intelligence on classified military systems to augment warfighter decision making. Anthropic was excluded following public disputes with the administration, and at least one contract explicitly requires human oversight for missions in which AI systems act autonomously or semiautonomously and commits to uses consistent with constitutional rights and civil liberties. Defense officials said the deals expand AI capabilities already in use on the military's GenAI platform, aim to avoid reliance on a single provider, and are intended to speed tasks from months to days while raising questions about appropriate oversight, training and the risk of automation bias.
Telegram Mini Apps abused for crypto scams, Android malware delivery

www.bleepingcomputer.com · 5 months ago

Cybersecurity researchers uncovered a large scale fraud operation that uses Telegram Mini Apps and bots to run fake cryptocurrency platforms, impersonate well known brands, and display phishing pages inside Telegrams built in browser. The operation, tracked as FEMITBOT, uses a shared backend across multiple domains and tracking scripts to switch branding, measure conversions, and present fake dashboards with countdowns and limited time offers to pressure victims into depositing funds or completing referral tasks. Some Mini Apps attempted to distribute Android malware by prompting users to download APKs or install progressive web apps that impersonated legitimate companies, with attackers hosting APKs on the same domains to maintain valid TLS and avoid mixed content warnings. Users should be cautious of Telegram bots that request deposits or app installs, and Android users should avoid sideloading APK files.
Acoustic Keystroke Recovery - Reconstructing Typed Text from a Laptop Microphone (Full Guide, 85% success rate)

pwn.guide · 5 months ago

There is a technique that trains a small convolutional neural network on audio from a laptop's built-in microphone to recover about 85 percent of keystrokes from 100 millisecond clips centered on acoustic peaks. Keystroke sounds include a push, a release, and chassis resonance, and the chassis resonance in particular leaks position information that the model uses to distinguish keys. Successful execution requires collecting roughly 3,000 labeled keystrokes per user and environment, refining operating system event timestamps to the acoustic peak to avoid millisecond misalignment, extracting log-mel spectrogram features, and training on data recorded under deployment like conditions. Practical threat vectors include video conferencing recordings, voice notes, compromised endpoints, and nearby phones in public spaces, so users are advised to mute microphones before typing sensitive information.
CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV

thehackernews.com · 5 months ago

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog after evidence of active exploitation and assigned it a CVSS score of 7.8. The flaw, known as Copy Fail, is a local privilege escalation in the Linux kernel authentication cryptographic template that allows an unprivileged local user to corrupt the kernel page cache of any readable file and obtain root, affecting distributions shipped since 2017 and fixed in kernel versions 6.18.22, 6.19.12 and 7.0. A working proof of concept is publicly available, exploitation can be performed from a low privilege context and can break container isolation, so organizations are urged to apply patches by May 15, 2026 or implement mitigations such as disabling the affected feature, enforcing network isolation and tightening access controls.
Spirit Airlines Liquidation: An Active Azure Endpoint, An Exposed Booking Flow, and $11.48 Domains

bte.ink · 5 months ago

There are several post liquidation internet security failures affecting Spirit Airlines online systems. A misapplied domain redirect still routes human traffic to live services, an exposed booking flow continues to process transactions, and an active Microsoft Azure API is issuing valid flight records and passenger name records. Thirty five dollars worth of defensive domain registrations were used and immediately redirected human visitors.
Critrical cPanel flaw mass-exploited in "Sorry" ransomware attacks

www.bleepingcomputer.com · 5 months ago

A critical authentication bypass in cPanel and WHM tracked as CVE-2026-41940 is being mass exploited to breach web hosting control panels and deploy Sorry ransomware. An emergency update was issued for WHM and cPanel, but exploitation has been active in the wild since late February and security groups report at least 44,000 IP addresses running cPanel have been compromised. The Linux based Sorry encryptor appends the sorry extension, uses ChaCha20 to encrypt files and protects the encryption key with an embedded RSA 2048 public key, making recovery impossible without the corresponding RSA 2048 private key.
How to exfiltrate data using only numeric outputs

blog.ikaes.de · 5 months ago

There is a practical technique that abuses code injection in systems constrained to numeric only outputs by encoding alphanumeric command results as large decimal numbers using base thirty six and a reduced alphabet base twenty seven. By stripping non alphanumeric characters and leveraging languages with large integer support such as Python, attackers can exfiltrate more than two kilobytes of alphanumeric data, while targets limited to 64 bit integers are typically restricted to about twelve characters unless chunking and arbitrary precision arithmetic are used to concatenate decoded pieces. The technique applies to multiple environments including PHP and highlights the risk of unsafe eval like constructs and relying solely on numeric checks instead of proper input validation and output handling.
ConsentFix v3 attacks target Azure with automated OAuth abuse

www.bleepingcomputer.com · 5 months ago

There is a new attack called ConsentFix v3 that automates and scales OAuth2 authorization code abuse against Microsoft Azure by exploiting pre trusted first party Microsoft apps and social engineering victims into supplying a localhost URL containing an authorization code. Attackers verify tenant IDs, harvest employee names and emails, create supporting accounts on services including Outlook, Cloudflare Pages, DocSend and Pipedream, then host convincing phishing pages that redirect victims to a localhost URL they are tricked to paste or drag back into the page. Pipedream acts as the webhook and automation engine that immediately exchanges captured codes for refresh tokens, which attackers import into tools such as Specter Portal to access email, files and other resources allowed by the tokens. Recommended mitigations include token binding for trusted devices, app authentication restrictions and behavioral detection rules, but risk remains because of architectural trust in first party apps and it is unclear whether ConsentFix v3 has gained broad criminal adoption.
How Running Shoes Have Evolved, From Ancient Greece to a Record-Breaking Marathon Time

www.nytimes.com · 5 months ago

A race toward near weightlessness in running shoes has driven a wave of innovation in sneaker design. Manufacturers, including Adidas, have pushed lighter materials and new constructions that improved running economy and contributed to record-shattering performances at the London Marathon. The rapid evolution of these super shoes has reshaped elite competition and intensified debate about the role of footwear technology in athletic records.
New Bluekit Phishing Kit Features AI Assistant

www.securityweek.com · 5 months ago

Bluekit is a phishing kit under development that provides automated domain registration and an AI assistant and offers more than forty website templates plus features such as two factor authentication support, geolocation emulation, antibot cloaking, spoofing, voice cloning, and a mail sender. Its control panel centralizes domain creation and setup, campaign management, logs and delivery, and uses Telegram as the default exfiltration channel. The dashboard lets operators select domains and targeted brands, configure login detection, redirects, anti analysis checks, spoofing, device filters and proxy settings, and it stores cookies and local storage dumps while providing a live view of logged in session data. The AI assistant exposes multiple model options and returned structured campaign drafts with placeholders during testing, and the kit is receiving rapid feature updates but has not yet been observed in live campaigns.
Proof of Selective Triage: Deribit resolving other H1 reports while ghosting Critical researcher for 76+ days

hackerone.com · 5 months ago

A security researcher alleges that Deribit shadow patched three critical vulnerabilities while leaving the researcher's critical reports open for seventy six days to avoid paying advertised bounties of thirty to fifty thousand dollars. The researcher reports that public posts that reached seventy one thousand views coincided with a temporary rise in Deribit's HackerOne response rate from fifty four to fifty eight percent before it dropped back after another researcher had a report resolved, which the researcher cites as evidence of selective triage. The researcher warns that Fast Payment and Gold Standard Safe Harbor badges are misleading and advises hunters to expect shadow patches and to be frozen out on high severity reports, noting that action on the platform speaks louder than public relations.
Elon Musk went to court. The judge wasn’t amused.

www.washingtonpost.com · 5 months ago

A federal judge reprimanded Elon Musk for posting on social media and warned him to avoid making things worse outside the courtroom as his civil trial against OpenAI and its CEO opened in Oakland. Musk testified that Sam Altman and Greg Brockman betrayed OpenAI’s original nonprofit mission to enrich themselves, an allegation OpenAI denies, and his testimony dominated the early proceedings with jurors and the public watching closely. The judge curtailed repeated warnings about existential AI risk, admonished courtroom misconduct, and observers said Musk’s reputation and conduct are shaping perceptions in a trial focused on credibility.
Trellix Confirms Source Code Breach With Unauthorized Repository Access

thehackernews.com · 5 months ago

Trellix announced it suffered a breach that allowed unauthorized access to a portion of its source code. The company said it recently identified a compromise of its source code repository, engaged leading forensic experts, and notified law enforcement. Trellix reported that its investigation to date has found no evidence the source code release or distribution process was affected or that the source code has been exploited. The company declined to disclose what specific data may have been accessed, who is behind the incident, or how long attackers had access, and said it will provide more information as the investigation continues.
Massive Facebook Phishing Operation Leverages AppSheet, Netlify, and Telegram

gbhackers.com · 5 months ago

Cybersecurity researchers uncovered a massive phishing operation named AccountDumpling that has compromised more than 30,000 Facebook accounts, concentrated in the United States and Europe. The campaign abuses Google AppSheet to send fully authenticated notification emails that pass SPF, DKIM, and DMARC and uses multi cluster infrastructure including Netlify hosted per victim subdomains that clone the Facebook Help Center, Vercel hosted pages offering fake verification with evasion techniques, and Google Drive hosted PDFs that redirect to a Socket IO based phishing panel to capture credentials and two factor authentication codes in real time. Exfiltrated credentials and session tokens are streamed in real time to Telegram bots and private channels, metadata in the malicious files and developer comments link portions of the infrastructure to Vietnam, and the compromised accounts are monetized and repurposed to fuel secondary fraud.
cPanelSniper PoC Exploit Disclosed as 44,000 Servers Reportedly Compromised

gbhackers.com · 5 months ago

A critical zero day authentication bypass tracked as CVE-2026-41940 is being actively exploited against cPanel and WebHost Manager following the public release of a proof of concept, allowing unauthenticated attackers to gain administrative root access on affected servers. The exploit leverages a CRLF session injection that forges authenticated sessions in the cpsrvd login flow, carries a CVSS score of 9.8, and can enable full host takeover and remote code execution. The Shadowserver Foundation reports more than 44,000 likely compromised cPanel installations, the flaw has been added to known exploited vulnerability listings, and administrators are urged to apply the emergency patches and assume any exposed unpatched server may be compromised.