Blahalla

New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android

thehackernews.com · 18 days ago

A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access take full control of a machine as root. It affects Linux desktops, servers, and Android, and a fix is out. Bad Epoll sits in the same small stretch of kernel code where Anthropic's most powerful AI model, Mythos, recently found a different bug.

New Avalon Malware Framework Packs CrownX Ransomware Capabilities

thehackernews.com · 18 days ago

Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by means of a multi-stage phishing chain capable of bypassing traditional security controls.

NetNut proxy network disrupted, 2 million infected devices cut off

www.bleepingcomputer.com · 18 days ago

A joint operation involving Google has disrupted NetNut, a residential proxy network that gave access to millions of compromised Android devices, including smart TVs and streaming boxes.

North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

thehackernews.com · 19 days ago

Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup polyfill tooling to facilitate remote access and data theft.

Microsoft 365 users fall victim to one-in-a-million password spray attack

www.csoonline.com · 19 days ago

Microsoft users have been hit by a massive, automated password spray attack. Among those targeted by the attack were clients of security company Huntress. It reported that the attackers made 81 million attempts to log into its customers’ accounts between June 12 and 26, and succeeded in at least 78 cases.

In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting

www.securityweek.com · 19 days ago

Noteworthy stories that might have slipped under the radar: Anonymous-linked Canadian hacker jailed, researcher drops zero-days in open source projects, Venezuelans sentenced in the US over ATM jackpotting.

ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit

www.bleepingcomputer.com · 19 days ago

A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an extensive toolkit designed to compromise Microsoft 365.

Adobe premieres a second Patch Tuesday each month to deliver fixes faster

www.csoonline.com · 19 days ago

Adobe will now issue security patches for its products twice as often to deal with the increasing pace of software vulnerability discovery and exploitation. This follows Oracle’s decision to increase its quarterly patch program to a monthly one. Adobe issues patches on the second Tuesday of each month, as do Microsoft and SAP.

Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer

thehackernews.com · 19 days ago

A previously undocumented threat actor known as Armored Likho has been attributed to cyber attacks targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. "Armored Likho blends financially motivated campaigns targeting private individuals with targeted cyber espionage aimed at organizations," Kaspersky said in a technical analysis published today. "

Chinese LLMs Broaden the Gap Between Attackers & Defenders

www.darkreading.com · 19 days ago

Two new models from Chinese firms compete with top US mainstream and frontier models. Should cyber-defenders be worried?

Pegasus Spyware Hacked European Parliament Member Investigating Spyware Abuse

gbhackers.com · 19 days ago

A newly disclosed forensic investigation has revealed that Pegasus spyware was used to hack a sitting Member of the European Parliament (MEP) who was actively investigating spyware abuses across the European Union. This raises serious concerns about surveillance targeting democratic institutions.

New CitrixBleed-like NetScaler flaw sees exploit attempts in the wild

www.csoonline.com · 19 days ago

Citrix NetScaler appliances have been a constant target for attackers in recent years, most recently through an information leak vulnerability dubbed CitrixBleed 3, the latest in a series of NetScaler memory overreads going back to 2023. This week, Citrix patched yet another CitrixBleed-like vulnerability and there are signs of in-the-wild exploitation already.

AI Agents Are Creating a New Enterprise Security Gap

www.techrepublic.com · 19 days ago

Five independent security disclosures in a single week point to the same gap: AI agent permissions, not AI agent capabilities, are the problem enterprises haven't solved.

Fake Google Play Store Pages Use Trusted Brand Names to Push Gambling PWAs

gbhackers.com · 19 days ago

Scammers are exploiting consumers’ trust in household and financial brands by deploying polished fake Google Play Store pages and social media ads that push Progressive Web Apps (PWAs) linked to online casinos. The fraud begins with paid social creative on platforms including Facebook, Instagram, Threads and TikTok.

Flock Cameras Can Surveil Cars Without License Plates

www.schneier.com · 19 days ago

This is from a 2024 company presentation: Officers can also tap into data showing a car’s decals, bumper stickers, back and top racks, along with temporary and unique state tags. Flock calls it a “Vehicle Fingerprint” and it’s touted as a way for law enforcement officials to get more information “even when you don’t have full plate information,” the company’s presentation shows.

European Parliament Member Investigating Spyware Was Hacked With Pegasus

thehackernews.com · 19 days ago

A new report from the Citizen Lab has revealed that former Member of the European Parliament Stelios Kouloglou had his mobile device repeatedly hacked with the notorious Pegasus spyware while serving on a committee that was tasked with investigating the abuse of such commercial surveillance tools in the bloc.

Fable Ban Reversed + Dr. Dana Suskind on Parenting With A.I. + Prediction Market Drama

www.nytimes.com · 19 days ago

What we learned from the government’s biggest attempt yet to control who can gain access to the most powerful new A.I. models.

Agentic AI Used to Conduct Ransomware Attack via Langflow

www.securityweek.com · 19 days ago

Attack demonstrates how LLM agents can combine known exploitation techniques with real-time reasoning to automate complex, multi-stage intrusions.

Alibaba Reportedly Bans Claude Code Over Alleged Backdoor Risk in AI Coding Tool

gbhackers.com · 19 days ago

Alibaba is reportedly preparing to ban the use of Anthropic’s Claude Code across its internal environments starting July 10. This decision comes in light of allegations that the AI-powered coding assistant has a covert detection mechanism resembling a backdoor.

Fake Google and Cloudflare Verification Pages Spread StealC, HijackLoader, and NetSupport Malware

gbhackers.com · 19 days ago

Threat actors are currently exploiting sophisticated ClickFix social engineering campaigns that mimic Google and Cloudflare verification systems to distribute several high-impact malware families, including StealC, HijackLoader, NetSupport RAT, and newly identified loaders.

Medtronic Data Breach Impacts 3.8 Million People

www.securityweek.com · 19 days ago

Medical technology giant Medtronic is notifying more than 3.8 million individuals that their personal and medical information was compromised in a recent data breach. The incident occurred in April 2026, when the infamous extortion group ShinyHunters accessed the company’s corporate IT systems.

Microsoft Exchange SSRF Vulnerability Lets Low-Privileged Attackers Read Arbitrary Files

gbhackers.com · 19 days ago

A newly disclosed vulnerability in Microsoft Exchange, identified as CVE-2026-45504 (CVSS score: 8.8), exposes a critical server-side request forgery (SSRF) flaw. This issue allows authenticated low-privileged users to access and read arbitrary files from vulnerable Exchange servers.

Hackers Use Fake API Documentation to Trick AI Agents Into Sending Crypto Payments

gbhackers.com · 19 days ago

Hackers are now weaponizing documentation and site metadata to mislead autonomous AI agents into executing cryptocurrency payments. The attack leverages indirect prompt injection (IPI): malicious instructions hidden in web content and structured data that influence an AI agent’s reasoning during automated tasks.

Alleged Scattered Spider Hacker Extradited to US

www.securityweek.com · 19 days ago

Prosecutors say 19-year-old Peter Stokes was a member of Scattered Spider, the hacking group linked to more than 100 network intrusions and over $100 million in ransom payments.

Microsoft Disclosure Provides Rare Glimpse of Tax Haven Tactics

www.nytimes.com · 19 days ago

Other U.S. companies will soon need to provide similar reports as a new European directive takes effect.

Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices

www.securityweek.com · 19 days ago

NetNut rented access to millions of compromised devices, allowing cybercriminals and nation-state actors to mask their identities during attacks.

PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords

thehackernews.com · 19 days ago

Cybersecurity researchers have flagged a new macOS information stealer called PamStealer that employs a series of clever tricks to infect systems and siphon sensitive data. The stealer, discovered by Jamf Threat Labs, is distributed as a compiled AppleScript (.scpt) file impersonating Maccy, a legitimate open-source clipboard manager.

Critical Cursor AI IDE Flaws Could Lead to OS-Level Remote Code Execution

www.securityweek.com · 19 days ago

The DuneSlide vulnerabilities enable zero-click prompt injection attacks that escape Cursor's sandbox and execute arbitrary code on the underlying operating system.

Anthropic Unveils Cyber Jailbreak Severity Framework for Claude Fable 5 Safeguards

gbhackers.com · 19 days ago

Anthropic has provided detailed technical insights into the cybersecurity safeguards of its redeployed Claude Fable 5 model. Alongside this, they have introduced a proposed Cyber Jailbreak Severity (CJS) framework designed to standardize how AI jailbreak risks are measured across various industry and government stakeholders.

FBI Says TeamPCP Uses Trojanized Updates to Steal Cloud Tokens, SSH Keys, and Kubernetes Secrets

gbhackers.com · 19 days ago

The Federal Bureau of Investigation (FBI) has issued an urgent FLASH advisory warning that the cybercriminal group TeamPCP is weaponizing trojanized software updates to harvest cloud access tokens, SSH keys, and Kubernetes secrets at scale.

ChatGPT Guardrail Bypass Vulnerability Exposes LFI Risk Through Download Flow

gbhackers.com · 19 days ago

A now-patched guardrail bypass in ChatGPT that could be exploited through a Local File Inclusion (LFI) vulnerability via its file download mechanism. This incident underscores how logic flaws in large language model (LLM) workflows, particularly concerning temporary file handling and access controls, can create exploitable weaknesses, even in sandboxed environments.

Hackers Use Compromised Websites and transcript.pdf.js Lure to Deliver PureLog Stealer

gbhackers.com · 19 days ago

Hackers are using compromised websites and a deceptive transcript.pdf.js lure to deliver PureLog Stealer through a layered, fileless infection chain that leans heavily on PowerShell, trusted cloud infrastructure, and in-memory execution.

SharkLoader Malware Uses Perfect DLL Hijacking to Execute Cobalt Strike in Memory

gbhackers.com · 19 days ago

SharkLoader, used by an intrusion cluster tracked as StrikeShark to deliver Cobalt Strike Beacon entirely in memory across a wide international footprint.

Claude Cowork Sandbox Flaw Lets Attackers Execute Commands as Root in Hyper-V VM

gbhackers.com · 19 days ago

A newly disclosed sandbox escape technique in Anthropic’s Claude Cowork for Windows illustrates how attackers can achieve root-level command execution inside a Hyper-V, isolated Ubuntu virtual machine (VM) by exploiting design vulnerabilities in CoworkVMService and its Remote Procedure Call (RPC) interface.

CitrixBleed Vulnerability Exploitation Within 24 Hours of Disclosure

gbhackers.com · 19 days ago

Citrix NetScaler appliances are currently facing significant threats due to the rapid exploitation of a newly disclosed memory disclosure vulnerability, CVE-2026-8451, which is part of the evolving “CitrixBleed” class. This high-severity flaw (CVSS 8.

Hackers Compromise GitHub Maintainer Accounts to Publish PolinRider-Infected Package Versions

gbhackers.com · 19 days ago

A widescale escalation in the PolinRider supply‑chain campaign: threat actors have compromised GitHub maintainer accounts to publish infected package versions across multiple ecosystems.

Google Disrupts NetNut Residential Proxy Botnet Used for Malware C2 and Password Spray Attacks

gbhackers.com · 19 days ago

Google has disrupted the NetNut residential proxy botnet, a large-scale infrastructure widely exploited for malware command-and-control (C2) operations and password spray attacks. This coordinated effort involved the FBI, Lumen, and various industry partners. It was announced by Google’s Threat Intelligence Group (GTIG) on July 3, 2026.

Claude Fable 5 isn’t permanently leaving subscriptions, Anthropic says

www.bleepingcomputer.com · 19 days ago

Anthropic says Claude Fable 5 won't be accessible via Claude subscriptions after July 7, but it's not a permanent change, and the company expects the model to return outside the usage-based plan soon.

Claude Fable relaunch disappoints users with nerfed performance

www.bleepingcomputer.com · 19 days ago

Claude Fable, the company's most powerful model, is now available to all users, but early impressions are disappointing, as it appears to be nowhere near the original release.

Aussies Face Reduced Cybercrime Risk, as Pressure Shifts to SMBs

www.darkreading.com · 19 days ago

Improved institutional safeguards and stricter regulations have pushed the burdens of protection and risk reduction on to Australian businesses.

How We Added WebAuthn to a Browser-Based RDP Client

unit42.paloaltonetworks.com · 19 days ago

A look inside the reverse-engineering journey of building the first RDP client outside of Windows to support WebAuthn redirection.

Tesla Driver Using Autopilot in Texas Crash Is Charged With Manslaughter

www.nytimes.com · 19 days ago

A front-door video camera of the crash, which killed a woman inside her home, showed the Tesla plowing into a house through its driveway.

Apple Reverses Age-Old Patch Policy to Keep Up With AI

www.darkreading.com · 19 days ago

Expect more compressed patching cycles from Apple going forward, as attackers leverage artificial intelligence to reduce time to exploit.

FBI Seizes NetNut Proxy Platform, Popa Botnet

krebsonsecurity.com · 19 days ago

The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR].

FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs

www.darkreading.com · 19 days ago

After gaining a foothold in thousands of Fortinet firewalls, the attackers are starting to monetize that access, and are also piling on a Nextcloud zero-day bug.

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices

thehackernews.com · 19 days ago

Google has significantly degraded NetNut, one of the biggest networks that turns home devices into rented relays for other people's traffic. Working with the FBI, Lumen, and others, Google's Threat Intelligence Group (GTIG) said this week it had reduced the network's pool of usable devices by millions.

Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials

thehackernews.com · 19 days ago

Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access.

Apple’s ‘Hide My Email’ Privacy Flaw Exposes Real Email Addresses

www.techrepublic.com · 19 days ago

Researchers say Apple’s Hide My Email flaw may expose real addresses, despite two fixes. Here’s what users should know about the privacy risk.

AI Oversight, Security Flaws, and Industry Shifts Define This Week in Tech

www.techrepublic.com · 19 days ago

See what you missed in Daily Tech Insider from June 29, July 2.

Ransomware Thugs Masquerade as Interpol to Entice Small Biz

www.darkreading.com · 19 days ago

The ransomware campaign relies on basic social engineering and stretches across multiple regions, including the US, Europe, Middle East, and elsewhere.