Blahalla

Crooks are hijacking and reselling AI infrastructure: Report

www.csoonline.com · 6 months ago

Researchers at Pillar Security warn that criminal campaigns are systematically probing exposed large language model and Model Context Protocol endpoints to steal compute, exfiltrate LLM context data, and resell API access. Honeypots captured about thirty five thousand attack sessions in recent weeks, and investigators have identified two campaigns, including one called Operation Bizarre Bazaar targeting unprotected LLMs and another targeting MCP servers. Attackers use search engines to find misconfigured services such as Ollama and high performance LLM servers, validate targets, and sell discounted access through a criminal marketplace hosted in the Netherlands. Recommended mitigations include enabling authentication and rate limiting on all LLM endpoints, auditing and firewalling MCP servers and development environments, blocking known malicious network ranges, and auditing production chatbots to prevent unauthorized use and lateral pivots.
SVD-2026-0101: Third-Party Package Update in Splunk Enterprise - MongoDB CVE-2025-14847

advisory.splunk.com · 6 months ago

There is a Medium severity vulnerability identified as CVE-2025-14847 in MongoDB used by Splunk Enterprise with a CVSS v3.1 score of 5.3. Splunk remediated the issue by upgrading bundled MongoDB builds and delivering fixes in Splunk Enterprise versions 10.2.0, 10.0.3, 9.4.8, 9.3.9, 9.2.12 and later. Users are advised to upgrade to those fixed Splunk Enterprise releases or higher and, as a mitigation for systems that do not use the KV Store, disable the App Key Value Store on indexers or heavy forwarders.
Initial access hackers switch to Tsundere Bot for ransomware attacks

www.bleepingcomputer.com · 6 months ago

A prolific initial access broker tracked as TA584 is using Tsundere Bot alongside the XWorm remote access trojan to gain network access that researchers say could lead to ransomware, and Proofpoint has tracked TA584 activity since 2020 with a significant recent increase. The attack chain begins with emails sent from hundreds of compromised aged accounts via SendGrid and Amazon Simple Email Service that include unique target URLs, geofencing, IP filtering, and redirect chains using traffic direction systems such as Keitaro, which lead victims to CAPTCHA and ClickFix pages instructing them to run a PowerShell command. The PowerShell command fetches and executes an obfuscated script that loads XWorm or Tsundere Bot into memory and redirects the browser to a benign site, while Tsundere Bot requires Node.js, retrieves its command and control address from the Ethereum blockchain using an EtherHiding technique with a hardcoded fallback, and communicates over WebSockets. Tsundere Bot profiles infected machines, can execute arbitrary JavaScript, supports using infected hosts as SOCKS proxies, features a built in market for buying and selling bots, and checks system locale to abort execution on Commonwealth of Independent States language settings.
Tycoon 2FA phishing campaign abusing *.contractors domains for Gmail & Microsoft 365 credential harvesting

malwr-analysis.com · 6 months ago

There is a coordinated credential harvesting campaign that abuses newly registered dot contractors domains to host Gmail and Microsoft 365 phishing pages and uses social engineering lures such as ICANN email verification, document sharing, and account security prompts. The operation is attributed with high confidence to the Tycoon 2FA phishing kit based on MFA aware multi step flows, client side obfuscation, encrypted runtime loaders, and advanced anti analysis logic including debugger detection and CAPTCHA gating to evade automated scanners. Campaign infrastructure reuses randomized subdomains and long URL paths that embed victim email addresses, with domains observed registered on January 7, 2026 and January 14, 2026, and employs benign decoy landing pages and additional domains beyond the contractors cluster to prolong domain lifespan and reduce detection.
How Can CISOs Respond to Ransomware Getting More Violent?

www.darkreading.com · 6 months ago

There are reports that ransomware actors are becoming more violent, resorting to threats of physical harm and other coercive tactics as they adapt to fewer victims willing to pay. Research finds that in about two fifths of attacks adversaries threatened to harm executives, sixty three percent of victims were threatened with data destruction, forty seven percent faced threats of regulatory complaints, and identity systems were compromised in eighty three percent of analyzed attacks enabling persistence and lateral movement. Victimization and payments remain high with an estimated fifty six percent of organizations in surveyed countries breached in 2024 and sixty nine percent of those paying ransoms, and Chainalysis estimates roughly eight hundred fourteen million U.S. dollars in ransom payments in 2024, down from one point three billion in 2023. Recommended defenses emphasize business resilience through prompt patching, improved user education, multi factor authentication, robust backups, automated defense and recovery, and well tested incident response processes that also cover suppliers to reduce impact and avoid repeat targeting.
Months After Patch, WinRAR Bug Poised to Hit SMBs Hardest

www.darkreading.com · 6 months ago

There is active exploitation of a months old WinRAR path traversal vulnerability tracked as CVE-2025-8088 that can allow attackers to execute arbitrary code by crafting malicious archive files. Google Threat Intelligence Group found multiple threat actors including Russia aligned and Chinese groups using the flaw to deploy remote access trojans and information stealers, with exploitation observed from July 18, 2025 and a patch released on July 30, 2025. The vulnerability poses particular danger to small and midsized businesses and to roles that routinely open compressed files because WinRAR is widely installed, often unmanaged, does not auto update, and can be used to drop payloads into startup folders via Alternate Data Streams. Security researchers and national vulnerability records urge immediate updating to WinRAR version 7.13 and monitoring for indicators of compromise published by researchers.
Cyberattack on Polish energy grid impacted around 30 facilities

www.bleepingcomputer.com · 6 months ago

There was a coordinated late December cyberattack on Poland's power grid that targeted distributed energy resource sites including combined heat and power facilities and wind and solar dispatch systems, impacting at least a dozen sites and as many as roughly thirty and damaging operational technology and key equipment beyond repair while failing to disrupt overall generation of about 1.2 gigawatts or five percent of the national supply. Dragos assesses the operation with moderate confidence as the work of a Russian aligned threat actor tracked as Electrum, distinct from but overlapping with groups such as Sandworm and APT44, and ties the activity to destructive wipers associated with prior attacks, including DynoWiper, Caddywiper and Industroyer2. Attackers leveraged exposed and misconfigured dispatch systems, remote terminal units, network edge devices and Windows machines to disable communications, corrupt device configurations beyond recovery and wipe Windows systems, and experts warn similar targeted actions could cause destabilizing frequency deviations and severe civilian harm if timed during harsh winter conditions.
Fortinet Confirms New Zero-Day Behind Malicious SSO Logins

www.darkreading.com · 6 months ago

Fortinet confirmed a new zero day vulnerability CVE-2026-24858, a critical authentication bypass with a CVSS score of 9.8 that allows an attacker with a FortiCloud account and a registered Fortinet device to log into another user s device using FortiCloud single sign on. The vendor temporarily disabled FortiCloud SSO on January 26, 2026 and re enabled it on January 27, 2026 while blocking logins from vulnerable versions and urging customers to upgrade FortiOS, FortiManager, FortiAnalyzer, FortiProxy and FortiWeb. The incident follows exploitation of a previous SSO bypass tracked as CVE-2025-59718 which was added to CISA s Known Exploited Vulnerabilities, and scans found roughly 10,000 exposed Fortinet instances with FortiCloud SSO enabled, down from about 25,000 in mid December.
eScan confirms update server breached to push malicious update

www.bleepingcomputer.com · 6 months ago

MicroWorld Technologies confirmed that one of its eScan update servers was breached and used to distribute an unauthorized update that was later analyzed as malicious to a small subset of customers during a two hour window on January 20, 2026. The company says it isolated and rebuilt the affected update infrastructure, rotated authentication credentials, issued a security advisory on January 21, 2026, and provided a remediation update, while researchers reported the malicious update delivered a modified Reload dot exe that enabled persistence and blocked remote updates by modifying the Windows hosts file. Analysts observed a backdoor downloader named CONSCTLX dot exe and multiple command and control servers used to fetch further payloads, and both eScan and the researchers recommended blocking those servers and running the remediation to restore proper update functionality.
Viral Moltbot AI assistant raises concerns over data security

www.bleepingcomputer.com · 6 months ago

There are insecure deployments of Moltbot, an open source personal AI assistant formerly known as Clawdbot, that can expose API keys, OAuth tokens, conversation history, and credentials. Exposed admin interfaces caused by reverse proxy misconfigurations and the chatbot's auto approval of local connections can allow unauthenticated access, credential theft, command execution, and root level access, and a researcher demonstrated a supply chain attack using a malicious Skill promoted on the official registry. Security firms warn that employees are using Moltbot without IT approval, that the assistant stores secrets in plaintext and lacks sandboxing by default, increasing prompt injection and malware targeting risks, and recommend isolating Moltbot in a virtual machine and restricting internet access with firewall rules.
Consumers Reluctant to Shop at Stores That Don't Take Security Seriously

www.darkreading.com · 6 months ago

Consumers are increasingly security conscious and many avoid retailers that have suffered cyberattacks, with eighty eight percent saying they think twice before shopping and twenty two percent saying they would avoid an affected retailer altogether. Retailers are attractive targets because they hold financial and purchase history that can be abused in fraud, and smaller shops often lack the protections of more regulated sectors. Companies commonly pledge to bolster security after incidents, but consumers question why safeguards were not implemented sooner, increasing expectations that security be proactive. Increased transparency, timely communication, accountability, and treating security as part of the customer experience are recommended to help restore trust after an incident.
Four arrested in crackdown on Discord-based SWATting and doxing

www.bitdefender.com · 6 months ago

Police in Hungary and Romania arrested four young men suspected of staging hoax bomb threats and terrorizing users through SWATting and doxing after disputes on the Discord platform. Law enforcement carried out coordinated raids that seized computers, smartphones and other digital evidence, and investigators say the suspects obtained victims names, addresses and phone numbers which were published online and used to spoof calls to police to direct armed responses to victims homes. The suspects are reported as a 17 year old from Bihar County Romania, a 16 year old from Kisvárda Hungary, an 18 year old from Nyiregyhaza Hungary and a 20 year old from Budapest, and authorities say the Romanian teenager faces terrorism related charges while investigations into the others continue; police warned that swatting and doxing endanger lives and that international cooperation will be used against perpetrators.
Critical bug in popular vm2 Node.js sandboxing library puts projects at risk

www.csoonline.com · 6 months ago

A critical vulnerability has been patched in vm2, a widely used Node.js sandboxing library that is a dependency of almost nine hundred packages and is downloaded millions of times per month. The flaw tracked as CVE 2026 22709 affects versions older than 3.10.2 and allows attackers to escape the sandbox by bypassing sanitization of Promise.prototype.then and Promise.prototype.catch callbacks, enabling arbitrary code execution. The original maintainer resumed work on the project in October 2025 but warns that JavaScript complexity makes airtight in process sandboxing difficult. Users are advised to upgrade to the latest vm2 release and to combine vm2 with additional isolation measures or use stronger isolation such as separate processes containers or virtual machines when security is critical.
$95M Payout: Apple Begins Compensating Users in Siri Eavesdropping Case

www.techrepublic.com · 6 months ago

Apple has begun issuing payouts from a 95 million dollar settlement over Siri eavesdropping, with payments labeled Lopez v. Apple appearing in claimant accounts beginning January 23, 2026. Claimants were eligible to receive up to five devices with a cap of twenty dollars per device, though some people who filed for multiple devices reported receiving as little as eight dollars per device. The 2021 lawsuit alleged that Siri recordings, including some captured by accidental triggers, were reviewed by subcontractors and that affected devices used between September 17, 2014 and December 31, 2024 were included, with the deadline to file a claim set at July 2, 2025.
WhatsApp Adds One-Tap Security Settings for Added Privacy

www.techrepublic.com · 6 months ago

There is a new Strict Account Settings one-toggle lockdown mode that bundles privacy protections for high-risk users, blocking attachments and media from people outside your contacts, disabling link previews, and silencing calls from unknown contacts. The mode also turns on two-step verification by default, enables security notifications for contact encryption code changes, restricts last seen and online status plus profile photo and about details to contacts only, and limits who can add you to groups. WhatsApp says the feature is rolling out gradually and can be enabled in Settings Privacy Advanced, and the company has deployed Rust under the hood to help protect photos, videos, and messages from spyware. The rollout continues a wider industry trend toward optional extreme protection modes similar to Apple Lockdown Mode and Android Advanced Protection Mode for users at risk of sophisticated attacks.
Burner phones and lead-lined bags: a history of UK security tactics in China

www.theguardian.com · 6 months ago

Keir Starmer's team has been issued burner phones, fresh SIM cards and temporary email addresses to prevent devices being loaded with spyware or UK government servers being hacked during the China visit. These precautions have been standard for UK delegations to China for at least a decade and were used at G20 summits in Brazil in 2024 and South Africa in 2025, though they are not employed on visits to allied nations or Five Eyes partners. The measures reflect long running concerns about surveillance, with past incidents including warnings to Theresa May in 2018 about spy cameras, a honey trap and a missing BlackBerry after Gordon Brown's 2008 visit, and the routine use of lead lined bags to store phones before entering Chinese diplomatic buildings.
Amazon to Cut 16,000 Jobs in Latest Round of Layoffs

www.nytimes.com · 6 months ago

false
New sandbox escape flaw exposes n8n instances to RCE attacks

www.bleepingcomputer.com · 6 months ago

There are two vulnerabilities in the n8n workflow automation platform that can allow attackers to fully compromise affected instances, access sensitive data, and execute arbitrary code on the underlying host, identified as CVE-2026-1470 and CVE-2026-0863. CVE-2026-1470 is an abstract syntax tree sandbox escape in JavaScript caused by improper handling of the with statement that allows a constructor identifier to resolve to Function and leads to full remote code execution and received a critical severity score of 9.9. CVE-2026-0863 is a Python abstract syntax tree sandbox escape that combines format string based object introspection with Python three point ten and later AttributeError behavior to regain access to restricted builtins and imports and execute operating system commands. Fixes are available in recent n8n releases and users of self hosted instances are urged to upgrade as soon as possible since the n8n cloud has already addressed the issues and a proof of concept exploit is expected to be published.
Fake Moltbot AI Coding Assistant on VS Code Marketplace Drops Malware

thehackernews.com · 6 months ago

There is a malicious Visual Studio Code extension posing as a free Moltbot AI coding assistant named ClawdBot Agent AI Coding Assistant with identifier clawdbot.clawdbot-agent that was published on January 27, 2026 and removed from the marketplace. The extension auto executes on IDE startup, fetches a config.json from an external server and runs a Code.exe that installs a remote desktop client such as ConnectWise ScreenConnect which phones home to attacker controlled infrastructure, granting persistent remote access. It contains multiple fallback delivery mechanisms including sideloading a Rust written DLL named DWrite.dll from cloud storage and using a batch script and hard coded alternate domains to ensure the ScreenConnect client is delivered even if primary command and control channels are unavailable. Researchers also reported hundreds of exposed Moltbot instances leaking configuration data, API keys and conversation histories that can enable impersonation, backdoored skills and supply chain attacks, and defenders are urged to audit configurations, revoke integrations, implement network controls and monitor for signs of compromise.
FBI seizes RAMP cybercrime forum used by ransomware gangs

www.bleepingcomputer.com · 6 months ago

The Federal Bureau of Investigation seized the RAMP cybercrime forum, taking control of both its Tor site and clearnet domain and switching their name servers to those used for FBI seizures. RAMP launched in July 2021 as a Russian speaking forum that openly promoted ransomware operations and was used to advertise malware, recruit affiliates, and buy and sell access to compromised networks. Law enforcement access to the seized domains could expose email addresses, IP addresses, private messages, and other data that may lead to the identification and arrest of poorly operationally secure threat actors. The forum was linked to aliases such as Orange, associated with the Babuk operation, and its creator Mikhail Matveev has been indicted, sanctioned, and placed on wanted lists by U.S. authorities.
FTC commissioner says online age verification ‘offers a better way’ to protect kids

therecord.media · 6 months ago

FTC Commissioner Mark Meador urged making online age verification a norm to protect children, saying it can empower parents while allowing American innovation to continue. At least 25 states have passed laws requiring age checks for some online content, court rulings have been mixed with NetChoice winning multiple challenges while the Supreme Court upheld a Texas law requiring pornography sites to verify user ages. Meador cited steep increases in youth suicide and self harm since 2010, saying suicide rates rose 91 percent for adolescent boys, 167 percent for adolescent girls, and emergency room visits for self harm among adolescent girls rose 188 percent. He said behavioral and AI driven verification can detect underage users without compromising privacy, and the FTC has stepped up enforcement of children's online privacy rules including a ten million dollar settlement with Disney and a lawsuit over an anonymous messaging app that collected children's data.
Palo Alto unveils Quantum-Safe Security to mitigate cryptographic risk

www.csoonline.com · 6 months ago

Palo Alto Networks unveiled the Quantum Safe Security solution to help organizations prepare for a post quantum era by transitioning from current cryptography to quantum resistant algorithms while minimizing business disruption. The platform provides continuous real time cryptographic visibility as a central intelligence layer that collects telemetry and logs from network infrastructure and third party security tools to discover and catalog applications, systems, infrastructure, and IoT devices and to analyze protocols, encryption algorithms, key exchanges, certificates, and libraries in use. It offers advanced cryptographic risk assessment and prioritization to identify harvest now decrypt later exposures and high value assets for priority migration, and a staged remediation approach that modernizes infrastructure, activates post quantum or hybrid algorithms, and applies virtual patching through real time encryption translation for legacy systems that cannot be upgraded. The solution also automates crypto hygiene, maintains a dynamic cryptographic bill of materials, detects weak ciphers and deviations in real time, supports automated compliance reporting aligned with standards such as NIST and FIPS 140 3, integrates with SIEM, EDR and other security operations tools, and addresses growing regulatory and operational urgency for quantum transition plans.
Limits of static guarantees under adaptive adversaries (G-CTR experience)

arxiv.org · 6 months ago

There is a game theoretic guidance layer called Generative Cut the Rope that extracts attack graphs from an agent context, computes Nash equilibria with effort aware scoring, and returns a concise digest into the language model loop to guide agent actions. Across five real world exercises the guidance matched seventy to ninety percent of expert graph structure while running sixty to two hundred forty five times faster and over one hundred forty times cheaper than manual analysis, and in a forty four run cyber range the digest raised success from twenty percent to forty two point nine percent, cut cost per success by 2.7 times, and reduced behavioral variance by 5.2 times. In attack and defense exercises a shared digest produced a Purple agent that won roughly two to one over an LLM only baseline and 3.7 to one over independently guided teams, with the closed loop guidance reducing ambiguity, collapsing the model search space, suppressing hallucinations, and improving consistency and reliability.
Empire cybercrime market owner pleads guilty to drug conspiracy

www.bleepingcomputer.com · 6 months ago

A Virginia man who co created Empire Market pleaded guilty to federal drug conspiracy charges for facilitating approximately 430 million dollars in illegal transactions between 2018 and 2020. Empire Market operated as a Tor hidden service and peaked in August 2020 with about 1.68 million registered users including nearly 360,000 buyers and more than 5,000 vendors. Drug sales were the dominant activity, totaling nearly 375 million dollars with 166,029 vendor listings, and the market facilitated more than 4 million transactions under operators including Raheim Hamilton known as Sydney and ZeroAngel and his co defendant Thomas Pavey. Authorities seized about 75 million dollars in cryptocurrency during the investigation, the operator agreed to forfeit roughly 1,230 bitcoin and 24.4 Ether along with properties, and he now faces a mandatory minimum sentence of 10 years and up to life in prison.
CVE-2025-40551: SolarWinds WebHelpDesk RCE Deep-Dive and Indicators of Compromise

horizon3.ai · 6 months ago

There are multiple vulnerabilities in SolarWinds Web Help Desk including an unauthenticated Java deserialization remote code execution vulnerability tracked as CVE-2025-40551, default demo credentials tracked as CVE-2025-40537, and a CSRF protection bypass tracked as CVE-2025-40536, with earlier related advisories for CVE-2024-28986, CVE-2024-28988, and CVE-2025-26399. These flaws are easily exploitable to achieve unauthenticated remote code execution, SolarWinds states the issues are patched in Web Help Desk version 2026.1, and administrators are urged to upgrade and to monitor WHD logs for signs such as client account logins and other indicators of compromise.
China-Backed 'PeckBirdy' Takes Flight for Cross-Platform Attacks

www.darkreading.com · 6 months ago

China aligned threat actors have been using a cross platform JScript command and control framework called PeckBirdy since 2023 to abuse living off the land binaries and deploy modular backdoors named MKDoor and HoloDonut. Two campaigns targeted Chinese gambling websites with fake Google Chrome update pages and Asian government entities by injecting scripts and using MSHTA for remote execution, employing Cobalt Strike, stolen code signing certificates, and an exploit tracked as CVE-2020-16040. Defenders are advised to continuously monitor infrastructure and hunt for indicators of compromise because PeckBirdy relies on dynamically generated runtime injected JavaScript and leaves few persistent file artifacts.
Russia-Aligned ELECTRUM Tied to December 2025 Cyber Attack on Polish Power Grid

thehackernews.com · 6 months ago

A coordinated cyber attack in late December 2025 targeting multiple sites across the Polish power grid has been attributed with medium confidence to a Russian state sponsored hacking crew known as ELECTRUM. Operational technology cybersecurity firm Dragos reports the activity is the first major cyber attack against distributed energy resources and affected communication and control systems at combined heat and power facilities and systems managing dispatch of wind and solar sites, disrupting about 30 distributed generation sites. Attackers are assessed to have breached remote terminal units and communication infrastructure via exposed network devices and exploited vulnerabilities, deploying ICS specific tooling, wiping Windows devices, resetting configurations, and disabling some equipment beyond repair, while allied KAMACITE operations focused on establishing access through spear phishing, stolen credentials, and exposed services.
Fun RCE in Command & Conquer: Generals

www.atredis.com · 6 months ago

There are multiple remote code execution vulnerabilities in Command and Conquer Generals, including a filename stack overflow in the NetPacket file handlers that can be exploited via crafted multiplayer packets to gain code execution through a return oriented programming chain. There is also an arbitrary file drop that allows writing a DLL into the game folder for persistence and an out of bounds write in the packet fragmentation logic that enables additional memory corruption. Researchers developed a worm that drops a DLL, hooks the game receive function to detect special infector packets or chat commands, harvests player IPs from game messages, and autonomously spreads the payload to other players. EA declined to issue CVE identifiers for the legacy title and the researchers have escalated to MITRE to obtain CVE assignments for the discovered bugs.
Teen swatting suspects arrested in Hungary and Romania

therecord.media · 6 months ago

Hungarian and Romanian police raided homes and arrested four young suspects, a 17-year-old Romanian and three Hungarians aged 16, 18 and 20, seizing computers and mobile phones in a probe into coordinated swatting and doxxing that prompted repeated false emergency responses. Investigators say the suspects used Discord to contact victims and obtain phone numbers and personal details, then placed false emergency calls and leaked data; the 17-year-old faces charges including terrorist acts, making threats to endanger the public, multiple counts of false reporting and misuse of personal data, while the 16-year-old was questioned and released pending further proceedings and the roles of the two older suspects are still under review. Authorities noted earlier bomb threat emails sent to more than 200 schools in January 2025 and said it is unclear whether those incidents are connected, and Romanian authorities separately announced an investigation into an alleged online marketplace that could enable hiring assassins.
AI Is Rewriting Compliance Controls and CISOs Must Take Notice

www.bleepingcomputer.com · 6 months ago

AI agents are increasingly embedded inside workflows that affect financial reporting, customer and patient data, payments, and identity decisions, acting as operational participants rather than mere assistants. Because these agents reason probabilistically and can change behavior with prompts, model updates, plugins, and shifting data inputs, they can silently collapse segregation of duties, move regulated data into noncompliant systems, and produce actions that logs show but cannot explain, undermining SOX, GDPR, PCI DSS, and HIPAA controls. CISOs must treat AI agents as non human identities with clear ownership, least privilege access, credential rotation, continuous monitoring, and documented change control, because regulators will expect proof of control and may hold security leaders accountable when AI-driven actions trigger compliance failures.
SolarWinds warns of critical Web Help Desk RCE, auth bypass flaws

www.bleepingcomputer.com · 6 months ago

SolarWinds released security updates to patch critical authentication bypass and remote command execution vulnerabilities in its Web Help Desk software. There are authentication bypass flaws tracked as CVE-2025-40552 and CVE-2025-40554, a deserialization based remote code execution vulnerability CVE-2025-40553, an additional RCE CVE-2025-40551, and a high severity hardcoded credentials issue CVE-2025-40537 that could grant unauthorized administrative access. SolarWinds addressed the issues in Web Help Desk 2026.1 and administrators are urged to apply the update promptly because the product has been frequently targeted in attacks.
Cyber Insights 2026: Offensive Security; Where It Is and Where It’s Going

www.securityweek.com · 6 months ago

Offensive security is moving from periodic pentests toward continuous, AI-augmented red teaming that combines automation, threat intelligence, and human expertise to find, validate, and help fix weaknesses faster. AI is expected to act as a force multiplier by speeding vulnerability discovery, enabling round the clock monitoring, and suggesting fixes, while raising concerns about false positives, regulatory compliance, overreliance, and the risk of tools being repurposed by attackers. Hybrid models that blend in-house red teams, external specialists, and crowdsourced bug bounty platforms are emerging, and the boundary between offensive and defensive functions is blurring as organizations aim for preemptive, continuous assurance.
Mesh Security Raises $12 Million for CSMA Platform

www.securityweek.com · 6 months ago

On January 28, 2026, Mesh Security announced it raised 12 million dollars in Series A funding, bringing total financing to over 16 million dollars. The round was led by Lobby Capital with participation from S Ventures and BrightPixel Capital. Based in Palo Alto and Tel Aviv and founded in 2022, Mesh provides a cybersecurity mesh architecture platform that operationalizes CSMA by unifying fragmented security stacks into a single interoperable execution layer that sits above existing tools to provide visibility, context, and control across business units and environments. The company said it will use the funds to advance autonomous, agentic capabilities across cross domain attack paths and to scale sales and customer support.
Why We Can’t Let AI Take the Wheel of Cyber Defense

www.securityweek.com · 6 months ago

false
Surging Cyberattacks Boost Latin America to Riskiest Region

www.darkreading.com · 6 months ago

Latin America and the Caribbean have become the most targeted region for cyberattacks, seeing an average of 3,065 attacks per week last year, a year over year increase of 26 percent, and about 40 percent more attacks than the global average. Three quarters of organizations experienced information disclosure attacks, a majority saw attempts at remote code execution and authentication bypass, and more than five percent suffered ransomware, driven by a shift to data leak extortion, surging credential stealing campaigns, exploitation of edge devices, and attackers leveraging AI. Security firms report ransomware and extortion activity rising and predict continued acceleration, especially against healthcare and manufacturing, while organizations using generative AI face governance risks with 91 percent seeing risky prompts, three percent posing leakage risk, and one quarter including potentially sensitive data.
Massives Datenleck bedroht rund 150 Millionen Benutzer

www.csoonline.com · 6 months ago

Ein Cybersicherheitsforscher hat ein Datenleck mit 149 Millionen Login-Datensätzen entdeckt, darunter Benutzernamen, Klartextpasswörter und direkte Login-URLs. Besonders betroffen sind Gmail mit rund 48 Millionen Einträgen, Facebook mit etwa 17 Millionen und Instagram mit rund 6,5 Millionen, zudem sind Konten zu Finanzdiensten, Krypto-Wallets und Bank- und Kreditkarten-Logins enthalten. Die Datensammlung geht auf Keylogger und Infostealer-Malware zurück und ist öffentlich zugänglich, was automatisierte Credential-Stuffing-Angriffe, Phishing, Betrug und Identitätsdiebstahl erleichtern könnte.
Cyberattack on Poland’s power grid hit around 30 facilities, new report says

therecord.media · 6 months ago

A coordinated cyberattack in late December compromised control and communications systems at around 30 energy facilities linked to distributed generation in Poland, disrupting operational technology while the national transmission system and overall power supply remained uninterrupted. Attackers gained access to OT systems at combined heat and power plants and renewable dispatch sites, disabled key equipment beyond repair at some locations, and cut communications that prevented remote monitoring and control. The operation is attributed with moderate confidence to the Russian group Sandworm and involved data wiping malware known as DynoWiper, though it is unclear whether intruders attempted to issue operational commands or focused only on disabling communications.
Cal.com Broken Access Controls Lead to Account Takeover and Data Exposure

gbhackers.com · 6 months ago

Cal.com patched critical broken access control vulnerabilities that allowed complete account takeover and exposure of sensitive booking data including attendee names and emails, meeting metadata, OAuth tokens, and API keys. A chained logic flaw in the organization signup flow let an attacker generate an organization invite link and submit a victim email to trigger a database upsert that overwrote the victim account and reassigned it to the attacker, and this was fixed in version 6.0.8 with strict global user existence validation. A separate issue exposed internal API version one route handlers because the Next js routing allowed direct access to internal route files with leading underscores, enabling any authenticated user with a valid API key to bypass authorization middleware to read or delete bookings and destination calendars, and Cal.com mitigated this by blocking direct access to those internal routes and returning forbidden responses.
Hackers hijack exposed LLM endpoints in Bizarre Bazaar operation

www.bleepingcomputer.com · 6 months ago

There is a malicious campaign called Bizarre Bazaar that targets exposed or poorly authenticated large language model service endpoints, with researchers recording more than 35,000 attack sessions against honeypots over a 40 day period. The operation monetizes access by stealing compute for cryptomining, reselling API access through a service marketed as SilverInc and NeXeonAI, exfiltrating prompts and conversation history, and attempting lateral movement via Model Context Protocol servers. Attackers scan for targets using Shodan and Censys and exploit misconfigurations such as unauthenticated Ollama endpoints on port 11434 and OpenAI compatible APIs on port 8000, and researchers attribute the operation to actors using the aliases Hecker, Sakuya, and LiveGamer101.
UK leaders warned country risks 'absorbing' cyber and hybrid attacks without offensive deterrence

therecord.media · 6 months ago

There is a warning from former national security adviser Lord Sedwill that Britain risks leaving itself exposed to cyberattacks and hybrid warfare unless it can impose costs on hostile states because resilience alone will not deter adversaries. Ministers defended plans to raise security spending after NATO commitments to increase total defense related spending to five percent of GDP with one point five percent allocated to indirect defense and resilience, while critics warned the resilience figure could simply repackage existing activity rather than deliver new capability. The government said it will publish a refreshed National Cyber Action Plan in the spring to shift from a strategic framework to more operational countermeasures, and ministers acknowledged shortcomings in countering foreign disinformation with an independent review due by the end of March.
Museum curator, 77, learns Gen Z slang and goes viral: ‘Honestly, she ate’

www.washingtonpost.com · 6 months ago

false
Rein Security Emerges From Stealth With $8M, Bringing Inside-Out AppSec Approach

www.securityweek.com · 6 months ago

Rein Security has emerged from stealth with eight million dollars in funding from Glilot Capital and is co headquartered in Tel Aviv and New York City, founded in 2024 by Matan Bar Efrat and Netanel Rubin. The company is introducing a patent pending runtime protection platform that installs with a single line of code and baselines acceptable application behavior in less than a day. If the platform detects deviations it issues alerts and prevents exploitation by micro sandboxing the malicious resource without terminating processes threads or HTTP requests, while claiming under one millisecond performance impact and no reliance on proxies sampling or eBPF. The technology is positioned to protect production applications against both zero day and one day attacks and to address security challenges from agentic and non deterministic applications.
eSkimming Attacks Surge with Evolving Tactics and Ongoing Recovery Challenges

gbhackers.com · 6 months ago

A year-long study tracking 550 previously compromised e-commerce sites across 68 countries found that 18 percent remained actively infected one year after discovery and 16 percent of victims went offline or became unreachable. Among the 98 still-infected sites, 57 percent showed re-infection or evolved attack paths rather than the original skimmer, and 12 percent of campaigns migrated from third-party to first-party JavaScript, with the United States accounting for nearly one third of active infections while Spain and Germany showed 23 percent and four percent persistence respectively. Researchers conclude that eSkimming is a long-lived, shape shifting browser side threat that evades server focused defenses and call for continuous client side runtime monitoring and behavior based controls to detect and block data exfiltration.
Slovakian man pleads guilty to operating darknet marketplace

www.bleepingcomputer.com · 6 months ago

A Slovakian national named Alan Bill, 33, known online as Vend0r or KingdomOfficial, pleaded guilty to conspiracy to distribute controlled substances for helping operate Kingdom Market, a darknet marketplace that ran from March 2021 through December 2023. Federal undercover investigators made purchases in July 2022 and authorities seized the market in December 2023 after finding it hosted about 42,000 items, several hundred sellers, and tens of thousands of customer accounts offering narcotics, cybercrime tools and services, fake government identification, and stolen personal information. Bill was arrested on December 15, 2023 at Newark Liberty International Airport with electronic devices and a hardware wallet tying him to the site, admitted providing web administration services and receiving cryptocurrency, and agreed to surrender domain names and forfeit cryptocurrency. He faces sentencing on May 5, 2026 on the drug trafficking conspiracy charge, which carries a mandatory minimum five year term and a maximum 40 year sentence and up to 5 million dollars in fines.
Gemini MCP Tool 0-Day Vulnerability Exposes Systems to Remote Code Execution

gbhackers.com · 6 months ago

A critical zero day vulnerability exists in the Gemini MCP Tool that enables unauthenticated remote attackers to execute arbitrary code on vulnerable installations without user interaction. The flaw is a command injection in the tool's execAsync method that allows crafted input to run system commands, is network accessible, requires no privileges, and carries a CVSS score of 9.8. The vulnerability is tracked as CVE-2026-0755 and was assigned ZDI-26-021 and ZDI-CAN-27783 after discovery by Peter Girnus of Trend Research, public disclosure occurred on January 9, 2026, and no vendor patch was available at disclosure so recommended mitigations include immediate network isolation, strict access controls, and limiting exposure to trusted networks.
Two High-Severity n8n Flaws Allow Authenticated Remote Code Execution

thehackernews.com · 6 months ago

There are two high severity vulnerabilities in the n8n workflow automation platform that allow authenticated remote code execution, identified as CVE-2026-1470 with a CVSS score of 9.9 and CVE-2026-0863 with a CVSS score of 8.5. CVE-2026-1470 is an eval injection that can bypass the Expression sandbox to execute crafted JavaScript on the main node, and CVE-2026-0863 is an eval injection that can bypass the python task executor sandbox to run arbitrary Python on the underlying operating system. Successful exploitation can let an attacker hijack an entire n8n instance including when the platform is running in internal execution mode, exposing linked infrastructure and sensitive data. Users are advised to update to patched releases 1.123.17 2.4.5 or 2.5.1 for CVE-2026-1470 and 1.123.14 2.3.5 or 2.4.2 for CVE-2026-0863 to mitigate the risk.
Cybercriminals Leverage AI-Generated Malicious Job Offers to Spread PureRAT Malware

gbhackers.com · 6 months ago

A Vietnamese threat actor is using AI authored code to run a phishing campaign that leverages realistic job offer lures to deliver PureRAT and HVNC payloads and gain remote access to corporate networks. The campaign began with malicious ZIP and RAR attachments containing executables that sideload malicious DLLs using legitimate software and has evolved to direct victims to cloud hosted archives to evade email filters, with AI styled batch and Python loaders that fetch and decode Base64 payloads and establish persistence via Run registry keys or scheduled tasks. The operation appears financially motivated, harvesting credentials, moving laterally, and selling access on criminal marketplaces, and organizations are urged to treat unsolicited job offers with external file hosting or executable documents as high risk and tune endpoint, email, and and cloud controls accordingly.
Critical IDIS IP Camera Vulnerability Allows Full Computer Compromise with One-Click Exploit

gbhackers.com · 6 months ago

There is a critical vulnerability in IDIS Cloud Manager ICM Viewer that allows one click remote code execution against Windows hosts monitoring video surveillance, tracked as CVE-2025-12556 with a CVSS v4 score of 8.7. The flaw results from a Windows service named CWGService.exe listening on localhost and launching WCMViewer.exe with unsanitized arguments, enabling injection of Chromium command line flags such as --utility-cmd-prefix to execute arbitrary programs via the Chromium Embedded Framework. A malicious webpage can open a WebSocket to the local service and send a crafted encrypted message that performs the argument injection, producing a true one click RCE that can spawn arbitrary executables and allow attackers to pivot inside victim networks. IDIS and CISA urge immediate remediation by upgrading ICM Viewer to version 1.7.1 or uninstalling the viewer if it is not used.
New report shows 16% of connections in retail companies have invalid or outdated SSL certificates

ethiack.com · 6 months ago

Analysis of 1,722 European retail domains found 57,898 exposed digital assets and three major security gaps: 16 percent of HTTPS connections use invalid or outdated SSL certificates, 17 percent of web servers expose version and software information, and 1,208 critical assets including email servers, admin dashboards, VPNs and checkout flows show concerning weaknesses. CVE disclosures increased 16 percent in 2025 and Time to Exploit has averaged negative one days, meaning active exploitation can occur before patches are available and rendering annual or quarterly assessments insufficient. Recommended mitigations include continuous attack surface management, autonomous AI driven penetration testing triggered by code and infrastructure changes, and automated detection and correction of basic security hygiene issues to reduce risk to payment systems, customer data and administrative access.
12 OpenSSL Vulnerabilities Found With LLMs

aisle.com · 6 months ago

There are 12 OpenSSL vulnerabilities discovered by AISLE’s autonomous analyzer and disclosed in January 2026, including the higher and moderate severity CVEs CVE-2025-15467 and CVE-2025-11187 and the lower severity CVEs CVE-2025-15468, CVE-2025-15469, CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, and CVE-2026-22796. Some issues date back decades and affect multiple subsystems such as CMS, QUIC, and post quantum signature handling, and AISLE recommended fixes that were incorporated directly into OpenSSL for five of the twelve CVEs. The findings were reported through responsible disclosure and coordinated with OpenSSL maintainers, resulting in fixes and additional preemptive merges before release.