Blahalla

Microsoft releases second out-of-band fix for Windows in a week

www.csoonline.com · 6 months ago

Outlook users have reported difficulties with Microsoft’s January Patch Tuesday updates, forcing Microsoft, once again, to patch some of its patches. Users reported that, after applying the January 13 Windows updates, some applications became unresponsive or encountered unexpected errors when opening files from or saving files to cloud-based storage such as OneDrive or Dropbox. In particular, certain Microsoft Outlook configurations with the PST file containing a users’ messages stored on OneDrive could cause Outlook to hang or lead to sent messages going missing or previously downloaded emails being re‑downloaded. In response, Microsoft has issued a bunch of out-of-band emergency updates for Windows 11 and 10 and Windows Server 2019, 2022, and 2025 to solve the problem. This is not the first time that Microsoft has had to issue a patch for a patch. Just last week, it had to react when it inadvertently introduced two new bugs: an inability to connect to Windows Cloud PCs and an inability to shut down some machines with Secure Launch enabled. Prior to that, in October 2025, a patch caused a multitude of different issues, while in May 2025 Microsoft had to issue an out-of-band patch to fix a Windows 11 start-up failure. Microsoft said the latest out-of-band updates are cumulative and include security fixes and improvements from the January 13, 2026, security update (KB5074109) and the out-of-band update (KB5077744) from January 17, 2026. This article first appeared on Computerworld.

6 Okta security settings you might have overlooked

www.bleepingcomputer.com · 6 months ago

Okta misconfigurations can quietly weaken identity security as SaaS environments evolve. Nudge Security shows six Okta security settings teams often overlook and how to fix them.

Romania probes two suspects over alleged hitman-for-hire website

therecord.media · 6 months ago

Police seized devices and cryptocurrency in multiple raids aimed at an alleged assassins-for-hire platform, Romanian authorities said.

Upwind Raises $250 Million at $1.5 Billion Valuation

www.securityweek.com · 6 months ago

The CNAPP company will use the fresh investment to scale its runtime-first cloud security offering across data, AI and code.

Elon Musk’s X Faces EU Inquiry Over Sexualized AI Images Generated by Grok

www.nytimes.com · 6 months ago

European Union regulators have launched an investigation into X, formerly known as Twitter, regarding the spread of sexualized images generated by the artificial intelligence chatbot Grok. Authorities allege X has failed to adequately control the platform, leading to the widespread distribution of deepfakes, some depicting children. This investigation could intensify a dispute between Europe and the United States over online content regulation. Last month, X was already fined over 120 million euros for violating Digital Services Act rules.

Blind Boolean-Based Prompt Injection

medium.com · 6 months ago

A new prompt injection technique called Blind Boolean Based Prompt Injection allows an attacker to extract hidden system instructions from a constrained LLM classifier by encoding true false predicates in user prompts and reading deterministic categorical outputs as boolean signals. In one proof of concept against a Flask application using an instruct model to classify colors, the attacker forced the model to reply with one classification for true and another for false, then brute forced the system codename letter by letter to reveal hidden instructions. Recommended mitigations include restricting or validating untrusted input, implementing anomaly detection and rate limiting, hiding classification outputs, and hardening system prompts to reduce susceptibility to this attack.

Hackers can bypass npm’s Shai-Hulud defenses via Git dependencies

www.bleepingcomputer.com · 6 months ago

The defense mechanisms that NPM introduced after the 'Shai-Hulud' supply-chain attacks have weaknesses that allow threat actors to bypass them via Git dependencies.

AI Finds Vulnerability Chain Leading to Account Takeover and Leaked Bookings

www.gecko.security · 6 months ago

A critical vulnerability involving broken access controls was identified within the Caldotcom platform. This flaw allows unauthorized users to bypass intended security restrictions and potentially access sensitive internal data. Researchers demonstrated that the vulnerability permits improper authentication, enabling broader data retrieval than intended. Users are advised to review their permissions immediately to mitigate this risk.

After reporting vulnerabilities found in MDT, Microsoft chose to retire the service rather than fix the issues... Admins should follow the defensive recommendations to mitigate the issues if they choose to continue using the software or can’t migrate to a different solution.

specterops.io · 6 months ago

Microsoft is retiring the Microsoft Deployment Toolkit due to unfixable security vulnerabilities. Researchers discovered that attackers could steal domain credentials and bypass security controls through unauthenticated discovery and open access to a monitoring service. A critical XXE vulnerability, stemming from outdated XML parsing, allows attackers to coerce authentication and leak sensitive information. Microsoft will officially end support for MDT on January 6, 2026, urging users to migrate to alternative solutions.

EU launches formal investigation into X and Grok over sexual images

therecord.media · 6 months ago

The European Commission has launched a formal investigation into X and its chatbot Grok over the generation and spread of sexually explicit images, including those potentially involving minors. Similar investigations are underway in the United Kingdom, France, and California. X has announced changes to Grok to address the issue, though the company's initial response was criticized. The investigation will determine if X adhered to its duties under the Digital Services Act, with potential penalties including significant monetary fines.

Lazarus Hackers Target European Drone Manufacturers in Active Campaign

gbhackers.com · 6 months ago

The North Korean state-sponsored Lazarus hacking group has launched a sophisticated cyberespionage campaign targeting European defense contractors involved in uncrewed aerial vehicle (UAV) manufacturing. The attacks appear directly linked to North Korea’s efforts to accelerate its domestic drone production capabilities through industrial espionage. The targeted organizations include a metal engineering firm, an aircraft component manufacturer

PoC Released for GNU InetUtils telnetd RCE as 800K+ Exposed Instances Remain Online

gbhackers.com · 6 months ago

A proof-of-concept exploit for CVE-2026-24061, a critical remote code execution vulnerability in the GNU Inetutils telnetd, has surfaced, with security researchers warning that over 800,000 vulnerable instances remain publicly accessible on the internet. The vulnerability allows unauthenticated attackers to execute arbitrary commands on affected systems running vulnerable versions of the telnetd service. Vulnerability Overview CVE-2026-24061

Instagram Investigates Reported Vulnerability Allowing Access to Private Content

gbhackers.com · 6 months ago

A server-side vulnerability in Instagram that allegedly allowed completely unauthenticated access to private account posts. This raises concerns about Meta’s vulnerability disclosure handling and the effectiveness of compensatory controls protecting user privacy. Technical Overview According to the disclosure, the vulnerability existed in Instagram’s mobile web interface and required no authentication or follower relationship to exploit.

Crunchbase Confirms Data Breach After Hacking Claims

www.securityweek.com · 6 months ago

Crunchbase has confirmed a data breach after hackers claimed to have stolen over two million records containing personal information. The cybercrime group ShinyHunters released a significant amount of data after Crunchbase refused to pay a ransom. This group has also targeted SoundCloud and Betterment, with SoundCloud confirming a breach impacting user data and Betterment experiencing a social engineering attack. ShinyHunters allegedly claims responsibility for a recent Okta vishing campaign targeting multiple organizations.

Ireland Proposes Giving Police New Digital Surveillance Powers

www.schneier.com · 6 months ago

The Irish government intends to expand police powers regarding communication interception, including encrypted messages. This proposal would also establish a legal framework for the use of spyware. The plan seeks to bolster the police’s surveillance capabilities. No CVEs were mentioned in this information.

New Malware Toolkit Redirects Victims to Malicious Sites Without Changing the URL

gbhackers.com · 6 months ago

A dangerous new malware toolkit is being sold on Russian cybercrime forums that can redirect victims to fake websites while keeping the real domain name visible in their browser’s address bar. The toolkit, called Stanley, costs between $2,000 and $6,000 and comes with a guarantee that it will pass Google’s Chrome Web Store review process.

Cyber Insights 2026: Threat Hunting in an Age of Automation and AI

www.securityweek.com · 6 months ago

false

⚡ Weekly Recap: Firewall Flaws, AI-Built Malware, Browser Traps, Critical CVEs & More

thehackernews.com · 6 months ago

Cybersecurity professionals are facing a rapidly escalating threat landscape. Several vulnerabilities have been disclosed in software from numerous companies, with network edge devices being primary targets. Attackers are increasingly using tools like Mamba PhaaS and a Chrome extension toolkit to facilitate widespread phishing and malware distribution. Additionally, a supply chain attack compromised EmEditor and critical flaws exist in OpenKM and Vivotek firmware.

CISA says critical VMware RCE flaw now actively exploited

www.bleepingcomputer.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency is urging federal agencies to address a critical vulnerability in VMware vCenter Server, identified as CVE-2024-37079. This flaw allows for remote code execution with network access and poses a significant risk. Broadcom confirms the vulnerability is actively exploited, and there are no available workarounds, requiring immediate patching. CISA has mandated agencies secure vulnerable systems within three weeks, alongside past advisories concerning CVE-2025-41244, CVE-2025-41251, CVE-2025-41252, CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226.

‘Stanley’ Malware Toolkit Enables Phishing via Website Spoofing

www.securityweek.com · 6 months ago

A new malware toolkit called Stanley has emerged on underground forums, offering a service to create malicious browser extensions that bypass security validation. This toolkit allows threat actors to display legitimate website addresses in the browser’s address bar while serving phishing pages, a feature that shifts distribution risk and implies a method for bypassing Google’s review process. The toolkit includes a management panel to track infected hosts and configure URL hijacking rules, and operators can actively lure users to targeted pages through real-time notifications. Stanley’s accessible pricing and ability to embed malicious functionality within seemingly legitimate extensions pose a significant threat to user security.

Winning Against AI-Based Attacks Requires a Combined Defensive Approach

thehackernews.com · 6 months ago

Cybersecurity threats are evolving with the rise of AI, with attackers using Large Language Models to conceal code and generate malicious scripts. Recent attacks include AI-orchestrated espionage campaigns and the use of steganography to deploy malware, bypassing traditional defenses. Adversaries are also exploiting vulnerabilities in endpoint detection and response systems by manipulating AV exclusion rules and leveraging compromised VPNs to spread malware. Network detection and response, alongside EDR, offers a combined defensive approach to identify and mitigate these increasingly sophisticated, AI-powered threats. The Volt Typhoon attack, attributed to Chinese state-sponsored actors, demonstrated the value of NDR in detecting malicious network traffic that evaded EDR.

TikTok Finalizes a Deal to Form a New American Entity

www.securityweek.com · 6 months ago

false

New DPRK Interview Campaign Uses Fake Fonts to Deliver Malware

gbhackers.com · 6 months ago

A dangerous new iteration of the “Contagious Interview” campaign that weaponizes Microsoft Visual Studio Code task files to distribute sophisticated malware targeting software developers. This campaign, which began over 100 days ago, has intensified dramatically in recent weeks with 17 malicious GitHub repositories identified across 11 distinct attack variants. North Korean threat actors linked to

"Open sesame": Critical vulnerabilities in dormakaba physical access control system enable unlocking arbitrary doors

r.sec-consult.com · 6 months ago

Multiple critical vulnerabilities in dormakaba Exos 9300, Access Manager and Registration Unit allow attackers with network access to open arbitrary doors, reconfigure connected controllers and peripherals without prior authentication, and extract or manipulate stored credentials and PINs. The flaws include unauthenticated SOAP and RPC interfaces, hardcoded legacy accounts and secrets, weak password derivation for the database account, hardcoded keys for PIN encryption, and a local privilege escalation in the system management application. Several thousand customers were affected, including some in high security environments, and some systems are reachable from the internet due to misconfiguration. Reported CVEs include CVE-2025-59090, CVE-2025-59091, CVE-2025-59092, CVE-2025-59093, CVE-2025-59094, CVE-2025-59095 and CVE-2025-59097.

NetSupport Manager 0-Day Vulnerabilities Enable Remote Code Execution

gbhackers.com · 6 months ago

Two critical 0-day vulnerabilities in NetSupport Manager that, when chained, allow unauthenticated remote code execution (RCE). The vulnerabilities were discovered during routine security assessments of operational technology (OT) environments and affect version 14.10.4.0 and earlier, with fixes implemented in version 14.12.0000 released on July 29th, 2025. The two vulnerabilities tracked as CVE-2025-34164 and CVE-2025-34165 reside

Microsoft Issues KB5078127 OOB Patch After Reports of Outlook Freezing and File System Instability

gbhackers.com · 6 months ago

Microsoft has released two critical out-of-band (OOB) security patches targeting widespread issues affecting Windows 11 users following January’s monthly security updates. The emergency patches, KB5078127 and KB5078132, address severe file system failures and application crashes that emerged after the January 13 security release. The primary culprit behind these issues is unexpected complications introduced by KB5073455

Silicon Valley Wants to Build A.I. That Can Improve A.I. on Its Own

www.nytimes.com · 6 months ago

false

Yann LeCun, an A.I. Pioneer, Warns the Tech ‘Herd’ Could Hit a Dead End

www.nytimes.com · 6 months ago

false

Parents say teens are addicted to social media. Now, a jury will decide.

www.washingtonpost.com · 6 months ago

false

I let ChatGPT analyze a decade of my Apple Watch data. Then I called my doctor.

www.washingtonpost.com · 6 months ago

A new tool, ChatGPT Health, now allows users to input personal health data from fitness trackers and medical records to receive health-related insights. One user provided a decade's worth of Apple Watch data, including steps and heart measurements, to the tool. The tool generated varied and questionable conclusions about the user's cardiac health. The tool's creators say it can help users understand long-term health patterns.

Angry gamers are forcing studios to scrap or rethink new releases

www.washingtonpost.com · 6 months ago

Consumer backlash is impacting the video game industry as gamers express concerns about artificial intelligence. This resistance is prompting developers to cancel planned releases and reconsider their use of AI technology. Gamers are leveraging online platforms to influence studios and limit the incorporation of AI. The movement reflects a broader trend of consumers pushing back against AI integration across various tech sectors.

Russian Sandworm Hackers Blamed for Cyberattack on Polish Power Grid

www.securityweek.com · 6 months ago

Russian state-sponsored hackers, known as Sandworm, targeted Poland’s power grid in a December 2025 cyberattack. The attack involved a new data wiper called DynoWiper, and officials believe Russia was responsible. The incident, considered the largest cyberattack against Poland in years, was prevented from causing a widespread blackout. Sandworm, also known by several other aliases, has a history of disruptive attacks, notably against Ukraine’s power grid ten years prior.

SyncFuture Campaign Abuses Enterprise Security Tools to Deploy Malware

gbhackers.com · 6 months ago

A sophisticated, multi-stage espionage campaign targeting Indian residents through phishing emails impersonating the Income Tax Department. The attack chain, tracked as the “SyncFuture Espionage Campaign,” weaponizes legitimate enterprise security software as its final payload, demonstrating how threat actors repurpose trusted commercial tools to establish persistent, undetectable access to victim systems. The campaign begins with targeted

Apache Hadoop Flaw Could Trigger System Crashes or Data Corruption

gbhackers.com · 6 months ago

A moderate out-of-bounds write vulnerability in Apache Hadoop’s HDFS native client that could allow attackers to trigger system crashes or cause data corruption in production environments. The flaw, identified as CVE-2025-27821, affects the native HDFS client’s URI parser and has been assigned moderate severity by Apache. The vulnerability was discovered and reported by security researcher

Dobrindt zu Cyberangriffen: “Wir werden zurückschlagen”

www.csoonline.com · 6 months ago

German officials are planning a more aggressive response to cyberattacks, including potential disruption and destruction of attacker infrastructure. Interior Minister Alexander Dobrindt stated Germany will lower the threshold for retaliatory action and will coordinate responses through intelligence agencies and the Federal Criminal Office. The government intends to grant Germany’s intelligence services new authorities regarding information gathering and operational activities. Dobrindt anticipates proposing relevant legislation within the first half of the year.

New Phishing Attack Exploits Vercel to Host and Deliver Remote Access Malware

gbhackers.com · 6 months ago

A new phishing campaign abusing the Vercel hosting platform has been active since at least November 2025 and is becoming increasingly sophisticated. The core trick is “inherited trust.” Attackers send short phishing emails with financial or business themes such as unpaid invoices, payment statements, or document reviews. The real hook is not the text, but

CISO’s predictions for 2026

www.csoonline.com · 6 months ago

false

2024 VMware Flaw Now in Attackers’ Crosshairs

www.securityweek.com · 6 months ago

A critical vulnerability in VMware vCenter Server, identified as CVE-2024-37079, is currently being exploited by attackers. This flaw, with a CVSS score of 9.8, allows for remote code execution through an out-of-bounds write issue in the DCERPC protocol. The US Cybersecurity and Infrastructure Security Agency, or CISA, has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within three weeks. Broadcom, VMware’s parent company, has confirmed the vulnerability is being exploited in the wild.

/r/netsec's Q1 2026 Information Security Hiring Thread

www.reddit.com · 6 months ago

false

ChatGPT Temporary chat feature is getting a much-needed upgrade

www.bleepingcomputer.com · 6 months ago

false

địt mẹ mày morphisec: When Malware Authors Taunt Security Researchers

profero.io · 6 months ago

Vietnamese Stealer is a Python based information stealer delivered via DLL sideloading of a legitimate Adobe binary, using social engineered lures in Korean and persisting through a scheduled task disguised as a Microsoft Edge update. It employs a four layer obfuscation chain of Base85, Bzip2, Zlib and Python marshal that expands small blobs into massive payloads and uses Telegram public channels as a dead drop resolver for command and control and exfiltration. The payload is padded with 99 percent junk repeating the string dit me may morphisec to crash analysis tools and taunt a security vendor, and attribution is supported by language indicators and Telegram operator metadata identifying handles ByteManzZz and panpan7986.

Certificate Transparency as Communication Channel

latedeployment.github.io · 6 months ago

false

Your Vibe Coded AI App Can Bankrupt You

utkusen.substack.com · 6 months ago

Cloud service users are at risk of unexpected and significant charges due to API key abuse or excessive request volume. One user experienced a £1000 bill after a leaked API key was misused, highlighting that cloud providers don't always forgive unauthorized usage. To mitigate this, developers are advised to utilize proxy services with built-in billing caps, securely store API keys using provider tools, and implement rate limits and spending limits within applications, particularly those offering free trials. Monitoring user behavior with tools like Sentry is also recommended to detect and respond to unusual activity.

cvsweb.openbsd.org fights AI crawler bots by redirecting hotlinking requests to theannoyingsite.com (labelled "Malware" by eero), gets blacklisted by eero, too, for "Phishing & Deception"

www.mail-archive.com · 6 months ago

The cvsweb system is currently redirecting users, which negatively impacts usability and user experience. Instead of redirects, a standard error message, such as HTTP 406 Not Acceptable, is recommended to provide users with information and allow them to use alternative services. A better solution would also include a back link on a custom error page, and the ability to redirect back to the main file page with the version as an anchor parameter. The entire cvsweb.openbsd.org site is now blacklisted due to these redirect practices.

1Password adds pop-pup warnings for suspected phishing sites

www.bleepingcomputer.com · 6 months ago

1Password has added built in pop up warnings that alert users when a visited URL is suspected of phishing, preventing automatic credential filling and prompting users to verify the address before entering passwords. The feature is enabled automatically for individual and family plans and can be activated by administrators for company accounts through Authentication Policies in the 1Password admin console. The change targets typosquatted domains and rising AI enabled phishing campaigns, with a vendor survey reporting that sixty one percent of respondents had been successfully phished and seventy five percent do not check URLs before clicking links.

1Password adds pop-up warnings for suspected phishing sites

www.bleepingcomputer.com · 6 months ago

1Password has implemented a new pop-up warning system to alert users about potential phishing sites. This additional layer of protection aims to address cases where users might unknowingly enter their credentials on malicious pages, even when the password manager doesn’t automatically fill in the login information. The feature will be automatically enabled for individual and family plan users and can be manually activated for company employees. A recent survey revealed that a significant number of users have been phished and often do not verify URLs before clicking links, highlighting the need for this enhanced security measure.

Microsoft investigates Windows 11 boot failures after January updates

www.bleepingcomputer.com · 6 months ago

Microsoft is investigating reports that some Windows 11 devices are failing to boot with "UNMOUNTABLEBOOTVOLUME" errors after installing the January 2026 Patch Tuesday security updates.

U.K. lawsuit seeks ban on smartphones in schools to protect children

www.washingtonpost.com · 6 months ago

The risks of children’s smartphone use, including sexual exploitation and bullying, are mounting in Britain where some say the government has a responsibility to do more.

Microsoft releases emergency OOB update to fix Outlook freezes

www.bleepingcomputer.com · 6 months ago

Microsoft has released emergency updates to address an issue preventing Microsoft Outlook from opening when using PST files stored in cloud storage services like OneDrive and Dropbox. This problem began affecting users after updates released on or after January 13, 2026, causing Outlook to freeze or fail to reopen. The updates are available for Windows 10, Windows 11, and various Windows Server versions. Users not experiencing the issue can wait for the regular update schedule to receive the fix.

BREAKMEIFYOUCAN! - Exploiting Keyspace Reduction and Relay Attacks in 3DES and AES-protected NFC Technologies

breakmeifyoucan.com · 6 months ago

NULL