Blahalla

Microsoft investigates Windows 11 boot failures after January updates

www.bleepingcomputer.com · 6 months ago

Microsoft is investigating reports that some Windows 11 devices are failing to boot with "UNMOUNTABLEBOOTVOLUME" errors after installing the January 2026 Patch Tuesday security updates.

U.K. lawsuit seeks ban on smartphones in schools to protect children

www.washingtonpost.com · 6 months ago

The risks of children’s smartphone use, including sexual exploitation and bullying, are mounting in Britain where some say the government has a responsibility to do more.

Microsoft releases emergency OOB update to fix Outlook freezes

www.bleepingcomputer.com · 6 months ago

Microsoft has released emergency updates to address an issue preventing Microsoft Outlook from opening when using PST files stored in cloud storage services like OneDrive and Dropbox. This problem began affecting users after updates released on or after January 13, 2026, causing Outlook to freeze or fail to reopen. The updates are available for Windows 10, Windows 11, and various Windows Server versions. Users not experiencing the issue can wait for the regular update schedule to receive the fix.

BREAKMEIFYOUCAN! - Exploiting Keyspace Reduction and Relay Attacks in 3DES and AES-protected NFC Technologies

breakmeifyoucan.com · 6 months ago

NULL

U.S. Automakers’ Foreign Troubles Now Extend to Canada

www.nytimes.com · 6 months ago

false

Sandworm hackers linked to failed wiper attack on Poland’s energy systems

www.bleepingcomputer.com · 6 months ago

Hackers linked to the Russian state-sponsored group Sandworm targeted Poland’s energy systems in late December 2025. The attack involved a new data-wiping malware called DynoWiper, which renders systems unusable and requires rebuilding. The attack specifically targeted combined heat and power plants and renewable energy management systems, and Polish officials have attributed the attack to Russian services. Security researchers have detected DynoWiper as Win32/KillFiles.NMO with a SHA-1 hash of 4EC3C90846AF6B79EE1A5188EEFA3FD21F6D4CF6.

Why the Power May Not Go Out Until After the Storm Has Passed

www.nytimes.com · 6 months ago

false

Konni hackers target blockchain engineers with AI-built malware

www.bleepingcomputer.com · 6 months ago

A North Korean hacker group known as Konni is targeting blockchain engineers and developers using AI-generated PowerShell malware. The attacks begin with a Discord link leading to a malicious shortcut file that deploys a backdoor and establishes a persistent connection with a command-and-control server. Researchers have observed the malware’s structure and documentation suggest the use of artificial intelligence in its creation, including unique comments characteristic of large language model-generated code. The campaign is currently focused on the Asia-Pacific region, specifically Japan, Australia, and India.

China investigates top general Zhang Youxia in rare purge of senior military leaders

therecord.media · 6 months ago

false

Microsoft Teams to Begin Sharing Employee Location with Employers Based on Wi-Fi Networks

gbhackers.com · 6 months ago

Microsoft Teams is introducing a feature that will automatically detect and share employee work locations based on Wi-Fi network connections. The update, slated for early to mid-March 2026, applies to desktop versions of Teams for Windows and Mac. While the feature is intended to improve location accuracy and reduce administrative overhead, it raises concerns about workplace surveillance and hybrid work policies because tenant administrators can enable it and potentially mandate participation. Microsoft states that the feature will be off by default and data will be cleared daily, but critics worry it could shift Teams into an attendance enforcement system.

Microsoft Open-Sources winapp, a New CLI Tool for Streamlined Windows App Development

gbhackers.com · 6 months ago

false

Multi-Stage Phishing Campaign Targets Russia with Amnesia RAT and Ransomware

thehackernews.com · 6 months ago

A multi-stage phishing campaign is targeting users in Russia, utilizing social engineering tactics to deploy ransomware and the Amnesia RAT. Attackers use public cloud services like GitHub and Dropbox to distribute payloads, and abuse Microsoft's Defendnot to disable Microsoft Defender. The campaign involves fake documents, PowerShell scripts, Visual Basic scripts, and Telegram bots to evade detection, steal data, and ultimately encrypt files while rerouting cryptocurrency transactions. The final payloads include Amnesia RAT for remote control and data theft, and ransomware derived from the Hakuna Matata family.

Prompt injection is No 1 Security threat for most systems.

challenge.antijection.com · 6 months ago

Large Language Models face a growing security threat called prompt injection, which uses natural language instructions to manipulate their behavior. This vulnerability is easy to exploit, bypassing traditional security measures and potentially leading to data breaches and system compromise. Due to the fundamental architecture of LLMs, a complete fix is unlikely, requiring instead a layered defense strategy involving limited access, sandboxing, and proactive security assessments. Experts warn that neglecting these precautions can result in significant security incidents.

Nike Probing Potential Security Incident as Hackers Threaten to Leak Data

www.securityweek.com · 6 months ago

Nike is investigating a potential security incident after a cybercrime group claimed to have stolen data from its systems. The group, known as WorldLeaks, listed Nike as a victim and threatens to release the stolen data if a ransom is not paid. WorldLeaks emerged in 2025 following the shutdown of Hunters International and focuses on data theft and extortion. The group now lists nearly 120 alleged victims, including Dell.

Microsoft Shared BitLocker Recovery Keys with the FBI to Unlock Encrypted Laptop Data

gbhackers.com · 6 months ago

Microsoft has confirmed it provided BitLocker encryption recovery keys to the FBI in response to a warrant. The request involved three encrypted laptops connected to a fraud investigation in Guam. Microsoft recommends cloud storage for recovery keys to offer convenience, but acknowledges this creates a potential vulnerability for law enforcement access. The company receives around 20 requests annually for these keys, but many cannot be fulfilled.

New DynoWiper Malware Used in Attempted Sandworm Attack on Polish Power Sector

thehackernews.com · 6 months ago

A sophisticated cyberattack targeting Poland’s power system occurred at the end of December 2025, attributed to the Russian nation-state hacking group Sandworm. The attack, which was unsuccessful, involved a new wiper malware called DynoWiper and aimed at combined heat and power plants and renewable energy management systems. Polish officials believe the attacks were linked to Russian services and are implementing stricter cybersecurity measures. The incident occurred on the tenth anniversary of a similar attack on Ukraine’s power grid in 2015 and follows a pattern of Sandworm’s disruptive cyber activity.

Who Approved This Agent? Rethinking Access, Accountability, and Risk in the Age of AI Agents

thehackernews.com · 6 months ago

AI agents are rapidly transforming how work is done, automating tasks and accessing data, but pose new security challenges. These agents often receive broad access permissions, making it difficult to trace ownership and approval. There are three categories of AI agents: personal, used by individuals; third-party, provided by vendors; and organizational, shared across teams, with organizational agents presenting the highest risk due to a lack of clear ownership and broad permissions. A key concern is the "agentic authorization bypass" where agents enable actions users are not explicitly authorized to perform, circumventing traditional access controls.

CISA Adds Actively Exploited VMware vCenter Flaw CVE-2024-37079 to KEV Catalog

thehackernews.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency has added a critical vulnerability to its list of actively exploited flaws. This vulnerability, CVE-2024-37079, affects Broadcom VMware vCenter Server and allows for remote code execution through a heap overflow. Researchers discovered this and another heap overflow, CVE-2024-37080, which Broadcom patched in June 2024. Federal agencies must update affected systems by February 13, 2026, due to confirmed exploitation in the wild.

Researchers Uncover Multi-Stage AiTM Attack Using SharePoint to Bypass Security Controls

gbhackers.com · 6 months ago

Microsoft Defender researchers have identified a complex adversary-in-the-middle phishing campaign targeting energy sector organizations. The attackers used SharePoint file-sharing to bypass security controls, sending phishing emails from compromised vendor addresses. Once victims authenticated, their credentials and session cookies were stolen, allowing attackers to delete emails and launch a wider phishing campaign. Organizations should review inbox rules, sign-in activity, and implement risk-based conditional access policies to prevent further compromise.

Attackers Leveraging telnetd Exploit for Root Privileges After PoC Goes Public

gbhackers.com · 6 months ago

Attackers are actively exploiting a critical authentication bypass vulnerability in GNU InetUtils telnetd, allowing them to gain root access without authentication. The flaw affects versions 1.9.3 through 2.7, introduced in March 2015, and is triggered by manipulating the USER environment variable. Following the public release of proof-of-concept code on January 20, 2026, security monitoring platforms detected widespread exploitation attempts, with 18 attacker IP addresses observed. Exploitation involves sending malicious Telnet IAC negotiation packets, and some attackers attempted to deploy a Python payload from a server at 67.220.95.16. Security teams are advised to audit networks and treat successful exploitation as a complete system compromise.

2025 Was a Wake-up Call to Protect Human Decisions, Not Just Systems

www.darkreading.com · 6 months ago

false

Five Ways People Are Using Claude Code

www.nytimes.com · 6 months ago

false

TikTok Strikes Deal to Create New U.S. Entity and Loosen App’s Ties to China

www.nytimes.com · 6 months ago

false

Happy 9th Anniversary, CTA: A Celebration of Collaboration in Cyber Defense

unit42.paloaltonetworks.com · 6 months ago

false

S.E.C. Drops Case Against Cryptocurrency Firm Founded by Winklevoss Twins

www.nytimes.com · 6 months ago

The agency says that victims of an investment offering involving Gemini Trust got their money back, though after a regulatory action brought by the New York attorney general.

ShinyHunters claim hacks of Okta, Microsoft SSO accounts for data theft

www.bleepingcomputer.com · 6 months ago

Cybercriminals, claiming to be the group ShinyHunters, are conducting voice phishing attacks targeting employees at companies using single sign-on (SSO) services from Okta, Microsoft Entra, and Google. Attackers impersonate IT staff to trick victims into providing login credentials and multi-factor authentication codes, gaining access to SSO accounts and connected applications like Salesforce, Microsoft 365, and Google Workspace. ShinyHunters is using stolen data from prior breaches to personalize these attacks and has demanded extortion payments from affected organizations. Crunchbase recently confirmed data theft from their network as a result of these attacks.

Fortinet confirms new zero-day attacks against customer devices

www.csoonline.com · 6 months ago

Fortinet has confirmed new attacks targeting customer devices, exploiting a previously unknown vulnerability. This attack bypasses authentication and allows for malicious configuration changes, impacting all SAML SSO implementations, including FortiCloud SSO. The attacks are distinct from a previous campaign that targeted CVE-2025-59718 and CVE-2025-59719. Fortinet recommends disabling FortiCloud SSO, updating software, restoring configurations, and rotating credentials to mitigate the risk.

Friday Squid Blogging: Giant Squid in the Star Trek Universe

www.schneier.com · 6 months ago

false

Correctly interpreting DMARC, SPF, and DKIM enforcement in DNS security

www.it-help.tech · 6 months ago

false

Data Leak Exposes 149M Logins, Including Gmail, Facebook

www.techrepublic.com · 6 months ago

A security researcher discovered a database containing 149 million compromised logins and passwords, totaling roughly 96 gigabytes of data. The database, which lacked password protection or encryption, included credentials for popular services like Gmail, Facebook, and Binance, as well as accounts linked to government domains. The data was likely collected through infostealer malware that records keystrokes and sends them to a hacker’s server, and the database remained active even as the researcher attempted to alert authorities. Experts advise users to change passwords, enable two-factor authentication, and be cautious of phishing attacks.

Swipe, Plug-in, Pwned: Researchers Find New Ways to Hack Vehicles

www.darkreading.com · 6 months ago

Researchers at the Pwn2Own automotive security competition demonstrated several new ways to compromise vehicle systems. One team successfully took over an Autel MaxiCharger AC Elite Home 40A using a near-field communication card. Attackers also exploited vulnerabilities in in-vehicle infotainment systems and leveraged signals from the charging gun to compromise EV chargers, like the Alpitronic HYC50. The increased connectivity of electric vehicles and charging infrastructure introduces heightened security risks, particularly due to a lack of holistic security design.

From runtime risk to real‑time defense: Securing AI agents

www.microsoft.com · 6 months ago

AI agents are increasingly used to automate tasks and access sensitive data, creating new security risks. Attackers can manipulate agent actions through crafted prompts, potentially leading to unintended data access or execution of unauthorized actions. Microsoft Defender provides real-time protection by inspecting tool invocations via webhook checks, blocking risky actions before they occur. Three scenarios highlight this protection, including malicious instruction injection, capability reconnaissance, and attempts to access sensitive documents. This approach allows organizations to deploy AI agents securely and confidently.

Exploited Zero-Day Flaw in Cisco UC Could Affect Millions

www.darkreading.com · 6 months ago

A zero-day vulnerability in Cisco’s Unified Communications Manager and related products has been exploited by threat actors. The flaw, tracked as CVE-2026-20045, allows for remote code execution and potential root-level access to affected systems through crafted HTTP requests. Cisco has released a patch and assigned the vulnerability a critical Security Impact Rating, while the US Cybersecurity and Infrastructure Security Agency has added it to its Known Exploited Vulnerabilities catalog. Security researchers are observing signs of mass scanning for vulnerable instances, indicating potential widespread targeting.

Europe's GCVE Raises Concerns Over Fragmentation in Vulnerability Databases

www.darkreading.com · 6 months ago

A European cybersecurity organization has launched the Global CVE Allocation System, or GCVE, to address concerns about the future of the existing MITRE-run Common Vulnerabilities and Exposures program. The GCVE aims to improve flexibility and autonomy in vulnerability identification by utilizing a decentralized database and independent authorities, known as GNAs. Experts caution that multiple, uncoordinated CVE initiatives could lead to fragmentation, duplication, and confusion for security teams. The lack of centrally enforced policies and the potential for identifiers not being shared with the existing CVE ecosystem are key concerns.

Malicious AI extensions on VSCode Marketplace steal developer data

www.bleepingcomputer.com · 6 months ago

Two malicious extensions available on the Visual Studio Code Marketplace have been discovered to be stealing developer data and sending it to servers in China. These extensions, ChatGPT, 中文版 and ChatMoss (CodeMoss), were installed over 1.5 million times combined and pose a significant risk to developers. The extensions collect data through three methods: monitoring opened files, stealthily transmitting files, and tracking user behavior using analytics SDKs. Exposed information could include source code, credentials, and API keys.

Y2K38 as a security risk for vulnerable systems today. Not in 12 years, but right now.

www.bitsight.com · 6 months ago

A looming crisis known as "Y2K38" threatens computer systems worldwide on January 19, 2038. This timekeeping issue, related to the Unix timet method, will cause a system reset and could affect millions of devices including critical infrastructure. The problem is difficult to fix and requires a global effort, especially because many systems still use vulnerable 32-bit architectures, and it can be exploited to manipulate systems. Bitsight is developing tools to help identify vulnerable systems and accelerate solutions.

The cybercrime industry continues to challenge CISOs in 2026

www.csoonline.com · 6 months ago

Cybercriminals have industrialized into structured, ROI driven organizations that use specialization and as a service models to scale attacks and lower barriers to entry. AI and automation are amplifying reconnaissance, personalized phishing and deepfakes, rapid malware and ransomware variant generation, and even automated extortion, while human expertise remains central for complex intrusions. Defenses must move beyond commodity detection to proactive prevention and hardening, with a focus on identity hygiene, zero trust, rapid containment, supply chain controls and defensive automation. Many organizations remain under resourced or distracted by hype, forcing CISOs to seek trusted partners, cyber insurance and board level support to build continuous, governance driven resilience.

CISA confirms active exploitation of four enterprise software bugs

www.bleepingcomputer.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency has confirmed that hackers are actively exploiting four software vulnerabilities. These vulnerabilities include CVE-2025-31125, a Versa improper access control issue; CVE-2025-34026, a critical authentication bypass in Versa Concerto; CVE-2025-54313, a supply chain compromise affecting eslint-config-prettier; and CVE-2025-68645, a Zimbra local file inclusion vulnerability. Federal agencies are now required to address these issues or cease using the affected products by February 12, 2026. Details regarding the exploitation activity have not been released.

4 things parents should know about screen time

www.washingtonpost.com · 6 months ago

false

Healthy Security Cultures Want People to Report Risks

www.darkreading.com · 6 months ago

false

US to deport Venezuelans who emptied bank ATMs using malware

www.bleepingcomputer.com · 6 months ago

Two Venezuelan nationals, Luz Granados and Johan Gonzalez-Jimenez, have been convicted of stealing hundreds of thousands of dollars from U.S. banks through an ATM jackpotting scheme and will be deported after serving their sentences. The criminals connected laptops to ATMs to install Ploutus malware, bypassing security protocols to force the machines to dispense all available cash. This operation targeted banks in South Carolina, Georgia, North Carolina, and Virginia, and the investigation has led to indictments of 54 individuals in Nebraska. Additional Venezuelan nationals are also facing deportation for their involvement in similar ATM thefts.

Hackers exploit critical telnetd auth bypass flaw to get root

www.bleepingcomputer.com · 6 months ago

A critical vulnerability, tracked as CVE-2026-24061, has been discovered in the GNU InetUtils telnetd server, allowing attackers to bypass authentication and gain root access. The flaw, present since 2015 and patched in version 2.8, occurs because of improper handling of environment variables. Attackers are exploiting this vulnerability to target vulnerable systems, with activity observed between January 21 and 22 originating from 18 unique IP addresses. While exposure to public internet is limited, affected systems should be patched or hardened.

CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities

thehackernews.com · 6 months ago

The U.S. Cybersecurity and Infrastructure Security Agency has added four vulnerabilities to its catalog of actively exploited software. These include a remote file inclusion flaw in Synacor Zimbra Collaboration Suite, an authentication bypass in Versa Concerto, an access control issue in Vite Vitejs, and a supply chain attack targeting eslint-config-prettier and related npm packages. The supply chain attack, CVE-2025-54313, involved a phishing campaign to steal credentials and distribute malicious code. Exploitation of the Zimbra Collaboration Suite vulnerability, CVE-2025-68645, has been observed since January 2026.

What an AI-Written Honeypot Taught Us About Trusting Machines

www.bleepingcomputer.com · 6 months ago

A security team used AI to draft code for a honeypot and later discovered a vulnerability where client-supplied IP headers were treated as legitimate visitor IPs, allowing attackers to inject payloads. Static analysis tools like Semgrep and Gosec failed to detect the flaw, which highlights the limitations of automated security checks when dealing with AI-generated code. Similar issues arose when using AI to generate AWS IAM roles, requiring multiple iterations and human intervention to achieve a secure configuration. Organizations should review code review processes and enhance detection capabilities to address this growing class of AI-introduced vulnerabilities.

Okta Uncovers Custom Phishing Kits Built for Vishing Callers

www.techrepublic.com · 6 months ago

Cybercriminals are increasingly using custom-built phishing kits to enhance voice-based social engineering attacks, often referred to as vishing. These kits allow attackers to intercept user credentials and synchronize phishing pages with live phone conversations, effectively bypassing multi-factor authentication. Attackers gather information about targets, deploy customized phishing pages, and persuade users to enter credentials, which are then relayed to the attacker. Experts recommend implementing phishing-resistant authentication methods such as Okta FastPass or passkeys, and restricting access from anonymizing services.

Cyberattack disrupts digital systems at renowned Dresden museum network

therecord.media · 6 months ago

A cyberattack has disrupted digital systems at the Dresden State Art Collections in Germany, impacting online ticket sales, visitor services, and payment processing. The museums remain open, and security systems protecting the collections are intact. Officials have not yet determined the attackers or their motives, and it is unclear if a ransom was demanded. This incident is part of a growing trend of cyberattacks targeting cultural institutions globally.

Organized Traffer Gang on the Rise Targeting Web3 Employees and Crypto Holders

hybrid-analysis.blogspot.com · 6 months ago

A sophisticated organized traffer gang is targeting Web3 employees and cryptocurrency holders by distributing malware through fake Electron applications disguised as legitimate tools. The operation uses more than eighty domains, abused code signing certificates and elaborate social engineering that creates fake companies and social media accounts to lure high value victims. Malware features include extensive system profiling, anti analysis and anti virtual machine checks, AES 256 decryption of downloaded payloads, token based execution and cross platform delivery that often leads to second stage stealers such as Rhadamanthys, Lumma and Amos and Atomic stealers. Russian language code comments and shared infrastructure patterns suggest links to traffer groups such as Marko Polo, CrazyEvil and Wagmi, and the campaign has yielded at least two point four million dollars in cryptocurrency theft.

Fortinet Confirms FortiCloud SSO Exploitation Against Patched Devices

www.securityweek.com · 6 months ago

Fortinet has confirmed that attackers are successfully bypassing single sign-on authentication on patched devices. Hackers are using automation to make configuration changes to firewalls, including adding users and enabling VPN access. This exploitation resembles previous attacks targeting CVE-2025-59718 and CVE-2025-59719, which affect FortiOS, FortiWeb, FortiProxy, and FortiSwitch Manager devices. Fortinet advises organizations to restrict internet access to administrative ports and consider disabling the FortiCloud SSO feature as a temporary measure.

Ransomware-Attacke auf Verkehrsgesellschaft Main-Tauber

www.csoonline.com · 6 months ago

A cyberattack has disrupted operations at the Verkehrsgesellschaft Main-Tauber, a public transportation company. The attack involved the encryption of the company’s servers and data, leading to the closure of its business office and mobility center. Whether data was stolen is currently unknown, and investigations are ongoing with the involvement of cybersecurity agencies and law enforcement. Fortunately, the public transportation system itself remains operational, and the attack did not impact the county administration due to a separate IT network.

In Other News: €1.2B GDPR Fines, Net-NTLMv1 Rainbow Tables, Rockwell Security Notice

www.securityweek.com · 6 months ago

European authorities issued over €1.2 billion in GDPR fines in 2025, with Ireland responsible for the majority of penalties since 2018. Security researchers released Net-NTLMv1 rainbow tables, demonstrating the ease of password recovery using standard hardware. Interpol has issued a Red Notice for the leader of the Black Basta ransomware gang, Oleg Evgenievich Nefedov. Additionally, researchers found vulnerabilities in Cloudflare's WAF and exposed cloud training applications, while scammers abused the Canonical Snap Store for malware delivery. Rockwell Automation has issued a security notice for DoS vulnerabilities in ControlLogix Redundancy Modules.