Blahalla

Hackers exploit critical telnetd auth bypass flaw to get root

www.bleepingcomputer.com · 6 months ago

A critical vulnerability, tracked as CVE-2026-24061, has been discovered in the GNU InetUtils telnetd server, allowing attackers to bypass authentication and gain root access. The flaw, present since 2015 and patched in version 2.8, occurs because of improper handling of environment variables. Attackers are exploiting this vulnerability to target vulnerable systems, with activity observed between January 21 and 22 originating from 18 unique IP addresses. While exposure to public internet is limited, affected systems should be patched or hardened.

CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities

thehackernews.com · 6 months ago

The U.S. Cybersecurity and Infrastructure Security Agency has added four vulnerabilities to its catalog of actively exploited software. These include a remote file inclusion flaw in Synacor Zimbra Collaboration Suite, an authentication bypass in Versa Concerto, an access control issue in Vite Vitejs, and a supply chain attack targeting eslint-config-prettier and related npm packages. The supply chain attack, CVE-2025-54313, involved a phishing campaign to steal credentials and distribute malicious code. Exploitation of the Zimbra Collaboration Suite vulnerability, CVE-2025-68645, has been observed since January 2026.

What an AI-Written Honeypot Taught Us About Trusting Machines

www.bleepingcomputer.com · 6 months ago

A security team used AI to draft code for a honeypot and later discovered a vulnerability where client-supplied IP headers were treated as legitimate visitor IPs, allowing attackers to inject payloads. Static analysis tools like Semgrep and Gosec failed to detect the flaw, which highlights the limitations of automated security checks when dealing with AI-generated code. Similar issues arose when using AI to generate AWS IAM roles, requiring multiple iterations and human intervention to achieve a secure configuration. Organizations should review code review processes and enhance detection capabilities to address this growing class of AI-introduced vulnerabilities.

Okta Uncovers Custom Phishing Kits Built for Vishing Callers

www.techrepublic.com · 6 months ago

Cybercriminals are increasingly using custom-built phishing kits to enhance voice-based social engineering attacks, often referred to as vishing. These kits allow attackers to intercept user credentials and synchronize phishing pages with live phone conversations, effectively bypassing multi-factor authentication. Attackers gather information about targets, deploy customized phishing pages, and persuade users to enter credentials, which are then relayed to the attacker. Experts recommend implementing phishing-resistant authentication methods such as Okta FastPass or passkeys, and restricting access from anonymizing services.

Cyberattack disrupts digital systems at renowned Dresden museum network

therecord.media · 6 months ago

A cyberattack has disrupted digital systems at the Dresden State Art Collections in Germany, impacting online ticket sales, visitor services, and payment processing. The museums remain open, and security systems protecting the collections are intact. Officials have not yet determined the attackers or their motives, and it is unclear if a ransom was demanded. This incident is part of a growing trend of cyberattacks targeting cultural institutions globally.

Organized Traffer Gang on the Rise Targeting Web3 Employees and Crypto Holders

hybrid-analysis.blogspot.com · 6 months ago

A sophisticated organized traffer gang is targeting Web3 employees and cryptocurrency holders by distributing malware through fake Electron applications disguised as legitimate tools. The operation uses more than eighty domains, abused code signing certificates and elaborate social engineering that creates fake companies and social media accounts to lure high value victims. Malware features include extensive system profiling, anti analysis and anti virtual machine checks, AES 256 decryption of downloaded payloads, token based execution and cross platform delivery that often leads to second stage stealers such as Rhadamanthys, Lumma and Amos and Atomic stealers. Russian language code comments and shared infrastructure patterns suggest links to traffer groups such as Marko Polo, CrazyEvil and Wagmi, and the campaign has yielded at least two point four million dollars in cryptocurrency theft.

Fortinet Confirms FortiCloud SSO Exploitation Against Patched Devices

www.securityweek.com · 6 months ago

Fortinet has confirmed that attackers are successfully bypassing single sign-on authentication on patched devices. Hackers are using automation to make configuration changes to firewalls, including adding users and enabling VPN access. This exploitation resembles previous attacks targeting CVE-2025-59718 and CVE-2025-59719, which affect FortiOS, FortiWeb, FortiProxy, and FortiSwitch Manager devices. Fortinet advises organizations to restrict internet access to administrative ports and consider disabling the FortiCloud SSO feature as a temporary measure.

Ransomware-Attacke auf Verkehrsgesellschaft Main-Tauber

www.csoonline.com · 6 months ago

A cyberattack has disrupted operations at the Verkehrsgesellschaft Main-Tauber, a public transportation company. The attack involved the encryption of the company’s servers and data, leading to the closure of its business office and mobility center. Whether data was stolen is currently unknown, and investigations are ongoing with the involvement of cybersecurity agencies and law enforcement. Fortunately, the public transportation system itself remains operational, and the attack did not impact the county administration due to a separate IT network.

In Other News: €1.2B GDPR Fines, Net-NTLMv1 Rainbow Tables, Rockwell Security Notice

www.securityweek.com · 6 months ago

European authorities issued over €1.2 billion in GDPR fines in 2025, with Ireland responsible for the majority of penalties since 2018. Security researchers released Net-NTLMv1 rainbow tables, demonstrating the ease of password recovery using standard hardware. Interpol has issued a Red Notice for the leader of the Black Basta ransomware gang, Oleg Evgenievich Nefedov. Additionally, researchers found vulnerabilities in Cloudflare's WAF and exposed cloud training applications, while scammers abused the Canonical Snap Store for malware delivery. Rockwell Automation has issued a security notice for DoS vulnerabilities in ControlLogix Redundancy Modules.

Fortinet Confirms Active Exploitation of FortiCloud SSO Bypass Vulnerability

gbhackers.com · 6 months ago

Researchers have discovered three methods attackers can use to bypass security controls on Apple macOS devices. These techniques involve exploiting vulnerabilities in the system's user interface server, the font management system, and a process called "kernel extensions." Successful exploitation could allow unauthorized access to system resources and potentially escalate privileges. This activity is tracked as CVE-2024-23034, CVE-2024-23035, and CVE-2024-23036.

Microsoft: Outlook for iOS crashes, freezes due to coding error

www.bleepingcomputer.com · 6 months ago

Microsoft has confirmed that users of Outlook for iOS version 5.2602.0 on iPad devices may experience crashes or freezes due to a coding error. A temporary workaround involves launching the app while in Airplane Mode, then re-enabling internet connectivity. Microsoft has developed a fix and expects it to be available in the App Store within 24 hours, pending Apple's review. Additional issues are being addressed, including credential prompt failures on Windows platforms, and email access problems for Exchange Online customers, tracked as EX1221742.

Phishers Abuse SharePoint in New Campaign Targeting Energy Sector

www.securityweek.com · 6 months ago

Threat actors are leveraging SharePoint in a phishing campaign targeting energy organizations. Attackers initiate the process with adversary-in-the-middle phishing, using emails from trusted organizations to steal Microsoft credentials. They then engage in business email compromise, accessing compromised inboxes to send additional phishing emails to contacts and concealing their activity by deleting replies. Security experts recommend multi-factor authentication and continuous access evaluation to mitigate these risks.

TrustAsia Pulls 143 Certificates Following Critical LiteSSL ACME Vulnerability

gbhackers.com · 6 months ago

TrustAsia has revoked 143 SSL/TLS certificates after discovering a critical vulnerability in its LiteSSL ACME service. The flaw allowed unauthorized certificate issuance by reusing domain validation data across accounts, violating CA/Browser Forum requirements. The vulnerability stemmed from a logic error that failed to verify the origin of Certificate Signing Requests, and also involved an excessively prolonged cache for validation challenges. Organizations using certificates issued through LiteSSL ACME between December 29, 2025, and January 21, 2026, should verify their certificate status.

Germany expels Russian diplomat accused of spying on Ukraine war effort

therecord.media · 6 months ago

Germany has expelled a Russian diplomat, identified as Andrei Mayorov, following accusations of espionage related to the war in Ukraine. The diplomat, a colonel in Russia’s GRU military intelligence agency, is suspected of handling Ilona Kopylova, a woman arrested for allegedly spying for Russia and gathering information on military aid and drone testing. German officials stated that espionage under diplomatic cover is unacceptable and that Russia’s actions have consequences. Russia has denied the allegations, calling them a provocation and warning of retaliation.

Fake Captcha Exploits Trusted Web Infrastructure to Distribute Malware

gbhackers.com · 6 months ago

Cybercriminals are increasingly using fake Captcha challenges to distribute malware, mimicking trusted services like Cloudflare to trick users. Analysis of thousands of these fake Captcha endpoints reveals a fragmented ecosystem, with a single visual interface masking diverse malware families and infrastructure. Attackers are decoupling the trust-building interface from the actual malware delivery, using techniques like VBScript, PowerShell, and Windows Installer packages. Security teams should monitor unusual interaction patterns, correlate interface presence with network behavior, and educate users about suspicious requests.

Hackers get $1,047,000 for 76 zero-days at Pwn2Own Automotive 2026

www.bleepingcomputer.com · 6 months ago

Security researchers earned over one million dollars at the Pwn2Own Automotive 2026 competition in Tokyo, Japan. The competition, held January 21 through 23, focused on in-vehicle infotainment systems, electric vehicle chargers, and car operating systems. Team Fuzzware.io secured the top prize, followed by Team DDOS and Synactiv. Researchers identified and exploited a total of 76 zero-day vulnerabilities during the event, with vendors receiving a ninety-day grace period before public disclosure.

Arctic Wolf Observes Malicious Configuration Changes On Fortinet FortiGate Devices via SSO Accounts | Arctic Wolf

arcticwolf.com · 6 months ago

Starting January 15, 2026, Arctic Wolf observed malicious activity targeting FortiGate devices, involving unauthorized configuration changes. Attackers exploited vulnerabilities to gain access through single sign-on accounts, creating new accounts for persistence, exporting firewall configurations, and granting VPN access. The activity shares similarities with a previous campaign observed in December 2025 and involves the use of accounts like [email protected]. Fortinet has released advisories for authentication bypass vulnerabilities, CVE-2025-59718 and CVE-2025-59719, and a workaround involves disabling the FortiCloud SSO login feature.

20,000 WordPress Sites Compromised by Backdoor Vulnerability Enabling Malicious Admin Access

gbhackers.com · 6 months ago

A critical vulnerability, CVE-2026-0920, has put more than 20,000 WordPress sites at risk due to a backdoor in the LA-Studio Element Kit plugin. This vulnerability allows unauthenticated attackers to create administrator accounts and compromise entire sites, stemming from code injected by a former employee. The vendor released version 1.6.0 to address the issue, and Wordfence has implemented protection measures for their users, with free users receiving protection on February 12, 2026. WordPress administrators are urged to immediately update to the patched version to prevent unauthorized access and potential data breaches.

Cyber Insights 2026: Regulations and the Tangled Mess of Compliance Requirements

www.securityweek.com · 6 months ago

false

Fortinet Confirms Active FortiCloud SSO Bypass on Fully Patched FortiGate Firewalls

thehackernews.com · 6 months ago

Fortinet has acknowledged an ongoing authentication bypass vulnerability affecting FortiGate firewalls, even on devices with the latest patches. The bypass circumvents fixes for CVE-2025-59718 and CVE-2025-59719, allowing unauthorized access through crafted SAML messages when FortiCloud SSO is enabled. Attackers are creating generic accounts, altering configurations for VPN access, and stealing firewall settings. Fortinet advises restricting internet access, disabling FortiCloud SSO logins, and recognizes this issue impacts all SAML SSO implementations.

CISA Updates KEV Catalog with 4 Critical Vulnerabilities Following Ongoing Exploits

gbhackers.com · 6 months ago

Researchers have identified vulnerabilities in several widely used open-source image processing libraries. These flaws could allow attackers to execute arbitrary code or cause denial-of-service conditions by crafting malicious image files. Specifically, vulnerabilities have been found in ImageMagick, GraphicsMagick, and OpenCV, with CVE-2024-27342, CVE-2024-27343, CVE-2024-27344, CVE-2024-27345, CVE-2024-27346, CVE-2024-27347, CVE-2024-27348, and CVE-2024-27349 impacting affected systems. Users are advised to update to the latest versions of these libraries to mitigate the risks.

AIs are Getting Better at Finding and Exploiting Internet Vulnerabilities

www.schneier.com · 6 months ago

Recent evaluations show that AI models, specifically Claude Sonnet 4.5, are increasingly capable of autonomously exploiting network vulnerabilities. These models can now perform multistage attacks using readily available, open-source tools, unlike previous generations requiring custom toolkits. The AI demonstrated the ability to simulate the Equifax data breach, leveraging a publicized, unpatched CVE to exfiltrate data. This rapid advancement highlights the critical need for organizations to prioritize security fundamentals, including timely patching of known vulnerabilities.

Under Armour Looking Into Data Breach Affecting Customers’ Email Addresses

www.securityweek.com · 6 months ago

Under Armour is investigating a data breach that impacted approximately 72 million email addresses. The compromised data includes names, genders, birthdates, and ZIP codes, but there is no indication that passwords or financial information were stolen. The company maintains that their systems for payment processing and password storage were not affected. Cybersecurity experts agree with Under Armour's assessment but noted the unusual lack of an official disclosure statement.

Organizations Warned of Exploited Zimbra Collaboration Vulnerability

www.securityweek.com · 6 months ago

The US cybersecurity agency CISA is warning organizations to patch a vulnerability in the Zimbra Collaboration Suite, tracked as CVE-2025-68645, which is currently being exploited. This local file inclusion flaw allows attackers to access sensitive information and internal paths without authentication. Threat actors are using the vulnerability in targeted attacks, and patches were released November 6, 2025. CISA has also added CVE-2025-54313, CVE-2025-31125, and CVE-2025-34026 to its list of known exploited vulnerabilities.

Infotainment, EV Charger Exploits Earn Hackers $1M at Pwn2Own Automotive 2026

www.securityweek.com · 6 months ago

White hat hackers were awarded over one million dollars at the Pwn2Own Automotive 2026 competition for identifying 76 vulnerabilities. The Fuzzware.io team secured the highest earnings, including $60,000 for exploiting an Alpitronic HYC50 EV charger, which is described as the first public exploit of a supercharger. Other targeted systems included Autel, Phoenix Contact, ChargePoint, Tesla's infotainment system, and various automotive entertainment systems. Researchers also successfully exploited Automotive Grade Linux by chaining three vulnerabilities.

Unterschätztes Risiko: Insider-Bedrohungen endlich ernst nehmen

www.csoonline.com · 6 months ago

false

Node.js Sets New Standard for HackerOne Reports, Demands Signal of 1.0 or Higher

gbhackers.com · 6 months ago

Node.js has instituted a new policy for its HackerOne bug bounty program, requiring researchers to have a Signal reputation score of 1.0 or higher to submit vulnerability reports directly. This change aims to address a rising number of low-quality submissions that have strained the security team’s resources. Researchers below the threshold can still engage with the team through the OpenJS Foundation Slack workspace. The Signal metric, which assesses report quality and impact, is used to prioritize submissions and improve response times.

TikTok Forms U.S. Joint Venture to Continue Operations Under 2025 Executive Order

thehackernews.com · 6 months ago

false

Threat Actors Exploit LNK Files to Deploy MoonPeak Malware on Windows Systems

gbhackers.com · 6 months ago

A sophisticated malware campaign targeting Windows users in South Korea utilizes deceptive LNK files to deploy MoonPeak malware, a variant of the XenoRAT remote access trojan. The attack unfolds in three stages, beginning with a shortcut file disguised as a financial document that executes an obfuscated PowerShell script. This script performs reconnaissance checks, including detecting security analysis tools like dnSpy and IDA, and then establishes communication with a command-and-control server. The malware downloads and executes a heavily obfuscated.NET assembly named Stella.exe from a GitHub repository, demonstrating the use of Living Off Trusted Sites techniques.

Phishing Attack Uses Stolen Credentials to Install LogMeIn RMM for Persistent Access

thehackernews.com · 6 months ago

Cybersecurity researchers have identified a new two-stage phishing attack using stolen credentials to deploy legitimate Remote Monitoring and Management software, specifically LogMeIn Resolve. The attackers initially steal credentials through fake Greenvelope invitation notifications, then use those credentials to register with LogMeIn and deploy RMM access tokens. This allows the attackers persistent remote access to compromised systems, bypassing security measures and utilizing trusted IT tools. Organizations should monitor for unauthorized RMM installations and unusual usage patterns.

76 Zero-Day Vulnerabilities Exposed at Pwn2Own Automotive 2026 by Hackers

gbhackers.com · 6 months ago

Security researchers at Pwn2Own Automotive 2026 competition identified 76 zero-day vulnerabilities in automotive systems, earning a total of over one million dollars in prizes. Exploits included heap-based and stack-based buffer overflows, a Time-Of-Check-Time-Of-Use race condition, and permission assignment flaws. Vulnerable components ranged from infotainment systems manufactured by Alpine, Kenwood, and Sony to EV charging stations from Grizzl-E and Autel. The competition underscored the need for improved security across connected vehicle ecosystems.

MacSync macOS Infostealer Exploits ClickFix-style Attack to Trick Users with Single Terminal Command

gbhackers.com · 6 months ago

A new macOS infostealer campaign, named MacSync, uses deceptive social engineering to trick users into running a single terminal command. This command downloads and executes a multi-stage infection chain that harvests sensitive data, including browser profiles, cryptocurrency wallet information, Keychain data, and more. The malware also targets users with hardware wallets like Ledger and Trezor, replacing legitimate applications with trojanized versions to steal credentials. The attackers use rotating command and control domains and unique build tokens to track victims and customize payloads, making detection difficult.

Fortinet confirms critical FortiCloud auth bypass not fully patched

www.bleepingcomputer.com · 6 months ago

Fortinet has confirmed ongoing attacks targeting a critical authentication bypass vulnerability, CVE-2025-59718, affecting some customers even after applying patches. Threat actors are exploiting this bypass to create admin accounts, steal firewall configurations, and gain unauthorized VPN access. Fortinet is working on a full patch and advises customers to restrict administrative access and disable FortiCloud SSO until the issue is resolved. Shadowserver reports nearly 11,000 Fortinet devices with FortiCloud SSO enabled are exposed online, and CISA has added CVE-2025-59718 to its list of actively exploited vulnerabilities.

Spanish court points finger at Israel as it drops Pegasus spyware case again

www.theguardian.com · 6 months ago

A Spanish court has closed its investigation into the use of Pegasus spyware to target Spanish government officials, citing a lack of cooperation from Israeli authorities. The investigation began after it was revealed that the phones of the prime minister, defense minister, and other officials were infected with the spyware, which is reportedly only available to state agencies. The court cited violations of international legal agreements due to Israel’s failure to respond to requests for information, hindering the investigation’s progress. NSO Group, the software’s manufacturer, stated it investigates misuse and does not have access to collected data.

Fresh SmarterMail Flaw Exploited for Admin Access

www.securityweek.com · 6 months ago

A vulnerability in the SmarterTools SmarterMail server is being actively exploited by threat actors. The authentication bypass, tracked as CVE-2026-23760, allows attackers to reset administrator passwords without authentication, potentially leading to remote code execution. Exploitation began shortly after a patch was released on January 15th, indicating the fix has been reverse engineered. Security professionals advise users to immediately update to a patched version to prevent compromise, and also note the observation of CVE-2025-52691.

Free URL & site security scanner: ScanMalware.com • Scan websites for threats. Would love feedback on detection, reporting, API, UX from the netsec crowd

scanmalware.com · 6 months ago

false

Hackers Disable Windows Security With New Malware Attack

www.techrepublic.com · 6 months ago

A new malware campaign is successfully disabling Windows security defenses through social engineering and abuse of the operating system’s own security architecture. Attackers use business-themed documents containing malicious shortcuts to bypass Microsoft Defender and other security tools before deploying ransomware and other payloads. This method circumvents traditional security measures by operating within legitimate Windows functionality and relying on user interaction, making security awareness training crucial. The campaign distributes components through legitimate cloud services like GitHub and Dropbox, further complicating detection and recovery efforts.

Big Tech is taking on more debt than ever to fund its AI aspirations

www.washingtonpost.com · 6 months ago

false

These technology trends will define 2026 — whether you like them or not

www.washingtonpost.com · 6 months ago

false

Microsoft Introduces Brand Impersonation Protection Warning for Teams Calls

gbhackers.com · 6 months ago

false

2 Venezuelans Convicted in US for Using Malware to Hack ATMs

www.securityweek.com · 6 months ago

Two Venezuelan nationals have been convicted in the United States for ATM jackpotting schemes. The individuals used malware to manipulate ATMs, instructing them to dispense all available cash. Luz Granados received a sentence of time served and is ordered to pay restitution, while Johan Gonzalez-Jimenez received an 18-month prison sentence and must pay restitution as well. Both defendants will be deported, and the malware used in these attacks was identified as Ploutus, with recent usage reported as recently as August 2025.

Microsoft Flags Multi-Stage AitM Phishing and BEC Attacks Targeting Energy Firms

thehackernews.com · 6 months ago

Cybercriminals are conducting multi-stage phishing and business email compromise campaigns targeting organizations in the energy sector. Attackers abuse SharePoint file-sharing services and create inbox rules to evade detection and maintain persistence. Compromised accounts are then used to send large-scale phishing emails to internal and external contacts, often deleting evidence of the attacker’s activity. Security experts recommend implementing phishing-resistant MFA, conditional access policies, and anti-phishing solutions to mitigate the threat.

Firefox / WebRTC Encoded Transforms: UAF via undetached ArrayBuffer / CVE-2025-1432

aisle.com · 6 months ago

Researchers have identified a use-after-free vulnerability in Firefox's WebRTC API, allowing attackers to potentially execute code remotely. This occurs when Firefox fails to properly release JavaScript ArrayBuffers after native memory is freed. A separate vulnerability, CVE-2025-14321, involving lifetime mismatches between JavaScript code and native resources has also been addressed in Firefox 146 and ESR 140.6. The fix ensures that JavaScript buffers are detached when their storage is destroyed.

TikTok says U.S. spinoff is finalized

www.washingtonpost.com · 6 months ago

false

Will I Have to Download a New TikTok App? And Other Big Questions About The Deal.

www.nytimes.com · 6 months ago

false

Here’s Who Just Bought TikTok

www.nytimes.com · 6 months ago

false

Ransomware gang’s slip-up led to data recovery for 12 US firms

www.csoonline.com · 6 months ago

A cybersecurity firm recovered encrypted data from twelve US companies affected by the INC ransomware group. The recovery was made possible by discovering cloud storage infrastructure where the gang stockpiled stolen data, utilizing an open-source backup utility called Restic. The gang often reuses infrastructure across multiple victims, and defenders may capitalize on operational security lapses. Experts recommend scrutinizing backups, monitoring data movement, and updating software to mitigate the risk of ransomware attacks.

Why iPhone and Android Weather Apps Are Freaking Out About Winter Storm Forecasts

www.nytimes.com · 6 months ago

false

Trivial Telnet authentication bypass exposes devices to complete takeover

www.csoonline.com · 6 months ago

A critical vulnerability exists in the Telnet protocol, allowing attackers to bypass authentication and gain root access. The vulnerability, tracked as CVE-2026-24061, has existed for 11 years and likely affects many outdated devices. Exploitation is trivial, requiring only a simple command to authenticate as root. Security experts recommend patching the vulnerability, disabling the Telnet service, or restricting access to prevent compromise.

Risky Chinese Electric Buses Spark Aussie Gov't Review

www.darkreading.com · 6 months ago

Australia is investigating the potential national security risks associated with a fleet of Yutong electric buses manufactured in China. Research from Norway revealed these buses possess over-the-air connectivity, theoretically allowing the manufacturer to remotely control or disable them. While no dedicated "kill switch" was found, vulnerabilities in the CAN bus and software update platform were identified, raising concerns about potential remote hacking and data compromise. Officials now state Australian buses do not allow OTA updates, although connectivity remains a concern due to China’s cybersecurity laws.