Blahalla

Will I Have to Download a New TikTok App? And Other Big Questions About The Deal.

www.nytimes.com · 6 months ago

false

www.nytimes.com · 6 months ago

false

Ransomware gang’s slip-up led to data recovery for 12 US firms

www.csoonline.com · 6 months ago

A cybersecurity firm recovered encrypted data from twelve US companies affected by the INC ransomware group. The recovery was made possible by discovering cloud storage infrastructure where the gang stockpiled stolen data, utilizing an open-source backup utility called Restic. The gang often reuses infrastructure across multiple victims, and defenders may capitalize on operational security lapses. Experts recommend scrutinizing backups, monitoring data movement, and updating software to mitigate the risk of ransomware attacks.

Why iPhone and Android Weather Apps Are Freaking Out About Winter Storm Forecasts

www.nytimes.com · 6 months ago

false

Trivial Telnet authentication bypass exposes devices to complete takeover

www.csoonline.com · 6 months ago

A critical vulnerability exists in the Telnet protocol, allowing attackers to bypass authentication and gain root access. The vulnerability, tracked as CVE-2026-24061, has existed for 11 years and likely affects many outdated devices. Exploitation is trivial, requiring only a simple command to authenticate as root. Security experts recommend patching the vulnerability, disabling the Telnet service, or restricting access to prevent compromise.

Risky Chinese Electric Buses Spark Aussie Gov't Review

www.darkreading.com · 6 months ago

Australia is investigating the potential national security risks associated with a fleet of Yutong electric buses manufactured in China. Research from Norway revealed these buses possess over-the-air connectivity, theoretically allowing the manufacturer to remotely control or disable them. While no dedicated "kill switch" was found, vulnerabilities in the CAN bus and software update platform were identified, raising concerns about potential remote hacking and data compromise. Officials now state Australian buses do not allow OTA updates, although connectivity remains a concern due to China’s cybersecurity laws.

Ireland plans law allowing law enforcement to use spyware

therecord.media · 6 months ago

Ireland is preparing legislation to authorize law enforcement use of spyware and electronic scanning equipment. The proposed law aims to strengthen lawful interception powers and address serious crime and security threats. Court authorization will be required for interception requests, and the law intends to include safeguards ensuring necessity and proportionality. Justice Minister Jim O’Callaghan considers the legislation long overdue.

White House shares doctored image portraying arrested church protester in tears

www.washingtonpost.com · 6 months ago

The White House shared a manipulated image on X, formerly Twitter, depicting an attorney who was arrested during a church protest. The photo was edited to portray the attorney as crying. The post has garnered significant attention, with over 2.5 million views. The altered image has raised questions regarding the administration's handling and presentation of factual events.

Okta SSO accounts targeted in vishing-based data theft attacks

www.bleepingcomputer.com · 6 months ago

Cybercriminals are using sophisticated voice phishing kits to steal Okta Single Sign-On credentials. These kits allow attackers to manipulate authentication flows in real-time during voice calls, even bypassing multi-factor authentication. The attackers impersonate IT staff, tricking employees into entering their credentials and TOTP codes on fake sites, then use those to access connected platforms like Microsoft 365, Google Workspace, and Salesforce. Companies in the financial and advisory sectors are being targeted, and some attacks are linked to the extortion group ShinyHunters. Okta recommends using phishing-resistant MFA methods like security keys or passkeys to mitigate the risk.

Fortinet Firewalls Hit With Malicious Configuration Changes

www.darkreading.com · 6 months ago

Threat actors have been exploiting Fortinet firewalls through single sign-on logins, resulting in unauthorized configuration changes and data exfiltration. Attackers created generic accounts with VPN access and stole firewall configurations, potentially through automated means. This activity appears to be related to previously disclosed vulnerabilities, CVE-2025-59718 and CVE-2025-59719, though it’s unclear if patches fully mitigated the risk. Affected customers are advised to restrict access to management interfaces and reset firewall credentials. Fortinet has not yet commented on the situation.

Halo Security Achieves SOC 2 Type II Compliance, Demonstrating Sustained Security Excellence Over Time

gbhackers.com · 6 months ago

false

Curl ending bug bounty program after flood of AI slop reports

www.bleepingcomputer.com · 6 months ago

The curl project is ending its HackerOne bug bounty program due to a surge of low-quality, often AI-generated vulnerability reports. Curl's founder, Daniel Stenberg, says the influx of these reports is overwhelming the small security team and impacting their ability to maintain the project. Researchers will need to submit security concerns directly through GitHub starting February 1, 2026. The move aims to reduce noise and protect the mental health of curl developers.

Spanish judge closes NSO Group spyware probe due to lack of cooperation from Israel

therecord.media · 6 months ago

A Spanish High Court probe into the alleged use of Pegasus spyware has been closed due to Israel's lack of cooperation. The investigation, which began in 2022, focused on the hacking of devices belonging to Prime Minister Pedro Sánchez and Defence Minister Margarita Robles, among others. Spanish officials reported the spyware, manufactured by Israel’s NSO Group, jeopardized the security of the Spanish State. Israel has reportedly ignored multiple requests for assistance, prompting the judge to cite a breach of international obligations.

SmarterMail auth bypass flaw now exploited to hijack admin accounts

www.bleepingcomputer.com · 6 months ago

Hackers are actively exploiting a vulnerability in SmarterMail, an email server and collaboration platform, to reset administrator passwords and gain full control of accounts. The flaw exists in an API endpoint that lacks authentication, allowing attackers to manipulate a setting and bypass security checks. Researchers discovered the issue and released a fix on January 15, but exploitation began just two days later, suggesting attackers reverse-engineered the patch. This vulnerability, which does not have a CVE identifier, allows for remote code execution and affects only administrator-level accounts. Users are advised to update to build 9511 to address this and a related pre-authentication remote code execution vulnerability tracked as CVE-2025-52691.

From a Whisper to a Scream: Europe Frets About Overreliance on US Tech

www.darkreading.com · 6 months ago

false

New Osiris Ransomware Emerges as New Strain Using POORTRY Driver in BYOVD Attack

thehackernews.com · 6 months ago

A new ransomware family called Osiris has emerged, targeting a major food service operator in Southeast Asia. The attack used a malicious driver, POORTRY, in a bring your own vulnerable driver, or BYOVD, attack to disable security software and exfiltrated data to a Wasabi cloud storage bucket. Researchers suspect links to the INC ransomware group and observed the use of dual-use tools and Rustdesk. The ransomware employs a hybrid encryption scheme and, notably, a flaw in Obscura ransomware makes files over 1GB unrecoverable. The threat actor exploited CVE-2019-11580.

House of Lords backs legislation to ban social media for children under 16

therecord.media · 6 months ago

false

Microsoft Security success stories: Why integrated security is the foundation of AI transformation

www.microsoft.com · 6 months ago

false

The Drama at Thinking Machines, a New A.I. Start-Up, Is Riveting Silicon Valley

www.nytimes.com · 6 months ago

false

Critical GNU InetUtils telnetd Flaw Lets Attackers Bypass Login and Gain Root Access

thehackernews.com · 6 months ago

A critical vulnerability has been identified in the GNU InetUtils telnet daemon, affecting versions from 1.9.3 through 2.7. The flaw, CVE-2026-24061, allows attackers to bypass authentication and gain root access by manipulating the USER environment variable. This occurs because the telnetd server does not properly sanitize this variable before passing it to the login process. Threat intelligence reports indicate malicious actors have already begun exploiting this vulnerability, with attempts originating from several countries.

The Upside Down is Real: What Stranger Things Teaches Us About Modern Cybersecurity

www.securityweek.com · 6 months ago

false

Microsoft Teams to add brand impersonation warnings to calls

www.bleepingcomputer.com · 6 months ago

Microsoft is introducing a new feature called Brand Impersonation Protection to Teams calls, designed to combat social engineering attacks. This feature, rolling out in February, identifies and warns users about external callers attempting to mimic trusted organizations. The alerts will be enabled by default and may persist during calls if suspicious activity continues. Microsoft is also enhancing Teams security with malicious URL detection and warnings about suspicious external traffic.

INC ransomware opsec fail allowed data recovery for 12 US orgs

www.bleepingcomputer.com · 6 months ago

A digital forensics company called Cyber Centaurs recovered stolen data from a dozen U.S. organizations after identifying an operational security failure by the INC ransomware group. Researchers discovered the gang's infrastructure while investigating a ransomware attack on a Cyber Centaurs client and found evidence of the legitimate backup tool Restic being used to store exfiltrated data. The analysis revealed encrypted data from 12 unrelated organizations in various sectors, which was subsequently decrypted and preserved while law enforcement was notified. INC ransomware is a ransomware-as-a-service operation that has targeted numerous high-profile victims.

CVE-2026-22200: Ticket to Shell in osTicket

horizon3.ai · 6 months ago

A critical vulnerability, CVE-2026-22200, has been identified in the osTicket helpdesk system, allowing unauthenticated attackers to potentially read files and achieve remote code execution. The exploit chain involves injecting malicious code into tickets and leveraging flaws in PDF generation and older library versions. Attackers can exploit the system through self-registration or brute-force attempts, and osTicket versions 1.18.3 and 1.17.7 include a patch. A related glibc vulnerability, CVE-2024-2961, is also recommended for patching.

Latin American Orgs Lack Confidence in Cyber Defenses, Skills

www.darkreading.com · 6 months ago

false

Pwn2Own Automotive 2026: Researchers Score $516,500 For 37 Unique Zero-Days

gbhackers.com · 6 months ago

Security researchers targeted automotive systems during Pwn2Own Automotive 2026, uncovering 37 unique zero-day vulnerabilities and earning over $516,500 in bounties. Exploits included command injections, buffer overflows, and authentication bypasses affecting devices from Alpine, ChargePoint, and Autel. Researchers frequently chained multiple vulnerabilities to achieve root or privileged execution, highlighting critical weaknesses in automotive technology. Several exploits involved CWE-120 buffer overflows and signal manipulation.

Old Attack, New Speed: Researchers Optimize Page Cache Exploits

www.securityweek.com · 6 months ago

Researchers at Graz University of Technology have significantly improved Linux page cache attacks, making them much faster than previously demonstrated. These attacks, which target Linux kernels from 2003 to the present, can now be executed in microseconds rather than milliseconds. Attackers can use these techniques to steal sensitive user data, monitor application activity, and potentially reconstruct passwords through inter-keystroke timing. One vulnerability, CVE-2025-21691, has been addressed, but the attack surface remains largely unmitigated.

Under Armour Ransomware Attack Exposes 72M Email Addresses

www.techrepublic.com · 6 months ago

A cyberattack by the Everest ransomware gang has exposed sensitive information from Under Armour, impacting 72 million customers worldwide. Hackers stole data in November 2025 and recently published customer records, including email addresses, names, dates of birth, and purchase information, on a hacking forum. The Everest group, operating since December 2020, is known for targeting large organizations and selling network access to other criminals. Experts warn of potential follow-up phishing campaigns exploiting the data breach and advise consumers to be wary of suspicious communications and review password hygiene.

Why Active Directory password resets are surging in hybrid work

www.bleepingcomputer.com · 6 months ago

Password resets are significantly increasing for organizations due to the rise of hybrid work environments. Remote employees often experience account lockouts due to outdated cached credentials and increased security policies mandating frequent password changes. The cost of each password reset is estimated at seventy dollars, and organizations are averaging thousands of resets annually, significantly impacting employee productivity and costing businesses substantial sums. Self-service password reset tools offer a solution by allowing employees to reset their own credentials, freeing up IT resources and minimizing downtime.

ThreatsDay Bulletin: Pixel Zero-Click, Redis RCE, China C2s, RAT Ads, Crypto Scams & 15+ Stories

thehackernews.com · 6 months ago

Cybersecurity threats are evolving with attackers prioritizing scale and patience. Spear-phishing attacks targeted government entities, while Russian-aligned groups are launching denial-of-service attacks against UK infrastructure. Criminals are also exploiting trusted services like Zendesk for spam campaigns and using malvertising to deliver remote access trojans. A group known as Larva-25012 is distributing proxyware through fake Notepad++ installers, stealing bandwidth from victims in South Korea.

Microsoft updates Notepad and Paint with more AI features

www.bleepingcomputer.com · 6 months ago

false

Intercepting OkHttp at Runtime With Frida

blog.doyensec.com · 6 months ago

false

DPRK Actors Deploy VS Code Tunnels for Remote Hacking

www.darkreading.com · 6 months ago

North Korean actors are using a spear-phishing campaign to compromise systems by abusing Microsoft Visual Studio Code's tunneling feature. Attackers send government-themed emails with malicious JSE files disguised as documents, which install VS Code and create a tunnel named "bizeugene" to gain remote control. This technique avoids traditional command-and-control infrastructure and blends with developer activity, requiring new detection methods beyond typical malware blocking. This marks the first observed use of this specific tactic by DPRK-linked actors, following previous abuse of VS Code by other groups.

Spanish e-retailer PcComponentes denies report it was hacked

www.csoonline.com · 6 months ago

Spanish e-commerce company PcComponentes is denying claims of a data breach following reports from Hackrisk.io that a hacker known as ‘daghetiaw’ allegedly stole data on 16.3 million people. PcComponentes states that its systems were not directly breached, but instead, a third party used compromised email addresses and passwords obtained from external data leaks, a practice known as credential stuffing. The company confirms some customer data like names, addresses, and ID numbers may have been accessed, but insists bank details and passwords were not compromised due to security measures. PcComponentes has implemented additional security measures to protect customer accounts.

New Osiris Ransomware Leverages Living Off the Land and Dual-Use Tools in Attacks

gbhackers.com · 6 months ago

A new ransomware family called Osiris targeted a foodservice company in Southeast Asia in November 2025. Researchers have linked the attackers to previous Inc ransomware operations, noting similarities in tactics like using Wasabi cloud storage and deploying Mimikatz with a specific filename. The attackers utilized living off the land binaries, a customized remote access tool disguised as WinZip, and the Poortry driver in a bring-your-own-vulnerable-driver attack to disable security software. Osiris employs a hybrid encryption scheme and terminates critical services and processes during its attack.

Critical Vivotek Flaw Enables Remote Arbitrary Code Execution

gbhackers.com · 6 months ago

A critical command injection vulnerability, tracked as CVE-2026-22755, has been discovered in legacy Vivotek IoT camera firmware. Attackers can remotely execute arbitrary code as root without authentication by exploiting unsafe handling of user input in the uploadmap.cgi script. Researchers used artificial intelligence to identify the flaw, which affects dozens of camera models and poses a significant risk for botnet recruitment and data compromise. Affected models include FD8365, FD9165, FE9180, IB9365, and IP9165 among others, and mitigation involves patching firmware and implementing stricter server-side input validation.

NVIDIA CUDA Toolkit Flaw Allows Command Injection, Arbitrary Code Execution

gbhackers.com · 6 months ago

NVIDIA has released an update to address critical vulnerabilities in its CUDA Toolkit, impacting developers and systems using GPU acceleration. The flaws, stemming from insufficient input validation and insecure DLL loading, enable command injection and arbitrary code execution by local attackers with limited privileges. Four CVEs were identified: CVE-2025-33228, CVE-2025-33229, CVE-2025-33230, and CVE-2025-33231, all carrying high to medium severity scores. Users are urged to upgrade to CUDA Toolkit 13.1 to mitigate these risks.

BIND 9 Flaw Lets Attackers Crash Servers With Malicious DNS Records

gbhackers.com · 6 months ago

A critical vulnerability, CVE-2025-13878, has been identified in BIND 9 DNS servers that could lead to denial-of-service attacks. Malformed BRID or HHIT records in DNS queries can trigger the server process to unexpectedly terminate, requiring no authentication for exploitation. The vulnerability impacts specific versions across BIND 9’s stable branches and has a CVSS score of 7.5, indicating a high availability impact. Administrators are urged to update to patched versions immediately, as BIND powers a significant portion of global DNS servers.

Jordan used Cellebrite phone-hacking tools against activists critical of Gaza war, report finds

therecord.media · 6 months ago

A new report indicates Jordanian authorities have been using Cellebrite digital forensic software to extract data from the phones of at least seven activists critical of the Gaza war, spanning from late 2023 to mid-2025. Cellebrite, an Israeli company, is known for its ability to bypass phone security and encryption to access data like messages, photos, and location history. The software has also been reportedly abused by governments in Serbia, Russia, and other nations. Cellebrite maintains it vets customers and requires legal authority for use, but did not deny the findings regarding Jordan.

PNB MetLife Phishing Attack: Multi-Stage Scheme Steals Data, Triggers UPI Payments

gbhackers.com · 6 months ago

A multi-stage phishing campaign is targeting PNB MetLife Insurance customers, using fake payment gateway pages to steal data and trigger fraudulent UPI payments. Attackers leverage free hosting services like EdgeOne Pages and Telegram bots to quickly deploy and exfiltrate data, often using SMS as the initial infection vector. The scheme involves collecting personal and banking details, manipulating QR codes, and silently copying attacker-controlled UPI IDs to victims' clipboards, escalating from payment fraud to full banking credential harvesting. The attackers use operator accounts on Telegram for real-time monitoring and data receipt.

Hacker legen Websites von Conceptnet-Kunden lahm

www.csoonline.com · 6 months ago

The IT service provider Conceptnet, based in Regensburg, Germany, has experienced a ransomware attack impacting its infrastructure. The attackers gained access around January 13, 2026, encrypting key systems including web and email servers. Several customers, including REWAG, Stadtwerk Regensburg, and SSV Jahn Regensburg, are affected, with temporary websites established to maintain service while restoration efforts continue. Reports suggest artificial intelligence and a ransom demand may have been involved.

Why AI Keeps Falling for Prompt Injection Attacks

www.schneier.com · 6 months ago

Large language models, or LLMs, are vulnerable to prompt injection attacks, which trick them into performing unintended actions by manipulating input phrasing. These attacks exploit the LLMs’ lack of contextual understanding and reliance on text similarity rather than reasoning. Current safeguards are ineffective, and a key challenge lies in replicating human defenses like instincts, social learning, and situational training. AI agents, designed for independent task completion, exacerbate these vulnerabilities due to their overconfidence and flattened context. Ultimately, achieving secure AI agents presents a trilemma where speed, intelligence, and security are difficult to balance.

Hackers exploit 29 zero-days on second day of Pwn2Own Automotive

www.bleepingcomputer.com · 6 months ago

Security researchers have collected over $439,000 during the second day of the Pwn2Own Automotive 2026 competition in Tokyo. Participants targeted electric vehicle chargers, in-vehicle infotainment systems, and car operating systems, successfully exploiting 29 zero-day vulnerabilities. Fuzzware.io currently leads the competition, earning $213,000 after two days, and researchers have collectively earned over $955,000 after exploiting 66 zero-days across the event. Vendors are given 90 days to resolve discovered vulnerabilities before public disclosure.

Hackers Exploit Snap Domains to Inject Malicious Code into Linux Software Packages

gbhackers.com · 6 months ago

Cybercriminals are exploiting a weakness in the Snap Store by taking over accounts of developers whose domain registrations have expired. Attackers use these compromised accounts to publish malicious snap packages containing cryptocurrency wallet stealers, bypassing trust signals users rely on. The attackers, believed to be operating from or near Croatia, are employing increasingly sophisticated obfuscation techniques, including visual homoglyph attacks and bait-and-switch methods. Security experts recommend publishers maintain active domain registrations and enable two-factor authentication while users should download cryptocurrency wallet applications directly from official project websites.

Actively exploited Cisco UC bug requires immediate, version‑specific patching

www.csoonline.com · 6 months ago

A critical remote code execution vulnerability, CVE-2026-20045, is actively being exploited in Cisco unified communications products. Attackers can gain root-level access to affected systems without user interaction by sending crafted HTTP requests. Cisco has released version-specific patches for most affected products, but will not provide patches for version 12.5, recommending migration to a supported release. The Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within two weeks.

New Wave of Attacks Targeting FortiGate Firewalls

www.securityweek.com · 6 months ago

Security researchers have observed a new wave of attacks targeting FortiGate firewalls, mirroring a previous campaign exploiting CVE-2025-59718 and CVE-2025-59719. These attacks involve automated creation of user accounts, modification of VPN access, and data exfiltration. The malicious activity originates from a limited number of hosting providers and focuses on the [email protected] account. It is currently unclear if the recent attacks are fully mitigated by existing patches, and users are advised to disable the FortiCloud login feature.

JA3 Fingerprinting Tool Exposes Attackers’ Infrastructure

gbhackers.com · 6 months ago

JA3 fingerprinting, which analyzes TLS ClientHello parameters, is regaining prominence as a valuable tool for identifying and tracking malicious infrastructure. This technique creates a persistent profile of tools, making it more resilient than traditional indicators like IP addresses. Security teams can use JA3 to track emerging threats, cluster attacker infrastructure, and expand investigations by pivoting from a single hash to related network activity, such as data exfiltration via Telegram, Discord, and GoFile. Specific JA3 hashes linked to Remcos RAT, WannaCry, and Skuld malware have been identified, demonstrating the technique’s practical application.

Cisco Unified CM Zero-Day RCE Under Attack, CISA Issues Warning

gbhackers.com · 6 months ago

CISA has issued a warning and added CVE-2026-20045 to its Known Exploited Vulnerabilities catalog due to a critical zero-day remote code execution vulnerability in Cisco Unified Communications Manager and related products. Attackers are exploiting improper input handling to inject code, gain user-level access, and escalate privileges to root, with active exploitation already observed. Organizations are urged to patch affected systems by February 11, 2026, or implement mitigation strategies such as restricting access and disabling unused services. Cisco recommends upgrading to specific patched versions or performing manual updates for air-gapped systems.

Critical Chainlit AI Flaws Let Hackers Seize Control Of Cloud Environments

gbhackers.com · 6 months ago

Researchers have identified two critical vulnerabilities in Chainlit, a framework for building conversational AI applications. These flaws, CVE-2026-22218 (arbitrary file read) and CVE-2026-22219 (SSRF), allow attackers to potentially steal sensitive data and gain control of cloud environments without user interaction. Exploitation has been observed on servers belonging to major organizations, and the vulnerabilities impact core components of the framework, including user interfaces and AI orchestration tools. Users are urged to upgrade to version 2.9.4 or implement mitigation strategies like Web Application Firewall rules.

Node.js binary-parser Library Flaw Enables Malicious Code Injection

gbhackers.com · 6 months ago

A critical vulnerability, CVE-2026-1245, has been identified in the Node.js binary-parser library, potentially allowing for arbitrary code execution. The flaw, present in versions prior to 2.3.0, stems from unsafe dynamic code generation during parser instantiation, allowing attackers to inject malicious payloads through field names or encoding parameters. The vulnerability affects applications using untrusted input and can lead to full process compromise, especially in server environments and cloud functions. Users are urged to upgrade to version 2.3.0 or later to mitigate the risk.