Blahalla

Ingram Micro admits 42,000 people impacted by ransomware attack

www.csoonline.com · 6 months ago

Ingram Micro recently experienced a ransomware attack that disrupted logistics for a week. The company has confirmed that sensitive data belonging to over 42,000 current, former employees, and job applicants was leaked. Information compromised includes names, contact information, dates of birth, identification numbers, and Social Security numbers. The ransomware group Safepay, active since September 2024, claimed responsibility for stealing 3.5 terabytes of data.

Oracle releases 337 security patches, including fix for critical Apache Tika flaw

www.csoonline.com · 6 months ago

Oracle released a quarterly security update containing 337 fixes for various products, with 27 rated as critical. The update addresses vulnerabilities in both proprietary and third-party code, including open source libraries. Several critical vulnerabilities are associated with CVEs, including CVE-2026-21962 affecting the Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in, and CVE-2025-66516, which addresses an Apache Tika issue. The Zero Data Loss Recovery Appliance received the most patches, with 56, and Oracle Enterprise Manager had 51.

Third-party identity verification provider breach exposes government ID images (Total Wireless / Veriff)

www.maine.gov · 6 months ago

Total Wireless experienced a data breach affecting 8583 individuals, including 13 Maine residents. The breach occurred on November 18, 2025, and was discovered on December 10, 2025, resulting from a system hacking. Affected individuals are being offered 12 months of complimentary credit monitoring and identity restoration services through Experian. Written notifications were sent to affected consumers on January 9, 2026.

When the Lab Door Stays Open: Exposed Training Apps Exploited for Fortune 500 Cloud Breaches

pentera.io · 6 months ago

Security researchers have discovered that numerous organizations, including major tech companies, are inadvertently exposing intentionally vulnerable training applications to the public internet. These misconfigured environments are being exploited by attackers for malicious purposes, including crypto mining and establishing backdoors. Attackers are taking advantage of default credentials, exposed public IPs, and a lack of monitoring to compromise entire cloud accounts. Organizations must apply the same security measures to non-production environments as they do to production systems to prevent exploitation.

Fortinet admins report patched FortiGate firewalls getting hacked

www.bleepingcomputer.com · 6 months ago

Administrators of Fortinet firewalls are reporting successful attacks against devices that had already been patched for a critical authentication vulnerability. The vulnerability, identified as CVE-2025-59718, bypasses the initial fix released in December. Fortinet is reportedly preparing to release updated firmware versions, including 7.4.11, 7.6.6, and 8.0.0, to fully address the issue. As a temporary workaround, administrators are advised to disable the FortiCloud single sign-on feature until a proper patch is available. CISA has listed CVE-2025-59718 as actively exploited.

North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews

thehackernews.com · 6 months ago

A North Korean threat activity cluster, known as PurpleBravo, has targeted over three thousand individual IP addresses across Europe, South Asia, and other regions. The campaign, also called CL-STA-0240 among other aliases, uses fake job interviews to compromise organizations in sectors like AI, cryptocurrency, and software development. Attackers are exploiting malicious Microsoft Visual Studio Code projects to distribute malware, including BeaverTail and a Go-based backdoor called GolangGhost. The operation utilizes Astrill VPN and C2 servers hosted across seventeen providers, raising concerns about supply chain vulnerabilities and data leakage.

Fake Lastpass emails pose as password vault backup alerts

www.bleepingcomputer.com · 6 months ago

LastPass is alerting users to a new phishing campaign impersonating the password management service. The emails urge recipients to back up their vaults within 24 hours through a suspicious link, aiming to steal account credentials or master passwords. Attackers launched the campaign over a holiday weekend using email addresses like support@lastpass[.]server8 and support@sr22vegas[.]com. LastPass advises users to never share their master passwords and to report suspicious emails to [email protected].

New Research Exposes Critical Gap: 64% of Third-Party Applications Access Sensitive Data Without Authorization

gbhackers.com · 6 months ago

New research reveals a significant increase in client-side risk due to third-party applications accessing sensitive data without proper authorization, with 64% of applications exhibiting this behavior. Malicious activity on government and education websites has also sharply risen. Tools like Google Tag Manager, Shopify, and Facebook Pixel are frequently identified as contributors to this risk, often due to over-permissioning. The report highlights a governance gap where organizations are granting excessive access by default, creating opportunities for attackers.

Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Cross-Site Scripting Vulnerabilities

sec.cloudapps.cisco.com · 6 months ago

Vulnerabilities have been identified in Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise web interfaces. These vulnerabilities could allow an authenticated attacker to execute cross-site scripting attacks, potentially accessing sensitive information. The issues stem from insufficient input validation, requiring administrative credentials for exploitation. Software updates are available to resolve these vulnerabilities, and there are no workarounds. Affected releases include versions earlier than 12.6 and specific versions of 12.6 and 15.0, with fixes available in releases 12.6(2)ES101 and 15.0(1)ES202511. The vulnerabilities are tracked as CVE-2026-20055 and CVE-2026-20109.

Cisco Intersight Virtual Appliance Privilege Escalation Vulnerability

sec.cloudapps.cisco.com · 6 months ago

A vulnerability has been identified in Cisco Intersight Virtual Appliance, potentially allowing an authenticated administrator to escalate privileges to root. This is due to improper file permissions within the maintenance shell, enabling manipulation of system files. Affected products include Cisco Intersight Connected Virtual Appliance and Cisco Intersight Private Virtual Appliance. Cisco recommends upgrading to a fixed software release to remediate the vulnerability, with versions 1.1.3 and earlier and 1.1.5 being vulnerable. There are no available workarounds.

Cisco IEC6400 Wireless Backhaul Edge Compute Software SSH Denial of Service Vulnerability

sec.cloudapps.cisco.com · 6 months ago

A vulnerability has been identified in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software. This flaw allows an unauthenticated attacker to potentially disrupt the SSH service through a denial-of-service attack. Cisco has released software updates to resolve this issue, and disabling the SSH service is a suggested mitigation. The vulnerability was discovered during internal security testing and there are no known instances of exploitation.

At Check-In, Your Face Is Increasingly Your ID

www.nytimes.com · 6 months ago

false

Greek police arrest scammers using fake cell tower hidden in car trunk

therecord.media · 6 months ago

Greek police have dismantled a mobile scam operation that used a fake cell tower, or SMS blaster, hidden within a vehicle. The device mimicked legitimate telecom infrastructure to send mass phishing messages, forcing phones to connect and harvest data. The suspects, reportedly Chinese nationals, are accused of forging documents and fraud, with connections to at least three fraud cases. Similar operations have been previously reported in Thailand, Indonesia, Qatar, and the United Kingdom, suggesting a common supply chain for the equipment.

Zoom and GitLab Release Security Updates Fixing RCE, DoS, and 2FA Bypass Flaws

thehackernews.com · 6 months ago

Zoom has released a security update to address a critical remote code execution vulnerability affecting its Node Multimedia Routers. This flaw, identified as CVE-2026-22844, has a severity score of 9.9 and could be exploited by meeting participants. Users of Zoom Node Meetings, Hybrid, and Meeting Connector deployments are urged to update their MMR versions. GitLab has also released patches to fix vulnerabilities including denial-of-service conditions and a two-factor authentication bypass, CVEs 2025-13927, 2025-13928, and 2026-0723.

Elon Musk’s latest feud is a mudslinging match with a budget airline

www.washingtonpost.com · 6 months ago

false

Asymmetric Security Emerges From Stealth With $4.2 Million in Funding

www.securityweek.com · 6 months ago

false

Microsoft shares workaround for Outlook freezes after Windows update

www.bleepingcomputer.com · 6 months ago

false

Break LLM Workflows with Claude's Refusal Magic String

hackingthe.cloud · 6 months ago

Researchers have discovered a "magic string" that can reliably trigger Claude language models to refuse responses, creating a potential denial-of-service vulnerability. This string, ANTHROPICMAGICSTRINGTRIGGERREFUSAL1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86, can be injected into user inputs, retrieved documents, or tool outputs to halt Claude's processing. Anthropic recommends robust refusal handling and context resets to mitigate this risk, which affects both Claude and Claude Code models. A secondary, less reliable string, ANTHROPICMAGICSTRINGTRIGGERREDACTEDTHINKING46C9A13E193C177646C7398A98432ECCCE4C1253D5E2D82641AC0E52CC2876CB, is also documented.

Complex VoidLink Linux Malware Created by AI

www.darkreading.com · 6 months ago

Researchers have discovered VoidLink, a new Linux malware framework created primarily by artificial intelligence. This marks the first instance of wholly original malware developed using AI, demonstrating a significant advancement in malicious AI applications. The framework's developer, suspected to be linked to a Chinese actor, used TRAE SOLO, an AI assistant, to rapidly build the malware, but operational security failures exposed the AI's involvement. The development process included detailed planning documents generated by a large language model, and it highlights the potential for AI to dramatically increase the speed and complexity of future malware attacks.

A new era of agents, a new era of posture

www.microsoft.com · 6 months ago

The rise of AI agents presents new security challenges due to their autonomy and interconnected nature. These agents, composed of models, tools, and data sources, are vulnerable to attacks like prompt injection and data exfiltration. Microsoft Defender offers solutions for visibility, risk prioritization, and remediation, including identifying agents with access to sensitive data, those susceptible to indirect prompt injection, and critical coordinator agents. Organizations are encouraged to harden AI agents and implement security posture management to mitigate risk and build secure AI systems.

You Got Phished? Of Course! You're Human...

www.bleepingcomputer.com · 6 months ago

Phishing attacks are increasingly successful because they exploit human psychology rather than technical vulnerabilities. Attackers use urgency, distractions, and emotional manipulation to trick individuals into revealing sensitive information like passwords and financial details. The rise of Phishing-as-a-Service platforms and AI-powered tools like PhishGPT have lowered the barrier to entry, allowing even low-skill actors to launch sophisticated campaigns. Experts are also falling victim, demonstrating that vigilance is a continuous habit, not a guarantee.

EU reviews cybersecurity to limit danger from high-risk suppliers

www.csoonline.com · 6 months ago

false

EU unveils new plans to tackle Huawei, ZTE as China alleges protectionism

therecord.media · 6 months ago

The European Commission has proposed revisions to cybersecurity regulations, aiming to reduce risks within the IT supply chain by establishing certification frameworks for trusted companies. Member states will phase out high-risk suppliers from critical infrastructure, with telecommunication network operators having up to three years to remove components from designated vendors. China has criticized the move as protectionism, while Huawei expressed concerns about fairness and non-discrimination. The proposals reflect growing worries about geopolitical tensions, cybercrime, and supply chain vulnerabilities, not specifically mentioning China or the United States.

'Damn Vulnerable' Training Apps Leave Vendors' Clouds Exposed

www.darkreading.com · 6 months ago

Researchers discovered numerous organizations, including major cybersecurity vendors like Palo Alto Networks, F5, and Cloudflare, are leaving deliberately insecure training applications exposed on the public internet. These applications, such as Hackazon, OWASP Juice Shop, Damn Vulnerable Web Application (DVWA), and Buggy Web Application (bWAPP), are often misconfigured and over-permissioned, allowing attackers to gain access to an organization’s cloud environments. One researcher exploited these vulnerabilities to obtain temporary cloud credentials and achieve lateral movement, including administrator access. Investigators found over 1,900 active instances of these vulnerable apps and evidence of prior cyberattacks, including the use of the XMRig cryptominer.

Hackers exploit security testing apps to breach Fortune 500 firms

www.bleepingcomputer.com · 6 months ago

Hackers are exploiting misconfigured security testing applications like DVWA, OWASP Juice Shop, and Hackazon to breach cloud environments belonging to Fortune 500 companies and security vendors. Researchers found nearly two thousand vulnerable applications exposed online, often linked to overly permissive cloud accounts and default credentials, granting attackers access to sensitive data and systems. Attackers have already deployed cryptocurrency miners using XMRig, webshells like filemanager.php, and persistence mechanisms like watchdog.sh to compromised systems. Security experts recommend organizations maintain a detailed inventory of cloud resources, enforce least-privilege access, and change default credentials to mitigate this risk.

GitLab warns of high-severity 2FA bypass, denial-of-service flaws

www.bleepingcomputer.com · 6 months ago

GitLab has released security updates to address several high and medium severity vulnerabilities. A two-factor authentication bypass vulnerability, identified as CVE-2026-0723, could allow attackers to circumvent authentication if they know an account ID. Additionally, denial-of-service vulnerabilities, tracked as CVE-2025-13927, CVE-2025-13928, CVE-2025-13335, and CVE-2026-1102, have also been resolved. Administrators are urged to upgrade to versions 18.8.2, 18.7.2, or 18.6.4 to mitigate these risks.

LastPass Users Targeted With Backup-Themed Phishing Emails

www.securityweek.com · 6 months ago

LastPass users are being targeted by a phishing campaign through emails urging them to back up their vaults. These emails direct recipients to a fake LastPass domain where they are tricked into revealing their master password. The timing of the campaign, coinciding with a holiday weekend, suggests an attempt to exploit reduced staffing for delayed detection. Following a significant 2022 data breach, threat actors are now successfully cracking stolen master passwords to access vaults and steal cryptocurrency.

Researchers Expose LockBit 5.0 Affiliate Panel and New Encryption Variants

gbhackers.com · 6 months ago

Researchers have uncovered details about the LockBit 5.0 ransomware affiliate panel, revealing a sophisticated infrastructure used for coordinating attacks and managing victim negotiations. Despite recent law enforcement disruption, the group has largely maintained its operations, with cosmetic updates indicating ongoing development. Four new LockBit 5.0 variants have been released, targeting Windows, Linux, VMware ESXi, and a specialized deployment environment. Intelligence suggests LockBit’s reputation has suffered within the cybercriminal community, but the group continues to recruit affiliates and expand its platform capabilities.

North Korean Hackers Target macOS Developers via Malicious VS Code Projects

www.securityweek.com · 6 months ago

North Korean threat actors are targeting macOS software developers through malicious Visual Studio Code projects. The attackers use fake job offers to trick victims into accessing or cloning compromised GitHub or GitLab repositories. These repositories contain VS Code task configuration files with obfuscated JavaScript code that executes malicious commands once the project is opened. The resulting backdoor establishes persistence, collects system information, and enables remote code execution and communication with a command-and-control server.

GitLab Security Flaws Could Allow Two-Factor Authentication Bypass and DoS

gbhackers.com · 6 months ago

GitLab has released security patches to address vulnerabilities in both Community and Enterprise Editions. A critical vulnerability, CVE-2026-0723, allows attackers to bypass two-factor authentication under specific circumstances. Several denial-of-service vulnerabilities, including CVE-2025-13927, CVE-2025-13928, CVE-2026-1102, and CVE-2025-13335, have also been resolved. Users with self-managed installations are strongly advised to upgrade immediately to mitigate these risks.

NVIDIA Nsight Graphics on Linux Exposed to Code Execution Vulnerability

gbhackers.com · 6 months ago

NVIDIA has released a security update to address a critical vulnerability in NSIGHT Graphics for Linux systems. This vulnerability, CVE-2025-33206, allows attackers with local access to execute arbitrary code through command injection. The flaw impacts all versions prior to 2025.5 and requires user interaction, but no special privileges. Users are urged to immediately update to version 2025.5 or later to mitigate the risk.

Contagious Interview turns VS Code into an attack vector

www.csoonline.com · 6 months ago

Threat actors linked to North Korea are now exploiting Microsoft Visual Studio Code to execute and persist malicious code as part of the long-running Contagious Interview campaign. Attackers embed malicious logic within VS Code project configurations, tricking users into unknowingly running harmful JavaScript payloads when they open a repository and grant it trust. This technique abuses VS Code’s task automation features, allowing for persistent backdoors even after the IDE is closed. Researchers recommend carefully reviewing repository contents and task configurations before granting trust or running install scripts.

Why Identity Security Must Move Beyond MFA

www.securityweek.com · 6 months ago

Multi-factor authentication, or MFA, is widely used, with approximately 70 percent of enterprise users employing it, and remains an effective deterrent against automated attacks. However, cybercriminals are increasingly bypassing MFA through techniques like social engineering, phishing, and SIM swapping. Experts are discouraging the use of email and SMS-based authentication due to vulnerabilities, and organizations are increasingly adopting phishing-resistant methods like hardware security keys and authenticator apps. To address the ongoing human element risk, identity threat detection solutions are now being implemented to monitor user behavior and proactively mitigate potential breaches.

Hackers Weaponize 2,500+ Security Tools to Disable Endpoint Defenses Before Ransomware Attacks

gbhackers.com · 6 months ago

A new cyber campaign is leveraging a legitimate security driver to disable endpoint defenses before deploying ransomware and remote access trojans. Attackers are abusing the Adlice Software TrueSight driver, version 2.0.2, exploiting a vulnerability, IOCTL command 0x22E044, to terminate security processes. The attackers manipulate the driver’s structure to evade detection, bypassing traditional security measures and utilizing phishing, fake websites, and watering hole attacks. This technique has been linked to the Silver Fox threat actor and has proliferated to various ransomware groups, deploying the HiddenGh0st RAT.

Tesla hacked, 37 zero-days demoed at Pwn2Own Automotive 2026

www.bleepingcomputer.com · 6 months ago

Security researchers successfully exploited 37 zero-day vulnerabilities in a Tesla Infotainment System during the Pwn2Own Automotive 2026 competition, earning a $516,500 reward. Several other teams also received cash awards for hacking electric vehicle chargers and digital media receivers, demonstrating vulnerabilities like information leaks and out-of-bounds write flaws. The competition, held in Tokyo, Japan, targets automotive technologies, with vendors receiving a 90-day window to address the discovered flaws before public disclosure. Last year’s competition awarded over $886,000 for exploiting 49 vulnerabilities.

MITRE Launches New Security Framework for Embedded Systems

www.securityweek.com · 6 months ago

false

Internet Voting is Too Insecure for Use in Elections

www.schneier.com · 6 months ago

Experts have long recognized internet voting as fundamentally insecure, and no technology currently exists to make it safe. Despite this, vendors continue to promote internet voting systems, claiming improvements or downplaying risks. The Mobile Voting Foundation is actively pushing for internet voting, which is considered misleading and dangerous. Concerns persist about the ongoing promotion of an insecure practice.

Cyber Insights 2026: API Security – Harder to Secure, Impossible to Ignore

www.securityweek.com · 6 months ago

The increasing use of agentic AI is driving a rapid expansion of APIs, creating a significant cybersecurity risk for businesses. This boom in APIs exposes sensitive data and business logic, making them attractive targets for attackers who will leverage AI to exploit vulnerabilities. Experts anticipate major data breaches will originate from poorly secured API integrations, highlighting the need for improved security controls and visibility. Securing APIs will require a shift to real-time behavioral analytics and a developer-centric approach.

VoidLink Emerges: First Fully AI-Driven Malware Signals a New Era of Cyber Threats

gbhackers.com · 6 months ago

A new Linux malware framework called VoidLink has emerged, marking a significant advancement in AI-driven cyber threats. Developed with the assistance of artificial intelligence and a skilled developer, the framework was created in under a week, demonstrating an unprecedented acceleration in malware development. VoidLink includes advanced capabilities such as rootkit functionality, cloud enumeration, and multiple command-and-control channels, and operates as a cloud-native implant written in Zig. Security teams are urged to strengthen Linux, cloud, and container environments to defend against increasingly sophisticated AI-generated threats.

Webinar: How Smart MSSPs Using AI to Boost Margins with Half the Staff

thehackernews.com · 6 months ago

false

EU’s New Cybersecurity Act Could Ban High-Risk Suppliers

www.techrepublic.com · 6 months ago

false

Anthropic MCP Server Flaws Lead to Code Execution, Data Exposure

www.securityweek.com · 6 months ago

Researchers have discovered vulnerabilities in Anthropic’s MCP servers that allow for remote code execution and unauthorized file access. These flaws, identified as CVE-2025-68143, CVE-2025-68145, and CVE-2025-68144, stem from a lack of input validation and can be exploited through prompt injection. Attackers can leverage compromised AI assistant inputs to trigger malicious actions without direct system access. Anthropic addressed these vulnerabilities in December 2025 with version 2025.12.18 of the Git MCP server.

Hacker erbeuten rund 42.000 Datensätze von Ingram Micro

www.csoonline.com · 6 months ago

Ingram Micro confirmed a cyberattack resulted in the theft of data affecting over 42,000 individuals. Sensitive employee and applicant information, including names, contact details, dates of birth, identification numbers, and application documents, was compromised. A ransomware group, Safepay, claimed responsibility for the attack, which disrupted logistics at Ingram Micro’s US and German locations. The cybercriminals reportedly stole 3.5 terabytes of data during the incident.

ErrTraffic Exploits Visual Page Breaks to Fuel ClickFix Attacks, Rebranding Exploits as “GlitchFix”

gbhackers.com · 6 months ago

A new social engineering technique called ErrTraffic is being used to trick users into installing malicious software. This technique, nicknamed "GlitchFix," intentionally breaks website visuals to simulate a device malfunction, prompting victims to run fake updates. The tool, sold on Russian forums for around $800, boasts a remarkably high success rate, with nearly 60% of users clicking on malicious buttons. ErrTraffic delivers legitimate Remote Monitoring and Management tools like FleetDeck and ITarian, bypassing traditional security defenses.

Trump team touts a coming economic revolution as voters fear job losses

www.washingtonpost.com · 6 months ago

false

Pro-Russian denial-of-service attacks target UK, NCSC warns

www.bitdefender.com · 6 months ago

The UK's National Cyber Security Centre has issued a warning about distributed denial-of-service attacks targeting British organizations. These attacks, linked to pro-Russian hacking groups, are disrupting online services, particularly those related to local government and critical infrastructure. While typically not highly sophisticated, these attacks can cause significant disruption and cost. The NCSC advises organizations to review defenses and harden resilience, especially those using operational technology, and mentions groups including Cyber Army of Russia Reborn, Z-Pentest, NoName057(16), and Sector16.

Oracle’s First 2026 CPU Delivers 337 New Security Patches

www.securityweek.com · 6 months ago

Oracle released its first Critical Patch Update for 2026, addressing 337 security patches across more than 30 products. The update includes fixes for approximately 230 unique CVEs, with more than two dozen resolving critical-severity vulnerabilities that can be exploited remotely. Several patches target CVE-2025-66516, a critical Apache Tika defect allowing XML injection attacks, impacting products like Commerce and Fusion Middleware. Oracle Communications received the most fixes, totaling 56, while Fusion Middleware followed with 51.

Critical Zoom Vulnerability Enables Remote Code Execution via Command Injection

gbhackers.com · 6 months ago

A critical command injection vulnerability, identified as CVE-2026-22844, has been discovered in Zoom Node Multimedia Routers, potentially allowing remote code execution. This flaw affects Zoom Node Meetings Hybrid and Meeting Connector deployments running module versions prior to 5.2.1716.0. The vulnerability has a CVSS score of 9.9, indicating severe exploitability and minimal attack complexity. Zoom recommends immediately updating to version 5.2.1716.0 or later to mitigate the risk of unauthorized code execution.

Vulnerability prioritization beyond the CVSS number

www.csoonline.com · 6 months ago

Traditional vulnerability assessments rely heavily on the Common Vulnerability Scoring System, or CVSS, but this approach often overlooks crucial context. Events like the Equifax breach, SolarWinds attack, and Log4Shell highlight that vulnerabilities can spread through interconnected systems, rendering high CVSS scores misleading. A new model, the unified linkage model, focuses on relationships between systems, adjacency, inheritance, and trust, to better understand propagation pathways and prioritize vulnerabilities based on their potential impact, rather than just severity. Log4Shell became significant not due to its technical severity, but because of its widespread inheritance and dependency across systems.

Exposure Assessment Platforms Signal a Shift in Focus

thehackernews.com · 6 months ago

Traditional vulnerability management is proving ineffective for modern enterprises, prompting the emergence of Exposure Assessment Platforms, or EAPs. These platforms shift focus from simply identifying vulnerabilities to managing continuous threat exposure by tracking how systems, identities, and vulnerabilities interact. Gartner's new Magic Quadrant for EAPs evaluates vendors based on their ability to prioritize risk and provide integrated visibility across environments, aiming to reduce unplanned downtime by 30% by 2027. EAPs consolidate discovery, prioritize based on context, integrate exposure data into workflows, and support lifecycle tracking, moving beyond static vulnerability lists to model attacker behavior.