Blahalla

AI Is Not Replacing Security Researchers

simonkoeck.com · 6 months ago

false
NIST Prioritizes NVD Enrichment for CVEs in CISA KEV, Critical Software

www.securityweek.com · 6 months ago

The National Institute of Standards and Technology has updated National Vulnerability Database operations to adopt a risk based enrichment model that prioritizes adding details to CVE entries placed on the Known Exploited Vulnerabilities catalog within one day and to vulnerabilities in software used by federal agencies or designated as critical under Executive Order 14028. Other newly added CVEs will still appear in the NVD but will be labeled Not Scheduled for enrichment unless they meet the prioritized criteria, and the backlog of unenriched entries published before March 1, 2026 will be moved to that category while users can request enrichment by email. NIST will not provide its own severity score when a CVE Numbering Authority has submitted a score and will not reanalyze entries modified after enrichment unless the changes materially affect enrichment data, a shift driven by a surge in CVE submissions that rose 263 percent between 2020 and 2025 and were nearly one third higher in the first three months of 2026 compared with the same period in 2025. The agency enriched 42,000 CVEs last year and framed the policy change as necessary to focus resources on systemic risk and to support development of automated systems and workflow enhancements for long term sustainability.
Data breach at edtech giant McGraw Hill affects 13.5 million accounts

www.bleepingcomputer.com · 6 months ago

The ShinyHunters extortion group leaked data linked to 13.5 million McGraw Hill user accounts after breaching a misconfigured webpage hosted in the company’s Salesforce environment earlier in April 2026. McGraw Hill confirmed unauthorized access to a limited set of data and said the incident did not affect its Salesforce accounts, courseware, customer databases, or internal systems. More than 100 gigabytes of files were later distributed and the exposed information includes email addresses, names, physical addresses, and phone numbers that could enable targeted spear-phishing, while ShinyHunters claimed up to 45 million Salesforce records were taken.
Hidden Passenger? How Taboola Routes Logged-In Banking Sessions to Temu

thehackernews.com · 6 months ago

A bank-approved Taboola tracking pixel performed a 302 redirect from sync.taboola.com to a Temu tracking endpoint that included the header Access-Control-Allow-Credentials set to true, causing browsers to send cookies to the Temu domain. This behavior ran on logged-in banking pages without the bank's knowledge or user consent and allowed Temu to associate tracking identifiers with authenticated sessions. Conventional security controls including WAFs, static analyzers, and Content Security Policy allow-lists failed to detect the issue because they validate the declared script origin rather than the runtime redirect destination. The finding, uncovered during a February 2026 audit, creates GDPR transparency and cross-border transfer risks and a PCI DSS review gap, prompting the recommendation that teams inspect runtime third-party script behavior and treat browser-level tracking on authenticated pages as high-risk.
Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT in Targeted Finance, Crypto Attacks

thehackernews.com · 6 months ago

A novel social engineering campaign abused the Obsidian note taking application by convincing targets to open a shared cloud vault and enable community plugin sync, which caused malicious plugin configuration files to execute code. Attackers posed as a venture capital firm on LinkedIn and Telegram to lure individuals in the financial and cryptocurrency sectors into a staged group and instruct them to connect to the malicious vault. On Windows the vault triggered a PowerShell script that drops an intermediate loader called PHANTOMPULL which decrypts and launches an in memory remote access trojan named PHANTOMPULSE that resolves its command and control via the Ethereum blockchain and supports commands including inject, drop, screenshot, keylog, uninstall, elevate and downgrade. On macOS the campaign used an obfuscated AppleScript dropper with domain and Telegram based fallback C2 resolution, and researchers reported the intrusion was detected and blocked before the adversary completed their objectives.
Cisco Patches Critical Vulnerabilities in Webex, ISE

www.securityweek.com · 6 months ago

Cisco patched 15 vulnerabilities, including critical flaws in Webex and Identity Services Engine. One critical Webex flaw, CVE 2026 20184, affects single sign on integration with Control Hub and could let remote, unauthenticated attackers impersonate any user by exploiting improper certificate validation, and customers using SSO are advised to upload a new identity provider SAML certificate to Control Hub. Three critical ISE flaws include CVE 2026 20180 and CVE 2026 20186, which can allow remote, authenticated attackers with read only admin rights to execute arbitrary commands on the underlying operating system by supplying crafted HTTP requests that lead to privilege escalation to root, and CVE 2026 20147, which allows remote, authenticated attackers with admin privileges to execute arbitrary commands and in single node deployments may cause denial of service. The remaining 11 fixes address medium severity issues such as path traversal, cross site scripting, authentication policy bypass, file leaks, file overwrite, and command injection, and Cisco says it is not aware of any exploitation in the wild.
Insurance carriers quietly back away from covering AI outputs

www.csoonline.com · 6 months ago

Several major insurance carriers are quietly withdrawing coverage for harms tied to AI generated outputs, increasingly excluding AI related liabilities from cybersecurity and errors and omissions policies or significantly raising premiums to account for the risk. Insurers cite an inability to trace AI reasoning and the unpredictability of outputs, prompting underwriters to ask detailed questions about how organizations govern and deploy AI and to treat AI vendors more harshly than AI users. Carriers are more willing to insure governed, tightly constrained AI systems but are declining or pricing out experimental autonomous agents, making insurability hinge on governance, traceability, and monitoring. Experts warn businesses to fully disclose their AI use or risk having claims denied, and some providers are marketing traceable AI platforms to retain insurability.
Human Trust of AI Agents

www.schneier.com · 6 months ago

Researchers ran the first controlled monetarily incentivized laboratory experiment comparing human choices in a multi-player p-beauty contest when opponents were large language models versus other humans. Participants chose significantly lower numbers against LLM opponents, driven largely by a higher prevalence of zero Nash equilibrium choices, with the effect strongest among subjects with high strategic reasoning ability. Players who picked the zero equilibrium cited perceived LLM reasoning ability and an unexpected propensity to cooperate, and the findings point to important implications for mechanism design in mixed human and LLM systems.
Hackers Exploit n8n Webhooks to Spread Malware

gbhackers.com · 6 months ago

There is an abuse campaign from October 2025 through March 2026 that weaponizes AI-driven workflow automation webhooks, particularly n8n, to deliver malware and capture device fingerprints. Security analysts observed a 686 percent rise in phishing emails embedding n8n-hosted webhook links between January 2025 and March 2026, and attackers tailor payloads dynamically using headers and system data. Campaigns included a phishing lure that led to a CAPTCHA page and the download of a file named DownloadedOneDriveDocument.exe which installed a modified Datto remote monitoring tool as a persistent backdoor, and a separate campaign that dropped a weaponized MSI using the Armadillo packer to install a rogue ITarian agent while exfiltrating system data. Attackers also used invisible tracking pixels that call n8n webhook URLs to fingerprint victims, and defenders are advised to monitor for unusual webhook traffic, tighten email filtering, and train users to recognize malicious automation links.
Ransomware Hits Automotive Data Expert Autovista

www.securityweek.com · 6 months ago

Autovista, a UK-based automotive analysis and data company, is working with third-party cybersecurity experts after a ransomware attack disrupted its services across Europe and Australia. The company is containing the incident, has temporarily lost employee access to email, and cannot provide a firm timeline for restoring applications. No group has claimed responsibility and Autovista said it will provide additional details as its investigation advances.
Two U.S. Nationals Sentenced in $5 Million DPRK Remote Worker Laptop Farm Scheme

gbhackers.com · 6 months ago

There are two U.S. nationals sentenced for facilitating a fraudulent remote information technology worker scheme that generated more than five million dollars for the government of the Democratic People’s Republic of Korea. Kejia Wang was sentenced to 108 months in prison and Zhenxing Wang was sentenced to 92 months; both pleaded guilty to charges including conspiracy to commit wire fraud and conspiracy to commit money laundering, and the court ordered three years of supervised release and forfeiture totaling six hundred thousand dollars. The scheme used hosted laptop farms and remote access hardware and software to let overseas IT workers appear to be U.S. residents, used stolen identities for more than eighty U.S. persons to obtain work at over one hundred U.S. companies, and caused at least three million dollars in damages to victim companies. Law enforcement executed coordinated searches across multiple states and seized dozens of web domains, financial accounts, and hundreds of computers as part of disrupting the network.
New PoC Exploit Published for Microsoft Defender 0-Day Flaw

gbhackers.com · 6 months ago

A security researcher using the alias Chaotic Eclipse publicly released a proof of concept exploit targeting Microsoft Defender and the recently patched vulnerability CVE-2026-33825. The exploit, named RedSun, was uploaded to a public code repository and follows prior disclosures by the same researcher including a denial of service tool called BlueHammer, with the researcher alleging Microsoft’s Security Response Center dismissed their initial report. The uncoordinated public release reduces the time defenders have before malicious actors can weaponize the code and the researcher threatened to publish more severe remote code execution exploits. Recommended actions include applying the official patch for CVE-2026-33825 immediately, monitoring network and endpoint detections for RedSun and BlueHammer indicators, reviewing logs for anomalous Microsoft Defender activity, and enforcing strict access controls and network segmentation.
The endless CISO reporting line debate — and what it says about cybersecurity leadership

www.csoonline.com · 6 months ago

There is still a running debate in 2026 about where the chief information security officer should report, signaling that many organizations remain unclear about the CISO role. The reporting line matters because it determines the CISO's authority, visibility and access to senior decision makers and therefore the ability to influence IT, operations, legal, compliance, human resources, procurement and third party partners. The real issue is whether the CISO has the organizational standing to influence decisions across silos, not the job title of the executive above them. There is no universal reporting model; success depends on organizational standing, trust with the reporting executive, strong governance, clear accountability and embedding cybersecurity into business strategy rather than relying on structural changes alone.
Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments

www.securityweek.com · 6 months ago

There is a prompt injection attack named Comment and Control that can hijack AI code security and automation agents including Anthropic Claude Code Security Review, Google Gemini CLI Action, and GitHub Copilot Agent by embedding malicious content in untrusted GitHub data such as pull request titles, comments, and issue bodies. Attackers can use specially crafted PR titles, issue comments, and hidden HTML comments to bypass model and runtime guardrails, trigger autonomous command execution, and exfiltrate secrets including full API keys and credentials into GitHub Actions logs. The pattern stems from agents processing untrusted input while having access to execution tools and secrets in the same runtime, and vendors confirmed the findings, with Anthropic labeling the issue critical and paying a bounty of one hundred dollars, Google paying a bounty of one thousand three hundred thirty seven dollars, and GitHub awarding five hundred dollars while calling it a known architectural limitation.
US nationals behind DPRK IT worker 'laptop farm' sent to prison

www.bleepingcomputer.com · 6 months ago

Two U.S. nationals were sentenced for running a scheme that helped North Korean IT workers pose as U.S. residents and obtain employment at more than one hundred U.S. companies, including Fortune five hundred firms. Between 2021 and October 2024 they generated over five million dollars for the North Korean government, caused an estimated three million dollars in damages by using stolen identities of more than eighty U.S. citizens, and operated shell companies while hosting company laptops in U.S. homes to hide remote access. One defendant received a sentence of one hundred eight months and the other received ninety two months, nine co defendants remain at large with a U.S. State Department reward of up to five million dollars for information, and U.S. agencies have warned since 2023 about North Korean actors impersonating U.S. IT staff.
Cisco FMC Zero-Day Among 31 High-Impact Vulnerabilities Exploited in March

gbhackers.com · 6 months ago

There are 31 high impact vulnerabilities actively exploited in March 2026, with Microsoft and Apple accounting for roughly 32 percent, nine enabling remote code execution, and proof of concept exploits available for ten of the bugs. One standout is a Cisco Secure Firewall Management Center and Security Cloud Control deserialization zero day tracked as CVE-2026-20131 that the Interlock ransomware group abused from January 26, 2026 and that Cisco patched on March 4, 2026, allowing unauthenticated attackers to submit crafted Java serialized objects and execute arbitrary Java code as root. The exploitation chain involves malicious HTTP requests to vulnerable FMC instances that fetch an ELF payload to establish persistence, followed by custom Java and JavaScript remote access tools, a memory resident web shell, and legitimate tools such as ConnectWise ScreenConnect for lateral movement and ransomware staging. Other tracked CVEs include CVE-2026-27483, CVE-2026-27944, CVE-2025-68613, and the long exploited CVE-2017-7921, and defenders are urged to apply vendor patches, validate exposure, and adopt detection templates and risk scoring.
Microsoft: April Windows Server 2025 update may fail to install

www.bleepingcomputer.com · 6 months ago

Microsoft is investigating a problem that can cause the KB5082063 security update released on April 14, 2026 to fail to install on some Windows Server 2025 systems. Affected systems report installation error 0x800F0983 when deploying the April 2026 cumulative updates, and Microsoft is monitoring diagnostic data after observing a recurring failure on Windows Server 2025 devices. Microsoft also warned that some Windows Server 2025 machines may boot into BitLocker recovery after deploying KB5082063, requiring the BitLocker key, though this appears limited to enterprise managed configurations and is unlikely to affect home users.
Chrome Privacy Vulnerability Exposes Users via Fingerprinting and Header Leaks

gbhackers.com · 6 months ago

A technical review finds modern tracking no longer depends only on cookies because websites can combine browser fingerprinting, storage tricks, and HTTP header leaks to identify users with surprising accuracy. Chrome has reduced some obvious signals but high value surfaces such as canvas rendering, WebGL, audio processing, Client Hints, and first party storage remain available to trackers and can produce persistent fingerprints that survive cookie clearing or Incognito mode. HTTP header leaks remain a significant risk, illustrated by CVE-2025-4664, a Chrome Link header handling vulnerability that could force a permissive referrer policy and expose full query strings, which was patched in Chrome 136. Recommended defenses include keeping Chrome updated, limiting extensions and permissions, monitoring script and network activity, and using browsers or privacy tools that specifically defend against fingerprinting rather than relying only on cookie blocking.
Critical Cisco ISE Flaws Let Remote Attackers Execute Malicious Code

gbhackers.com · 6 months ago

There are two newly discovered vulnerabilities affecting Cisco Identity Services Engine and the ISE Passive Identity Connector that reside in the web based management interfaces and can be exploited by authenticated remote attackers. CVE-2026-20147 is a critical remote code execution flaw with a CVSS score of 9.9 that can be triggered by crafted HTTP requests to gain system access and potentially be elevated to root, and CVE-2026-20148 is a medium severity path traversal allowing authenticated attackers to read arbitrary sensitive files. Cisco reports there are no available workarounds and urges immediate installation of vendor patches, with specific upgrade targets provided for versions 3.1 through 3.5 and migration required for legacy releases. The vulnerabilities were independently reported by researcher Jonathan Lein of TrendAI Research and Cisco PSIRT stated it was not aware of any public proof of concept exploits or active exploitation at the time of the advisory.
Cisco Webex Vulnerability Allows User Impersonation Attacks

gbhackers.com · 6 months ago

There is a critical vulnerability in Cisco Webex tracked as CVE-2026-20184 that could allow unauthenticated remote attackers to bypass security checks and impersonate legitimate users. The flaw stems from improper certificate validation in single sign on integrations with the Cisco Control Hub, is classified as CWE-295, and carries a CVSS base score of 9.8 out of 10. Cisco has applied patches to its cloud Webex infrastructure but administrators must generate and upload new SAML certificates and update SSO integration settings because there are no temporary workarounds and the fix is not fully automatic. There is currently no publicly available proof of concept and no evidence of exploitation in the wild, but organizations are urged to act immediately and the issue is tracked under Cisco Bug ID CSCwt37111.
Fake Adobe Reader Download Drops ScreenConnect via Fileless Loader

gbhackers.com · 6 months ago

A deceptive campaign distributed a fake Adobe Acrobat Reader installer that secretly deployed ConnectWise ScreenConnect through a multilayer in memory execution chain. The attack began with a phishing page that downloaded an obfuscated VBScript loader which executed PowerShell with ExecutionPolicy Bypass, fetched additional components from cloud storage, and compiled and executed a hidden.NET assembly entirely in memory using reflection. The actors used dynamic string reconstruction, process metadata spoofing, and COM based silent elevation to bypass defenses and then installed a renamed ScreenConnect MSI with msiexec to gain persistent remote access, and indicators of compromise such as file hashes and download artifacts were published.
UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign

thehackernews.com · 6 months ago

CERT-UA disclosed a campaign observed between March and April 2026 by a threat cluster tracked as UAC-0247 that targeted governments and municipal healthcare institutions, mainly clinics and emergency hospitals, to steal data from Chromium based browsers and WhatsApp. The attack begins with phishing emails offering humanitarian aid that link to compromised or AI generated sites which download a Windows shortcut file that launches an HTA via mshta.exe, displays a decoy form, injects shellcode into legitimate processes such as runtimeBroker.exe, and then loads a two stage proprietary loader with a compressed and encrypted final payload. Deployed components include a TCP reverse shell tracked as RAVENSHELL, a C sharp remote control family called AGINGFLY, and a PowerShell script named SILENTLOOP, while operators leverage open source tools to extract browser cookies and WhatsApp data and use DLL side loading via Signal delivered archives; recommended mitigations include restricting execution of LNK, HTA and JS files and blocking utilities such as mshta.exe, powershell.exe and wscript.exe.
Russian Hosting Tied to 1,250+ C2 Servers Across 165 Providers

gbhackers.com · 6 months ago

More than 1,250 command‑and‑control servers were identified across 165 Russian infrastructure providers between January 1 and April 1, 2026, with analysts mapping about 1,290 malicious artifacts including 1,252 C2 servers, 75 malicious open directories, 69 phishing sites, and 17 public IOCs. A small group of providers hosted a disproportionate share, led by TimeWeb with 311 detected C2 servers, followed by WebHost1 with 140 and REG.RU with 138, while VDSina and PROSPERO OOO also featured prominently. The Keitaro framework accounted for 587 unique C2 IPs and C2 infrastructure represented roughly 88.6 percent of observed artifacts, with IoT botnets such as Hajime, Mozi, and Mirai also active in these networks. Infrastructure analytics using Host Radar and HuntSQL enabled organization‑level mapping that turns noisy indicators into prioritized intelligence for monitoring, blocking, takedown, and escalation against high‑risk networks.
6-Year Ransomware Campaign Targets Turkish Homes & SMBs

www.darkreading.com · 6 months ago

Researchers uncovered a low dollar, high volume ransomware campaign active since at least 2020 that targets homes and small and medium sized businesses in Turkey. Phishing lures deliver a malicious Java archive that installs a modified Adwind remote access Trojan which geofences victims by Turkish locale and language, disables Microsoft Defender and Windows updates, removes recovery options, and then loads a JanaWare ransomware plugin that demands between 200 and 400 dollars. The operators rely on high volume and low ransoms to stay under the radar, exploiting weaker defenses and underreporting among smaller victims while generating steady revenue.
Nginx-UI Flaw Actively Exploited to Enable Full Server Takeover

gbhackers.com · 6 months ago

A critical unauthenticated flaw in nginx-ui, tracked as CVE-2026-33032 with a CVSS base score of 9.8, is being actively exploited in the wild and allows remote attackers to completely take over Nginx servers without credentials. The flaw stems from an unauthenticated MCP endpoint that can be triggered with a small number of HTTP requests, enabling full server compromise and was listed by threat intelligence firms among high-impact vulnerabilities exploited in March 2026. Researchers and vendors urge immediate action by applying available nginx-ui patches or, if patches are not available, disabling MCP functionality and restricting network access as interim mitigations.
Splunk Enterprise and Cloud Platform Exposed to Dangerous RCE Vulnerability

gbhackers.com · 6 months ago

Splunk disclosed a high severity remote code execution vulnerability tracked as CVE-2026-20204 with a CVSS score of 7.1 that stems from improper handling and insufficient isolation of temporary files in Splunk Web and allows a low privileged authenticated user to upload a crafted file that can lead to arbitrary code execution. Affected Enterprise versions include 10.2.0, 10.0.0 through 10.0.4, 9.4.0 through 9.4.9, and 9.3.0 through 9.3.10, and Cloud Platform builds below the listed 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127 builds while version 10.4.2603 is not impacted. Splunk advises immediate upgrades to patched Enterprise releases 10.2.1, 10.0.5, 9.4.10, or 9.3.11, notes that Cloud instances are being patched, and recommends temporarily disabling the Splunk Web component via configuration as a mitigation until fixes are applied.
AI Content Hijacks Google Discover to Deliver Malicious Alerts

gbhackers.com · 6 months ago

A large scale operation is exploiting Google Discover and Chrome new tab feeds to push malicious notifications and scams using AI generated articles and clickbait headlines. Threat actors created about 113 fake domains filled with AI written posts, used SEO and possible paid placements to get those items into Discovery, and trick users into enabling push notifications that deliver persistent system level alerts that bypass ad blockers. Named Pushpaganda by researchers at HUMAN Satori, the campaign delivers scareware and deepfake ads, uses a JavaScript tab rotation to inflate traffic, generated over 240 million ad bid requests in a single week, and Google has implemented fixes while Satori continues to monitor the infrastructure.
Critical Chrome Flaws Allow Arbitrary Code Execution – Patch Immediately

gbhackers.com · 6 months ago

There are 31 Chrome vulnerabilities being patched, including five rated critical, with stable channel updates to version 147.0.7727.101 and 147.0.7727.102 for Windows and Mac and 147.0.7727.101 for Linux rolling out now and users are urged to update immediately. The most severe flaws could allow remote attackers to execute arbitrary code by directing users to a crafted HTML page, with memory safety bugs such as use after free and heap buffer overflow affecting core components including ANGLE, Proxy, Skia, Prerender, and XR. Addressed CVEs include CVE-2026-6296, CVE-2026-6297, CVE-2026-6298, CVE-2026-6299, CVE-2026-6358, CVE-2026-6359, CVE-2026-6300, CVE-2026-6301, CVE-2026-6302, CVE-2026-6303, CVE-2026-6304, CVE-2026-6305, CVE-2026-6306, CVE-2026-6307, CVE-2026-6308, CVE-2026-6309, CVE-2026-6360, CVE-2026-6310, CVE-2026-6311, CVE-2026-6312, CVE-2026-6313, CVE-2026-6314, CVE-2026-6315, CVE-2026-6316, CVE-2026-6361, CVE-2026-6362, CVE-2026-6317, CVE-2026-6363, CVE-2026-6318, CVE-2026-6319, and CVE-2026-6364.
Was bei der Cloud-Konfiguration schiefläuft – und wie es besser geht

www.csoonline.com · 6 months ago

Misconfigured cloud services pose a serious threat to businesses, with numerous virtual machines exhibiting configuration errors across major cloud platforms. These errors often stem from prioritizing speed over security and failing to incorporate security early in the deployment process. Experts suggest implementing practices like least-privilege access, infrastructure as code, and continuous scanning to mitigate risks. While artificial intelligence may offer future assistance, substantial improvements in cloud security are still needed.
Sneaker Company Allbirds Plans to Pivot to A.I. Yes, A.I.

www.nytimes.com · 6 months ago

false
Smashing Security podcast #463: This AI company leaked its own code. It’s also built something terrifying

grahamcluley.com · 6 months ago

There are claims that a hacking group calling itself Infrastructure Destruction Squad accessed the hydraulic pump system protecting Venice’s Piazza San Marco on March 26, spent about ten days exploring the control interface, began publicly disclosing evidence on April 7, and offered to sell full root access for 600 dollars. There was an accidental exposure of Anthropic’s Claude Code source when an npm package included source maps pointing to an archive on Cloudflare R2, which researchers quickly mirrored and analyzed. Anthropic also announced a new model called Mythos that the company says can autonomously find, chain, and in some cases generate working exploits for vulnerabilities across major operating systems and browsers, prompting calls for coordinated defensive action.
Critical Nginx UI auth bypass flaw now actively exploited in the wild

www.bleepingcomputer.com · 6 months ago

A critical authentication bypass in Nginx UI Model Context Protocol support allows unauthenticated access to the mcpmessage endpoint and is tracked as CVE-2026-33032. Attackers can establish an SSE session to obtain a session ID and then invoke all MCP tools without credentials to read and exfiltrate nginx configuration files, inject malicious server blocks, and restart or reload the service to achieve full Nginx server takeover; public proof of concept code exists and active exploitation has been observed. Internet scans found about 2,600 publicly exposed instances worldwide, a fix was released on March 15, 2026, and the secure nginx-ui version as of April 15, 2026 is 2.3.6, so administrators are urged to update immediately.
New AgingFly malware used in attacks on Ukraine govt, hospitals

www.bleepingcomputer.com · 6 months ago

A new malware family named AgingFly has been used in targeted attacks against Ukrainian local governments, hospitals, and possibly Defense Forces representatives to steal authentication data from Chromium based browsers and the WhatsApp Windows client, and CERT UA attributes the campaign to the UAC 0247 cluster. The attack chain begins with a phishing email offering humanitarian aid that redirects victims to compromised or AI generated fake sites, delivers an archive with a shortcut file that launches an HTA to show a decoy form and create a scheduled task that downloads and runs an executable which injects shellcode and deploys a two stage loader, with stagers such as TCP reverse shells or RAVENSHELL communicating via XOR encrypted TCP and a PowerShell component named SILENTLOOP that retrieves C2 addresses from a Telegram channel. AgingFly is a C Sharp remote access tool that compiles command handlers on the host from source received from its C2, communicates over WebSockets and uses AES CBC with a static key for traffic, and defenders are advised to block LNK, HTA, and JS file execution to disrupt the campaign.
Critical MCP Integration Flaw Puts NGINX at Risk

www.darkreading.com · 6 months ago

There is a critical vulnerability in the nginx-ui implementation of the Model Context Protocol that allows unauthenticated attackers to invoke MCP commands and restart, create, modify, or delete NGINX configuration files, enabling full takeover of NGINX-managed services. The flaw is tracked as CVE-2026-33032 with a CVSS score of 9.8 and stems from an unauthenticated mcpmessage endpoint and use of a static nodesecret, and it is often combined with CVE-2026-27944 which exposed backups and decryption keys that make retrieving the nodesecret trivial. Over 2,600 publicly exposed nginx-ui instances were found reachable on the default port and maintainers released nginx-ui version 2.3.4 to address the issue. Exploitation can let attackers rewrite proxy configurations to capture traffic, take services offline by forcing invalid reloads, and map internal architectures and certificates.
Ford Says Doug Field, Who Led Company's E.V. Push, is Leaving

www.nytimes.com · 6 months ago

false
That Meeting You Hate May Keep A.I. From Stealing Your Job

www.nytimes.com · 6 months ago

As artificial intelligence automates routine tasks, human work that involves cajoling, arm twisting and reassuring is growing more important. Roles that require persuasion, negotiation, emotional labor and relationship building are increasing in value because people still need trust, accountability and complex social judgment that AI cannot reliably provide. Organizations are shifting job tasks toward oversight, explanation, dispute resolution and human-centered communication while using AI for efficiency and content generation.
Critical nginx UI tool vulnerability opens web servers to full compromise

www.csoonline.com · 6 months ago

A critical vulnerability in the open source nginx UI web server configuration tool has been under active exploitation since March, enabling unauthenticated access to a Model Context Protocol endpoint known as MCPwn. Tracked as CVE-2026-33032 with a CVSS score of 9.8, the flaw exposes twelve MCP tools including config writes with automatic nginx reload, allowing attackers to inject configurations and take over nginx, intercept traffic, harvest credentials, maintain persistence, and perform infrastructure reconnaissance. Researchers found 2,689 internet reachable vulnerable instances and recommend installing patched release version 2.3.4 released March 15 or, until patched, disabling MCP or restricting the IP whitelist and reviewing access logs; related prior attacks against nginx servers exploited CVE-2025-55182.
WordPress plugin suite hacked to push malware to thousands of sites

www.bleepingcomputer.com · 6 months ago

More than 30 WordPress plugins in the EssentialPlugin package were compromised with a backdoor that was introduced after the project changed hands in August 2025, enabling unauthorized access to sites running those plugins. The backdoor was recently activated to fetch a file named wp-comments-posts.php that injects malware into wp-config.php, with an invisible payload that uses Ethereum based command and control to retrieve spam links, redirects, and fake pages while serving the spam only to Googlebot. WordPress.org closed the affected plugins and pushed a forced update to disable the backdoor communications, but wp-config.php is not cleaned and the malware may hide in other files, so administrators must inspect and remediate infected sites manually.
netwatch - Real time network diagnostics in your terminal.

terminaltrove.com · 6 months ago

false
Navigating the Unique Security Risks of Asia's Digital Supply Chain

www.darkreading.com · 6 months ago

false
Comcast’s $117.5M Breach Settlement: Up to 30M People May Qualify

www.techrepublic.com · 6 months ago

Comcast agreed to an 117 point 5 million dollar settlement concerning a data breach. The incident involved the exposure of records belonging to 30 million people. The settlement resolves claims that the company failed to adequately protect customer data.
Snap Is Laying Off 16% of Full-Time Staff as It Embraces A.I.

www.nytimes.com · 6 months ago

false
Ad Companies Settle With F.T.C. Over Claims of Harm to Conservative Sites

www.nytimes.com · 6 months ago

NULL
Signed software abused to deploy antivirus-killing scripts

www.bleepingcomputer.com · 6 months ago

A digitally signed adware tool attributed to Dragon Boss Solutions LLC deployed MSI and PowerShell payloads that ran with SYSTEM privileges and disabled antivirus protections on thousands of endpoints across multiple sectors. Researchers observed more than 23,500 infected hosts in 124 countries contacting the operator infrastructure in a single day, with hundreds of infections inside high value networks including academic institutions, operational technology, municipal governments, and healthcare providers. The operation abused the Advanced Installer update mechanism to silently install a Setup.msi disguised as an image and execute a PowerShell script named ClockRemoval.ps1 that stops services, kills processes, deletes installation directories and registry entries, runs vendor uninstallers, force deletes files, and blocks vendor domains to prevent reinstallation. Because the attackers did not register the main update domain, researchers were able to register and sinkhole it, and they warned the same update mechanism could deliver more dangerous payloads while recommending defenders search for specific WMI event subscriptions and scheduled tasks, review hosts file entries blocking AV vendors, and inspect Defender exclusions for suspicious paths.
n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails

thehackernews.com · 6 months ago

Threat actors have been weaponizing n8n, a popular AI workflow automation platform, since October 2025 to run sophisticated phishing campaigns that send automated emails to deliver malicious payloads and fingerprint devices. By leveraging trusted infrastructure and legitimate n8n webhooks, attackers bypass traditional email security filters and increase deliverability. The campaigns use automated workflows to exfiltrate information and stage further compromise across enterprise environments. Organizations using n8n should audit webhook configurations restrict public access and monitor for unusual outbound email activity.
Sweden Blames Pro-Russian Group for Cyberattack Last Year on Its Energy Infrastructure

www.securityweek.com · 6 months ago

A pro-Russian group with links to Russia's security and intelligence services was responsible for a cyberattack last year that targeted a heating plant in western Sweden but the attack failed, Sweden's minister for civil defense said. Officials compared the incident to coordinated December attacks in Poland that struck combined heat and power plants and other energy infrastructure and said evidence pointed to hackers linked to Russian services. Officials said the attacks target systems controlling critical infrastructure, carry potentially serious consequences for society, and form part of more than 150 incidents of sabotage and malign activity across Europe tracked since February 2022, with similar events reported in Denmark, Norway and Latvia.
Massive Chrome Extension Scam Exposes 20,000 Users to Data Theft

www.techrepublic.com · 6 months ago

Security researchers linked 108 malicious Chrome extensions to a coordinated campaign that exposed about 20,000 users to data theft, backdoors, and ad injection. The extensions, published across five publishers, abused OAuth to steal Google account identities in 54 cases, included a universal backdoor in 45 cases, and also exfiltrated Telegram Web sessions, removed security headers on YouTube and TikTok for ad injection, redirected translation requests through attacker servers, and injected content scripts into every visited page. All 108 extensions were live on the Chrome Web Store when reported, and researchers submitted their findings to Google while advising users to verify publisher reputation and reviews and to keep browsers updated.
Microsoft pays $2.3M for cloud and AI flaws at Zero Day Quest

www.bleepingcomputer.com · 6 months ago

Microsoft has awarded 2.3 million dollars to security researchers after receiving nearly 700 vulnerability submissions to this year's Zero Day Quest, with over 80 high impact cloud and AI flaws identified during a live hacking event at its Redmond campus. Researchers demonstrated credential exposure, server side request forgery chains, and cross tenant access while testing in authorized environments, and Microsoft says the findings will be shared through the CVE program and used across the company under its Secure Future Initiative to improve cloud and AI security.
Incident response for AI: Same fire, different fuel

www.microsoft.com · 6 months ago

There are core incident response principles that still apply to AI including explicit ownership, containment before investigation, safe escalation, and clear transparent communication, but AI non determinism and machine speed change how incidents manifest and how fixes are validated. There are new challenges that require expanded taxonomies for harms such as dangerous instructions or targeted content, improved telemetry for anomalous outputs and classifier confidence shifts, and deliberate reconciliation of privacy preserving defaults with the need for forensics. There are practical recommendations including a three stage remediation approach to stop the bleed, broaden and automate mitigations, and fix at the source, sustained post remediation watch periods because model behavior can vary, and investment in responder wellbeing to manage exposure to harmful content.
Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities

sec.cloudapps.cisco.com · 6 months ago

There are multiple vulnerabilities in the web based management interface of Cisco Identity Services Engine that could allow an authenticated remote attacker with administrative write privileges to perform stored or reflected cross site scripting attacks against users of the interface. The vulnerabilities are caused by insufficient sanitization of user supplied data stored in web pages and can be exploited by convincing a user to click a crafted link or view an affected page, potentially executing injected script in the interface context or exposing sensitive browser based information. Cisco has released software updates to address the vulnerabilities, no workarounds are available, and the issue is tracked as CVE-2026-20132.