Blahalla

He stoked ‘deep state’ conspiracy theories. Now they’re coming back to haunt him.

www.washingtonpost.com · 6 months ago

false

These prophets of economic doom are worried about another collapse

www.washingtonpost.com · 6 months ago

false

Critical XSS Vulnerabilities in Meta Conversion API Enable Zero-Click Account Takeover

gbhackers.com · 6 months ago

Security researchers have identified two critical cross-site scripting, or XSS, vulnerabilities within Meta’s Conversions API Gateway. One vulnerability involves improper origin validation in the client-side JavaScript, potentially allowing attackers to load malicious scripts through CSP bypass techniques. A more severe, stored XSS vulnerability exists in the gateway's backend, enabling attackers to inject arbitrary JavaScript into the capig-events.js file, impacting Meta properties and an estimated 100 million third-party deployments.

Researchers Breach StealC Infrastructure, Access Malware Control Panels

gbhackers.com · 6 months ago

Researchers have discovered three methods attackers can exploit to bypass Apple’s Lockdown mode. These techniques involve manipulating user interface elements, exploiting shared links, and leveraging malicious fonts. Successful exploitation could allow attackers to remotely execute code and potentially gain control of a device. The vulnerabilities affect iOS, macOS, iPadOS, and tvOS versions prior to iOS 17.1, macOS 14.1, iPadOS 17.1, and tvOS 17.1, and have been assigned CVE identifiers CVE-2023-40903, CVE-2023-41002, CVE-2023-41003, CVE-2023-41004, CVE-2023-41005, CVE-2023-41006, CVE-2023-41007, CVE-2023-41008, CVE-2023-41009, and CVE-2023-41010.

Windows 11 January Update Sparks Widespread Shutdown Complaints

gbhackers.com · 6 months ago

Researchers have identified three methods attackers can use to bypass Apple's Lockdown Mode on iPhones. These techniques involve exploiting vulnerabilities in external applications, manipulating Universal Control, and leveraging the Home Connectivity feature. Successful exploitation could grant attackers unauthorized access to sensitive device data and functionality. The vulnerabilities identified are CVE-2023-42052, CVE-2023-42053, CVE-2023-42054, CVE-2023-42055, CVE-2023-42056, CVE-2023-42057, CVE-2023-42058, CVE-2023-42059, CVE-2023-42060, and CVE-2023-42061.

Best Security Awareness Training Platforms For 2026

gbhackers.com · 6 months ago

false

Anatomy of an Attack: The Payroll Pirates and the Power of Social Engineering

unit42.paloaltonetworks.com · 6 months ago

An organization recently experienced a payroll fraud incident where an attacker redirected employee paychecks into their own accounts. The attacker gained access through social engineering tactics, impersonating employees to manipulate help desk personnel and bypass multi-factor authentication. The investigation revealed a need for stronger help desk verification procedures and enhanced multi-factor authentication enforcement. During the investigation, evidence of a WannaCry ransomware compromise within the organization's legacy operational technology environment was also discovered.

Coinbase, the Biggest U.S. Crypto Company, Asserts Its Power in Washington

www.nytimes.com · 6 months ago

false

More Problems for Fortinet: Critical FortiSIEM Flaw Exploited

www.darkreading.com · 6 months ago

A critical vulnerability, CVE-2025-64155, has been discovered in Fortinet’s FortiSIEM platform, allowing unauthenticated attackers to execute remote code. Cybersecurity vendor Defused reports that threat actors, including groups linked to China, have already begun exploiting the flaw in the wild. The vulnerability stems from an issue with the phMonitor service, which has previously led to other maximum-severity flaws like CVE-2024-23108 and CVE-2023-34992. Fortinet advises users running versions 6.7 through 7.4 to update and recommends limiting access to the phMonitor service as a temporary fix.

StealC hackers hacked as researchers hijack malware control panels

www.bleepingcomputer.com · 6 months ago

Researchers discovered a cross-site scripting vulnerability in the control panel used by operators of the StealC malware, allowing them to observe sessions and gather intelligence. The vulnerability enabled the researchers to identify characteristics of the attackers’ computers, including location and hardware details. One StealC customer, known as YouTubeTA, used the malware to compromise YouTube channels and steal sensitive data, including passwords and cookies. The researchers disclosed the flaw to disrupt StealC operations, which have recently increased, potentially due to events involving the Lumma malware.

Trump and States Aim to Stop A.I. From Inflating Energy Bills

www.nytimes.com · 6 months ago

false

White House and governors confront electricity’s rising costs as data centers expand

www.washingtonpost.com · 6 months ago

false

Black Basta boss makes it onto Interpol's 'Red Notice' list

www.bleepingcomputer.com · 6 months ago

Law enforcement in Ukraine and Germany have identified Oleg Evgenievich Nefedov as the leader of the Black Basta ransomware gang, adding him to Europol's Most Wanted and Interpol's Red Notice lists. Nefedov, also known as tramp, is believed to be connected to the now-defunct Conti ransomware group, which splintered into smaller operations like Black Basta. Authorities also raided two locations in Ukraine, seizing digital storage devices and cryptocurrency from suspected members who specialized in gaining initial network access and cracking passwords. Black Basta, operating as a ransomware-as-a-service, has reportedly impacted organizations worldwide, including Rheinmetall, Hyundai, and Ascension.

What a 76-cent average tip reveals about gig work in America

www.washingtonpost.com · 6 months ago

false

Cisco finally patches seven-week-old zero-day flaw in Secure Email Gateway products

www.csoonline.com · 6 months ago

Cisco has released a patch for a critical zero-day vulnerability, CVE-2025-20393, affecting AsyncOS Software used in Secure Email Gateway and Secure Email and Web Manager products. The flaw allows attackers to gain root privileges and complete control of affected appliances if the Spam Quarantine feature is exposed to the internet. Threat intelligence indicates the attacks are linked to a Chinese-nexus threat actor deploying custom persistence mechanisms, including AquaShell. Customers are advised to upgrade to the latest available versions to mitigate the risk and address any potential compromise.

Jordanian initial access broker pleads guilty to helping target 50 companies

therecord.media · 6 months ago

A Jordanian national, Feras Albashiti, has pleaded guilty to selling unauthorized access to computer networks, impacting at least 50 companies. Albashiti, using the online alias "r1z," initially sold cracked software and then access to networks through firewall exploits for $5,000, and later offered malware to disable endpoint detection and response tools for $15,000. Authorities tracked Albashiti through his IP address, which was linked to a $50 million ransomware attack. Cybersecurity firms and government agencies had previously identified "r1z" as a credible threat actor involved in selling exploits for vulnerabilities like CVE-2022-26134 affecting Confluence servers, Cobalt Strike, and other security products. Albashiti faces a maximum of 10 years in prison and will be sentenced in May.

Battles Over Truth Rage Online Amid Iran’s Internet Blackout

www.nytimes.com · 6 months ago

Iran's internet blackout has led to a surge of disinformation and propaganda online. Both the Iranian government and its critics are using social media platforms like X and Instagram to spread conflicting narratives and manipulated visuals. These campaigns often promote figures like Reza Pahlavi or blame the unrest on the United States and Israel. The goal appears to be influencing global public opinion while also reflecting internal divisions within Iran.

GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection

thehackernews.com · 6 months ago

Security researchers have observed a malware loader called GootLoader employing a novel evasion technique using specially crafted ZIP archives. Attackers concatenate 500 to 1,000 ZIP archives together, truncate key data, and randomize field values to bypass automated analysis tools while still allowing the default Windows unarchiver to process the file. This technique, called hashbusting, ensures each user receives a unique file, rendering hash-based detection ineffective. The malware, delivered through SEO poisoning and malvertising, uses JavaScript to create a persistent shortcut and ultimately execute PowerShell commands for further malicious activity.

China-linked hackers exploited Sitecore zero-day for initial access

www.bleepingcomputer.com · 6 months ago

A China-linked hacker group, tracked as UAT-8837, has been targeting critical infrastructure in North America since at least 2025. The group gains initial access by exploiting compromised credentials and vulnerabilities, including a zero-day flaw in Sitecore products, CVE-2025-53690. Once inside a network, attackers use tools like GoTokenTheft, Rubeus, and Earthworm to steal credentials, map the network, and maintain persistent access, often utilizing hands-on-keyboard techniques. Researchers have observed the exfiltration of sensitive data and DLLs, raising concerns about potential supply chain attacks.

Police raid homes of alleged Black Basta hackers, hunt suspected Russian ringleader

therecord.media · 6 months ago

Law enforcement in Ukraine and Germany have identified two Ukrainian citizens suspected of involvement with the Black Basta ransomware group, which has targeted companies worldwide, including ABB and Ascension, causing significant financial losses. The suspects allegedly specialized in obtaining login credentials and preparing ransomware attacks. Authorities have also placed a 36-year-old Russian national, Oleg Nefedov, believed to be the group’s leader, on an international wanted list, suspecting him of orchestrating the group's operations and ransom demands. Nefedov is allegedly connected to the Conti ransomware group and may be in Russia.

ServiceNow Virtual Agent Auth Bypass → AI Agent Privilege Escalation (85% Fortune 500 affected)

opena2a.org · 6 months ago

A significant AI security vulnerability recently impacted a large number of companies. Attackers exploited vulnerabilities like shared credentials and email-only authentication to potentially take control of systems. A new solution, Agent Identity Management or AIM, is designed to address these issues by treating AI agents as unique identities with specific access controls and continuous monitoring. AIM offers both free, open-source and managed hosting options.

Verizon starts issuing $20 credits after nationwide outage

www.bleepingcomputer.com · 6 months ago

false

In Other News: FortiSIEM Flaw Exploited, Sean Plankey Renominated, Russia’s Polish Grid Attack

www.securityweek.com · 6 months ago

A vulnerability in Fortinet’s FortiSIEM, tracked as CVE-2025-64155, is currently being exploited by unauthenticated attackers for arbitrary code execution. Telegram has implemented a warning to alert users of disguised proxy links that can expose their IP addresses. Poland experienced a large-scale cyberattack on its power grid in late 2025, which officials attribute to Russian hackers. Additionally, five Venezuelan nationals have been prosecuted for their involvement in an ATM jackpotting ring targeting financial institutions.

CISOs Rise to Prominence: Security Leaders Join the Executive Suite

www.darkreading.com · 6 months ago

false

Go Programming Language 1.26 Patches Several Security Flaws

www.techrepublic.com · 6 months ago

Security updates have been released for Go versions 1.25.6 and 1.24.12 to address six vulnerabilities, ranging from denial-of-service attacks to toolchain flaws enabling code execution. Several vulnerabilities impact core components like the archive/zip package, net/http, and the crypto/tls module. The updates resolve issues such as excessive CPU consumption when processing ZIP archives, memory exhaustion during form parsing, and improper handling of TLS session tickets. Two critical vulnerabilities, CVE-2025-61731 and CVE-2025-68119, affect the Go toolchain, potentially allowing arbitrary command execution during module fetching and dependency resolution. Organizations are advised to upgrade to the patched versions to mitigate these risks.

StackWarp: Exploiting Stack Layout Vulnerabilities in Modern Processors

stackwarpattack.com · 6 months ago

NULL

AI and the Corporate Capture of Knowledge

www.schneier.com · 6 months ago

false

Google Vertex AI security permissions could amplify insider threats

www.csoonline.com · 6 months ago

Google’s Vertex AI platform has vulnerabilities that allow users with minimal privileges to escalate to higher-privileged Service Agent roles, according to XM Cyber. These Service Agents, which are managed identities used by Google Cloud to access resources, are granted broad permissions for functionality, creating a risk of privilege escalation if compromised. Google maintains the system operates as intended, highlighting a misalignment between enterprise security principles and cloud provider defaults. Experts recommend CISOs audit AI workloads and monitor service agent behavior to detect potential abuse, as current security tools often overlook these vulnerabilities.

Project Eleven Raises $20 Million for Post-Quantum Security

www.securityweek.com · 6 months ago

false

Canadian investment regulator confirms hackers hit 750,000 investors

therecord.media · 6 months ago

Canadian Investment Regulatory Organization, or CIRO, has confirmed a cyber incident impacted approximately 750,000 investors. The breach, resulting from a phishing attack detected last August, potentially exposed personal information including dates of birth, phone numbers, social insurance numbers, and account statements. While login credentials were not compromised, CIRO is offering affected investors two years of credit monitoring and identity theft protection. The organization states there is currently no evidence the information has been misused and is working to strengthen cybersecurity defenses.

Google and Mozilla Patch 26 Security Flaws in Chrome 144, Firefox 147

www.techrepublic.com · 6 months ago

Google and Mozilla have released major browser updates, Chrome 144 and Firefox 147, addressing a total of 26 security vulnerabilities. Chrome 144 fixes ten issues, including three high-severity bugs found in the V8 and Blink engines, with CVE-2026-0899, CVE-2026-0900, and CVE-2026-0901. Firefox 147 resolves sixteen security flaws, notably four sandbox escape vulnerabilities within its Graphics and Messaging System components. While no active exploits have been reported, security experts recommend promptly updating to protect against potential attacks.

Five Malicious Chrome Extensions Impersonate Workday and NetSuite to Hijack Accounts

thehackernews.com · 6 months ago

Cybersecurity researchers have identified five malicious Google Chrome extensions designed to steal account credentials and compromise user accounts. These extensions, published under names like DataByCloud Access and Software Access, impersonate legitimate HR and ERP platforms such as Workday and NetSuite. The extensions steal authentication cookies, block security administration pages, and facilitate session hijacking through cookie injection. Users are advised to remove the extensions, reset passwords, and monitor for unauthorized access.

AI System Reduces Attack Reconstruction Time From Weeks to Hours

www.darkreading.com · 6 months ago

false

Google Begins Rolling Out Long-Awaited @gmail.com Email Feature to Users

gbhackers.com · 6 months ago

false

Modular DS bug hands hackers instant WordPress admin access

www.csoonline.com · 6 months ago

Security researchers have confirmed that a critical vulnerability in the Modular DS plugin, used for managing WordPress sites, is being actively exploited. The flaw, identified as CVE-2026-23550, allows unauthenticated attackers to gain full administrator access to vulnerable sites. The vulnerability stems from an oversight in the plugin’s authentication logic, enabling attackers to bypass authentication and access sensitive routes. A fix, version 2.5.2, has been released, and users are urged to update immediately, as over 40,000 installations remain at risk.

WEF 2026: KI weiterhin Top-Thema in der Cybersicherheit

www.csoonline.com · 6 months ago

false

Cisco Secure Email Gateway Zero-Day RCE Exploited in Active Attacks

gbhackers.com · 6 months ago

Cisco has confirmed an active cyberattack campaign exploiting a zero-day vulnerability in its Secure Email Gateway and Email and Web Manager appliances. The critical vulnerability, CVE-2025-20393, allows unauthenticated attackers to execute commands with root privileges due to insufficient input validation in the Spam Quarantine feature. The vulnerability affects devices running vulnerable AsyncOS software with the Spam Quarantine feature enabled and exposed to the internet. Cisco has released software updates to address the vulnerability and strongly recommends immediate patching, alongside restricting access to the affected appliances.

NSA Publishes New Guidelines for Implementing a Zero Trust Security Model

gbhackers.com · 6 months ago

false

750,000 Impacted by Data Breach at Canadian Investment Watchdog

www.securityweek.com · 6 months ago

A data breach at the Canadian Investment Regulatory Organization, or CIRO, has impacted approximately 750,000 individuals. The breach, stemming from a phishing attack in August 2025, exposed personal information like annual income, dates of birth, government ID numbers, and investment account details. CIRO reports that passwords and security questions were not compromised and no misuse of the data has been detected. Affected individuals are being offered two years of free credit monitoring and identity theft protection services.

Cyber Insights 2026: Social Engineering

www.securityweek.com · 6 months ago

Cybersecurity experts predict a significant shift in social engineering attacks by 2026, driven by artificial intelligence. Attackers will utilize AI to exploit trust through personalized campaigns incorporating deepfakes and synthetic data. The increasing availability of phishing-as-a-service platforms and collaboration between social engineers and ransomware groups amplifies the threat. Experts recommend fostering a culture of skepticism and implementing stringent verification processes to mitigate these evolving risks.

How Activists in Iran Are Using Starlink to Stay Online

www.nytimes.com · 6 months ago

Iranian authorities recently enacted a communications blackout to suppress protests, but activists circumvented the shutdown using smuggled Starlink satellite internet systems. Approximately 50,000 terminals have been brought into the country, defying Iranian law and enabling the sharing of information about the protests. The Iranian government responded by deploying electronic warfare to disrupt Starlink’s GPS signals. This situation highlights a growing trend where digital blackouts are becoming increasingly difficult to enforce due to the spread of technologies like satellite internet.

Microsoft: Windows 11 update causes Outlook freezes for POP users

www.bleepingcomputer.com · 6 months ago

Microsoft is investigating reports that a recent Windows 11 security update is causing the classic Outlook desktop client to freeze and hang for users utilizing POP email accounts. The issue appears after installing security update KB5074109 for Windows 11 versions 25H2 and 24H2. A temporary workaround involves uninstalling the problematic security update, though this could leave systems vulnerable to security threats. Microsoft has not yet provided a timeline for a permanent fix.

Jonathan Haidt Strikes Again + What You Vibecoded + An Update on the Forkiverse

www.nytimes.com · 6 months ago

false

WhisperPair Attack Leaves Millions of Audio Accessories Open to Hijacking

www.securityweek.com · 6 months ago

Researchers have identified a critical vulnerability, tracked as CVE-2025-36911, in the Google Fast Pair Bluetooth pairing process. This flaw allows attackers within roughly 46 feet to forcibly pair audio accessories like headphones and speakers with their devices without user consent. Exploitation, dubbed WhisperPair, can grant attackers control over the accessory, enabling actions like playing audio or recording conversations, and potentially tracking users via Google’s Find Hub network. Multiple manufacturers, including Google, Jabra, JBL, Logitech, and Xiaomi, are affected, and users are urged to update both their Android phones and accessory firmware.

UAT-8837 Launches Targeted Attacks to Steal Sensitive Organizational Data

gbhackers.com · 6 months ago

A China-linked advanced persistent threat group, UAT-8837, is targeting critical infrastructure sectors in North America. The group is using known vulnerabilities and zero-day exploits, including CVE-2025-53690 in Sitecore products, to gain access and steal sensitive data. Once inside networks, they employ tools like Earthworm, SharpHound, and DWAgent to map systems and exfiltrate credentials and organizational secrets. Security professionals are advised to monitor RDP configurations and Active Directory activity, implement multi-factor authentication, and patch Sitecore installations.

Cybersecurity Firms React to China’s Reported Software Ban

www.securityweek.com · 6 months ago

false

Your Digital Footprint Can Lead Right to Your Front Door

thehackernews.com · 6 months ago

false

Hackers now exploiting critical Fortinet FortiSIEM flaw in attacks

www.bleepingcomputer.com · 6 months ago

Hackers are actively exploiting a critical vulnerability in Fortinet FortiSIEM appliances. The flaw, identified as CVE-2025-64155, allows unauthenticated attackers to execute unauthorized code and escalate privileges to root access through an OS command injection. Fortinet has released security updates to address the issue and provided a temporary workaround by limiting access to the phMonitor port. Indicators of compromise are available to help identify affected systems, and organizations are advised to upgrade to a patched version of FortiSIEM.

LOTUSLITE Backdoor Targets U.S. Policy Entities Using Venezuela-Themed Spear Phishing

thehackernews.com · 6 months ago

Security experts have identified a new malware campaign targeting U.S. government and policy entities. The campaign, attributed to the Chinese state-sponsored group Mustang Panda, uses spear phishing emails with Venezuela-themed lures to deliver the LOTUSLITE backdoor. The backdoor uses DLL side-loading for execution and communicates with a command-and-control server to perform tasks like remote command execution and data exfiltration. The activity highlights the continued use of reliable execution techniques over complex exploits.

Multiple cross-site leaks disclosing Facebook users in third-party websites

ysamm.com · 6 months ago

Researchers have identified multiple cross-site leakage (XS-Leak) vulnerabilities affecting Facebook, Workplace, and Meta for Work platforms. These vulnerabilities allow attackers to identify logged-in users and Meta employees through techniques like observing response differences in callback endpoints, manipulating Facebook plugin behavior, and exploiting JavaScript payload leakage. One method directly reveals Facebook user IDs via a JavaScript file, bypassing traditional timing side channels. The identified issues facilitate user de-anonymization, cross-platform fingerprinting, and targeted attacks, and were resolved between December 2024 and May 2025.