Blahalla

Hackers now exploiting critical Fortinet FortiSIEM flaw in attacks

www.bleepingcomputer.com · 6 months ago

Hackers are actively exploiting a critical vulnerability in Fortinet FortiSIEM appliances. The flaw, identified as CVE-2025-64155, allows unauthenticated attackers to execute unauthorized code and escalate privileges to root access through an OS command injection. Fortinet has released security updates to address the issue and provided a temporary workaround by limiting access to the phMonitor port. Indicators of compromise are available to help identify affected systems, and organizations are advised to upgrade to a patched version of FortiSIEM.

LOTUSLITE Backdoor Targets U.S. Policy Entities Using Venezuela-Themed Spear Phishing

thehackernews.com · 6 months ago

Security experts have identified a new malware campaign targeting U.S. government and policy entities. The campaign, attributed to the Chinese state-sponsored group Mustang Panda, uses spear phishing emails with Venezuela-themed lures to deliver the LOTUSLITE backdoor. The backdoor uses DLL side-loading for execution and communicates with a command-and-control server to perform tasks like remote command execution and data exfiltration. The activity highlights the continued use of reliable execution techniques over complex exploits.

Multiple cross-site leaks disclosing Facebook users in third-party websites

ysamm.com · 6 months ago

Researchers have identified multiple cross-site leakage (XS-Leak) vulnerabilities affecting Facebook, Workplace, and Meta for Work platforms. These vulnerabilities allow attackers to identify logged-in users and Meta employees through techniques like observing response differences in callback endpoints, manipulating Facebook plugin behavior, and exploiting JavaScript payload leakage. One method directly reveals Facebook user IDs via a JavaScript file, bypassing traditional timing side channels. The identified issues facilitate user de-anonymization, cross-platform fingerprinting, and targeted attacks, and were resolved between December 2024 and May 2025.

Go 1.26 Released With Fixes for Multiple Vulnerabilities Causing Memory Exhaustion

gbhackers.com · 6 months ago

Go versions 1.25.6 and 1.24.12 have been released to address six critical security vulnerabilities. These vulnerabilities involve memory exhaustion in the net/http Request.ParseForm function, leading to potential denial-of-service attacks. There are also flaws in the crypto/tls module enabling unauthorized session resumption and vulnerabilities in the cmd/go toolchain that allow for arbitrary code execution. The identified CVEs include CVE-2025-61728, CVE-2025-61726, CVE-2025-68121, CVE-2025-61731, CVE-2025-68119, and CVE-2025-61730.

Instagram account takeover via Meta Pixel script abuse

ysamm.com · 6 months ago

Researchers discovered a vulnerability allowing attackers to steal Instagram OAuth codes and generate first-party access tokens, potentially enabling account takeovers. The attack exploits a misconfigured Facebook endpoint and trust in cross-window messaging within the fbevents.js script, which is widely used on Meta properties and third-party websites. Attackers can manipulate messages to extract sensitive data like OAuth codes and tokens, which are then used to obtain a first-party Instagram access token. Meta addressed the vulnerability and awarded a security bounty for its disclosure.

Leaking Meta FXAuth Token leading to 2 click Account Takeover

ysamm.com · 6 months ago

A flaw in Meta’s FXAuth authentication system allowed attackers to steal and reuse tokens, leading to account linking and takeover. The vulnerability stemmed from a redirect flaw where the baseuri parameter, intended to restrict redirect destinations to Meta domains, could be exploited through older applications registered on apps.facebook.com. This enabled attackers to control JavaScript execution and extract sensitive tokens, bypassing confirmation steps for actions like account linking and re-authentication. Meta addressed the issue in January 2026 after multiple reports and bounty awards.

TikTok to Roll Out Stronger Age Verification Across the EU

www.techrepublic.com · 6 months ago

false

Cisco Patches Vulnerability Exploited by Chinese Hackers

www.securityweek.com · 6 months ago

Cisco has released patches to address a critical vulnerability, identified as CVE-2025-20393, in its Secure Email Gateway and Secure Email and Web Manager products. This flaw allows attackers to execute commands with root privileges on affected devices due to insufficient validation of HTTP requests. The attacks, attributed to the China-linked APT group UAT-9686, have been actively exploited since at least November 2025 to install backdoors like AquaShell and tunneling tools such as AquaTunnel. Users are strongly advised to update their software to the specified fixed versions to remediate the vulnerability and remove any installed persistence mechanisms.

AWS Console Supply Chain Breach Enables GitHub Repository Hijacking

gbhackers.com · 6 months ago

A supply chain attack is targeting the Amazon Web Services management console, allowing attackers to hijack GitHub repositories. Cybercriminals are exploiting misconfigured AWS credentials and integrated GitHub actions, often finding leaked access tokens in public repositories. Once inside, they can deploy malicious code, modify data, and gain persistent access through compromised build infrastructure. Developers are advised to use least-privilege access, rotate credentials, and enable secret scanning to mitigate this growing threat.

Cisco finally fixes AsyncOS zero-day exploited since November

www.bleepingcomputer.com · 6 months ago

Cisco has released a patch to address a maximum-severity zero-day vulnerability affecting Cisco AsyncOS software used in Secure Email Gateway and Secure Email and Web Manager appliances. The flaw, identified as CVE-2025-20393, allows attackers to execute commands with root privileges if the Spam Quarantine feature is enabled and exposed online. The attacks are attributed to a Chinese hacking group known as UAT-9686, who have deployed malware including AquaShell, AquaTunnel, and AquaPurge. The Cybersecurity and Infrastructure Security Agency has added the vulnerability to its list of known exploited vulnerabilities and directed federal agencies to remediate the issue.

Zero-Click Exploit Chain Discovered Targeting Google Pixel 9 Devices

gbhackers.com · 6 months ago

Security researchers have discovered a zero-click exploit chain affecting Google Pixel 9 smartphones. The exploit sequence combines vulnerabilities in the Dolby audio decoder, a kernel driver, and a third, undisclosed weakness to achieve code execution and privilege escalation. Specifically, CVE-2025-54957 is an integer overflow in the Dolby Unified Decoder, CVE-2025-36934 is a privilege escalation vulnerability in a kernel driver, and CVE-2025-49415 is a buffer overflow in a Monkey’s Audio codec. The vulnerabilities are being exploited due to the automatic processing of audio attachments by Google Messages, dramatically expanding the attack surface on Android devices.

Azure Identity Token Flaw Exposes Windows Admin Center to Tenant-Wide Breaches

gbhackers.com · 6 months ago

Researchers have identified a high-severity authentication bypass vulnerability, CVE-2026-20965, affecting Microsoft Windows Admin Center’s Azure AD Single Sign-On. This flaw allows an attacker with local administrator access to compromise other systems within the same Azure tenant by exploiting improper validation of tokens. The vulnerability impacts Azure Virtual Machines and Azure Arc-connected machines running versions of the Windows Admin Center Azure Extension prior to 0.70.00, and Microsoft released a security update on January 13, 2026. Organizations should upgrade and monitor for suspicious virtual accounts created with the email address format [email protected].

Microsoft: Some Windows PCs fail to shut down after January update

www.bleepingcomputer.com · 6 months ago

Some Windows 11 devices running Enterprise and IoT editions are experiencing issues shutting down or entering hibernation after installing the January 13, 2026, security update, KB5073455. This problem occurs on systems with System Guard Secure Launch enabled, causing them to restart instead of shutting down. A temporary workaround involves using the shutdown /s /t 0 command in the command prompt. Microsoft is also investigating a bug with KB5074109 that affects Remote Desktop connections and another that triggers security application flags on Windows components.

Former CISA Director Jen Easterly Appointed CEO of RSAC

www.securityweek.com · 6 months ago

false

China-Linked APT Exploited Sitecore Zero-Day in Critical Infrastructure Intrusions

thehackernews.com · 6 months ago

A China-linked advanced persistent threat, tracked as UAT-8837, has been targeting critical infrastructure in North America since last year. The group uses tactics like exploiting zero-day vulnerabilities, including CVE-2025-53690 in Sitecore, to gain initial access and harvest sensitive information. Once inside a network, the threat actor deploys tools such as GoTokenTheft, EarthWorm, and SharpHound for reconnaissance and persistent access. Researchers noted the possibility of trojanizing shared libraries during intrusions, potentially leading to supply chain compromises.

Insider risk in an age of workforce volatility

www.csoonline.com · 6 months ago

Economic pressures, AI-driven job displacement, and organizational churn are significantly increasing insider risk across industries. AI agents, with privileged access and rapid decision-making capabilities, are emerging as a major threat vector, potentially enabling data exfiltration or disruption. Security leaders are concerned about AI misuse and the challenges posed by hybrid work models, which limit visibility and control. Organizations must adopt holistic mitigation strategies that integrate behavioral analytics for both human and machine activity, prioritize reskilling programs, and strengthen governance of machine identities.

Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways

thehackernews.com · 6 months ago

Cisco has released security updates to address a critical zero-day remote command execution vulnerability, CVE-2025-20393, affecting Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. This flaw allows attackers to execute commands with root privileges if the appliance is vulnerable, has the Spam Quarantine feature enabled, and is accessible from the internet. The vulnerability was exploited by a China-linked APT group, UAT-9686, to deploy tools like ReverseSSH, Chisel, and AquaShell. Cisco recommends several mitigation steps, including disabling HTTP and enforcing strong authentication.

One click is all it takes: How ‘Reprompt’ turned Microsoft Copilot into data exfiltration tools

www.csoonline.com · 6 months ago

Researchers have discovered a new attack technique called "Reprompt" that exploits Microsoft Copilot to exfiltrate data. The attack uses a three-step process involving URL parameter injection, repeated requests to bypass initial security checks, and chain requests to extract sensitive information. Attackers can initiate this data theft with a single click on a malicious link and continue extracting data even after the user closes the chat. Security experts recommend treating URLs as untrusted, implementing phishing-resistant authentication, and limiting LLM access to prevent data breaches.

State and Federal Lawmakers Want Data Centers to Pay More for Energy

www.nytimes.com · 6 months ago

false

Google now lets you change your @gmail.com address, rolling out

www.bleepingcomputer.com · 6 months ago

false

WinBoat: Drive by Client RCE + Sandbox escape.

hack.do · 6 months ago

Researchers have identified a critical vulnerability in WinBoat, an application that allows Linux users to run Windows applications. Attackers can exploit a permissive, unauthenticated HTTP API endpoint to replace a component within the Windows container, leading to remote code execution on the Linux host. This occurs because the application trusts and interpolates guest-provided paths into shell commands when a user clicks a malicious application entry. The vulnerability affects versions of WinBoat up to v0.8.7, and was resolved in v0.9.0 by requiring authentication.

Palo Alto Networks patches firewalls after discovery of a new denial-of-service flaw

www.csoonline.com · 6 months ago

Palo Alto Networks has released patches to address a denial-of-service vulnerability affecting its PAN-OS firewall platform. The flaw, identified as CVE-2026-0227, allows unauthenticated attackers to trigger maintenance mode, potentially causing network outages. A proof of concept for the vulnerability exists, and it shares similarities with a previous issue, CVE-2024-3393. Most Prisma Access customers have already been patched, but PAN-OS NGFW users with GlobalProtect enabled need to apply the update to avoid disruption.

ChatGPT is now more reliable at finding and remembering your past chat

www.bleepingcomputer.com · 6 months ago

false

Gootloader now uses 1,000-part ZIP archives for stealthy delivery

www.bleepingcomputer.com · 6 months ago

The Gootloader malware is now using a sophisticated technique to evade detection, utilizing malformed ZIP archives containing up to 1,000 concatenated files. This method causes common analysis tools like 7-Zip and WinRAR to crash while still allowing Windows to unpack the malicious JScript file. Attackers are employing several obfuscation techniques, including truncated file headers, randomized disk numbers, and XOR encoding, to avoid static detection. Once executed, the malware uses Windows Script Host and PowerShell to establish persistence on the system.

Possible software supply chain attack through AWS CodeBuild service blunted

www.csoonline.com · 6 months ago

Researchers discovered a vulnerability in the AWS CodeBuild service that could have allowed attackers to compromise key AWS GitHub repositories. The issue involved a flaw in how build triggers were handled, stemming from a missing two characters in a regular expression filter. AWS quickly resolved the problem and implemented additional security measures, stating that no customer environments or services were impacted. To prevent future incidents, AWS recommends developers secure their CodeBuild-GitHub connections and prevent untrusted pull requests from triggering privileged builds.

Eurail customer database hacked

www.csoonline.com · 6 months ago

Eurail has confirmed a data breach impacting customer information. The stolen data potentially includes identification details, contact information, and passport numbers. While there’s no evidence of misuse, customers are advised to be cautious of potential phishing scams and identity theft. The European Union has also stated that identification documents, IBAN numbers, and health data may have been compromised for DiscoverEU program participants.

Anchorage police department takes servers offline after cyberattack on service provider

therecord.media · 6 months ago

The Anchorage Police Department has taken action to address a cyberattack impacting a technology service provider, Whitebox Technologies. City IT officials shut down police department servers, disabled third-party access, and removed data from the service provider’s servers. Officials state there is no evidence of data compromise, but systems are being closely monitored and protective measures are being implemented. Whitebox Technologies provides services to municipalities nationwide and is leading the investigation into the incident.

Grubhub confirms hackers stole data in recent security breach

www.bleepingcomputer.com · 6 months ago

Grubhub has confirmed a recent data breach after hackers gained access to its systems and are now demanding a ransom. The company states sensitive customer information like financial details and order history were not affected but is cooperating with a cybersecurity firm and law enforcement. Hackers, believed to be the ShinyHunters cybercrime group, are seeking Bitcoin in exchange for not releasing Salesforce data from February 2025 and Zendesk data stolen recently. The breach is believed to be connected to a previous Salesloft Drift data theft campaign impacting AWS access keys and Snowflake tokens.

Predator Spyware Sample Indicates 'Vendor-Controlled' C2

www.darkreading.com · 6 months ago

Mobile security firm Jamf has discovered sophisticated anti-analysis features within the Predator spyware, suggesting the vendor, Intellexa, has more control over deployments than previously claimed. The spyware reports specific error codes to a command-and-control server, allowing operators to diagnose and correct failed attacks. Researchers found Predator terminates deployment when iOS Developer Mode is enabled, providing a potential defense strategy. Intellexa has not responded to requests for comment and its website appears abandoned.

Chinese hackers targeting ‘high value’ North American critical infrastructure, Cisco says

therecord.media · 6 months ago

Chinese government-backed hacking groups, specifically identified as UAT-8837, have targeted North American critical infrastructure organizations. These actors gained initial access through compromised credentials and exploited vulnerabilities, including CVE-2025-53690 affecting SiteCore products. The attackers used tools like Earthworm to expose internal endpoints and establish remote access, indicating potential access to zero-day exploits. This activity has heightened concerns about Chinese cyber threats, especially after recent incidents targeting Congressional staffers and industrial control systems.

Kaiser to Pay $46M in Patient Data Lawsuit. Find Out If You’re Eligible

www.techrepublic.com · 6 months ago

Kaiser Permanente has agreed to a 46 million dollar settlement over claims that patient health information was improperly shared online with companies like Google, Microsoft, Twitter, and Adobe. The lawsuit alleges that data was transmitted to third parties during routine use of Kaiser’s online platforms between 2017 and 2024. Affected patients who used Kaiser’s digital platforms during that time may be eligible to submit a claim for a potential payout, with the deadline being March 12, 2026. Kaiser maintains it did not violate patient privacy but settled to avoid litigation costs.

Hackers exploit Modular DS WordPress plugin flaw for admin access

www.bleepingcomputer.com · 6 months ago

Hackers are exploiting a vulnerability in the Modular DS WordPress plugin to gain administrator access to sites. The flaw, identified as CVE-2026-23550, affects versions 2.5.1 and earlier and allows remote bypass of authentication. Attackers began exploiting the vulnerability on January 13th. A fix was released in version 2.5.2, which removed URL-based route matching and added security checks.

CISA Issues New AI Security Guidance for Critical Infrastructure

www.techrepublic.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency, or CISA, has issued new guidance to address the growing risks of artificial intelligence in critical infrastructure operational technology, or OT. The increasing use of tools like ChatGPT within these environments, which manage essential services like power grids and water treatment, creates vulnerabilities that could lead to data breaches and disruptions. The guidance outlines four key principles: understanding AI risks, assessing AI use, establishing governance frameworks, and embedding safety and security practices. Experts warn that a lack of cybersecurity expertise within the OT sector poses a significant challenge to effectively mitigating these threats.

Verizon blames nationwide outage on a "software issue"

www.bleepingcomputer.com · 6 months ago

A nationwide wireless outage affecting Verizon customers began January 14th around noon Eastern Time. The disruption, which left many phones in SOS mode and preventing some calls to 911, impacted users across the United States. Verizon attributes the outage to a software issue and is conducting a review, stating there's no indication of a cybersecurity incident. Affected customers will receive a 20 dollar account credit.

AWS CodeBuild Misconfiguration Exposed GitHub Repos to Potential Supply Chain Attacks

thehackernews.com · 6 months ago

A misconfiguration in AWS CodeBuild, nicknamed CodeBreach, exposed several AWS-managed GitHub repositories to potential supply chain attacks. The flaw involved improperly configured webhook filters, allowing attackers to bypass security measures and gain administrative privileges over repositories like aws-sdk-js-v3. Attackers could have then injected malicious code, exfiltrated secrets, and pushed changes directly to main branches. AWS has fixed the issue and implemented additional security measures, noting no evidence of exploitation.

Stand-alone Grok app still undresses women after X curtails access to tool

www.washingtonpost.com · 6 months ago

The social media platform X is restricting its Grok AI image generation tool. This action follows widespread outrage over the creation of sexualized images of individuals without their permission. X stated it is disabling the tool in specific regions to comply with local laws. Prime Minister Keir Starmer has publicly condemned the actions of Grok and X.

Winter Olympics Could Share Podium With Cyberattackers

www.darkreading.com · 6 months ago

Cybercriminals are targeting the upcoming Winter Olympics in Milano Cortina, with potential attacks ranging from disruptions to ransomware and espionage. Financially motivated actors may target critical infrastructure like ticketing and payment systems for extortion, while nation-state groups are likely to conduct espionage on high-profile attendees. Hacktivists aim to use the event to amplify their messages through data leaks and website disruptions, potentially leveraging AI-generated phishing scams and deepfakes. Security experts anticipate attacks will exploit vulnerabilities within the complex network of systems and vendors supporting the Games.

Microsoft Copilot Studio extension for VS Code now publicly available

www.bleepingcomputer.com · 6 months ago

false

NSA, Cyber Command nominee defends record during Senate hearing

therecord.media · 6 months ago

false

Forget Predictions: True 2026 Cybersecurity Priorities From Leaders

www.securityweek.com · 6 months ago

false

New ‘StackWarp’ Attack Threatens Confidential VMs on AMD Processors

www.securityweek.com · 6 months ago

Researchers have discovered a hardware vulnerability, dubbed StackWarp, affecting AMD processors from Zen 1 to Zen 5. This software-based attack exploits a synchronization failure, allowing a malicious host to manipulate virtual machines and potentially execute code. Demonstrations include stealing RSA keys, bypassing authentication, and gaining kernel access. AMD has rated the vulnerability as low severity and released patches in July 2025, assigning it the CVE identifier CVE-2025-29943.

Closing the Door on Net-NTLMv1: Releasing Rainbow Tables to Accelerate Protocol Deprecation

cloud.google.com · 6 months ago

Security researchers are releasing a dataset of Net-NTLMv1 rainbow tables to accelerate the deprecation of this outdated and insecure protocol. The tables allow for the recovery of Net-NTLMv1 keys within hours using readily available hardware, lowering the barrier to demonstrating the protocol’s vulnerability. This legacy protocol allows for trivial credential theft and can be exploited to compromise Active Directory accounts, potentially leading to privilege escalation and DCSync attacks. Security professionals are urged to disable Net-NTLMv1 to prevent authentication coercion attacks.

Vibe Coding Tested: AI Agents Nail SQLi but Fail Miserably on Security Controls

www.securityweek.com · 6 months ago

Recent testing of five AI coding agents revealed significant security vulnerabilities in generated applications. The agents, including Anysphere Cursor, Claude Code, OpenAI Codex, Replit, and Cognition Devin, successfully avoided common issues like SQL injection and cross-site scripting but struggled with authorization and server-side request forgery, resulting in 69 vulnerabilities. A key concern is the consistent failure to implement basic security controls, highlighting a need for improved prompting techniques and increased programmer rigor. While vibe coding offers speed and cost savings, it requires careful oversight to ensure security and production readiness.

Google to pay $8.25 million to settle lawsuit alleging children’s privacy violations

therecord.media · 6 months ago

Google has reached a proposed $8.25 million settlement to resolve a class-action lawsuit alleging illegal data collection from children under 13. The lawsuit claims Google’s AdMob software collected data from children who downloaded apps through the Play Store, despite assurances of compliance with the Children's Online Privacy Protection Act. These apps were part of Google’s “Designed for Families” program. The settlement follows another recent agreement for $30 million related to data collection practices on Google’s YouTube platform.

BreachLock Expands Adversarial Exposure Validation (AEV) to Web Applications

gbhackers.com · 6 months ago

Researchers have discovered vulnerabilities in multiple widely used open-source libraries, potentially impacting numerous applications. The flaws include a denial-of-service vulnerability in ImageMagick, allowing attackers to crash systems through specially crafted images. Another issue involves a path traversal vulnerability in Exiv2, potentially enabling unauthorized file access. A third vulnerability is a use-after-free bug in OpenSSL, which could lead to remote code execution. The identified vulnerabilities have been assigned CVE identifiers CVE-2024-24845, CVE-2024-24846, and CVE-2024-24847.

WEF: AI overtakes ransomware as fastest-growing cyber risk

www.fortra.com · 6 months ago

Artificial intelligence has surpassed ransomware as the fastest-growing cyber risk, according to a new report. The increased integration of AI systems expands the attack surface and lowers the barrier for sophisticated phishing attacks. A major concern is data leaks from organizations' own AI tools, with many worried about AI agents accumulating excessive privileges and introducing vulnerabilities at scale. While 77% of firms have adopted AI for cybersecurity, a significant portion lacks a process to validate AI security before deployment.

AppGuard Critiques AI Hyped Defenses; Expands its Insider Release for its Next-Generation Platform

gbhackers.com · 6 months ago

false

Demonstration: prompt-injection failures in a simulated help-desk LLM

www.ihackai.com · 6 months ago

NULL

Critical WhisperPair flaw lets hackers track, eavesdrop via Bluetooth audio devices

www.bleepingcomputer.com · 6 months ago

A critical vulnerability, designated CVE-2025-36911 and nicknamed WhisperPair, has been identified in Google’s Fast Pair protocol affecting numerous Bluetooth audio devices from manufacturers like Google, Jabra, and Sony. The flaw allows attackers to hijack these devices, track users, and eavesdrop on conversations from a range of up to 14 meters. Attackers can exploit this by initiating a Bluetooth pairing process without user consent, potentially gaining control over the device's audio and microphone. Users are advised to install firmware updates from manufacturers to mitigate the risk, as disabling Fast Pair on phones does not resolve the issue.

Critical flaw lets hackers track, eavesdrop via Bluetooth audio devices

www.bleepingcomputer.com · 6 months ago

A critical vulnerability, designated CVE-2025-36911 and nicknamed WhisperPair, affects millions of Bluetooth audio devices from numerous manufacturers. The flaw allows attackers to hijack devices, track users, and eavesdrop on conversations by exploiting a weakness in Google's Fast Pair protocol. Attackers can forcibly pair with vulnerable accessories from a distance of up to 14 meters using common Bluetooth devices. Users are advised to install firmware updates from manufacturers to mitigate the risk.