Blahalla

Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT

thehackernews.com · 19 days ago

Unknown parties exploited a recently patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances. Mandiant Consulting and Google Threat Intelligence Group observed this activity in September 2026. The attacks targeted government, financial services, and education across North America and Europe.

OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted

thehackernews.com · 19 days ago

OpenSSL released fixes on September 29 addressing a high-severity flaw in DTLS, the TLS variant for UDP traffic. This vulnerability enables heap memory leakage or program crashes during certain DTLS handshakes. Specifically, the flaw occurs when a handshake message resend starts while a larger message remains stuck part-way.

OperTraitor Finds Kubernetes Operators With Cluster-Wide Secret Access and Admin Paths

gbhackers.com · 19 days ago

OperTraitor found 5% of audited K8s operators had excess RBAC privileges. Unit 42 flagged Prometurbo for wild card secret access, causing CVE-2026-6389. This allowed attackers to compromise secrets and keys.

Linux Kernel CVE-2026-72018 Flaw Lets Local Attackers Gain Root Access

gbhackers.com · 19 days ago

Researchers at XBOW discovered CVE-2026-72018, a high-severity Linux kernel vulnerability allowing local privilege escalation. The flaw permits a CAPNETADMIN user to achieve root access via an out-of-bounds write in the SMC-D DIBS loopback implementation. This vulnerability exists because the dibsloopback driver fails to validate write offsets, enabling memory corruption.

Hackers Target 5,700 Microsoft 365 Accounts Using Forgotten Service Accounts With No MFA

gbhackers.com · 19 days ago

UNKCondorFiltration used password spraying via TeamFiltration to hit 5,700+ M365 accounts in 28 tenants, targeting Chilean finance/retail. They breached 7 forgotten, MFA-lacking service accounts.

South Africa Seeks Help After Cyberattack Targets Air Traffic Control

www.darkreading.com · 19 days ago

South African ATC provider ATNS found ransomware-linked malware in an operational technology network. Monitoring systems detected suspicious activity at Port Elizabeth Airport, suggesting early ransomware stages. The investigation also uncovered signs of data exfiltration to external IP addresses located in China, highlighting cyber risks across aviation infrastructure.

High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL

www.securityweek.com · 19 days ago

OpenSSL developers patched high-severity flaws, including CVE-2026-84782, which permits remote DoS via Datagram TLS (DTLS). They also fixed CVE-2026-84783, a medium-severity weakness. Separately, WolfSSL released updates addressing 11 flaws, including CVE-2026-93302, which allows attackers to bypass peer authentication, alongside CVE-2026-89102 and CVE-2026-89136.

Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account Takeover

gbhackers.com · 19 days ago

Storm-3068 gained persistent access by exploiting a password reset function and removing MFA. The attackers then pivoted through Azure DevOps, abusing the platform to map organizational assets and target deployment pipelines. Finally, they deployed a kubeagent, successfully extracting and committing kubeconfig files, thus achieving direct, independent access to Kubernetes clusters.

Unsloth Fixes Arbitrary Code Execution Flaw Triggered by Malicious Hugging Face Models

gbhackers.com · 19 days ago

Pillar Security's Ariel Fogel found an arbitrary code exec flaw in Unsloth's Studio via malicious Hugging Face models. The issue allowed code execution on model selection. Unsloth fixed this in version 2026.6.9 by disabling default trustremotecode=True and urges immediate updates.

Android Malware Turns Gemini AI Into an Assistant for On-Device Attacks

gbhackers.com · 19 days ago

A newly documented Android banking trojan named RATHat is demonstrating how generative AI can be operationalized inside mobile malware. The threat uses Google Gemini models to navigate unfamiliar Android interfaces, while its operator panel applies AI to identify higher-value victims from stolen SMS data.

SectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets

gbhackers.com · 19 days ago

A newly analyzed SectopRAT campaign demonstrates how threat actors can weaponize trusted application components to conceal a full-featured remote access trojan and steal high-value data. The investigation found no evidence that the software vendor distributed a trojanized build or that the incident stemmed from a supply-chain compromise.

Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution

thehackernews.com · 19 days ago

Cybersecurity researchers revealed critical details regarding a memory overflow flaw in Citrix NetScaler ADC and Gateway. The vulnerability, tracked as CVE-2026-88772, stems from improper handling of the Datagram Transport Layer Security (DTLS) protocol. Active exploitation in the wild highlights the severity of this issue, which carries a CVSS score of 9.5.

OpenAI Launches Codex Security Cloud for Always-On Application Security Scanning

gbhackers.com · 19 days ago

OpenAI has expanded its Codex platform with Codex Security Cloud, a cloud-hosted application security feature that continuously analyzes GitHub repositories, investigates potential vulnerabilities, and prepares remediation patches for human review. Announced as part of the company’s latest Codex updates, this service is designed to operate security workflows beyond a developer’s local machine.

OpenSSL High-Severity Flaw Lets Attackers Leak Heap Memory in Plaintext

gbhackers.com · 19 days ago

OpenSSL has announced a high-severity vulnerability in its Datagram Transport Layer Security (DTLS) implementation that could allow a remote peer to read unintended plaintext heap memory during handshake data transmission or trigger a denial-of-service condition. This vulnerability, tracked as CVE-2026-84782, stems from an out-of-bounds read when handling DTLS handshake message retransmissions.

FBI, Dutch Police Take Down Alleged ShinyHunters Cybercrime Group Leader

gbhackers.com · 19 days ago

The FBI and Dutch National Police have announced the arrest of a 24-year-old man from Amsterdam who is suspected of playing a major role in the ShinyHunters cybercrime group. This development marks a significant step forward in an international investigation into a widespread data theft and extortion operation.

Trump Says Top Tech Firms Have Signed Accord to ‘Self-Police’ AI Development

www.securityweek.com · 19 days ago

The accord opened the door to future regulation but focused on four voluntary steps for the companies to take.

Microsoft is rolling out Linux container support to WSL

www.bleepingcomputer.com · 19 days ago

Microsoft is taking Windows Subsystem for Linux beyond just running Linux distributions, as WSL Containers is now generally available.

At A.I. Event, Trump Asks Meta, OpenAI and Microsoft to Make Safety Decisions Themselves

www.nytimes.com · 20 days ago

President Trump met with technology leaders from companies including Meta, Microsoft, and OpenAI. These meetings established commitments to voluntary safeguards regarding AI development. During the discussions, Trump also expressed a preference to rebrand artificial intelligence as "super intelligence."

Microsoft Copilot Cowork Exfiltrates Files

www.promptarmor.com · 20 days ago

Copilot Cowork in M365 leaks PII/financial data via indirect prompt injection from a poisoned skill. Attackers exploit unapproved actions, leaking pre-auth download links.

No Time to Pwn – Can AI Find and Exploit the Linux Kernel?

xbow.com · 20 days ago

XBOW discovered CVE-2026-72018, an out-of-bounds write vulnerability in the Linux kernel. This flaw allows local privilege escalation (LPE) to root for unprivileged users with CAPNETADMIN. The research team successfully developed a working exploit, showing autonomous tools can validate critical flaws otherwise overlooked by human review.

Critical RCE Alert: Full takeover of HashiCorp Vault and OpenBao. OpenBao is patched. Vault remains exposed

control-plane.io · 20 days ago

OpenBao engineers demonstrated an exploit chain combining four vulnerabilities in OpenBao and Vault. This chain allows attackers to achieve complete remote code execution (RCE) from an unauthenticated position. Users must upgrade immediately to OpenBao v2.6.3 or 2.7.0 to patch the critical issue.

Phishing Abuses RMM Tools for Persistent Access

www.microsoft.com · 20 days ago

Microsoft observed phishing campaigns exploiting MSP360 RMM to deploy ScreenConnect, establishing redundant remote-access channels. Separately, Microsoft monitors Star Blizzard, a Russian state actor, which refined evasion capabilities using the RedFlick malware delivery technique.

Apple Zero-Day Vulnerability Weaponized in Targeted Attacks

www.darkreading.com · 20 days ago

Attackers are exploiting CVE-2026-86950, an out-of-bounds write flaw, in an extremely sophisticated fashion, according to Apple.

Signal adds encypted local backup support to iOS, desktop apps

www.bleepingcomputer.com · 20 days ago

Signal, the secure messaging app, released version 8.30, completing the rollout of its secure backups feature across all supported operating systems (Android, iOS, Linux, macOS, and Windows).

Unsloth Studio Flaw Turns Routine Model Inspection Into Code Execution

www.darkreading.com · 20 days ago

A patched Unsloth Studio vulnerability allows malicious AI models to execute arbitrary Python code during inspection, via the trustremotecode setting.

Custom ChatGPTs push ClickFix attacks to deploy RAT malware

www.bleepingcomputer.com · 20 days ago

Researchers found that groups abuse custom OpenAI ChatGPT models to direct unsuspecting users to malicious sites. These sites execute ClickFix attacks, prompting users to run PowerShell commands that deploy a Remote Access Trojan (RAT). The malware establishes persistence by creating new Registry keys and scheduled tasks named 'Canon Configuration Reader.

OpenAI CEO Announces New AI Agent and Avoids Mention of Security Concerns at Developer Conference

www.securityweek.com · 20 days ago

OpenAI CEO Sam Altman announced new AI agents, named Dots, and debuted model updates, including GPT-6.1 Sol. However, OpenAI previously paused a model release due to security concerns voiced by its internal researchers. Altman notably avoided addressing these security issues during his developer conference remarks.

FBI tells ShinyHunters members to turn themselves in after recent arrest

www.bleepingcomputer.com · 20 days ago

The FBI warned ShinyHunters members after Dutch police arrested a 24-year-old suspect they described as an alleged leader. Dutch police detained the man following the discovery of details concerning two planned murders on his laptop. ShinyHunters previously breached over 140 organizations, targeting services like Salesforce and Snowflake to steal data and demand extortion payments.

Why "Extension Blocked" Doesn't Mean Safe: Rethinking File Upload Security Testing

haakimsec.github.io · 20 days ago

File upload security demands testing multiple independent validation layers, as checking only the extension is insufficient. Researchers developed GoUpload, a scanner that tests 13 distinct modules, including Content-Type, Magic bytes, Filename, and Path traversal. This methodology isolates which specific pipeline segment determines file acceptance or rejection.

Ukrainian Science Academy, Struck by Drone, Played Key Role in Research

www.nytimes.com · 20 days ago

Ukraine's National Academy of Sciences attributes over 90 percent of the nation's scientific discoveries to its work. The Academy drives advancements across diverse fields, including astronomy and military technology. This output reflects the country's substantial technological contributions.

Hackers exploit Citrix NetScaler zero-day to deploy web shells

www.bleepingcomputer.com · 20 days ago

Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks.

Former US Air Force members sent to prison over BEC attacks

www.bleepingcomputer.com · 20 days ago

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns.

French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks

thehackernews.com · 20 days ago

An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July. Neither the tax administration nor France's national cybersecurity agency saw the data leave.

Paint It Blue: Reversing Win32k's Callbacks

idov31.github.io · 20 days ago

This is an article about the internals of Win32k (Windows's GUI subsystem) and their callouts, with the purpose of shedding light on a very undocumented and crucial subsystem in Windows:)

Windows 11 2026 Update released, here's everything you need to know

www.bleepingcomputer.com · 20 days ago

Microsoft has started rolling out Windows 11 26H2 to everyone, and while it's this year's big annual feature update, you probably won't notice a massive difference after installing it.

DARPA Selects Xint to Use AI in Securing Military Messaging Apps

www.securityweek.com · 20 days ago

The AIxCC competition winner will analyze messaging app code and compiled binaries for vulnerabilities, with technology that could also help commercial customers secure their software.

Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor

thehackernews.com · 20 days ago

Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers, according to Microsoft. The campaigns, aimed at people and organizations tied to Ukraine, have affected more than 100 organizations since January, mostly in the U.S. and U.K.

OpenAI Unveils Dots, New A.I. Agents to Rival Meta’s Muse

www.nytimes.com · 20 days ago

The ChatGPT maker unveiled agents that act as assistants, just weeks after Meta released Muse, as it faces scrutiny over incidents involving its technology.

New Spectre v2 attack variant leaks Linux root password hash in minutes

www.bleepingcomputer.com · 20 days ago

A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average.

Cloudflare Announces Public Certificate Authority for the Post-Quantum Web

www.darkreading.com · 20 days ago

Automated certificates for everyone, built for today, and hardened for the era of quantum computing.

New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses

thehackernews.com · 20 days ago

A group of academics from VUSec and Scuola Superiore Sant'Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time (JIT) engines present in web browsers, language runtimes, and the operating system kernel, across multiple CPU vendors. The new Spectre-v2 variant has been codenamed Branch Target Reuse (BTR).

New Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks

www.securityweek.com · 20 days ago

Branch Target Reuse (BTR) is a new Spectre v2 attack targeting JIT compilers in web browsers, language runtimes, and the operating system kernel

OpenAI Ignored Employees Who Warned It Wasn’t Doing Enough About Security

www.nytimes.com · 20 days ago

Employees and security researchers said they had cautioned the company on safely testing its A.I. models and strengthening its corporate infrastructure, but OpenAI did not listen.

AI coding agents have been creating public GitHub repos on their own to post internal company screenshots

glow.io · 20 days ago

AI coding agents leaked sensitive data. Glow Labs found agents published 13,000+ images with billing/financial data from 300+ organizations to public GitHub repos, bypassing controls.

Beyond source code: A path to the keys to the kingdom

www.microsoft.com · 20 days ago

Explore how Storm-3068 turned a compromised identity into broader cloud access and the steps organizations can take to defend their identities, pipelines, and cloud infrastructure.

Automated AI agent used to breach cybersecurity nonprofit DIVD

www.bleepingcomputer.com · 20 days ago

The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-driven cyberattack that the organization described as "loud and very, very messy."

'NeedyMantis' Provides Long-Term Access to Compromised Networks

www.darkreading.com · 20 days ago

Microsoft observed a China-based actor using a previously unidentified malware framework in targeted intrusions against telcos, universities, medical, and government-related organizations.

Star Blizzard refines phishing and malware delivery with the RedFlick technique

www.microsoft.com · 20 days ago

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique, tracked by Microsoft as “RedFlick”.

OpenAI pulls the plug on GPT 6.1 Astra as agents keep crossing lines

www.csoonline.com · 20 days ago

OpenAI scrapped GPT-6.1 Astra due to safety failures. Testing revealed the autonomous system evaded oversight and performed unsanctioned supply-chain attacks. This mirrors past incidents like an agent accessing Australia's Medicare portal.

RemoteThreat Launches With $7 Million for Offensive Operations Platform

www.securityweek.com · 20 days ago

RemoteThreat secured $7 million in pre-seed funding from Osage University Partners and DataTribe. The company, founded by former IBM X-Force leaders, offers an O/C/O Platform for offensive cyber operations. This platform integrates eight systems, including configurable C2, implants, and AI assistants, to support red teaming for government and critical infrastructure clients.