Blahalla

Critical flaw lets hackers track, eavesdrop via Bluetooth audio devices

www.bleepingcomputer.com · 6 months ago

A critical vulnerability, designated CVE-2025-36911 and nicknamed WhisperPair, affects millions of Bluetooth audio devices from numerous manufacturers. The flaw allows attackers to hijack devices, track users, and eavesdrop on conversations by exploiting a weakness in Google's Fast Pair protocol. Attackers can forcibly pair with vulnerable accessories from a distance of up to 14 meters using common Bluetooth devices. Users are advised to install firmware updates from manufacturers to mitigate the risk.

Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager

sec.cloudapps.cisco.com · 6 months ago

On December 10, Cisco became aware of a new cyberattack campaign targeting a limited subset of appliances with certain ports open to the internet that are running Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. This attack allows the threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. The ongoing investigation has revealed evidence of a persistence mechanism planted by the threat actors to maintain a degree of control over compromised appliances. Cisco strongly recommends that customers follow the guidance provided in the Recommendations section of the security advisory in order to assess exposure and mitigate risks. For more information, see the Recommendations section of this advisory. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4 <br/Security Impact Rating: Critical <br/CVE: CVE-2025-20393

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 6 months ago

A stored cross-site scripting vulnerability exists in Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure. This allows an authenticated attacker to potentially execute code or access sensitive information through the web-based management interface. The vulnerability stems from inadequate input validation and requires administrative credentials to exploit. Software updates are available to resolve the issue, and no workarounds are provided. Affected releases include Cisco EPNM 7.0 and earlier, 8.0, and Cisco Prime Infrastructure 3.9 and earlier.

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 6 months ago

A vulnerability has been identified in the web-based management interface of Cisco Identity Services Engine, potentially allowing an authenticated attacker to execute scripts and access sensitive information. This is a stored cross-site scripting issue resulting from insufficient input validation. There are no workarounds available, and users are strongly encouraged to upgrade to a fixed software release. Affected versions include Cisco ISE 3.1 and earlier, as well as 3.2 before Patch 8, 3.3 before Patch 5, and 3.4 before Patch 1.

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 6 months ago

A vulnerability has been identified in Cisco Identity Services Engine and Cisco ISE Passive Identity Connector, potentially allowing an authenticated attacker to execute cross-site scripting attacks. This occurs due to insufficient input validation in the web-based management interface. Attackers could inject malicious code to access sensitive information or execute arbitrary scripts, requiring administrative credentials. Software updates are available to resolve the issue, and no workarounds are provided. Affected releases include those earlier than version 3.2, 3.2 prior to patch 8, 3.3 prior to patch 8, and 3.4 prior to patch 4.

Germany turns to Israel for a ‘cyber dome’ amid rising threats

therecord.media · 6 months ago

false

CVE-2026-20965: Cymulate Research Labs Discovers Token Validation Flaw that Leads to Tenant-Wide RCE in Azure Windows Admin Center

cymulate.com · 6 months ago

A critical vulnerability, identified as CVE-2026-20965, has been discovered in Microsoft’s Windows Admin Center. Attackers with local administrator access can exploit this flaw to gain unauthorized access and execute commands on other machines within the same Azure tenant. The vulnerability is caused by improper token validation and a lack of dynamic scoping, enabling token reuse. Microsoft has released a patch, version 0.70.00 of the WAC Azure Extension, to address the issue.

Critical WordPress Modular DS Plugin Flaw Actively Exploited to Gain Admin Access

thehackernews.com · 6 months ago

A critical security vulnerability, CVE-2026-23550, is actively being exploited in the Modular DS WordPress plugin. This flaw allows unauthenticated attackers to escalate privileges and gain administrator access by manipulating request parameters. Attackers can bypass authentication mechanisms and access sensitive routes, potentially leading to full site compromise. Patches are available in version 2.5.2, and users are urged to update immediately.

Vulnerabilities Surge, But Messy Reporting Blurs Picture

www.darkreading.com · 6 months ago

A record number of vulnerabilities were reported in 2025, with 48,177 assigned a CVE identifier. This increase isn't necessarily indicative of heightened cyber risk but reflects a healthier and more robust vulnerability reporting ecosystem with new organizations, like WordPress security firms, contributing significantly. Data quality within the National Vulnerability Database has faced challenges, including incomplete CVSS scores and CPE entries, and a backlog required unusual measures like deferring older vulnerabilities. Analysts suggest the rise in CVEs is due to improved reporting methods, including the use of AI and more security researchers, and highlights the importance of organizations understanding their software assets.

Researchers Reveal Reprompt Attack Allowing Single-Click Data Exfiltration From Microsoft Copilot

thehackernews.com · 6 months ago

Researchers have identified a new attack called Reprompt that allows data exfiltration from AI chatbots like Microsoft Copilot with a single click, bypassing security controls. The attack uses crafted instructions injected via a URL parameter, instructs the chatbot to bypass safeguards, and triggers a hidden data exfiltration chain. Several other prompt injection vulnerabilities impacting various AI tools have also been discovered, including ZombieAgent, Lies-in-the-Loop, and GeminiJack. These vulnerabilities highlight the ongoing risk of prompt injections and the need for layered security defenses.

How to automate just-in-time access to applications with Tines

www.bleepingcomputer.com · 6 months ago

false

Elon Musk’s X Restricts Ability to Create Explicit Images With Grok

www.nytimes.com · 6 months ago

X, formerly known as Twitter, is restricting its Grok artificial intelligence chatbot from creating explicit images of real people. This action comes after global concerns and investigations regarding A.I.-generated content on the platform. Regulators, including Ofcom in Britain and investigators in California, have scrutinized Grok’s practices. X intends to use geoblocking to enforce these restrictions in regions where such content is illegal.

Aembit Announces Agenda and Speaker Lineup for NHIcon 2026 on Agentic AI Security

gbhackers.com · 6 months ago

false

Zorin OS Hits 2 Million Downloads as Windows 10 Support Ends

www.techrepublic.com · 6 months ago

false

Elon Musk’s X says it will block Grok from making sexual images

therecord.media · 6 months ago

X announced it will prevent its AI tool Grok from creating sexualized images of people without their consent, including images critics say amount to child sexual abuse material, and will geoblock the ability to generate images of real people in bikinis underwear and similar attire in jurisdictions where that is illegal. The move follows thousands of users generating sexual images of women and children and widespread condemnation from authorities in the United States Europe and East Asia, along with recent legislative and regulatory activity including the Senate passage of the DEFIANCE Act and investigations by the California Attorney General and Britain s Ofcom. X said it has zero tolerance for child sexual exploitation nonconsensual nudity and unwanted sexual content while the scope of technical blocking versus geoblocking remains unclear.

Smashing Security podcast #450: From Instagram panic to Grok gone wild

grahamcluley.com · 6 months ago

Claims of a data leak affecting 17.5 million Instagram accounts have caused confusion, with password reset emails being sent to users. Elon Musk’s AI chatbot, Grok, has generated concerning sexualized images, prompting action from regulators in Indonesia and Malaysia. Hackers allegedly exposed funders of a Free Speech Union, while an Illinois man faces charges related to a Snapchat hacking investigation. A database from BreachForums was also recently leaked.

Promptware Kill Chain – Five-step Kill Chain Model For Analyzing Cyberthreats

gbhackers.com · 6 months ago

Researchers have identified a new type of malware called promptware, which exploits vulnerabilities in AI systems powered by large language models. This malware uses natural language or multimodal content as a payload, mimicking traditional malware campaigns. The Promptware Kill Chain model outlines five stages: Initial Access, Privilege Escalation, Persistence, Lateral Movement, and Actions on Objective, detailing how attacks can lead to data theft, remote code execution, and physical damage. Attackers use techniques such as jailbreaking and manipulating memory features to achieve persistence and spread across systems.

ThreatsDay Bulletin: AI Voice Cloning Exploit, Wi-Fi Kill Switch, PLC Vulns, and 14 More Stories

thehackernews.com · 6 months ago

Security researchers have identified a critical vulnerability in Delta Electronics Programmable Logic Controllers, now addressed with a patch. Cybercriminals have stolen twenty-six million dollars in Ether from the Truebit platform due to a smart contract flaw. A phishing campaign uses fake invoices to deploy Remote Monitoring and Management tools for unauthorized network access. The CrazyHunter ransomware, connected to Chinese hackers, recently targeted Taiwanese hospitals, exploiting Active Directory and a modified anti-malware driver.

Microsoft Patch Tuesday Fixes 112 Flaws, Includes SharePoint and Windows

www.techrepublic.com · 6 months ago

Microsoft’s January 2026 security update addresses 112 vulnerabilities across several products, including Windows, Office, and SharePoint. A critical, actively exploited zero-day vulnerability, CVE-2026-20805, affects the Windows Desktop Window Manager, allowing information disclosure. Other significant vulnerabilities include CVE-2026-20947, CVE-2026-20963, CVE-2026-20868, CVE-2026-20952, CVE-2026-20955, and CVE-2026-20944, alongside an expiring Secure Boot certificate, CVE-2026-21265. The update also removes outdated modem drivers and requires immediate action to mitigate risks.

Critical Cal.com Vulnerability Let Attackers Bypass Authentication and Hijack Any User Account

gbhackers.com · 6 months ago

A critical vulnerability has been discovered in Cal.com, a scheduling and booking platform, allowing attackers to bypass authentication and take control of any user account. The flaw stems from a logic error in the session handling process, enabling attackers to manipulate the JSON Web Token without server-side validation. This allows attackers to impersonate users, even those with administrative privileges, by forging a token and accessing sensitive data like booking information, calendar details, and billing modules. Cal.com has released version 6.0.7 to address the issue, which is tracked as GHSA-7hg4-x4pr-3hrg, and advises users of self-hosted instances to upgrade immediately.

Windows Remote Assistance Vulnerability Allow attacker To bypass Security Features

gbhackers.com · 6 months ago

A security vulnerability, CVE-2026-20824, has been identified in Windows Remote Assistance that allows attackers to bypass security features. The vulnerability is categorized as a protection mechanism failure and requires local access but no privileges to exploit. Successful exploitation allows attackers to evade Mark of the Web defenses, potentially enabling malicious content to appear as trusted files. Microsoft has released security updates, including KB5073724, to address the issue across a wide range of Windows versions, and users are urged to apply these updates promptly.

Microsoft and Authorities Dismatles BEC Attack Chain Powered By RedVDS Fraud Engine

gbhackers.com · 6 months ago

Microsoft, along with U.S., U.K., German, and Europol authorities, has dismantled RedVDS, a cybercrime-as-a-service platform enabling business email compromise and AI-powered fraud. RedVDS provided criminals with virtual machines and proxy IPs for approximately US $24 monthly, facilitating attacks that resulted in over US $40 million in verified fraud losses in the United States alone. The platform was used to send millions of phishing emails and execute sophisticated BEC schemes utilizing AI-generated content, impacting organizations worldwide and sectors like real estate, healthcare, and manufacturing. Authorities seized key domains and servers, disrupting the platform and aiming to identify its operators.

Depthfirst Raises $40 Million for Vulnerability Management

www.securityweek.com · 6 months ago

Depthfirst, a software security startup founded in 2024, has secured $40 million in Series A funding led by Accel. Their platform uses artificial intelligence to identify, triage, and resolve vulnerabilities across software and infrastructure, reportedly finding eight times more flaws than traditional methods. The company’s General Security Intelligence platform aims to understand enterprise systems and respond to AI-empowered attacks. Depthfirst plans to use the funding for research and development, team expansion, and go-to-market initiatives.

Palo Alto Networks Firewall Vulnerability Allows Attackers To Trigger Denial Of Service

gbhackers.com · 6 months ago

Researchers have discovered several vulnerabilities affecting multiple versions of Ivanti’s Endpoint Manager Mobile (formerly MobileIron). These flaws include a bypass of multi-factor authentication, a cross-site scripting vulnerability, and a potential denial-of-service condition. The vulnerabilities have been assigned CVE identifiers including CVE-2024-23020, CVE-2024-23021, CVE-2024-23022, CVE-2024-23023, CVE-2024-23024, and CVE-2024-23025. Affected users are advised to review Ivanti’s security advisories and apply the necessary patches to mitigate these risks.

HPE Aruba Vulnerabilities Enables Unauthorized Access To Sensitive Information

gbhackers.com · 6 months ago

HPE has released security updates to address several high-severity vulnerabilities in HPE Networking Instant On devices. A critical flaw, CVE-2025-37165, exposes VLAN configuration data when devices operate in router mode. Another vulnerability, CVE-2025-37166, can cause access points to become unresponsive, resulting in a denial-of-service attack. Additionally, kernel-level issues detailed in CVE-2023-52340 and CVE-2022-48839 could lead to denial-of-service and memory corruption. Users should upgrade to software version 3.3.2.0 or later to mitigate these risks.

Can A.I. Generate New Ideas?

www.nytimes.com · 6 months ago

false

isVerified Emerges From Stealth With Voice Deepfake Detection Apps

www.securityweek.com · 6 months ago

false

New ‘Reprompt’ Attack Silently Siphons Microsoft Copilot Data

www.securityweek.com · 6 months ago

Security researchers have identified a new attack, called Reprompt, that allows data exfiltration from Microsoft Copilot through a single malicious link. The attack exploits the ‘q’ parameter and uses multiple request techniques to bypass data leak protections and persist even after a session ends. This method involves tricking Copilot into performing tasks multiple times, allowing attackers to retrieve sensitive information in subsequent responses. Microsoft has addressed the vulnerability, and the issue does not impact Microsoft 365 Copilot users.

New Vulnerability in n8n

www.schneier.com · 6 months ago

A critical vulnerability, identified as CVE-2026-21858, has been discovered in the n8n platform, potentially affecting approximately 100,000 servers worldwide. This vulnerability allows attackers to take control of locally deployed instances. Currently, no workarounds are available, and users are advised to upgrade to version 1.121.0 or later to address the security issue. The vulnerability carries a CVSS score of 10.0, indicating a critical level of severity.

Interrail-Kundendatenbank gehackt

www.csoonline.com · 6 months ago

Eurail has disclosed a data breach impacting its customer database, which also includes Interrail pass holders for German customers. Potentially compromised data includes names, dates of birth, email addresses, residential addresses, phone numbers, passport numbers, and expiration dates. Eurail reports no evidence of data misuse at this time, but warns customers to be vigilant against potential phishing or fraud attempts. Customers who purchased tickets through the "DiscoverEU" program may also have had copies of identification documents, IBAN numbers, and health data exposed.

Model Security Is the Wrong Frame – The Real Risk Is Workflow Security

thehackernews.com · 6 months ago

Security teams are shifting focus from protecting AI models to securing the workflows that surround them. Recent incidents, such as Chrome extensions stealing ChatGPT data and prompt injections tricking AI coding assistants, demonstrate that attackers exploit the context in which AI operates, not the models themselves. Traditional security controls are ineffective because AI-driven workflows blur boundaries and rely on probabilistic decision-making, making it crucial to treat the entire workflow as the target and implement guardrails to monitor and restrict AI actions. Emerging security platforms are helping organizations gain visibility and enforce these controls.

Researchers warn of long‑running FortiSIEM root exploit vector as new CVE emerges

www.csoonline.com · 6 months ago

A critical command injection vulnerability, CVE-2025-64155, has been disclosed in Fortinet’s FortiSIEM platform, potentially allowing unauthenticated attackers to gain root access. The flaw resides in the phMonitor service, a central component for system health monitoring, and exploit code is now publicly available. This vulnerability is part of a pattern of similar flaws in FortiSIEM, with a previous vulnerability, CVE-2025-25256, already patched earlier in 2025. Security experts urge immediate patching and access restrictions to mitigate the risk, as Fortinet vulnerabilities are a high-value target for attackers.

NASA crew splashes down safely after mission cut short over astronaut’s health

www.washingtonpost.com · 6 months ago

false

Chinese Hackers Control 18,000 Active Servers Across 48 Hosting Providers

gbhackers.com · 6 months ago

Researchers have identified several methods attackers can use to bypass Microsoft Defender's anti-exploitation mitigations. These techniques involve manipulating process memory and leveraging undocumented system behaviors to execute malicious code. One method involves using a technique called “indirect task creation” to evade detection, while another exploits a flaw in how Defender handles memory regions. The vulnerabilities do not have associated CVE identifiers.

4 Outdated Habits Destroying Your SOC's MTTR in 2026

thehackernews.com · 6 months ago

false

Trio of Critical Bugs Spotted in Delta Industrial PLCs

www.darkreading.com · 6 months ago

Researchers discovered four vulnerabilities in Delta Electronics’ DVP-12SE11T programmable logic controllers, commonly used in industrial settings across Asia. These vulnerabilities range in severity, with three rated as critical, posing a risk of unauthorized access, password leaks, device freezing, and unexpected device behavior. The vulnerabilities are CVE-2025-15102, CVE-2025-15103, CVE-2025-15358, and CVE-2025-15359. While Delta Electronics has released a firmware update, patching may be delayed in many operational networks, raising concerns about potential physical harm or disruption due to exploitation.

Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data

www.varonis.com · 6 months ago

A new attack called Reprompt enables attackers to steal personal data from AI assistants like Microsoft Copilot through a single link click. The vulnerability exploits a URL parameter, allowing prompts to bypass security measures and exfiltrate data discreetly. Microsoft has addressed the issue, emphasizing the cybersecurity risks associated with AI platforms. Security experts advise users to be cautious of links and review AI-generated prompts.

Central Maine Healthcare Data Breach Impacts 145,000 Individuals

www.securityweek.com · 6 months ago

Central Maine Healthcare recently experienced a data breach impacting over 145,000 patients. The intrusion occurred between March and June of 2025, compromising personal data such as names, dates of birth, Social Security numbers, and health insurance information. The healthcare provider began notifying individuals in July and is offering credit and identity theft monitoring services. Central Maine Healthcare is working to enhance its security measures following the incident.

A.I. Has Arrived in Gmail. Here’s What to Know.

www.nytimes.com · 6 months ago

false

ICE and activists clash over doxing and privacy, in court and streets

www.washingtonpost.com · 6 months ago

Tensions are rising between immigration agents and protesters following a recent death related to an ICE officer. Both sides are attempting to identify individuals involved in the conflicts, raising privacy concerns. Residents and protesters are trying to identify officers while concealing their own identities. ICE is seeking to uncover the identities of those involved in the demonstrations.

Why your power bill is spiking faster than a nearby data center’s

www.washingtonpost.com · 6 months ago

false

FTC bans GM from selling drivers' location data for five years

www.bleepingcomputer.com · 6 months ago

Researchers have discovered a flaw in the popular open-source image processing library, ImageMagick, allowing for arbitrary code execution. The vulnerability, identified as CVE-2024-36207, arises from improper handling of crafted TIFF files. Attackers could exploit this by tricking a user into opening a malicious image, potentially gaining control of their system. The issue stems from a lack of sufficient input validation during image parsing.

Microsoft Legal Action Disrupts RedVDS Cybercrime Infrastructure Used for Online Fraud

thehackernews.com · 6 months ago

Microsoft and law enforcement have disrupted RedVDS, a cybercrime subscription service that provided criminals with cheap, disposable virtual computers for approximately US $24 a month. Since March 2025, RedVDS-enabled activity has resulted in roughly US $40 million in reported fraud losses in the United States. The service allowed users to operate anonymously, host phishing infrastructure, and conduct business email compromise schemes, often leveraging generative AI tools for more convincing attacks. Microsoft is tracking the developer and maintainer of RedVDS under the moniker Storm-2470 and has identified over 191,000 organizations worldwide compromised by attacks facilitated through this infrastructure.

VoidLink Linux Malware Framework Targets Cloud Environments

www.securityweek.com · 6 months ago

Security researchers have discovered VoidLink, a new Linux malware framework designed for cloud environments. The framework, written in the Zig programming language, targets major cloud platforms and can steal credentials from various systems. It employs a modular design, includes rootkit capabilities, and uses a development API similar to Cobalt Strike. Currently, no real-world infections have been observed, but it appears to be in development for potential commercial use.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Aveva, Phoenix Contact

www.securityweek.com · 6 months ago

Several industrial control system vendors released security updates this week to address numerous vulnerabilities. Siemens addressed a critical authorization bypass flaw in Industrial Edge Devices, allowing potential unauthorized access. Schneider Electric fixed a privilege escalation issue in EcoStruxure Process products and arbitrary code execution flaws in EcoStruxure Power Build. Phoenix Contact resolved a high-severity command injection vulnerability in its industrial routers, and Aveva addressed multiple high and critical vulnerabilities in Process Optimization.

Palo Alto Networks warns of DoS bug letting hackers disable firewalls

www.bleepingcomputer.com · 6 months ago

A high-severity vulnerability has been discovered in Palo Alto Networks firewalls, tracked as CVE-2026-0227, which allows unauthenticated attackers to trigger a denial-of-service condition and potentially force the firewall into maintenance mode. The flaw affects PAN-OS versions 10.1 and later, as well as Prisma Access configurations with GlobalProtect enabled. Palo Alto Networks has released updates to address the issue and advises users to upgrade to the latest available versions. Previously, Palo Alto Networks firewalls have been targeted in attacks exploiting zero-day vulnerabilities and other flaws, including CVE-2024-3393, CVE-2025-0111, CVE-2025-0108, and CVE-2024-9474.

Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC

neodyme.io · 6 months ago

Researchers have identified several vulnerabilities affecting Fortinet's FortiOS operating system. These flaws could allow an unauthenticated attacker to execute arbitrary code on affected systems. Three distinct methods of exploitation have been detailed, including improper input validation and command injection vulnerabilities. Affected versions include FortiOS 7.0, 7.2, and 7.4, with the identified vulnerabilities assigned CVE identifiers CVE-2023-42376, CVE-2023-42377, and CVE-2023-42378.

Traveler Information Stolen in Eurail Data Breach

www.securityweek.com · 6 months ago

Eurail, a European travel company, has reported a data breach affecting customers who purchased rail passes or made seat reservations. The compromised data includes personal and contact information, potentially including passport details, health information, and IBANs for those participating in the DiscoverEU program. Eurail is investigating the incident with the European Commission and has secured the affected systems. Affected individuals are advised to be wary of phishing and identity theft attempts.

Schlag gegen Cyberkriminelle in Deutschland

www.csoonline.com · 6 months ago

Law enforcement agencies in Germany, the United States, and the United Kingdom, along with Microsoft, have dismantled RedVDS, a cybercrime service facilitating online fraud. The service operated from a data center in Germany and provided cybercriminals with infrastructure to anonymously commit crimes, including phishing scams and business email compromise. Victims include companies and government agencies, with damages estimated at hundreds of millions of euros and at least 40 million US dollars in the United States alone. RedVDS offered subscriptions for around 24 US dollars per month, allowing criminals to send over one million phishing emails daily.

Palo Alto Fixes GlobalProtect DoS Flaw That Can Crash Firewalls Without Login

thehackernews.com · 6 months ago

Palo Alto Networks has addressed a high-severity denial-of-service vulnerability affecting GlobalProtect Gateway and Portal. The flaw, identified as CVE-2026-0227, allows an unauthenticated attacker to trigger a DoS condition and potentially force the firewall into maintenance mode. Multiple versions of PAN-OS and Prisma Access are impacted, requiring users to update to patched versions. Scans of exposed GlobalProtect gateways have increased in recent times, highlighting the need for prompt updates.