Blahalla

CVE-2026-22666: Dolibarr 23.0.0 dol_eval() whitelist bypass -> RCE (full write-up + PoC)

jivasecurity.com · 6 months ago

A critical zero-day vulnerability, CVE-2026-22666, has been identified in Dolibarr versions 23.0.0, impacting the ERP/CRM platform. The flaw in the doleval() and dolevalstandard() functions allows authenticated administrators to execute arbitrary PHP code, bypassing security measures like whitelists and blacklists. Attackers can leverage this to create files, access database information, and potentially gain control of the system through remote code execution. Dolibarr version 23.0.2 addresses this vulnerability with improved filtering and safer expression evaluation.

GitHub and Jira Alerts Hijacked for Trusted-SaaS Phishing

gbhackers.com · 6 months ago

Hackers are exploiting GitHub and Jira's notification systems to conduct phishing campaigns. These emails appear legitimate because they originate from the platforms’ own servers, bypassing standard security checks like SPF, DKIM, and DMARC. Attackers embed malicious content within commit notifications on GitHub and Jira invitations, often disguised as urgent billing or account issues. This "Platform-as-a-Proxy" technique leverages the trusted reputation of these services to deliver phishing links and harvest credentials, with one campaign accounting for nearly 3% of all GitHub emails. Security experts advise adopting a Zero-Trust approach and monitoring API logs to detect suspicious activity.

⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More

thehackernews.com · 6 months ago

Cybersecurity threats are escalating with reports of an actively exploited zero-day vulnerability in Adobe Reader (CVE-2026-34621) and ongoing attacks against critical infrastructure linked to Iran. A North Korean group recently stole $285 million in digital assets, while law enforcement disrupted a Russian botnet, APT28. The emergence of AI-powered vulnerability hunting tools and the proliferation of new Remote Access Trojans, like RetroRAT, pose significant risks, highlighting the need for vigilance and rapid security updates.

A Second Agent That Proves the First One Wrong

blog.tahr.one · 6 months ago

AI agents can quickly identify potential vulnerabilities, but often produce false positives, requiring significant manual review. To address this, a new agent, EVA, independently verifies findings from initial testing agents by attempting to reproduce vulnerabilities. EVA classifies findings as VERIFIED, POTENTIAL, or FALSEPOSITIVE, with only confirmed vulnerabilities making it into reports. The verification process involves statistical measurements, response analysis, and real-time browser execution to ensure accurate identification of exploitable vulnerabilities.

Critical flaw in Marimo Python notebook exploited within 10 hours of disclosure

www.csoonline.com · 6 months ago

A critical remote code execution vulnerability in the Marimo Python notebook platform, identified as CVE-2026-39987, was exploited within 10 hours of public disclosure. Attackers could gain complete control of exposed Marimo servers through a single, unauthenticated connection, bypassing authentication checks. Researchers observed attackers stealing credentials, including AWS access keys, within three minutes of exploiting a honeypot server. Organizations are urged to immediately update to version 0.23.0 or restrict external access to Marimo servers.

OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack

www.securityweek.com · 6 months ago

OpenAI has confirmed it was impacted by a recent supply chain attack targeting the widely used Axios JavaScript library. Hackers, believed to be linked to North Korea, compromised an Axios maintainer’s NPM account to distribute malicious packages containing a remote access Trojan. The compromised packages briefly affected OpenAI’s macOS app-signing process, potentially exposing a signing certificate, which the company has since revoked and rotated as a precaution. Cybersecurity firms have identified evidence of compromise on a number of systems, with the attackers primarily motivated by financial gain.

YARA-X now runs in the browser - official Playground

virustotal.github.io · 6 months ago

false

New Nginx 1.29.8 and FreeNginx Versions Patch Critical Security Flaws

gbhackers.com · 6 months ago

Nginx and FreeNginx have released new versions to address critical security vulnerabilities and introduce enhancements. Version 1.29.8 includes full compatibility with OpenSSL 4.0, improving encryption protocols and secure connections. New configuration tools, like the “maxheaders” directive, are being implemented to help mitigate denial-of-service attacks. Administrators are urged to update promptly and test in a staging environment to ensure compatibility.

Seven IBM WebSphere Liberty flaws can be chained into full takeover

www.csoonline.com · 6 months ago

Security researchers have identified seven vulnerabilities in IBM WebSphere Liberty that can be combined to allow an attacker to take complete control of a server. The initial vulnerability is a pre-authentication flaw in the SAML Web SSO component, tracked as CVE-2026-1561, enabling remote code execution without authentication. Additional weaknesses in the AdminCenter component, including CVE-2025-14915, CVE-2025-14917, CVE-2025-14914, and CVE-2025-14923, allow privilege escalation and access to sensitive data, ultimately leading to full administrative access and remote code execution. Organizations are advised to apply available patches, rotate secrets, and enhance auditing practices.

Hackers Exploit MSBuild LOLBin to Evade Detection in Fileless Windows Attacks

gbhackers.com · 6 months ago

Researchers have discovered three methods attackers could exploit to bypass security measures on Apple macOS devices. These techniques involve manipulating system processes to escalate privileges and potentially execute malicious code. One method utilizes a flaw in the system's kernel, while others exploit weaknesses in the way macOS handles certain file types and processes. The vulnerabilities affect macOS versions prior to Sonoma 14.3 and have been assigned CVE identifiers CVE-2024-23027, CVE-2024-23028, and CVE-2024-23029.

Your MTTD Looks Great. Your Post-Alert Gap Doesn't

thehackernews.com · 6 months ago

Anthropic recently restricted a model after it autonomously exploited zero-day vulnerabilities across major operating systems and browsers, highlighting the increasing speed of attacks. Traditional security operations centers are slowed by a “post-alert gap,” the time between an alert firing and a thorough investigation, often taking 20 to 40 minutes. Artificial intelligence can compress this gap by rapidly investigating every alert and optimizing detection rules, shifting focus from detection speed to investigation coverage and detection improvement. Security teams should prioritize metrics like investigation coverage rate and hunt-driven detection creation to measure true security posture.

International Operation Targets Multimillion-Dollar Crypto Theft Schemes

www.securityweek.com · 6 months ago

Law enforcement agencies from the United States, the United Kingdom, and Canada have launched Operation Atlantic, targeting cryptocurrency theft schemes. The operation has identified over $45 million in stolen funds and frozen approximately $12 million, which will be returned to victims. Criminals use approval phishing tactics to gain administrative access to cryptocurrency wallets, draining accounts and compromising over 20,000 wallet addresses across 30 countries. Authorities have taken down over 120 fraudulent web domains used in these scams.

The persistence of analog RF links in drone video feeds

www.midnightblue.nl · 6 months ago

false

Booking.com warns customers of hack that exposed their data

www.theguardian.com · 6 months ago

Booking.com recently experienced a data breach where unauthorized parties accessed guest booking information. The company updated reservation pin numbers and notified affected customers, stating that financial information was not compromised. Potentially accessed data includes booking details, names, email addresses, phone numbers, and information shared with accommodations. This incident follows previous cybercrime attempts and a prior data breach involving hotel employee login details, resulting in a fine for a late report to the Dutch privacy regulator.

CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads

www.securityweek.com · 6 months ago

The CPUID website was recently compromised, leading to the distribution of trojanized software including CPU-Z, HWMonitor, and PerfMonitor. Attackers exploited a secondary API feature to redirect users to malicious downloads containing the cryptbase.dll file, which installs the STX RAT malware. This watering hole attack has impacted over 150 victims across various sectors, with a significant presence in Brazil, China, and Russia. Security researchers believe a Russian-speaking threat actor has been conducting this campaign for approximately ten months, with the compromise window spanning from April 3 to April 10.

Iran-Linked CyberAv3ngers Target Water Utilities, Industrial Controllers

gbhackers.com · 6 months ago

Iran-linked threat group CyberAv3ngers is intensifying attacks on U.S. water utilities and industrial control systems, evolving from hacktivism to operational technology disruption. The group, operating as a persona for Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command, has leveraged Linux-based OT/IoT malware called IOCONTROL and exploited CVE-2021-22681 in Rockwell Automation controllers. This exploitation has led to malicious tampering with programmable logic controller project files and manipulation of human-machine interface displays across critical infrastructure sectors. U.S. agencies are urging immediate action, including disconnecting PLCs from the public internet and implementing secure remote access measures.

Basic-Fit Suffers Data Breach Affecting Millions Across Multiple Nations

gbhackers.com · 6 months ago

Basic-Fit, a European fitness operator, has confirmed a data breach impacting approximately one million members across multiple nations. The breach exposed personal and financial data, including names, dates of birth, contact information, and bank account details, but not passwords or government identification. The company detected the intrusion and contained the activity, but threat actors still managed to steal a significant amount of data. Affected members are urged to monitor their accounts and remain vigilant against phishing attempts.

One Uppercase Letter Breaks Every Nuxt App

simonkoeck.com · 6 months ago

A vulnerability has been identified in the h3 HTTP framework, commonly used with Nuxt and Nitro applications. The issue stems from a case-sensitive check for the Transfer-Encoding header, which can lead to request smuggling when a reverse proxy handles chunked requests differently. Attackers can exploit this by crafting requests with a case variation of "chunked", causing the proxy and h3 to disagree on request boundaries, allowing for the injection of malicious requests that bypass security measures. The vulnerability, resolved in h3 v1.15.5, has been assigned CVE-2026-23527 and GHSA-mp2g-9vg9-f4cg.

Critical Axios Vulnerability Enables Remote Code Execution, PoC Released

gbhackers.com · 6 months ago

A critical vulnerability, CVE-2026-40175, has been discovered in the Axios HTTP client library, allowing for Remote Code Execution and potential cloud infrastructure compromise. The flaw stems from a lack of HTTP header sanitization, enabling attackers to bypass AWS security controls through a "Gadget" attack chain that requires no direct user input. Affected versions include all Axios releases prior to 1.15.0, and immediate updates are recommended to mitigate the risk by validating header values and preventing request smuggling. This allows attackers to retrieve session tokens and steal IAM credentials.

AI Chatbots and Trust

www.schneier.com · 6 months ago

false

Fake Claude Website Distributes PlugX RAT

www.securityweek.com · 6 months ago

Cybercriminals are using a fake website mimicking Anthropic’s Claude AI platform to distribute the PlugX remote access trojan. Victims are tricked into downloading a malicious ZIP archive disguised as a pro version of the AI model, which installs malware alongside the legitimate application. A VBScript dropper then deploys several files, including NOVUpdate.exe, which establishes a connection to an Alibaba Cloud command-and-control server. The malware uses DLL sideloading to execute PlugX, and employs error-handling techniques to avoid detection.

VIPERTUNNEL Python Backdoor Hidden in Fake DLL, Obfuscated Loader Chain

gbhackers.com · 6 months ago

Hackers are employing a stealthy Python backdoor named VIPERTUNNEL, which uses a fake DLL and layered obfuscation to establish covert network tunnels. The backdoor uses a sitecustomize.py file to auto-load code, and employs techniques like Base85 encoding and control-flow flattening to evade detection. It ultimately creates a SOCKS5 proxy to communicate with a command-and-control server over port 443, facilitating lateral movement and data exfiltration. This backdoor is linked to UNC2165/EvilCorp activity and is associated with credential-stealing tool ShadowCoil.

North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware

thehackernews.com · 6 months ago

A North Korean hacking group, APT37, is using Facebook to compromise targets through social engineering. Attackers build trust by adding individuals as friends and then lure them into installing a modified version of Wondershare PDFelement, which delivers the RokRAT remote access trojan. The attackers leverage compromised infrastructure, including a Japanese real estate website and Zoho WorkDrive, for command and control and payload delivery. RokRAT’s core functionality remains consistent, with attackers focusing on evolving delivery and evasion techniques.

CISOs tackle the AI visibility gap

www.csoonline.com · 6 months ago

false

The hottest college major hit a wall. What happened?

www.washingtonpost.com · 6 months ago

false

Scenic Chesapeake Bay county finds itself in the middle of a data center fight

www.washingtonpost.com · 6 months ago

false

Marimo RCE Vulnerability Exploited Within 10 Hours of Public Disclosure

gbhackers.com · 6 months ago

A critical remote code execution vulnerability was rapidly exploited in the Marimo open-source platform. The flaw, identified as CVE-2026-39987, allows unauthenticated attackers to gain a shell on exposed instances by bypassing authentication checks in the terminal WebSocket endpoint. Exploitation began less than ten hours after the vulnerability’s public disclosure, with attackers using technical advisory details to develop a working exploit without publicly available code. The attackers quickly extracted sensitive cloud infrastructure credentials, highlighting the need for organizations to prioritize patching and reviewing network activity, upgrading to version 0.23.0.

Gmail Brings End-to-End Encryption to Android and iOS for Enterprise Users

www.securityweek.com · 6 months ago

false

CVE-2025-8061: From User-land to Ring 0

sibouzitoun.tech · 6 months ago

A vulnerability, identified as CVE-2025-8061, has been discovered in a signed Lenovo driver, LnvMSRIO.sys. Researchers have developed a four-part series outlining an exploit chain that begins with arbitrary read/write primitives and ultimately achieves stealthy kernel implant execution. The exploit bypasses hardware mitigations like SMAP and employs techniques such as Direct Kernel Object Manipulation to evade detection. The approach involves reverse-engineering, rebuilding, and dynamically adjusting the exploit for real-world scenarios, culminating in reflective driver loading and hook manipulation.

APT37 Uses Facebook, Telegram, and Trojanzied Installer in New Targeted Cyberattack

gbhackers.com · 6 months ago

A North Korean-linked threat actor, APT37, is conducting a new intrusion campaign targeting defense-related organizations. Attackers establish trust with victims through Facebook and Telegram, then trick them into installing a tampered Wondershare PDFelement installer to deploy a RokRAT-like backdoor. The installer disguises malicious activity by preserving normal functionality while injecting shellcode that uses dism.exe to deploy a second-stage payload from a C2 server hosted on a Japanese real estate information service. The final payload exfiltrates sensitive data, including documents and audio recordings, using Zoho WorkDrive for command and control.

Apache Tomcat Flaws Enable EncryptInterceptor Bypass

gbhackers.com · 6 months ago

Security updates have been released for Apache Tomcat to address three vulnerabilities. Researchers found a padding oracle attack impacting the EncryptInterceptor, which affects multiple versions of Tomcat. A flawed patch for the initial vulnerability inadvertently introduced a bypass allowing traffic interception, and a separate issue caused occasional failures in client certificate validation. Affected versions include Tomcat 11.0.0-M1 through 11.0.20, 10.1.0-M1 through 10.1.53, and 9.0.13 through 9.0.116, with CVE-2026-29146, CVE-2026-34486, and CVE-2026-34500 assigned. System administrators are urged to upgrade to the latest available versions to mitigate these risks.

OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident

thehackernews.com · 6 months ago

OpenAI experienced a supply chain incident where a malicious library was downloaded during a macOS app-signing process. The incident, attributed to a North Korean hacking group, involved compromised versions 1.14.1 and 0.30.4 of the Axios library, deploying the WAVESHAPER.V2 backdoor. While user data and systems weren’t compromised, OpenAI is revoking and rotating a signing certificate and ending support for older versions of its macOS apps by May 8, 2026. This incident is part of a broader series of supply chain attacks, including one targeting Trivy and linked to the TeamPCP group, resulting in widespread stolen secrets and impacting organizations like the European Commission. CVE-2026-33634 has been added to CISA's KEV catalog.

WordPress Plugin Vulnerability Enables Admin Takeover via Auth Bypass

gbhackers.com · 6 months ago

A critical vulnerability, CVE-2026-1492, has been identified in the User Registration & Membership plugin for WordPress. The flaw allows remote attackers to bypass authentication and gain full administrative access without valid credentials by manipulating parameters in AJAX-based membership workflows. Versions of the plugin up to 5.1.2 are affected, and the vulnerability carries a CVSS v4 score of 9.8. The plugin developer has released version 5.1.3 to address the issue, and users are urged to update immediately.

Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet

brave.com · 6 months ago

Researchers discovered a vulnerability in Perplexity Comet, an AI browser, allowing attackers to manipulate the AI assistant through indirect prompt injection. Malicious instructions hidden within webpage content, like Reddit comments, could trick the AI into performing unauthorized actions, such as accessing email accounts and exfiltrating sensitive data. This attack bypasses traditional web security measures and underscores the need for new protections in agentic browsers. Developers suggest separating user instructions from website content and requiring user confirmation for sensitive actions.

EDR Killers Broaden Ransomware Tactics, ESET Warns

gbhackers.com · 6 months ago

Ransomware attackers are increasingly using a diverse set of tools called EDR killers to disable endpoint security measures. Researchers have identified nearly 90 distinct EDR killers in use, including those leveraging vulnerable drivers, anti-rootkit utilities like GMER, and driverless techniques such as EDRSilencer. Attackers often rely on affiliates to select these tools, and commercialization of EDR killers is spreading their use across multiple ransomware gangs. There are also indications of artificial intelligence being used in the development of some EDR killer tools.

Elon Musk Announces XChat Launch With Self-Destructing Messages

gbhackers.com · 6 months ago

false

Google Brings End-to-End Encrypted Gmail to Android and iPhone

gbhackers.com · 6 months ago

false

WhatsApp’s “End-to-End Encryption by Default” Claim Called Consumer Fraud by Pavel Durov

gbhackers.com · 6 months ago

Telegram founder Pavel Durov has accused WhatsApp of consumer fraud, claiming its end-to-end encryption is undermined by default backup settings that store most messages unencrypted on Apple and Google servers. Approximately 95% of user conversations are vulnerable due to this default configuration, leaving them susceptible to compromise or legal access. Durov’s criticism highlights a trade-off between usability and privacy, as seamless syncing often necessitates centralized data storage. A new messaging application, XChat, is launching soon and promises enhanced privacy features.

Adobe Fixes Actively Exploited Zero-Day in Acrobat Reader

gbhackers.com · 6 months ago

Adobe has released an emergency update to fix a critical zero-day vulnerability affecting Acrobat and Reader for Windows and macOS. The flaw, designated CVE-2026-34621, is a Prototype Pollution vulnerability allowing for potential arbitrary code execution if a user opens a malicious PDF file. Threat actors have been actively exploiting this vulnerability since late 2025, requiring user interaction to trigger the exploit. Users should immediately update to the latest versions: 26.001.21411 for Continuous Track, 24.001.30362 for Acrobat 2024 on Windows, and 24.001.30360 for Acrobat 2024 on macOS.

Was ist Federated Identity Management?

www.csoonline.com · 6 months ago

false

The Escalating Global A.I. Arms Race

www.nytimes.com · 6 months ago

false

We combined DRAM timing attacks, electrical grid frequency detection, and gyroscope fusion into a single bot detection stack and I think we need to talk about it

www.npmjs.com · 6 months ago

false

Reverse engineered SilentSDK - RAT and C2 infrastructure found on beamers, sold on Amazon/AliExpress/eBay

github.com · 6 months ago

Several inexpensive Android projectors from brands like Magcubic and Hotack are affected by pre-installed malware called SilentSDK. This supply chain attack allows a command-and-control server to remotely access devices, steal data, and run malicious code. The malware uses techniques like silent installation, data collection, privilege escalation, and ad injection, while employing multiple communication servers including api.pixelpioneerss.com. Users should block these communication domains and manually remove the malicious application for mitigation.

Critical Marimo pre-auth RCE flaw now under active exploitation

www.bleepingcomputer.com · 6 months ago

Hackers are actively exploiting a critical vulnerability in the Marimo open-source Python notebook platform. This flaw, tracked as CVE-2026-39987, allows for remote code execution without authentication. Attackers began exploiting the vulnerability within 10 hours of its public disclosure, targeting sensitive information like credentials and SSH keys. Users are urged to immediately upgrade to version 0.23.0 or block access to the vulnerable endpoint.

Paying Google to Hack macOS Users?

pgaleone.eu · 6 months ago

Researchers have discovered a malvertising campaign targeting macOS users through sponsored search results on Google. These results lead to phishing websites distributing malicious software disguised as disk cleanup utilities. The software downloads and executes a Mach-O binary that exhibits behaviors consistent with the Atomic Stealer malware, which is designed to steal passwords, cryptocurrency wallets, and other sensitive data. Attackers exploit the common practice of installing software via curl | sh to deliver different payloads depending on whether the request comes from a browser or curl, making inspection difficult.

Adobe Patches Reader Zero-Day Exploited for Months

www.securityweek.com · 6 months ago

Adobe has released emergency patches to address a critical zero-day vulnerability, CVE-2026-34621, affecting Acrobat and Reader for Windows and macOS. This flaw allows for arbitrary code execution and has been actively exploited in the wild since November 2025. A researcher discovered the vulnerability while analyzing a sophisticated PDF exploit, and indicators suggest a potential connection to an advanced persistent threat using Russian-language lures. Security professionals are encouraged to update their software to mitigate the risk.

CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads

thehackernews.com · 6 months ago

Hackers compromised the CPUID website, which hosts hardware monitoring tools, for approximately 24 hours to distribute malware. Malicious versions of CPU-Z and HWMonitor were offered through fake download links, containing a legitimate executable and a malicious DLL named CRYPTBASE.dll, which then installs the STX RAT, a remote access trojan with information stealing capabilities. This campaign reused infrastructure from a previous attack involving FileZilla installers, impacting over 150 individuals and organizations primarily in Brazil, Russia, and China.

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621

thehackernews.com · 6 months ago

Adobe has released security updates to address a critical vulnerability, CVE-2026-34621, in Acrobat Reader and Acrobat. The flaw, described as prototype pollution, allows attackers to potentially run malicious code. This vulnerability is actively being exploited in the wild and may have been exploited as early as December 2025. The vulnerability affects versions of Acrobat DC, Acrobat Reader DC, and Acrobat 2024, with fixes available in recent updates.

AI screen readers as an emerging attack surface for sensitive web form inputs — Microsoft Copilot Vision reads page content in real time including what users type

support.microsoft.com · 6 months ago

Microsoft Copilot Vision is a new feature that uses artificial intelligence to analyze what you see on your Windows PC, Mac, or mobile device. It functions as a second set of eyes, offering insights and answering questions about screen content or camera views. User data is not captured or stored for training purposes, although conversation transcripts are stored but can be deleted. The feature is available across supported regions and languages and requires a Microsoft account, with subscribers receiving extended usage limits.

Over 20,000 crypto fraud victims identified in international crackdown

www.bleepingcomputer.com · 6 months ago

An international law enforcement operation, called Operation Atlantic, has identified over 20,000 victims of cryptocurrency fraud in Canada, the United Kingdom, and the United States. Authorities have frozen more than 12 million dollars in suspected criminal proceeds and have identified over 45 million dollars in stolen cryptocurrency. The initiative involved multiple agencies including the U.K.’s National Crime Agency and the U.S. Secret Service, and will be part of the U.K. government's Fraud Strategy. The FBI also reports a significant increase in cryptocurrency investment fraud complaints, with losses totaling over 7 billion dollars.