Blahalla

Critical Marimo pre-auth RCE flaw now under active exploitation

www.bleepingcomputer.com · 6 months ago

Hackers are actively exploiting a critical vulnerability in the Marimo open-source Python notebook platform. This flaw, tracked as CVE-2026-39987, allows for remote code execution without authentication. Attackers began exploiting the vulnerability within 10 hours of its public disclosure, targeting sensitive information like credentials and SSH keys. Users are urged to immediately upgrade to version 0.23.0 or block access to the vulnerable endpoint.

Paying Google to Hack macOS Users?

pgaleone.eu · 6 months ago

Researchers have discovered a malvertising campaign targeting macOS users through sponsored search results on Google. These results lead to phishing websites distributing malicious software disguised as disk cleanup utilities. The software downloads and executes a Mach-O binary that exhibits behaviors consistent with the Atomic Stealer malware, which is designed to steal passwords, cryptocurrency wallets, and other sensitive data. Attackers exploit the common practice of installing software via curl | sh to deliver different payloads depending on whether the request comes from a browser or curl, making inspection difficult.

Adobe Patches Reader Zero-Day Exploited for Months

www.securityweek.com · 6 months ago

Adobe has released emergency patches to address a critical zero-day vulnerability, CVE-2026-34621, affecting Acrobat and Reader for Windows and macOS. This flaw allows for arbitrary code execution and has been actively exploited in the wild since November 2025. A researcher discovered the vulnerability while analyzing a sophisticated PDF exploit, and indicators suggest a potential connection to an advanced persistent threat using Russian-language lures. Security professionals are encouraged to update their software to mitigate the risk.

CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads

thehackernews.com · 6 months ago

Hackers compromised the CPUID website, which hosts hardware monitoring tools, for approximately 24 hours to distribute malware. Malicious versions of CPU-Z and HWMonitor were offered through fake download links, containing a legitimate executable and a malicious DLL named CRYPTBASE.dll, which then installs the STX RAT, a remote access trojan with information stealing capabilities. This campaign reused infrastructure from a previous attack involving FileZilla installers, impacting over 150 individuals and organizations primarily in Brazil, Russia, and China.

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621

thehackernews.com · 6 months ago

Adobe has released security updates to address a critical vulnerability, CVE-2026-34621, in Acrobat Reader and Acrobat. The flaw, described as prototype pollution, allows attackers to potentially run malicious code. This vulnerability is actively being exploited in the wild and may have been exploited as early as December 2025. The vulnerability affects versions of Acrobat DC, Acrobat Reader DC, and Acrobat 2024, with fixes available in recent updates.

AI screen readers as an emerging attack surface for sensitive web form inputs — Microsoft Copilot Vision reads page content in real time including what users type

support.microsoft.com · 6 months ago

Microsoft Copilot Vision is a new feature that uses artificial intelligence to analyze what you see on your Windows PC, Mac, or mobile device. It functions as a second set of eyes, offering insights and answering questions about screen content or camera views. User data is not captured or stored for training purposes, although conversation transcripts are stored but can be deleted. The feature is available across supported regions and languages and requires a Microsoft account, with subscribers receiving extended usage limits.

Over 20,000 crypto fraud victims identified in international crackdown

www.bleepingcomputer.com · 6 months ago

An international law enforcement operation, called Operation Atlantic, has identified over 20,000 victims of cryptocurrency fraud in Canada, the United Kingdom, and the United States. Authorities have frozen more than 12 million dollars in suspected criminal proceeds and have identified over 45 million dollars in stolen cryptocurrency. The initiative involved multiple agencies including the U.K.’s National Crime Agency and the U.S. Secret Service, and will be part of the U.K. government's Fraud Strategy. The FBI also reports a significant increase in cryptocurrency investment fraud complaints, with losses totaling over 7 billion dollars.

Can AI be a ‘child of God’? Inside Anthropic’s meeting with Christian leaders.

www.washingtonpost.com · 6 months ago

false

Google Locks Chrome Sessions to Devices to Stop Cookie Theft

gbhackers.com · 6 months ago

Google has released Device Bound Session Credentials, or DBSC, a security upgrade for Chrome to prevent session hijacking. This feature cryptographically locks web sessions to a user’s device, utilizing hardware-backed security modules like TPMs or Secure Enclaves. By requiring proof of the private key for new session cookies, DBSC renders stolen cookies useless and significantly reduces session theft. Google emphasizes user privacy by ensuring distinct keys for each session and limiting data sharing with servers.

Citizen Lab: Law Enforcement Used Webloc to Track 500 Million Devices via Ad Data

thehackernews.com · 6 months ago

Law enforcement agencies in several countries are utilizing Webloc, a geolocation surveillance system acquired by Penlink from Cobwebs Technologies. This system tracks the movements and data of up to 500 million mobile devices by analyzing data from mobile apps and digital advertising. U.S. agencies using Webloc include Immigration and Customs Enforcement, the military, and various police departments. The tool allows users to monitor location data, infer addresses, and analyze historical movements, raising concerns about privacy and potential warrant-less tracking.

Reverse Engineering a Multi Stage File Format Steganography Chain of the TeamPCP Telnyx Campaign

husseinmuhaisen.com · 6 months ago

false

Claude and ChatGPT Exploited in Sweeping Cyber Campaign Against Government Agencies

gbhackers.com · 6 months ago

A cyber campaign targeted nine Mexican government agencies between late 2025 and mid-2026, resulting in the theft of hundreds of millions of citizen records. The attacker used Anthropic’s Claude Code and OpenAI’s GPT-4.1 to automate reconnaissance and exploit generation, allowing a single operator to achieve results typically requiring a team. Forensic analysis revealed over 400 custom attack scripts and 20 tailored exploits targeting 20 Common Vulnerabilities and Exposures, including fundamental security gaps that standard security practices could have prevented. The incident underscores the escalating threat of AI-powered cyberattacks and the importance of addressing technical debt within organizations.

Artemis II splashes down safely after historic voyage around the moon

www.washingtonpost.com · 6 months ago

false

ChatGPT rolls out new $100 Pro subscription to challenge Claude

www.bleepingcomputer.com · 6 months ago

false

Claude + Humans vs nginx: CVE-2026-27654

blog.calif.io · 6 months ago

Researchers collaborated with an AI, Claude, to discover and analyze a vulnerability, CVE-2026-27654, in Nginx. The bug is a heap buffer overflow in the ngxhttpdavmodule, triggered by a specific configuration and an unsigned underflow. Initially, Claude produced an exploit involving arbitrary file writes, but human expertise refined it to a simpler, more practical exploit involving copying an existing file. The rapid reproduction of the exploit highlights how AI is shrinking the window between patch release and exploit availability.

Molotov Cocktail Is Hurled at Home of Sam Altman, OpenAI’s CEO

www.nytimes.com · 6 months ago

NULL

Google adds end-to-end Gmail encryption to Android, iOS devices for enterprises

www.csoonline.com · 6 months ago

false

Friday Squid Blogging: Squid Overfishing in the South Pacific

www.schneier.com · 6 months ago

false

Hims Breach Exposes the Most Sensitive Kinds of PHI

www.darkreading.com · 6 months ago

There was a breach of the telehealth company Hims where threat actors accessed a third party customer support platform and took customer support tickets, with unauthorized access occurring from February 4 to February 7 and the company first becoming aware on February 5. The compromised records included names, email addresses and potentially ultra sensitive personal health information related to erectile dysfunction, balding, obesity and mental health, which could enable targeted blackmail or other reputational and privacy harms, and a group calling itself ShinyHunters claimed responsibility though that claim was not verified. Hims is offering impacted customers a year of free credit monitoring and identity guidance, and security experts warn that fragmented customer service systems concentrate sensitive data and should be redesigned so data moves securely, remains within trusted environments and is retained only as long as necessary.

Your Next Breach Will Look Like Business as Usual

www.darkreading.com · 6 months ago

Business as usual logins are now a leading attack vector, with nearly one in three intrusions involving valid employee credentials as credential theft surges and AI makes large scale credential attacks faster and cheaper. Security teams should shift detection models by integrating Dark Web credential monitoring into automated response workflows, adopting phish resistant multifactor authentication such as FIDO2 hardware keys, and treating authentication as a continuous process that reevaluates trust based on behavioral signals. Organizations should also harden help desk verification against AI social engineering, audit identity sprawl and service accounts for static credentials, and treat any compromised credential as a high priority incident that triggers immediate rotation and retrospective access reviews.

Volkswagen to End E.V. Production at Tennessee Plant

www.nytimes.com · 6 months ago

false

Old Docker authorization bypass pops up despite previous patch

www.csoonline.com · 6 months ago

A newly discovered vulnerability, CVE-2026-34040, allows attackers to bypass authorization plug-ins in Docker Engine and potentially gain root-level access to host systems. This flaw stems from a long-standing issue dating back to 2016, where requests exceeding 1MB are silently dropped by Docker's middleware, preventing authorization checks. The vulnerability shares a root cause with a previous flaw patched in 2024, CVE-2024-41110, and has been resolved in Docker Engine 29.3.1 and Docker Desktop 4.66.1. As a temporary mitigation, organizations can limit request sizes to 512KB. Administrators should review logs and prioritize patching systems with production credentials.

Nmap triage without a backend: XSLT -> HTML report that highlights unusual hosts/services

xn--mbius-jua.band · 6 months ago

Content states it was a joke. It instructs making an HTTP POST to a cake endpoint and supplying a recipe.

Claude Code Audit: Confirmed RCE via Environment Variable Injection

audited.xyz · 6 months ago

On March 31, 2026, Anthropic leaked the Claude Code source and an audit found one confirmed low severity vulnerability that enabled remote worker remote code execution. Claude Code's structured input output layer accepted update environment variables transport messages and applied incoming key value pairs directly to the process environment with no allowlist, allowing injection of NODEOPTIONS to execute arbitrary code when child Node processes spawned. The same mechanism can redirect OAuth and API endpoints to attacker servers, force HTTPS traffic through a malicious proxy, or disable TLS verification, and the attack surface is limited to remote worker deployments while the local CLI uses a trusted parent. A one line fix was recommended to restrict environment mutations to CLAUDECODE prefixed keys, and the issue was disclosed to Anthropic on April 2, 2026 with confirmation on April 7, 2026.

Microsoft: Third-Party Android Vulnerability Leaves Over 50M Users Exposed

www.techrepublic.com · 6 months ago

A critical vulnerability was discovered in the EngageLab SDK, a popular tool used by Android apps for push notifications. This vulnerability, an "intent redirection vulnerability," allowed malicious apps to send crafted messages that the SDK would trust and execute, potentially exposing sensitive data and internal app functions. The flaw affected over 50 million users, with over 30 million installations of crypto wallet apps impacted. EngageLab released a patch in November 2025, and Android removed affected apps from the Google Play Store.

Have You Used A.I. Chatbots for Nutrition Advice?

www.nytimes.com · 6 months ago

false

Nearly 4,000 US industrial devices exposed to Iranian cyberattacks

www.bleepingcomputer.com · 6 months ago

Iranian-linked hacking groups are targeting U.S. industrial devices, specifically Rockwell Automation programmable logic controllers, resulting in data manipulation and operational disruptions. More than three thousand eight hundred of these devices are currently exposed online in the United States. Security experts advise disconnecting devices from the internet, implementing multifactor authentication, and regularly updating systems to mitigate risk. These attacks follow similar incidents, including those targeting Unitronics and Stryker, demonstrating an escalation of Iranian cyber activity.

FINRA Launches Financial Intelligence Fusion Center to Combat Cybersecurity and Fraud Threats

www.darkreading.com · 6 months ago

FINRA has launched the Financial Intelligence Fusion Center, a secure portal that enables FINRA and member firms to share timely intelligence on cybersecurity and fraud threats and to coordinate responses. The center will collect, analyze, and disseminate threat intelligence, leverage existing FINRA partnerships with government and private sector entities, and builds on a pilot program run last year that informed its functionality. FINRA is encouraging member firms to opt into the portal to access centralized intelligence sharing intended to bolster defenses, protect investors, and safeguard market integrity.

AI and cryptocurrency scams are costing Americans billions, FBI reports

www.fortra.com · 6 months ago

The FBI’s Internet Crime Complaint Center reports cybercrime complaints exceeded one million in 2025, resulting in over 21 billion US dollars in losses. Artificial intelligence and cryptocurrency are driving this surge, with AI-enabled cybercrime costing victims over 893 million US dollars. Cryptocurrency scams, particularly those using “romance baiting,” caused over 11.3 billion US dollars in losses, and AI is lowering the skill level required for Business Email Compromise schemes. The FBI’s Operation Level Up initiative is working to notify victims and mitigate further losses.

Orange Business Reimagines Enterprise Voice Communications With Trust and AI

www.darkreading.com · 6 months ago

false

In Other News: Cyberattack Stings Stryker, Windows Zero-Day, China Supercomputer Hack

www.securityweek.com · 6 months ago

Federal officials met to discuss the potential cyber risks posed by Anthropic’s new AI model, Mythos. A new macOS malware, NotnullOSX, is targeting cryptocurrency wallets, spreading through fake documents. Ten major Japanese corporations are forming a joint organization to share cyber threat intelligence and develop security talent, following a breach at Asahi. A researcher released a Windows zero-day exploit, BlueHammer, due to a dispute with Microsoft, and Microsoft has not yet assigned a CVE.

Hacker Unknown now known, named on Europol’s most-wanted list

www.csoonline.com · 6 months ago

German police have identified Danii Shchukin, previously known as UNKN or Unknown, as the leader of the GandCrab/Revi ransomware group. Shchukin and his accomplice, Anatoly Kravchuk, are now on Europol’s most wanted list and are accused of widespread extortion across Germany, resulting in approximately $2.2 million in ransom payments and $40 million in economic damage. Shchukin reportedly refused to work with English-speaking hackers and prohibited attacks against Russia and related nations. Authorities believe both suspects are currently in Russia.

Storm-2755 Uses AiTM Hijacking to Divert Employee Salaries

gbhackers.com · 6 months ago

Hackers are targeting Canadian employees through a new campaign called Storm-2755, diverting their salaries to attacker-controlled accounts. The group uses adversary-in-the-middle (AiTM) session hijacking to bypass multifactor authentication and modify payroll records, often employing malvertising and SEO poisoning to lure victims to a fake Microsoft 365 sign-in page. Attackers then replay stolen tokens to access services and change direct deposit information, sometimes altering passwords and MFA settings for persistence. Microsoft recommends token revocation, MFA resets, and adaptive session lifetimes to mitigate the threat.

Analysis of one billion CISA KEV remediation records exposes limits of human-scale security

www.bleepingcomputer.com · 6 months ago

A new analysis of over one billion CISA vulnerability remediation records reveals that current security practices are failing to keep pace with rapidly evolving threats. Despite increased effort, critical vulnerabilities remain open for longer periods, with remediation often slower than exploitation, as seen with Spring4Shell and Cisco IOS XE vulnerabilities. The data indicates a shift is needed from traditional reactive approaches to autonomous, closed-loop risk operations to address the widening gap between attacker and defender capabilities. Focusing on cumulative exposure, measured by Risk Mass and Average Window of Exposure (AWE), is more valuable than simply tracking CVE counts.

AI Expansion, Security Crises, and Workforce Upheaval Define This Week in Tech

www.techrepublic.com · 6 months ago

Several significant developments occurred this week in the tech industry. Google introduced Gemini Notebooks, while Meta unveiled Muse Spark, a new multimodal AI system. Several critical vulnerabilities were reported, including a zero-day in Adobe Acrobat Reader and a Windows exploit known as BlueHammer. Fortinet addressed a zero-day vulnerability, CVE-2026-35616, and Google Chrome patched CVE-2026-5281. Additionally, a widespread scam targeting Apple Pay users is currently underway.

EngageSDK Vulnerability puts millions of crypto wallets at risk

gbhackers.com · 6 months ago

A critical vulnerability has been identified in the EngageSDK, an Android library used by many applications, particularly cryptocurrency wallets. This “intent redirection” flaw allows malicious apps to bypass security protections and access sensitive data, potentially impacting over 30 million wallet installations and 50 million app installs. The vulnerability, discovered by Microsoft and fixed in version 5.2.1, involved a process where crafted intents were unknowingly redirected with excessive permissions. Google has removed affected apps and implemented additional protections, but users should update their apps to mitigate risk.

Juniper Networks Patches Dozens of Junos OS Vulnerabilities

www.securityweek.com · 6 months ago

Juniper Networks has released patches to address nearly three dozen vulnerabilities across its Junos OS and Junos OS Evolved platforms. The most critical issue, CVE-2026-33784, involves a default password in the Support Insights Virtual Lightweight Collector that could allow remote takeover. Another vulnerability, CVE-2026-33771, stems from a failure to enforce password complexity in CTP OS, potentially enabling attackers to use weak passwords. Several other flaws, including one in Juniper Networks Apstra allowing for machine-in-the-middle attacks, are also resolved in this update.

Industrial Controllers Still Vulnerable As Conflicts Move to Cyber

www.darkreading.com · 6 months ago

There are warnings from the US government dated April 7, 2026 that Iran-linked cyberattackers are targeting programmable logic controllers used in water, wastewater, and energy facilities. Researchers found at least 179 Modbus devices exposing the protocol on default port 502 with no authentication, including devices tied to a national railway and two national power grids. These Internet-exposed controllers allow anyone to read and potentially write to industrial devices, creating risks of serious physical consequences and indicating attackers are increasingly directly targeting operational technology in addition to pivoting from IT. Organizations are urged to scan internal and external assets, improve segmentation and credential security, and deploy ICS-aware monitoring because fewer than ten percent of OT networks have adequate visibility.

GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs

thehackernews.com · 6 months ago

Cybersecurity researchers have discovered a new tactic in the ongoing GlassWorm campaign, involving a compromised extension disguised as a developer tool. The malicious extension, originally "specstudio.code-wakatime-activity-tracker," uses a Zig-compiled native binary to stealthily infect multiple IDEs, including Visual Studio Code and its forks. It then downloads and installs a second-stage VS Code extension, "floktokbok.autoimport," which steals data and deploys a remote access trojan. Users who installed either extension should rotate their secrets, assuming a system compromise.

Hungarian government email passwords exposed ahead of election

www.csoonline.com · 6 months ago

Passwords for almost 800 Hungarian government email accounts, including some tied to national security, are circulating online ahead of the parliamentary election. The leaks affected 12 of 13 government departments and were caused mainly by poor email hygiene and weak passwords such as variations of the word password, simple number sequences like 1234567, and use of surnames. The disclosure exposes officials including an information security officer and a counter terrorism expert and highlights the need for password managers, passkeys, and stronger credential policies across government.

CPUID hacked to deliver malware via CPU-Z, HWMonitor downloads

www.bleepingcomputer.com · 6 months ago

Hackers gained access to an API for the CPUID project and changed the download links on the official website to serve malicious executables for the popular CPU-Z and HWMonitor tools.

Hackers Exploit GitHub Copilot Flaw to Exfiltrate Sensitive Data

gbhackers.com · 6 months ago

A high severity flaw in GitHub Copilot Chat allowed attackers to silently exfiltrate sensitive data such as API keys and private source code by embedding hidden prompts in pull requests and issues. Attackers used a prompt injection technique that leveraged GitHub’s Camo image proxy to encode secrets as sequences of tiny image requests, bypassing Content Security Policy and reconstructing data character by character. The researcher reported the proof of concept and GitHub disabled image rendering in Copilot Chat and rolled out mitigations in mid August 2025 to stop the Camo based exfiltration.

Can Anthropic Keep Its Exploit-Writing AI Out of the Wrong Hands?

www.darkreading.com · 6 months ago

Anthropic's Mythos Preview model can identify and exploit zero day vulnerabilities across major operating systems and web browsers, producing complex exploits such as a chained web browser exploit with a JIT heap spray, local privilege escalation via subtle race conditions and KASLR bypasses, and a remote code execution against FreeBSD's NFS server that split a 20 gadget ROP chain over multiple packets. The capability emerged as a downstream consequence of improving the model's code and reasoning for vulnerability detection, and the company says it has responsibly disclosed thousands of high and critical vulnerabilities, including a patched 27 year old OpenBSD flaw. The company launched Project Glasswing with partners including Apple, AWS, Microsoft, Palo Alto Networks, and CrowdStrike, granted Mythos Preview access to more than 40 organizations, and committed one hundred million dollars in usage credits plus four million dollars in donations to open source security groups. Security experts caution that controls cannot guarantee exclusivity, call for independent verification, and advise defenders to assume proliferation and invest in detection, zero trust, aggressive patching, and anomaly based monitoring.

Industry Reactions to Iran Hacking ICS in Critical Infrastructure: Feedback Friday

www.securityweek.com · 6 months ago

The US government warned that Iran linked hackers have targeted critical infrastructure by manipulating programmable logic controllers and supervisory control and data acquisition systems, causing operational disruption and financial loss. Attackers reportedly connected to internet exposed PLCs and abused legitimate engineering software such as Studio 5000 Logix Designer to extract controller logic and manipulate HMI and SCADA displays, with targets including government services, water, and energy. Indicators include traffic on ports 44818, 102, and 502 and vendor advisories from Rockwell and Siemens, and recommended mitigations include removing PLCs from public internet exposure, enforcing OT segmentation and access controls, rotating default credentials, securing engineering workstations, implementing multifactor authentication and zero trust access, and applying continuous monitoring and incident response playbooks.

Microsoft: Canadian employees targeted in payroll pirate attacks

www.bleepingcomputer.com · 6 months ago

There are payroll pirate attacks by a financially motivated threat actor tracked as Storm-2755 that hijack Canadian employees' Microsoft 365 accounts using malicious sign-in pages pushed by malvertising or SEO poisoning to capture authentication tokens and session cookies. By replaying these stolen session tokens in adversary in the middle attacks, attackers bypass multifactor authentication and gain access to Microsoft services without reauthenticating. After compromise, attackers create inbox rules to hide HR messages and either social‑engineer HR staff to change direct deposit details or log into HR platforms such as Workday to update payroll information and steal salary payments. Recommended defenses include blocking legacy authentication, implementing phishing resistant multifactor authentication, revoking compromised tokens and sessions, removing malicious inbox rules, and resetting credentials and MFA methods for affected accounts.

Orthanc DICOM Vulnerabilities Lead to Crashes, RCE

www.securityweek.com · 6 months ago

Nine vulnerabilities in the open source DICOM server Orthanc allow attackers to crash servers, cause information disclosure, and achieve remote code execution. The flaws, tracked as CVE-2026-5437 to CVE-2026-5445, include out-of-bounds reads, heap buffer overflows, a GZIP decompression bomb, ZIP metadata that can trigger memory exhaustion, and improper validation in Philips Compression, Palette Color, and PAM image decoding. Orthanc versions 1.12.10 and earlier are affected, and users are advised to update to version 1.12.11; the defects were reported by researchers at Machine Spirits and documented by CERT Coordination Center.

Claude uncovers a 13‑year‑old ActiveMQ RCE bug within minutes

www.csoonline.com · 6 months ago

Anthropic's Claude helped uncover a critical remote code execution vulnerability in Apache ActiveMQ Classic that had existed for about 13 years. The flaw abused the broker management plane by using the Jolokia management API endpoint and methods like addNetworkConnector to supply a crafted brokerConfig URL that forces ActiveMQ to fetch a remote Spring XML which can create and execute arbitrary Java code. The issue is tracked as CVE-2026-34197 with a CVSS of 8.8, affects ActiveMQ Classic versions prior to 5.19.4 and several 6.x releases and is fixed in versions 5.19.4 and 6.2.3, and while it requires authentication default credentials remain common and in some 6.x versions CVE-2024-32114 can expose the Jolokia API without authentication making exploitation effectively unauthenticated. ActiveMQ has a history of high impact management plane flaws including CVE-2016-3088 and CVE-2022-41678, and researchers at Horizon3.ai said Claude reduced exploit development from about a week to minutes.

Fake BTS Tour Ticket Scams Target Fans Worldwide

gbhackers.com · 6 months ago

Cybercriminals are exploiting hype around BTS returning to the global stage and the ARIRANG world tour by launching fake ticketing websites targeting fans in Argentina, Brazil, Chile, Colombia, France, Mexico, Peru, Portugal, and Spain. Researchers identified at least ten fraudulent domains that closely mimic official ticket portals, distribute links via social media, and use tactics like fake payment errors to push victims toward irreversible instant payments such as PIX in Brazil, with funds channeled to mule accounts. Fans are advised to use only official ticket sources, check domain names and site pages, understand local ticketing rules, avoid social media links, enable transaction alerts, and contact banks immediately if scammed.

Browser Extensions Are the New AI Consumption Channel That No One Is Talking About

thehackernews.com · 6 months ago

AI browser extensions create a broad, largely unmonitored attack surface by living inside browsers and accessing page content, user inputs, session data, and cookies while bypassing data loss prevention and SaaS logs. A LayerX report shows these extensions are widespread in enterprises, with 99 percent of users running at least one extension and about one in six using an AI extension, and finds AI extensions are 60 percent more likely to have a CVE than average and significantly more likely to access cookies, execute remote scripts, and manipulate tabs. Extensions can install in seconds, persist indefinitely, and are nearly six times more likely to change permissions over time, making static allowlists ineffective. Security recommendations include continuous organization wide extension inventories, targeted controls and behavior monitoring for AI extensions, and minimum trust and transparency criteria for installs.

Taiwanese Prosecutors Seize $6.6M in Assets from Incognito Market Admin "Pharoah" (Lin Rui-siang)

tordaily.com · 6 months ago

Researchers have identified three distinct methods attackers can exploit to bypass security measures in popular video conferencing platforms. These techniques involve manipulating meeting URLs, leveraging shared screen functionalities, and exploiting vulnerabilities in integrated chat applications. Attackers could potentially gain unauthorized access to meetings, share malicious content, or eavesdrop on conversations using these methods. The vulnerabilities addressed include CVE-2024-3094, CVE-2024-3096, and CVE-2024-3097.