Blahalla

Node.js Security Release Fixes 7 Vulnerabilities Across All Supported Versions

gbhackers.com · 6 months ago

Researchers have discovered three methods attackers can exploit to bypass Apple's Lockdown Mode, a security feature designed to protect users from targeted spyware. These methods involve utilizing the system's accessibility features, exploiting the communication limit functionality through third-party apps, and manipulating the trusted input sources. The vulnerabilities allow potential attackers to circumvent Lockdown Mode's protections and gain unauthorized access to devices. These findings highlight the ongoing challenge of securing mobile devices against sophisticated threats.

An AI-Driven Game-Theoretic Approach to Attack and Defense

gbhackers.com · 6 months ago

Researchers have developed a new system called Generative Cut-the-Rope, or G-CTR, to improve cybersecurity AI by incorporating game theory. This system enhances AI agents used for penetration testing and defense planning, enabling them to think strategically like experienced cybersecurity professionals. G-CTR operates in three phases: creating attack graphs, calculating optimal strategies, and providing guidance to the agent. Tests show this approach improves success rates, reduces costs, and creates more consistent results compared to AI-only methods.

PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces

thehackernews.com · 6 months ago

Cyberattacks targeting Ukrainian defense forces have been observed between October and December 2024, attributed to the Russian hacking group Void Blizzard. The malware, PLUGGYAPE, uses messaging platforms like Signal and WhatsApp to distribute malicious files disguised as charitable organizations. Attackers are also using compromised accounts of Ukrainian mobile operators for initial contact and leveraging external services to hide command-and-control infrastructure. Several other threat actors, UAC-0239 and UAC-0241, are employing phishing campaigns using tools like FILEMESS, OrcaC2, LaZagne, and GAMYBEAR.

FortiOS and FortiSwitchManager Flaw Allows Remote Code Execution

gbhackers.com · 6 months ago

A vulnerability has been discovered in Fortinet’s FortiOS and FortiSwitchManager products, allowing attackers to execute code remotely without authentication. This flaw, identified as CVE-2025-25249, is a heap-based buffer overflow within the cwacd daemon and has a CVSS score of 7.4. Affected versions of FortiOS and FortiSwitchManager require updates to mitigate the risk, including upgrades to versions 7.6.4, 7.4.9, 7.2.12, 7.0.18, 6.4.17, and 7.2.7 respectively. Organizations should prioritize patching and monitor systems for suspicious activity.

New Magecart Campaign Steals Credit Card Details During Online Checkouts

gbhackers.com · 6 months ago

A sophisticated Magecart web-skimming campaign has been stealing credit card data from e-commerce websites since January 2022. Threat actors inject malicious JavaScript code into checkout pages, creating fake payment forms that mimic legitimate interfaces to steal sensitive financial information. The malware evades detection by disappearing when WordPress administrators are logged in and simulates a successful checkout to deceive victims. Stolen data is encrypted and sent to exfiltration servers, with some hosted on a European-sanctioned entity.

Microsoft January 2026 Patch Tuesday Fixes 114 Flaws, Including 3 Zero-Days

gbhackers.com · 6 months ago

Microsoft released January 2026 security updates addressing 114 vulnerabilities across various components. These flaws include remote code execution vulnerabilities in Microsoft Word, Excel, and Office, alongside elevation of privilege vulnerabilities affecting Windows Graphics Component, Virtualization-Based Security, and the Local Security Authority Subsystem Service. Several vulnerabilities also lead to information disclosure and security feature bypasses. Notable CVEs include CVE-2026-20822, CVE-2026-20944, CVE-2026-0386, and CVE-2024-55414.

Starlink Users in Iran Get Free Internet Access, Nonprofits Say

www.nytimes.com · 6 months ago

Users in Iran are accessing free internet service through Elon Musk’s Starlink satellite internet, according to a U.S.-based organization. This development comes amidst a government-imposed communications blackout aimed at suppressing recent mass protests. SpaceX, Starlink’s parent company, reportedly waived service fees, allowing Iranians to bypass restrictions. Iranian authorities have previously banned Starlink terminals and enacted strict penalties for its use, attempting to jam signals to block the service.

California privacy agency appoints surveillance expert to board

therecord.media · 6 months ago

false

Taiwan Endures Greater Cyber Pressure From China

www.darkreading.com · 6 months ago

Cyberattacks against Taiwan have increased, with daily attacks rising 6% to an average of 2.63 million in 2025. Energy infrastructure saw a tenfold increase in attacks, while hospital systems experienced a 54% rise. Taiwan’s National Security Bureau attributes these attacks to China, characterizing them as a deliberate effort to compromise critical infrastructure and disrupt government functions. Five Chinese cyber groups, BlackTech, Flax Typhoon, Mustang Panda, APT41, and UNC3886, are identified as primary adversaries targeting various sectors.

January 2026 Microsoft Patch Tuesday: Actively exploited zero day needs attention

www.csoonline.com · 6 months ago

Microsoft’s January 2026 Patch Tuesday addresses eight critical vulnerabilities and a zero-day vulnerability currently being exploited. A significant concern is CVE-2026-20805, a Desktop Window Manager information disclosure flaw that allows attackers to view memory and potentially compromise systems. Security teams should also prioritize patching vulnerabilities that Microsoft identifies as likely to be exploited, including issues in Windows Error Reporting, the NTFS file system, and the Windows Agere Soft Modem Driver (CVE-2023-31096). Additionally, updates are necessary to prevent Secure Boot bypasses due to expiring certificates and to address vulnerabilities in SAP, Mozilla Firefox, and Oracle products.

Patch Tuesday, January 2026 Edition

krebsonsecurity.com · 6 months ago

Microsoft has released patches to address 113 security vulnerabilities in Windows and related software. A critical vulnerability, CVE-2026-20805, exists in the Desktop Window Manager and is currently being exploited, potentially undermining system security controls. Several critical remote code execution flaws in Microsoft Office, CVE-2026-20952 and CVE-2026-20953, are also included in this month's updates. Additionally, Microsoft is removing legacy modem drivers, including those related to CVE-2023-31096, and addressing a Secure Boot vulnerability, CVE-2026-21265, which requires attention due to expiring certificates.

CrowdStrike to Buy Seraphic Security in Bid to Boost Browser Security

www.darkreading.com · 6 months ago

false

CISO Succession Crisis Highlights How Turnover Amplifies Security Risks

www.darkreading.com · 6 months ago

false

Ukraine's army targeted in new charity-themed malware campaign

www.bleepingcomputer.com · 6 months ago

Ukrainian Defense Forces officials were targeted in a malware campaign between October and December 2025, using a backdoor called PluggyApe. The attacks, likely carried out by the Russian threat groups Void Blizzard and Laundry Bear, involved fake charity websites and messages sent through Signal and WhatsApp. PluggyApe gathers system information, establishes persistence, and uses external sources for command-and-control addresses. CERT-UA warns of increased targeting of mobile devices and the use of compromised accounts to enhance attack credibility.

New VoidLink malware framework targets Linux cloud servers

www.bleepingcomputer.com · 6 months ago

A new Linux malware framework called VoidLink has been discovered, targeting cloud environments like Kubernetes and Docker. Written in Zig, Go, and C, the framework includes custom loaders, implants, rootkits, and plugins for post-exploitation and stealth operations. It can detect cloud providers and collect detailed system information, communicating with operators through encrypted channels and utilizing various plugins for reconnaissance, credential harvesting, and lateral movement. Researchers believe the framework is developed by Chinese-speaking developers and designed for commercial purposes, exhibiting advanced anti-analysis and anti-forensic capabilities.

'Most Severe AI Vulnerability to Date' Hits ServiceNow

www.darkreading.com · 6 months ago

A significant vulnerability has been identified in ServiceNow, a widely used IT services management platform. Researchers discovered that a universal credential and lax authentication protocols allowed attackers to potentially gain full control of ServiceNow instances and access connected systems. The vulnerability involved ServiceNow’s Virtual Agent chatbot and its Now Assist agentic AI technology, enabling attackers to create admin-level accounts and pivot to other systems like Salesforce or Microsoft. ServiceNow has addressed the issue by rotating the universal credential and restricting AI agent capabilities, and advises organizations to review AI agent permissions and implement a review process.

More than 40 countries impacted by North Korea IT worker scams, crypto thefts

therecord.media · 6 months ago

false

Microsoft Starts 2026 With a Bang: A Freshly Exploited Zero-Day

www.darkreading.com · 6 months ago

Microsoft’s January security update addresses 112 common vulnerabilities and exposures, or CVEs, significantly more than last month. A zero-day vulnerability, CVE-2026-20805, in the Desktop Window Manager is already being exploited to leak memory addresses. Eight vulnerabilities are considered likely to be exploited, including remote code execution flaws CVE-2026-20840 and CVE-2026-20922 in Windows NTFS, and several elevation-of-privilege vulnerabilities. Microsoft also identified two critical vulnerabilities, CVE-2026-20952 and CVE-2026-20953, in Microsoft Office that could enable remote code execution.

Microsoft Patches Exploited Windows Zero-Day, 111 Other Vulnerabilities

www.securityweek.com · 6 months ago

Microsoft’s latest security updates address 112 vulnerabilities, including a zero-day being actively exploited. This vulnerability, CVE-2026-20805, is an information disclosure issue in the Desktop Windows Manager component. Security researchers believe the flaw may be part of a chain enabling arbitrary code execution, demonstrating the significance of memory leaks. Additionally, two vulnerabilities, CVE-2026-21265 and CVE-2023-31096, were publicly disclosed before patches were released, with CVE-2023-31096 considered more likely to be exploited.

Tennessee man to plead guilty to hacking Supreme Court’s electronic case filing system

therecord.media · 6 months ago

A Tennessee man is set to plead guilty to a misdemeanor charge of hacking into the Supreme Court’s electronic case filing system. Nicholas Moore allegedly accessed the system without authorization on 25 separate occasions between August and October 2023. The details of what information was accessed remain undisclosed. This incident is part of a larger pattern of cyberattacks targeting the federal judicial system, including a previously reported breach by Russian hackers of the PACER system.

Cybersecurity risk will accelerate this year, fueled in part by AI, says World Economic Forum

www.csoonline.com · 6 months ago

The World Economic Forum’s latest cybersecurity outlook highlights that AI will be the most significant driver of change in cybersecurity by 2026, with 94% of leaders anticipating its impact. Survey data indicates increased AI-related vulnerabilities, cyber-enabled fraud, and supply chain disruptions. Confidence in national cyber preparedness is declining, and organizations are grappling with the challenges of implementing AI security measures, including a lack of expertise and concerns about risk. Ultimately, the report emphasizes the need for collaboration, robust governance frameworks, and a balance between automation and human judgment to improve cyber resilience.

CrowdStrike to Acquire Browser Security Firm Seraphic for $420 Million

www.securityweek.com · 6 months ago

false

Central Maine Healthcare breach exposed data of over 145,000 people

www.bleepingcomputer.com · 6 months ago

A data breach at Central Maine Healthcare impacted over 145,000 individuals. Hackers were present on the organization’s systems for over two months, beginning in March of last year. Exposed data includes names, dates of birth, treatment information, Social Security Numbers, and health insurance details, increasing the risk of fraud for affected patients. Central Maine Healthcare is providing free credit monitoring and a dedicated support line for those impacted.

Threat Brief: MongoDB Vulnerability (CVE-2025-14847)

unit42.paloaltonetworks.com · 6 months ago

A critical vulnerability, CVE-2025-14847, known as MongoBleed, has been identified in MongoDB Server affecting versions 5.0 through 8.2. This unauthenticated flaw allows attackers to potentially leak sensitive data, such as credentials, through a compression issue. Approximately 146,000 exposed MongoDB instances are currently vulnerable and exploitation is actively occurring. Palo Alto Networks recommends patching and offers detection and mitigation capabilities through products like Cortex XDR, Xpanse, and Cortex Cloud.

Belgian hospital AZ Monica shuts down servers after cyberattack

www.bleepingcomputer.com · 6 months ago

A cyberattack forced the Belgian hospital AZ Monica to shut down its servers and cancel scheduled procedures. The hospital is operating with reduced capacity, and critical patients were transferred to other facilities with assistance from the Red Cross. Registration for new patients is experiencing delays as staff are relying on paper records. Authorities are investigating the incident, and while unconfirmed reports suggest a ransom demand, hospital officials have not confirmed this.

New Windows updates replace expiring Secure Boot certificates

www.bleepingcomputer.com · 6 months ago

false

Adobe Patches Critical Apache Tika Bug in ColdFusion

www.securityweek.com · 6 months ago

Adobe released security updates for eleven products, addressing twenty-five vulnerabilities. A critical vulnerability, CVE-2025-66516, is an XML External Entity injection flaw in the Apache Tika modules, impacting ColdFusion versions 2025 Update 5 and earlier, and 2023 Update 17 and earlier. This flaw could lead to information leaks, SSRF attacks, denial-of-service, or remote code execution. Dreamweaver received updates for five high-severity flaws, including arbitrary code execution and system file write vulnerabilities.

Ukraine parliament approves resignation of security service chief in major reshuffle

therecord.media · 6 months ago

false

Microsoft releases Windows 10 KB5073724 extended security update

www.bleepingcomputer.com · 6 months ago

Microsoft has released security update KB5073724 for Windows 10, addressing 114 vulnerabilities including three actively exploited zero-day flaws. The update resolves an elevation of privileges vulnerability in Agere modem drivers, a security flaw in the WinSqlite3.dll component, and prepares for the expiration of Secure Boot certificates in 2026. This update removes several modem drivers and introduces a phased rollout of updated Secure Boot certificates to eligible devices. Affected builds include 19045.6809 for Windows 10 and 19044.6809 for Windows 10 Enterprise LTSC 2021.

Windows 11 KB5074109 & KB5073455 cumulative updates released

www.bleepingcomputer.com · 6 months ago

Microsoft has released cumulative updates for Windows 11 versions 23H2 and 25H2, including January 2026 security patches. These mandatory updates address vulnerabilities and resolve bugs, changing build numbers to 26200.7623 for 25H2 and 226x1.6050 for 23H2. The update resolves issues with mirrored networking in WSL, RemoteApp connection failures in Azure Virtual Desktop, and addresses unexpected power consumption on devices with an NPU. It also introduces changes to Secure Boot certificate deployment and phases out hands-free deployment functionality in Windows Deployment Services.

Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws

www.bleepingcomputer.com · 6 months ago

Microsoft’s January 2026 Patch Tuesday resolves 114 vulnerabilities across Windows, Office, and SQL Server. The update addresses eight critical flaws and three zero-day vulnerabilities, including an actively exploited information disclosure issue in the Desktop Window Manager. Security enhancements include the removal of vulnerable modem drivers and the renewal of Windows Secure Boot certificates. The vulnerabilities patched encompass elevation-of-privilege, information disclosure, remote code execution, and denial-of-service issues impacting core system drivers, services, and networking components.

CVE-2025-64155: 3 Years of Remotely Rooting the Fortinet FortiSIEM

horizon3.ai · 6 months ago

Security researchers have discovered vulnerabilities in the FortiSIEM appliance, leading to remote code execution and privilege escalation. The issues, assigned CVE-2025-64155, stem from an unauthenticated argument injection and a file overwrite flaw within the phMonitor service. Exploitation involves crafting malicious requests that manipulate curl commands to write files as the admin user and ultimately escalate to root privileges by modifying a script executed by the root crontab. Previous vulnerabilities, CVE-2023-34992 and CVE-2024-23108, also affected the phMonitor service.

Google confirms Android bug causing volume key issues

www.bleepingcomputer.com · 6 months ago

Google has acknowledged a bug affecting Android devices where volume keys malfunction when the accessibility feature "Select to Speak" is enabled. The issue causes volume keys to adjust the accessibility volume instead of the media volume and prevents photo capture when using the camera. This accessibility service reads text aloud and describes screen elements for users with vision or reading difficulties. A temporary workaround involves disabling the "Select to Speak" service within device settings.

The AI Fix #83: ChatGPT Health, Victorian LLMs, and the biggest AI bluffers

grahamcluley.com · 6 months ago

false

Shadow#Reactor Uses Text Files to Deliver Remcos RAT

www.darkreading.com · 6 months ago

A new malware campaign called ShadowReactor is using a unique method to deliver the Remcos RAT. Attackers use text-only files delivered through Windows Script Host and PowerShell to bypass security measures, reconstructing the malicious payload in memory. This technique involves downloading fragmented text payloads and compiling them to deploy the RAT, which gives attackers complete control over compromised systems. The campaign targets businesses and uses social engineering tactics, and researchers suspect a financially motivated threat actor is behind the attacks.

Long-Running Web Skimming Campaign Steals Credit Cards From Online Checkout Pages

thehackernews.com · 6 months ago

Researchers have identified a large-scale web skimming campaign active since January 2022 that targets major payment networks including American Express, Discover, and Mastercard. Attackers inject malicious JavaScript code into e-commerce sites to steal credit card information and other personal data, a technique classified as Magecart. The skimmer avoids detection by checking for administrator login indicators and manipulating user interfaces to display fake payment forms, often mimicking legitimate services like Stripe. Stolen data, including names, addresses, and payment details, is sent to the server lasorie[.]com.

Malicious Chrome Extension Steals MEXC API Keys by Masquerading as Trading Tool

thehackernews.com · 6 months ago

A malicious Google Chrome extension called MEXC API Automator is stealing API keys from users of the MEXC cryptocurrency exchange. The extension, published on September 1, 2025, masquerades as a trading tool and secretly creates API keys with withdrawal permissions, then sends those keys to a Telegram bot controlled by the attackers. This allows the threat actor to control a user’s MEXC account, execute trades, and potentially drain funds. Researchers warn that similar attacks could be adapted to target other platforms that issue API keys.

GoBruteforcer Botnet Targeting Crypto, Blockchain Projects

www.securityweek.com · 6 months ago

A new variant of the GoBruteforcer botnet is targeting cryptocurrency and blockchain projects in a financially motivated attack. The botnet scans for vulnerable internet-exposed services like FTP, MySQL, phpMyAdmin, and PostgreSQL, often exploiting weak default credentials. Researchers attribute the botnet’s success to factors including the widespread use of large language models in server deployments and the continued use of vulnerable software like XAMPP. The botnet operators are also targeting TRON blockchain addresses to identify potential victims and transfer tokens to attacker-controlled wallets.

After Goldman, JPMorgan Discloses Law Firm Data Breach

www.securityweek.com · 6 months ago

JPMorgan Chase is notifying investors about a data breach affecting individuals in a private equity fund. The breach originated from a cybersecurity incident at the law firm Fried, Frank, Harris, Shriver & Jacobson LLP, impacting 659 people. Compromised data includes names, contact information, account numbers, Social Security numbers, and government identification numbers. This incident mirrors a previous breach notification from Goldman Sachs related to the same law firm.

Trump seeks to quell rebellion over data centers

www.washingtonpost.com · 6 months ago

false

Cyber Insights 2026: External Attack Surface Management

www.securityweek.com · 6 months ago

The rapid adoption of AI and cloud technologies is expected to dramatically expand an organization’s external attack surface by 2026. Experts say External Attack Surface Management, or EASM, is increasingly critical for identifying and managing internet-facing assets. AI poses both a defensive and offensive threat, and organizations must invest in AI-powered tools, continuous monitoring, and broaden their view of risk to include third-party partners. Ultimately, organizations need to acknowledge a loss of control and prepare for escalated cybersecurity challenges.

How Microsoft builds privacy and security to work hand-in-hand

www.microsoft.com · 6 months ago

false

Senior military cyber operator removed from Russia task force

therecord.media · 6 months ago

false

Betterment confirms data breach after wave of crypto scam emails

www.bleepingcomputer.com · 6 months ago

Betterment, a digital investment advisor managing over one million customer accounts, recently confirmed a data breach. Hackers exploited a third-party marketing platform to send fraudulent emails to customers, promising triple cryptocurrency deposits. While customer accounts and credentials were not accessed, the attacker gained access to customer information including names, addresses, phone numbers, and dates of birth. This incident mirrors a similar scam targeting Grubhub in December, and Betterment is enhancing security measures and advising customers to be cautious of suspicious communications.

Microsoft Pledges to Pay More for Electricity, Drawing Praise From Trump

www.nytimes.com · 6 months ago

false

Cyberbro v0.10.2 Released | GUI enhancements, MCP, Threat Intel tool | Open Source Security Atlas

www.opensecatlas.com · 6 months ago

false

5 Facts You Should Know About Cybersecurity

gbhackers.com · 6 months ago

false

Convincing LinkedIn comment-reply tactic used in new phishing

www.bleepingcomputer.com · 6 months ago

Scammers are using a new tactic on LinkedIn, flooding posts with fake reply comments that impersonate the platform itself. These comments falsely claim policy violations and direct users to external links, sometimes masking the destination with LinkedIn’s URL shortener, lnkd.in. Clicking the link leads to phishing sites designed to steal credentials, with one site appearing as very1929412.netlify[.]app and another as very128918[.]site. LinkedIn is aware of the campaign and taking action, advising users to report suspicious behavior.

Kremlin-linked hackers pose as charities to spy on Ukraine’s military

therecord.media · 6 months ago

Hackers with ties to the Kremlin are targeting Ukraine’s military personnel through a cyber-espionage campaign. Researchers have identified a new malware strain called PluggyApe, which was used between October and December 2023. Attackers posed as charitable organizations, contacting victims through messaging apps like Signal and WhatsApp to distribute malicious files. The group, known as Void Blizzard or UAC-0190, is increasingly using trusted communication channels to deliver malware and establish remote access to systems.

Suspected ransomware attack threatens one of South Korea’s largest companies

therecord.media · 6 months ago

South Korean education and lifestyle company Kyowon Group has shut down portions of its computer network following a suspected ransomware attack. The company confirms data may have been leaked externally and is investigating whether customer information was compromised. Hackers have demanded a ransom, and the incident is prompting concerns about the potential impact on millions of individuals. Kyowon has reported the breach to authorities and is working to restore systems while prioritizing customer protection.