Blahalla

The Pirate Bay : Top 8 Best Pirate Bay Alternatives and Proxy List 2026

gbhackers.com · 6 months ago

The Pirate Bay, a popular torrent website, has experienced recent downtime and access restrictions. Users can access the site and download torrent files using proxy servers or VPN services, which help bypass censorship. Several alternatives to The Pirate Bay exist, including KickAss Torrents, Yify Torrent, RARBG, 1337x, ExtraTorrent, Torrentz2, LimeTorrents, and Putlocker Proxy. Users are advised to utilize antivirus software and be cautious of potential malware when downloading torrent files.

Im Fokus: Die IT-Agenda 2026 gestalten

de.resources.csoonline.com · 6 months ago

false

AsyncRAT and the Misuse of Cloudflare Free-Tier Infrastructure: Detection and Analysis

gbhackers.com · 6 months ago

Cybersecurity researchers have identified a sophisticated AsyncRAT campaign that exploits Cloudflare’s free-tier infrastructure to evade detection. The attack begins with phishing emails containing Dropbox links that lead to malicious files, ultimately downloading and executing AsyncRAT payloads. Attackers use WebDAV servers hosted on TryCloudflare domains, such as plus-condos-thy-redeem.trycloudflare.com, and employ Python scripting and polymorphic code injection techniques to establish persistence and gain remote access. Security professionals recommend enhanced email security controls, user awareness training, and monitoring for unusual WebDAV connections.

Over 100,000 Internet-Exposed n8n Instances Vulnerable to RCE Attacks

gbhackers.com · 6 months ago

More than 100,000 internet-connected n8n workflow automation instances are vulnerable to remote code execution. The flaw, identified as CVE-2026-21858, has a critical severity score of 10.0, allowing attackers to run code without authentication. Approximately half of all detected n8n deployments are affected, highlighting security gaps in deployment practices. Organizations are urged to apply available patches and verify their system security.

New Angular Vulnerability Allows Attackers to Execute Malicious Payloads

gbhackers.com · 6 months ago

A critical Cross-Site Scripting vulnerability, CVE-2026-22610, has been identified in Angular’s Template Compiler, posing a significant risk to web applications. The flaw occurs because Angular’s sanitization improperly handles href attributes in SVG script elements, allowing attackers to execute malicious JavaScript. Successful exploitation requires specific conditions, including the use of property binding on SVG script elements and data from untrusted sources. Patched versions of Angular 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0 are now available to address the issue.

CISA Alerts on Actively Exploited Gogs Path Traversal Flaw

gbhackers.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency has identified a critical vulnerability in Gogs, a self-hosted Git service, and added it to their Known Exploited Vulnerabilities catalog. Tracked as CVE-2025-8110, this path traversal flaw allows attackers to potentially execute arbitrary code on vulnerable systems. Federal agencies and organizations are required to address the vulnerability by February 2, 2026, and are advised to apply security patches or discontinue use if patches are unavailable. Security teams should prioritize remediation efforts to protect infrastructure.

Last Week in Security (LWiS) - 2026-01-12

blog.badsectorlabs.com · 6 months ago

Recent cybersecurity news includes Iran's internet disconnection and Germany seeking CTF players. Security researchers discovered a pre-authentication remote code execution vulnerability in SmarterMail, designated CVE-2025-52691, and another in n8n, CVE-2026-21858. New tools and techniques emerged, including methods for process hiding using PatchGuard and generating shadow copies via the VSS API, alongside red team tools designed to evade EDR software. Several new tools were released, including a command-and-control agent and a lightweight macOS detection agent.

Malicious Chrome Extension Steals Wallet Credentials, Enables Automated Trading Abuse

gbhackers.com · 6 months ago

A malicious Chrome extension called MEXC API Automator is stealing API credentials from cryptocurrency traders. The extension, published on September 1, 2025, masquerades as a legitimate trading tool but secretly creates MEXC API keys with withdrawal permissions and sends them to a Telegram bot. This allows attackers to take complete control of affected accounts, execute unauthorized trades, and drain cryptocurrency wallets while hiding the enabled withdrawal permissions from users. The threat actor uses the alias jorjortan142 and is linked to a broader threat infrastructure named SwapSushi.

InvisibleJS: Executable ES Modules Hidden in Plain Sight with Zero-Width Characters

gbhackers.com · 6 months ago

A new tool called InvisibleJS has been released, demonstrating a method to completely hide JavaScript code using zero-width Unicode characters. This technique converts code into binary strings represented by these invisible characters, making files appear empty while remaining executable. There are two versions, one compatible with older environments and one supporting modern ES Modules. Security experts caution that this could be used to conceal malicious code and bypass security reviews, and recommend automated code analysis tools for detection.

Trump Administration Nears Trade Deal With Taiwan

www.nytimes.com · 6 months ago

false

Hacker gets seven years for breaching Rotterdam and Antwerp ports

www.bleepingcomputer.com · 6 months ago

A Dutch national has been sentenced to seven years in prison for computer hacking and attempted extortion related to drug trafficking. The man compromised the IT systems of the ports of Rotterdam, Barendrecht, and Antwerp by using employees to insert malware. This allowed him to access port systems, exfiltrate data, and intercept transmissions, facilitating the undetected import of drugs. He also attempted to resell malware and usage instructions, and while one charge was dropped, the court rejected arguments concerning the legality of intercepting communications on the Sky ECC encrypted chat service.

Stewart Cheifet, Host of TV’s ‘Computer Chronicles,’ Dies at 87

www.nytimes.com · 6 months ago

false

Meta Plans to Cut 10% to 15% of Employees in Reality Labs Business

www.nytimes.com · 6 months ago

false

Elon Musk’s X Under UK Investigation Over Grok’s Sexualized A.I. Images

www.nytimes.com · 6 months ago

British authorities have launched an investigation into X, formerly known as Twitter, over the spread of sexualized images generated by its chatbot, Grok. The images, created in response to user prompts, depict real people, including children, in provocative situations. Ofcom, the UK regulator, is examining whether X violated laws regarding illegal content, potentially leading to substantial fines. The investigation is considered a high priority due to the risk of harm, particularly to children.

BreachForums Breached, Exposing 324K Cybercriminals

www.darkreading.com · 6 months ago

A breach of BreachForums, a marketplace for stolen data, has exposed the personal information of approximately 324,000 cybercriminals. The leaked database includes usernames, email addresses, IP addresses, and registration details, which could assist law enforcement in identifying and prosecuting members of the hacking community. An individual using the moniker "James" published the data, citing disillusionment with BreachForums members and targeting those who attacked French interests. Cybersecurity firm Resecurity confirmed the data's authenticity and noted its usefulness for investigations.

Notorious BreachForums hacking site hit by ‘doomsday’ leak of 324,000 criminal users

www.csoonline.com · 6 months ago

The BreachForums hacking forum, a successor to RaidForums, has experienced a significant data breach revealing a database of over 320,000 users. The leaked data includes email addresses, IP data, hashed passwords, private messages, and forum posts. Security experts caution that the data's integrity may be questionable and could potentially contain disinformation, while law enforcement may find the information useful despite many IP addresses being loopbacks. The forum has already faced numerous arrests, takedowns, and the sentencing of its alleged founder, raising questions about its future viability.

Apple taps Google to power a new Siri and future AI tools

www.washingtonpost.com · 6 months ago

false

Apple Teams Up With Google for A.I. in Its Products

www.nytimes.com · 6 months ago

false

Multipurpose GoBruteforcer Botnet Targets 50K+ Linux Servers

www.darkreading.com · 6 months ago

A botnet called GoBruteforcer is targeting Linux servers by brute-forcing weak user passwords on services like FTP, MySQL, and phpMyAdmin. Researchers suspect AI-generated server configurations with common usernames and weak defaults are contributing to the widespread vulnerability, affecting an estimated 50,000 internet-facing servers. The botnet operators are financially motivated, seeking data theft and cryptocurrency. Security experts recommend stronger passwords, secure configuration practices, and continuous exposure management to mitigate the risk.

Facebook login thieves now using browser-in-browser trick

www.bleepingcomputer.com · 6 months ago

Hackers are increasingly using a browser-in-browser technique to steal Facebook account credentials. This method presents users with a fake login window, making it difficult to detect as malicious. Attackers are impersonating law firms and Meta to lure victims, and are leveraging legitimate cloud platforms to host phishing pages. Security experts recommend navigating directly to official URLs and enabling two-factor authentication to protect against these attacks.

Internet monitoring experts say Iran blackout likely to continue

therecord.media · 6 months ago

Iran has implemented a widespread internet blackout now entering its fourth day, impacting its 90 million residents. The shutdown began following nationwide protests focused on economic issues, and authorities cite "prevailing conditions" as the reason. Internet monitoring groups report this is the fastest deployment of Iran’s internet “kill switch” to date, disabling fixed-line internet, mobile data, and calls while targeting satellite communication tools. While officials suggest a potential restoration of service, experts believe the blackout could continue indefinitely.

Armenia probes alleged sale of 8 million government records on hacker forum

therecord.media · 6 months ago

Armenian officials are investigating a potential data breach after hackers offered to sell a large dataset of government records on an underground forum. The data, reportedly containing around 8 million records from a government notification system and electronic civil litigation platform, is being offered for $2,500. The seller, known as dk0m, is a known broker who has previously sold government data from multiple countries and is believed to use infostealer malware. Cybersecurity experts warn that the compromised data could be used to target Armenian citizens with convincing social engineering scams.

Navigating Privacy and Cybersecurity Laws in 2026 Will Prove Difficult

www.darkreading.com · 6 months ago

false

CISA orders feds to patch Gogs RCE flaw exploited in zero-day attacks

www.bleepingcomputer.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency has directed federal agencies to address a critical vulnerability in Gogs, a collaboration platform. This remote code execution flaw, identified as CVE-2025-8110, allows attackers to overwrite system files and execute arbitrary commands by exploiting a path traversal weakness. Researchers discovered over 1,400 exposed Gogs servers, with more than 700 showing signs of compromise, and observed ongoing attacks targeting this vulnerability as a zero-day. Federal agencies must patch the vulnerability by February 2, 2026.

Hungary grants asylum to former Polish minister implicated in spyware probe

therecord.media · 6 months ago

Hungary has granted political asylum to former Polish Justice Minister Zbigniew Ziobro, who is facing charges related to a spyware scandal. Ziobro is accused of allegedly embezzling funds to purchase spyware and surveil political opponents, with accusations suggesting snooping on nearly 600 people. He claims the asylum is necessary due to political persecution in Poland and a lack of rule of law. Another former Justice Ministry official, Marcin Romanowski, also recently sought asylum in Hungary amid similar charges.

'Bad actor' hijacks Apex Legends characters in live matches

www.bleepingcomputer.com · 6 months ago

Apex Legends players recently experienced disruptions during live matches with reports of unauthorized control over their characters, disconnections, and nickname changes. The game publisher, Respawn, confirmed a security incident but stated it was not due to malware or code execution. Investigations suggest a "bad actor" gained elevated privileges, potentially accessing server debugging systems, although Respawn resolved the issue, attributing it to cheat-related activities. This incident follows a previous security breach during a North American competition, raising concerns about the game's safety.

FBI Flags Quishing Attacks From North Korean APT

www.darkreading.com · 6 months ago

North Korean cyber actors, specifically the Kimsuky group, are using quick response or QR codes in spear-phishing emails to evade security measures. These "quishing" attacks target US and foreign government entities, think tanks, and academic institutions, often leading victims to credential harvesting pages designed for mobile devices. Attackers are able to bypass multifactor authentication by stealing session tokens and replay them. The attacks are difficult to detect because they leverage mobile devices, which often lack enterprise endpoint protection.

Astaroth’s Boto Cor-de-Rosa campaign targets Brazil with new WhatsApp malware technique

www.acronis.com · 6 months ago

Researchers have identified a new malware campaign targeting Brazil, utilizing the Astaroth banking trojan. This campaign, dubbed "Boto Cor-de-Rosa," leverages WhatsApp Web to spread the infection by sending malicious ZIP files to contacts. The malware employs a Visual Basic script for initial download and a Python module for WhatsApp propagation, alongside a core Delphi payload for banking credential theft. Compromised systems also have their contact lists exfiltrated, and the malware adjusts its greetings based on the recipient's local time.

A common denominator in AI agent framework CVEs: Validation

niyikiza.com · 6 months ago

A recurring pattern in LangChain and LlamaIndex vulnerabilities is that validation checks operate on the input string while attacks exploit differences in how the system ultimately interprets that string. Known examples include CVE-2024-3571 for path traversal caused by checking for double dot without normalization, CVE-2024-0243 for SSRF from validating a URL but not its redirect destination, CVE-2025-2828 for no IP restrictions in RequestsToolkit, CVE-2025-3046 for validating a path string without resolving symlinks, and CVE-2025-61784 for SSRF from checking URL format without resolving its IP. Attackers can bypass naive checks using encoded path segments and alternative numeric IP representations so that blocklists and regexes fail. Fixes require validating in the same semantic space as execution, for example resolving symlinks before containment checks and resolving DNS to check concrete IPs, because more regex is not a sufficient defense.

Sweden detains ex-military IT consultant suspected of spying for Russia

therecord.media · 6 months ago

A former IT consultant for Sweden’s Armed Forces has been detained and is suspected of spying for Russian intelligence. The alleged espionage may have begun in 2022 and continued through 2024 and into the new year. The suspect, who previously worked with the military and is the head of a cybersecurity firm, is being investigated for activities that threaten national security. This case is part of a wider effort to address suspected Russian intelligence activity across Europe.

University of Hawaii Cancer Center hit by ransomware attack

www.bleepingcomputer.com · 6 months ago

The University of Hawaii’s Cancer Center experienced a ransomware attack in late August 2025, resulting in data theft. Stolen data includes research files, some containing Social Security numbers from the 1990s. The university paid a ransom to obtain a decryption tool and ensure the deletion of the stolen information, and is working to notify affected individuals. Security enhancements implemented include endpoint protection software, firewall replacements, and security audits. The Clop ransomware gang exploited an Oracle E-Business Suite zero-day vulnerability to target Harvard University and the University of Pennsylvania.

Zuckerberg draws Trump’s praise for his choice for Meta president

www.washingtonpost.com · 6 months ago

false

Game-theoretic feedback loops for LLM-based pentesting: doubling success rates in test ranges

arxiv.org · 6 months ago

NULL

Target's dev server offline after hackers claim to steal source code

www.bleepingcomputer.com · 6 months ago

Hackers are claiming to have stolen and are attempting to sell Target Corporation's internal source code, advertising a dataset of approximately 860 GB. The hackers initially posted sample code repositories on a public platform called Gitea, listing tens of thousands of files for sale. After Target was contacted, the repositories were removed, and their developer Git server became inaccessible. The leaked files contained internal development server names, employee information, and references to internal systems, suggesting the data originated from Target’s private development infrastructure.

OID-See: Giving Your OAuth Apps the Side-Eye

cirriustech.co.uk · 6 months ago

false

The Best Conference Calling Apps for Mobile

gbhackers.com · 6 months ago

false

Apple confirms Google Gemini will power Siri, says privacy remains a priority

www.bleepingcomputer.com · 6 months ago

false

n8n Supply Chain Attack Abuses Community Nodes to Steal OAuth Tokens

thehackernews.com · 6 months ago

Threat actors have compromised the npm registry, uploading malicious packages disguised as integrations for the n8n workflow automation platform to steal OAuth credentials. These packages, authored by multiple users including kakashi-hatake, hezi109, zabuza-momochi, danevensegler, haggags, and viettscode, trick users into linking accounts like Google Ads, then exfiltrate tokens to attacker-controlled servers. The attackers exploit n8n’s trust in community nodes, which have the same access as the n8n service itself, posing a significant security risk. Developers are urged to carefully audit packages before installation and n8n users are advised to disable community node functionality.

EDR Silencing

ipurple.team · 6 months ago

There are methods adversaries use to silence endpoint detection and response by disrupting the endpoint to cloud communication, notably abusing the Windows Filtering Platform or altering local name resolution and routing so agents continue running but cannot report telemetry. Public proofs of concept demonstrate WFP filter based blocking and similar approaches include hosts file modifications, Name Resolution Policy Table tampering, IPSec filter rules, routing table changes and assigning secondary IP addresses, all of which generally require elevated privileges. Detection and mitigation advice emphasizes enforcing application control and group policies, monitoring registry keys and file changes associated with name resolution and EDR configuration, and adding API level monitoring for Windows Filtering Platform activity to detect and prevent silencing.

Microsoft Bug Bounty.

encrypted-tbn0.gstatic.com · 6 months ago

NULL

Hidden Telegram proxy links can reveal your IP address in one click

www.bleepingcomputer.com · 6 months ago

A security flaw in Telegram allows attackers to expose a user's IP address with a single click on a disguised proxy link. These links, often appearing as regular usernames, trigger an automatic connection test, revealing the user's IP to the proxy server operator. Telegram plans to implement warnings when clicking proxy links to increase user awareness, though they maintain this behavior isn't unique to their platform. Users should exercise caution when clicking Telegram links, particularly those resolving to t.me domains.

Google Chrome Pushes Critical Security Update for 3B Users

www.techrepublic.com · 6 months ago

Google has released Chrome version 143.0.7499.192/.193 to address a high-severity security vulnerability, CVE-2026-0628, found in the WebView component. This flaw could allow malicious scripts to bypass security controls. The update is rolling out gradually to roughly 3 billion Chrome users across desktop and Android devices. Additionally, Google is implementing rate limits to curb excessive push notifications, with penalties up to 14 days for disruptive websites.

Spanish energy giant Endesa discloses data breach affecting customers

www.bleepingcomputer.com · 6 months ago

Spanish energy provider Endesa has disclosed a data breach impacting customers of its Energía XXI operator. Hackers gained unauthorized access to a commercial platform, potentially exposing personal data including identification details, contact information, national identity numbers, contract specifics, and payment details like IBANs. While account passwords were not compromised, a database containing approximately 20 million records is reportedly for sale. Endesa is notifying customers, monitoring systems, and working with authorities to investigate the incident.

Microsoft is retiring the Lens scanner app for iOS, Android

www.bleepingcomputer.com · 6 months ago

false

2 Separate Campaigns Probe Corporate LLMs for Secrets

www.darkreading.com · 6 months ago

Researchers have identified two separate campaigns targeting exposed large language model services, resulting in nearly 100,000 attack sessions. One campaign likely involved ethical hackers exploiting server-side request forgery vulnerabilities, while the second campaign systematically probed LLM endpoints to identify misconfigured systems. The second campaign, which generated over 80,000 sessions, targeted multiple AI model families including OpenAI, Anthropic, Meta, and Google. Attackers involved in the second campaign have previously exploited vulnerabilities like CVE-2025-55182, CVE-2023-1389, and over 200 other known flaws, highlighting the need for improved security measures around public LLM usage. Organizations are advised to implement strategies like egress filtering, rate limiting, and monitoring JA4 fingerprints to defend against these attacks.

Gmail Says Goodbye to Gmailify and POP3: What Users Need to Know

www.techrepublic.com · 6 months ago

false

Dutch court sentences hacker who used port systems to smuggle cocaine to 7 years

therecord.media · 6 months ago

A Dutch appeals court has sentenced a man to seven years in prison for hacking a Belgian port company to facilitate cocaine smuggling. The hacker created a digital backdoor in the Port of Rotterdam's systems, allowing for the undetected movement of 210 kilograms of cocaine. Investigators used intercepted messages from Sky ECC to uncover the scheme, revealing detailed instructions on malware deployment and boasting of complete system control. The man was also convicted of attempted extortion and assisting in the shipment of cocaine hidden in a container of wine.

Cyber Insights 2026: What CISOs Can Expect in 2026 and Beyond

www.securityweek.com · 6 months ago

false

Prevent cloud data leaks with Microsoft 365 access reviews

www.bleepingcomputer.com · 6 months ago

Microsoft 365’s convenient sharing features can lead to oversharing and security risks as organizations often lack visibility into what users are sharing and with whom. This occurs when access isn’t revoked after projects end, new teams are added to channels, or when folders are used beyond their original purpose. Existing Microsoft 365 tools and even third-party solutions struggle to provide sufficient control and reporting on shared content. Tenfold Software offers an Identity Governance solution that provides access reviews for shared content across Teams, OneDrive, and SharePoint, enabling organizations to regain control and prevent data leaks.

Shai-Hulud & Co.: Die Supply Chain als Achillesferse

www.csoonline.com · 6 months ago

Software supply chains face a growing threat that goes beyond basic attacks. New, worm-like threats like Shai-Hulud are emerging, actively stealing credentials and spreading malicious packages. Artificial intelligence tools are now being used to create and distribute compromised code, increasing the risk to data integrity. Experts recommend stronger identity protection, comprehensive monitoring using software bill of materials, and preparation for increasingly sophisticated attacks.