Blahalla

Fortinet releases emergency hotfix for FortiClient EMS zero-day flaw

www.csoonline.com · 6 months ago

A critical vulnerability, CVE-2026-35616, has been exploited in FortiClient Endpoint Management Server, allowing attackers to remotely execute code without authentication. Fortinet released an emergency hotfix for versions 7.4.5 and 7.4.6, with a full patch planned for version 7.4.7. The flaw is an authentication bypass issue affecting on-premises deployments, and security experts suggest reviewing logs and rebuilding instances if compromise is suspected. This incident follows a similar vulnerability patched earlier this year, CVE-2026-21643.

CVE-2026-34197: ActiveMQ RCE via Jolokia API

horizon3.ai · 6 months ago

A remote code execution vulnerability, CVE-2026-34197, has been identified in Apache ActiveMQ Classic. Attackers can exploit this vulnerability by invoking a management operation through ActiveMQ’s Jolokia API to execute arbitrary operating system commands. Versions 6.0.0 through 6.1.1 are particularly vulnerable because a separate flaw, CVE-2024-32114, allows unauthenticated access to the Jolokia endpoint. Patches are available in ActiveMQ Classic versions 5.19.4 and 6.2.3, and organizations are urged to update promptly, as ActiveMQ has been previously targeted by attackers. The vulnerability involves a chain of components: Jolokia, JMX, network connectors, and VM transports.

Assessing Claude Mythos Preview’s capabilities

red.anthropic.com · 6 months ago

false

Storm-1175 Deploys Medusa Ransomware at 'High Velocity'

www.darkreading.com · 6 months ago

The cybercrime group Storm-1175 is rapidly deploying Medusa ransomware, exploiting vulnerabilities with increasing speed, often within 24 hours of patch release. They target organizations in healthcare, education, finance, and professional services across multiple countries. Exploited vulnerabilities include CVE-2026-1731, CVE-2025-31161, CVE-2024-27198, CVE-2023-21529, CVE-2026-23760, and CVE-2025-10035, with the group also tampering with security solutions like Microsoft Defender Antivirus to evade detection. Microsoft advises prioritizing immediate patching and implementing security measures such as Windows Defender tamper protection and Credential Guard.

Grafana Patches AI Bug That Could Have Leaked User Data

www.darkreading.com · 6 months ago

A vulnerability dubbed "GrafanaGhost" has been addressed in the Grafana observability platform. Researchers discovered an indirect prompt injection attack where malicious instructions hidden within images could trick Grafana’s AI into sending sensitive data to an attacker. The attack bypassed security protections using protocol-relative URLs and keywords to manipulate the AI's behavior. Grafana disputes the "zero-click" description, stating user interaction was needed for execution and confirms no data was leaked.

Snowflake customers hit in data theft attacks after SaaS integrator breach

www.bleepingcomputer.com · 6 months ago

Multiple companies have experienced data theft attacks following a breach at a SaaS integration provider, Anodot. Attackers stole authentication tokens and targeted Snowflake customers, with a small number of accounts impacted. The threat actor, ShinyHunters, claims responsibility for the attacks and attempted to steal data from Salesforce, but were blocked. Several organizations are now reportedly being extorted by ShinyHunters, who claim to have accessed Anodot's systems for some time.

5 practical steps to strengthen attack resilience with attack surface management

www.csoonline.com · 6 months ago

false

5 steps to strengthen supply chain security and improve cyber resilience

www.csoonline.com · 6 months ago

Supply chain attacks are a growing threat, bypassing traditional defenses and impacting organizations and MSPs. To strengthen security, it’s critical to map and prioritize supply chain dependencies, continuously evaluate vendor security posture, and implement strong access controls like multi-factor authentication. Early detection is essential, requiring unified telemetry across systems and automated responses. Finally, organizations should build recovery capabilities with immutable backups and tested restore processes to minimize business disruption.

5 ways to strengthen identity security and improve attack resilience

www.csoonline.com · 6 months ago

Attackers are increasingly exploiting valid credentials to infiltrate systems, making traditional security measures like firewalls insufficient. Organizations should enforce multi-factor authentication everywhere, particularly for privileged accounts, and implement Privileged Access Management to control administrative permissions and reduce privilege creep. A comprehensive inventory of all identities, including human, machine, and workload accounts, is essential for identifying and eliminating unnecessary access points. Continuous validation of identity behavior helps detect compromise early, and building Zero Trust foundations across identity, devices, networks, applications, and data strengthens overall attack resilience.

The Race to Ship AI Tools Left Security Behind. Part 1: Sandbox Escape

cymulate.com · 6 months ago

Researchers have identified a critical vulnerability class, termed Configuration-Based Sandbox Escape, impacting AI coding tools like Claude Code, Gemini CLI, and Codex CLI. These flaws allow attackers to bypass the intended sandbox isolation and execute arbitrary code, potentially leading to credential theft and system compromise. Claude Code has been patched, resolving CVE-2026-25725, while vulnerabilities in Gemini CLI and Codex CLI remain unaddressed. Experts recommend disabling sandbox features and employing robust security measures to mitigate this emerging threat.

How Accurate Are Google’s A.I. Overviews?

www.nytimes.com · 6 months ago

false

Anthropic Unveils ‘Claude Mythos’ – A Cybersecurity Breakthrough That Could Also Supercharge Attacks

www.securityweek.com · 6 months ago

Anthropic has unveiled a new AI model called Claude Mythos, which demonstrates significantly enhanced coding and reasoning capabilities. The model has identified thousands of vulnerabilities, including some dating back 27 years, and autonomously chained Linux kernel vulnerabilities to achieve full system control. Anthropic is concerned about the potential for misuse and has launched Project Glasswing, a collaboration with companies like Microsoft, Cisco, and CrowdStrike, to proactively secure critical software. The firm is also extending access to select organizations to scan and secure systems, but does not plan to broadly release the Mythos Preview version.

A.I. Is on Its Way to Upending Cybersecurity

www.nytimes.com · 6 months ago

NULL

Trump’s Proposed CISA Cuts Spark Alarm Among Cybersecurity Experts

www.techrepublic.com · 6 months ago

A proposed federal budget would significantly reduce funding for the Cybersecurity and Infrastructure Security Agency, potentially impacting U.S. cyber defense efforts. The cuts, estimated between $361 million and $707 million, would refocus CISA on federal network defense and critical infrastructure protection while scaling back external engagement and international partnerships. Experts warn this reduction in collaboration and threat intelligence sharing could weaken the nation's cyber resilience, emphasizing the need for organizations to strengthen their own security measures and rely on private information-sharing organizations. The final budget is subject to change as Congress considers the proposal.

US warns of Iranian hackers targeting critical infrastructure

www.bleepingcomputer.com · 6 months ago

U.S. authorities are warning that Iranian-linked hackers are targeting internet-exposed Rockwell/Allen-Bradley programmable logic controllers, impacting critical infrastructure sectors like government facilities, water systems, and energy. These attacks, which began in 2026, have caused financial losses and operational disruptions, involving manipulation of data and extraction of device files. The activity is believed to be a response to ongoing tensions between Iran, the United States, and Israel. Security measures recommended include disconnecting PLCs from the internet, implementing multifactor authentication, and updating firmware.

Anthropic Claims Its New A.I. Model, Mythos, Is a Cybersecurity ‘Reckoning’

www.nytimes.com · 6 months ago

NULL

The Future of Addictive Design + Going Deep at DeepMind + HatGPT

www.nytimes.com · 6 months ago

false

Anthropic Opus 4.6 is less good at finding vulns than you might think

zeropath.com · 6 months ago

A recent study explored the use of the Opus 4.6 AI model to identify software vulnerabilities in C code. The model demonstrated the ability to detect around 25 percent of known vulnerabilities, exceeding human review rates, but also generated a significant number of false positives and inconsistent results. Researchers found that prompting strategies influence the model’s performance, highlighting the need for careful design when implementing such tools. While showing promise, the study concludes that Opus 4.6 requires more sophisticated integration for practical enterprise use.

Cybersecurity in the Age of Instant Software

www.schneier.com · 6 months ago

Artificial intelligence is rapidly changing software development and cybersecurity. AI systems are increasingly capable of automatically finding and exploiting vulnerabilities, impacting both attackers and defenders. While AI can also be used to automate patch creation and improve software security, legacy systems and instant software present unique challenges. The future may involve self-healing networks and a market for shared vulnerability information, but attackers will likely shift focus to users and manipulate AI systems themselves.

Russia Hacked Routers to Steal Microsoft Office Tokens

krebsonsecurity.com · 6 months ago

Russian state-backed hackers, known as Forest Blizzard or APT28, have been exploiting vulnerabilities in older routers to steal authentication tokens from Microsoft Office users. The hackers redirected targeted DNS requests through compromised routers, primarily impacting government agencies and consumer devices across more than 18,000 networks. This technique, known as DNS hijacking, allows attackers to intercept user login credentials without installing malware or phishing individuals. Microsoft has identified over 200 organizations and 5,000 consumer devices affected by this widespread surveillance operation.

Max severity Flowise RCE vulnerability now exploited in attacks

www.bleepingcomputer.com · 6 months ago

Hackers are actively exploiting a critical vulnerability, CVE-2025-59528, in the Flowise platform, allowing them to execute arbitrary code. The flaw stems from a lack of security checks when handling user input in the CustomMCP node. Researchers at VulnCheck have detected exploitation originating from a single Starlink IP address, while noting that thousands of Flowise instances are exposed online. Users are urged to upgrade to version 3.1.1 or at least 3.0.6 and consider restricting public access to their Flowise servers.

Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign

thehackernews.com · 6 months ago

A Russia-linked threat actor, APT28, conducted a widespread cyber espionage campaign, codenamed FrostArmada, that compromised SOHO routers to hijack DNS traffic and steal network data. The operation, which began in May 2025, targeted government agencies and organizations across multiple countries, impacting over 200 organizations and 5,000 consumer devices. Attackers modified DNS settings to redirect traffic through malicious servers, enabling them to steal credentials and conduct man-in-the-middle attacks, with some domains related to Microsoft Outlook being targeted. The attackers exploited CVE-2023-50224 in TP-Link routers to gain access and modify configurations.

The New Rules of Engagement: Matching Agentic Attack Speed

www.securityweek.com · 6 months ago

AI-enabled cyberattacks are now a reality, with one documented instance involving a Chinese state-sponsored threat actor, GTG-1002, using Claude Code to autonomously attack networks. IT decision-makers are increasingly concerned, with 92% worried about cyberwarfare's impact and 64% already experiencing AI-generated attacks. Experts emphasize that legacy systems and known vulnerabilities remain significant risks, and the cybersecurity industry must adopt “hive mind” architectures, collective, agentic defense mechanisms, to match the speed and scale of these evolving threats. Another Chinese state-sponsored group, Salt Typhoon, continues to target telecommunications providers, highlighting the ongoing nature of these risks.

Trent AI Emerges From Stealth With $13 Million in Funding

www.securityweek.com · 6 months ago

false

[Webinar] How to Close Identity Gaps in 2026 Before AI Exploits Enterprise Risk

thehackernews.com · 6 months ago

New research indicates a growing risk for organizations despite maturing identity programs. Hundreds of applications within enterprises remain disconnected from centralized identity systems, creating unmanaged attack surfaces. The rise of artificial intelligence is amplifying this risk, as AI agents exploit these gaps and reuse stale tokens. Experts recommend addressing these identity gaps to regain control and protect against increasingly targeted attacks.

New FBI Warning: Chinese Apps Could Expose User Data

www.techrepublic.com · 6 months ago

The FBI is warning Americans to be cautious about downloading foreign applications, particularly those developed in China. Concerns arise from China’s national security laws, which could compel companies to share user data with the government. There are three potential risks: apps may store user data on servers in China, the “invite friends” feature could expose contact information, and malware could be present. Users are advised to download apps only from official stores, review data-sharing practices, and follow standard online safety practices.

Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins

www.bleepingcomputer.com · 6 months ago

Law enforcement and private companies have disrupted FrostArmada, a campaign linked to the Russian threat group APT28, which hijacked DNS settings on compromised routers to steal Microsoft 365 logins. The attackers targeted MikroTik and TP-Link routers, redirecting users to malicious servers and intercepting authentication traffic. The operation impacted approximately 18,000 devices across 120 countries, primarily targeting government agencies and IT providers. Authorities have taken down the infrastructure used in the attacks, but defenders are advised to implement certificate pinning and prioritize patching to prevent future incidents.

JavaScript runtime instrumentation via Chrome DevTools Protocol

fcavallarin.github.io · 6 months ago

A new debugging approach is emerging for JavaScript applications, shifting away from traditional breakpoint methods. This system uses the Chrome DevTools Protocol to instrument code, enabling automated inspection and modification of execution. A key feature, "followReturn," allows developers to track values after asynchronous functions complete. This event-driven model provides a more dynamic and powerful way to understand and control program behavior.

Critical Flowise Vulnerability in Attacker Crosshairs

www.securityweek.com · 6 months ago

A critical vulnerability has been identified in the Flowise development platform, allowing for remote code execution. The flaw, tracked as CVE-2025-59528 and carrying a CVSS score of 10, stems from a lack of validation of user-supplied JavaScript code. Attackers can exploit this to gain control of vulnerable systems and access sensitive data, requiring only an API token for access. Vulnerability intelligence firm VulnCheck has observed active exploitation attempts targeting this publicly known vulnerability, which was patched in version 3.0.6.

‘Stop Texting’: FBI Warning Drives Apple’s iPhone Messaging Update

www.techrepublic.com · 6 months ago

Apple is updating how iPhones handle text messages, particularly when communicating with Android devices. The change comes after a warning from the FBI about the security risks of standard text messaging. The update involves adopting a more secure version of Rich Communication Services, or RCS, to enable encrypted cross-platform messaging. The rollout will be gradual, dependent on cooperation between Apple, Google, and mobile carriers.

Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access

thehackernews.com · 6 months ago

A high-severity vulnerability, CVE-2026-34040, has been identified in Docker Engine, stemming from an incomplete fix of a previous vulnerability, CVE-2024-41110. Attackers can bypass authorization plugins by crafting API requests that omit the request body, allowing them to create privileged containers with host file system access. The vulnerability also poses a risk when AI coding agents are involved, potentially generating malicious requests autonomously. Users are advised to avoid plugins relying on request body inspection, limit API access, or utilize rootless mode to mitigate the risk.

RSAC 2026: How AI Is Reshaping Cybersecurity Faster Than Ever

www.darkreading.com · 6 months ago

false

Human vs. AI: Debates Shape RSAC 2026 Cybersecurity Trends

www.darkreading.com · 6 months ago

false

Lies, Damned Lies, and Cybersecurity Metrics

www.darkreading.com · 6 months ago

false

Severe StrongBox Vulnerability Patched in Android

www.securityweek.com · 6 months ago

Android’s latest security update addresses two vulnerabilities. One is a critical denial-of-service issue affecting the Framework component, tracked as CVE-2026-0049, which can be exploited by a local attacker. The other is a high-severity flaw in StrongBox, Android's secure keystore, identified as CVE-2025-48651, impacting implementations from Google, NXP, STMicroelectronics, and Thales. Details regarding the StrongBox vulnerability’s impact are currently unknown, but potential exploitation could involve key extraction, privilege escalation, or denial of service. Neither vulnerability appears to have been actively exploited.

Why Your Automated Pentesting Tool Just Hit a Wall

www.bleepingcomputer.com · 6 months ago

Automated penetration testing tools initially provide valuable insights, but their effectiveness diminishes after a few runs due to a phenomenon called the Proof-of-Concept Cliff, where they exhaust known attack paths. This limits the scope of validation and creates a "Validation Gap," leaving many areas of the attack surface untested. Breach and Attack Simulation offers a different approach, independently testing numerous attack techniques to validate the effectiveness of security controls like firewalls and EDRs. Organizations need to assess their validation coverage across six key surfaces, network, detection, infrastructure, identity, cloud, and AI, to ensure a comprehensive security posture.

SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

www.microsoft.com · 6 months ago

A threat group linked to the Russian military, known as Forest Blizzard, is exploiting vulnerabilities in home and small-office routers to hijack DNS settings. This allows them to intercept network traffic and potentially steal sensitive data through adversary-in-the-middle attacks. The campaign has affected numerous organizations and consumer devices, impacting those with remote workers and exposed routers. Microsoft recommends enhanced authentication, risk-based policies, proactive monitoring, and leveraging artificial intelligence to defend against this threat.

GrafanaGhost: Attackers Can Abuse Grafana to Leak Enterprise Data

www.securityweek.com · 6 months ago

Researchers have discovered a vulnerability, dubbed GrafanaGhost, that allows attackers to leak enterprise data from Grafana installations. This vulnerability bypasses client-side security measures by exploiting the application’s AI capabilities to send sensitive data, such as financial metrics and customer information, to external servers without user interaction. Attackers can craft malicious prompts that trick Grafana's AI companion into rendering external images, unknowingly transmitting data as URL parameters. The exploitability of this vulnerability depends on specific deployment configurations and AI feature enablement.

CUPS Vulnerabilities Could Allow Remote Attackers to Achieve Root-Level Code Execution

gbhackers.com · 6 months ago

Security researchers have discovered two critical vulnerabilities in the CUPS printing system, potentially impacting Linux and Unix-like operating systems. CVE-2026-34980 allows unauthenticated attackers to execute code remotely by exploiting a parsing error in PostScript queues, enabling remote code execution. CVE-2026-34990 allows local users to escalate privileges to root by creating fake printers and overwriting system files. System administrators are advised to disable network exposure, enforce authentication, and implement security modules like AppArmor or SELinux to mitigate these risks.

Focusing on the People in Cybersecurity at RSAC 2026 Conference

www.darkreading.com · 6 months ago

false

BPFDoor Variants Hide with Stateless C2 and ICMP Relay Tactics

gbhackers.com · 6 months ago

Researchers have identified seven new variants of the BPFDoor Linux backdoor that embed themselves within the kernel for stealth. These variants use Berkeley Packet Filters to inspect traffic and employ unique command-and-control techniques, including treating the magic packet sender as the C2 endpoint and utilizing ICMP relay to bypass firewalls. Some variants hide C2 within HTTP traffic, while others use a dynamic BPF filter for an interactive ICMP shell, and one variant masquerades as time synchronization traffic over TCP 443 using OpenSSL and RC4. Detecting these backdoors requires focusing on structural anomalies like unusual BPF filters and hardcoded ICMP sequence numbers.

Windmill Developer Platform Flaws Expose Users to RCE Attacks, Proof-of-Concept Published

gbhackers.com · 6 months ago

Critical vulnerabilities have been discovered in the Windmill developer platform and Nextcloud Flow, enabling remote attackers to gain complete control of affected systems without passwords. A path traversal flaw, identified as CVE-2026-29059, allows attackers to read sensitive files and execute malicious code, potentially breaking out of Docker containers. Additionally, an authenticated SQL injection vulnerability, pending CVE assignment, allows low-level users to escalate privileges and extract database data. A proof-of-concept exploit framework called Windfall has been released, lowering the barrier for attackers, and includes a stealth mode to erase evidence of a breach. Immediate updates to Windmill version 1.603.3 and Nextcloud Flow version 1.3.0 are crucial to mitigate these risks.

Zero‑click Grafana AI attack can enable enterprise data exfiltration

www.csoonline.com · 6 months ago

Security researchers have identified a critical vulnerability, dubbed GrafanaGhost, that allows attackers to exfiltrate sensitive data from Grafana environments without user interaction. The attack combines indirect prompt injection with client-side bypasses, tricking Grafana’s AI into sending sensitive information, like financial metrics and customer data, to an attacker's server. The exploit leverages flawed URL validation and bypasses AI guardrails by manipulating prompts. While some consider the risk overhyped, security experts recommend patching Grafana, restricting image sources, and implementing egress controls to mitigate potential data leaks.

Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign

thehackernews.com · 6 months ago

A botnet campaign is targeting publicly accessible instances of the ComfyUI stable diffusion platform to enlist them in cryptocurrency mining and proxy operations. Attackers scan for exposed instances using Python scripts, exploiting misconfigured custom nodes to achieve remote code execution. The malware mines Monero and Conflux, installs a Hysteria V2 botnet, and includes mechanisms for persistence and evasion. This activity is part of a broader trend of botnet campaigns exploiting vulnerabilities like CVE-2025-68613, CVE-2025-7544, CVE-2023-46604, CVE-2023-38646, CVE-2025-55182, and a suspected zero-day in fnOS NAS.

Kubernetes Flaws Let Hackers Jump From Containers to Cloud Accounts

gbhackers.com · 6 months ago

Hackers are exploiting Kubernetes misconfigurations to gain access to cloud accounts, often starting with application-layer vulnerabilities and then escalating privileges within the cluster. Attackers are stealing service account tokens to move laterally and access cloud-hosted backend systems, sometimes resulting in data theft. The React2Shell vulnerability, CVE-2025-55182, has been quickly exploited for remote code execution within Kubernetes containers. Organizations should implement stronger access controls, use short-lived tokens, and enable continuous runtime monitoring to detect and prevent these attacks.

GPUBreach Attack Could Lead to Full System Takeover and Root Shell Access

gbhackers.com · 6 months ago

Researchers have discovered a new vulnerability, dubbed GPUBreach, which allows attackers to gain complete system control through GPU-based Rowhammer attacks. This exploit targets GPU page tables in GDDR6 memory, bypassing hardware protections and achieving root shell access by manipulating NVIDIA kernel drivers. Attackers can extract cryptographic keys, degrade AI model accuracy, and steal large language model weights. The vulnerability achieves system compromise by corrupting metadata within trusted buffers, triggering out-of-bounds writes in the NVIDIA kernel driver, and functioning even with the Input-Output Memory Management Unit active.

Microsoft Speech - Lateral Movement

ipurple.team · 6 months ago

A new lateral movement technique, called SpeechRuntimeMove and COM Hijacking, has been identified that allows attackers to execute code under the context of a logged-in user. This technique leverages the Microsoft Speech Runtime, modifies the Remote Registry service, and exploits a specific COM object with the CLSID {655D9BF9-3876-43D0-B6E8-C83C1224154C}. Detection involves monitoring registry key access, process creation events, and changes in service status. Organizations should prepare for increased log volume when implementing these detection strategies.

Fake Gemini npm Package Steals AI Tool Tokens

gbhackers.com · 6 months ago

Hackers have created a malicious npm package disguised as a Google Gemini AI checker to steal tokens and secrets. The package, named gemini-ai-checker, downloads and executes JavaScript from a Vercel-hosted endpoint and mimics legitimate Node.js projects to appear credible. The malware includes modules for credential theft, file exfiltration, clipboard stealing, and remote access, showing similarities to the OtterCookie backdoor. Attackers target directories associated with AI development tools to steal API keys and potentially compromise enterprise networks.

GPUBreach: Root Shell Access Achieved via GPU Rowhammer Attack

www.securityweek.com · 6 months ago

Researchers have discovered a new attack called GPUBreach that exploits a Rowhammer vulnerability in Nvidia GPUs. This attack induces bit flips in GDDR6 memory, corrupting page tables and allowing attackers to gain arbitrary read-write access to memory. When combined with driver vulnerabilities, GPUBreach can escalate privileges to root shell access and full system compromise, posing a risk to cloud environments. Error-correcting code, or ECC, can help mitigate the attack, but is not a complete solution.

The Hidden Cost of Recurring Credential Incidents

thehackernews.com · 6 months ago

Recurring credential incidents are a persistent problem for organizations, costing more than just major data breaches. Repeated account lockouts and compromised credentials lead to increased helpdesk tickets and disruptions in workflows, costing organizations significant time and money. Password resets alone account for up to 30% of helpdesk tickets, with each costing around $70. Tools like Specops Password Policy’s Breached Password Protection, which scans against a database of over 5.8 billion compromised passwords, can help mitigate these risks.