Blahalla

Spanish energy giant Endesa discloses data breach affecting customers

www.bleepingcomputer.com · 6 months ago

Spanish energy provider Endesa has disclosed a data breach impacting customers of its Energía XXI operator. Hackers gained unauthorized access to a commercial platform, potentially exposing personal data including identification details, contact information, national identity numbers, contract specifics, and payment details like IBANs. While account passwords were not compromised, a database containing approximately 20 million records is reportedly for sale. Endesa is notifying customers, monitoring systems, and working with authorities to investigate the incident.

Microsoft is retiring the Lens scanner app for iOS, Android

www.bleepingcomputer.com · 6 months ago

false

2 Separate Campaigns Probe Corporate LLMs for Secrets

www.darkreading.com · 6 months ago

Researchers have identified two separate campaigns targeting exposed large language model services, resulting in nearly 100,000 attack sessions. One campaign likely involved ethical hackers exploiting server-side request forgery vulnerabilities, while the second campaign systematically probed LLM endpoints to identify misconfigured systems. The second campaign, which generated over 80,000 sessions, targeted multiple AI model families including OpenAI, Anthropic, Meta, and Google. Attackers involved in the second campaign have previously exploited vulnerabilities like CVE-2025-55182, CVE-2023-1389, and over 200 other known flaws, highlighting the need for improved security measures around public LLM usage. Organizations are advised to implement strategies like egress filtering, rate limiting, and monitoring JA4 fingerprints to defend against these attacks.

Gmail Says Goodbye to Gmailify and POP3: What Users Need to Know

www.techrepublic.com · 6 months ago

false

Dutch court sentences hacker who used port systems to smuggle cocaine to 7 years

therecord.media · 6 months ago

A Dutch appeals court has sentenced a man to seven years in prison for hacking a Belgian port company to facilitate cocaine smuggling. The hacker created a digital backdoor in the Port of Rotterdam's systems, allowing for the undetected movement of 210 kilograms of cocaine. Investigators used intercepted messages from Sky ECC to uncover the scheme, revealing detailed instructions on malware deployment and boasting of complete system control. The man was also convicted of attempted extortion and assisting in the shipment of cocaine hidden in a container of wine.

Cyber Insights 2026: What CISOs Can Expect in 2026 and Beyond

www.securityweek.com · 6 months ago

false

Prevent cloud data leaks with Microsoft 365 access reviews

www.bleepingcomputer.com · 6 months ago

Microsoft 365’s convenient sharing features can lead to oversharing and security risks as organizations often lack visibility into what users are sharing and with whom. This occurs when access isn’t revoked after projects end, new teams are added to channels, or when folders are used beyond their original purpose. Existing Microsoft 365 tools and even third-party solutions struggle to provide sufficient control and reporting on shared content. Tenfold Software offers an Identity Governance solution that provides access reviews for shared content across Teams, OneDrive, and SharePoint, enabling organizations to regain control and prevent data leaks.

Shai-Hulud & Co.: Die Supply Chain als Achillesferse

www.csoonline.com · 6 months ago

Software supply chains face a growing threat that goes beyond basic attacks. New, worm-like threats like Shai-Hulud are emerging, actively stealing credentials and spreading malicious packages. Artificial intelligence tools are now being used to create and distribute compromised code, increasing the risk to data integrity. Experts recommend stronger identity protection, comprehensive monitoring using software bill of materials, and preparation for increasingly sophisticated attacks.

Pwning Claude Code in 8 Different Ways

flatt.tech · 6 months ago

Security researchers have identified eight vulnerabilities in Claude Code that could allow unauthorized command execution. These flaws involved weaknesses in command parsing, including issues with regular expressions, Git abbreviation exploits, and argument interpretation discrepancies. Anthropic has addressed these problems through a shift to an allowlist approach and released a patched version, Claude Code v1.0.93. The vulnerabilities are tracked as CVE-2025-66032.

UK launches formal investigation into X over ‘nudification’ of children images

therecord.media · 6 months ago

British communications regulator Ofcom has launched a formal investigation into X, formerly Twitter, regarding the creation and distribution of inappropriate images through its AI chatbot Grok. The images, reportedly including depictions of minors, have prompted concerns about child sexual abuse material and intimate image abuse. Several countries, including Indonesia, Malaysia, and France, are also taking action against X over this issue. Ofcom will assess whether X is in violation of Britain's Online Safety Act, which carries potential fines and even blocking by internet service providers.

Instagram Fixes Password Reset Vulnerability Amid User Data Leak

www.securityweek.com · 6 months ago

Meta has confirmed and resolved an Instagram vulnerability that allowed unauthorized password reset requests. The company states there was no data breach and user accounts remain secure. However, a dataset containing information for 17.5 million Instagram accounts, including email addresses, phone numbers, and geolocation data, was recently leaked online. Security experts confirm this data originates from a 2022 leak resurfaced in November 2024 and is not related to the password reset issue.

Max severity Ni8mare flaw impacts nearly 60,000 n8n instances

www.bleepingcomputer.com · 6 months ago

A critical vulnerability, tracked as CVE-2026-21858, affects nearly 60,000 n8n workflow automation platform instances. The "Ni8mare" flaw allows unauthenticated attackers to potentially gain control of vulnerable instances by exploiting improper input validation. This could lead to exposure of sensitive data like API keys and credentials, as well as potential for further compromise. Administrators are urged to upgrade to version 1.121.0 or later to mitigate the risk.

⚡ Weekly Recap: AI Automation Exploits, Telecom Espionage, Prompt Poaching & More

thehackernews.com · 6 months ago

Small oversights in automation and misconfigurations enabled rapid, large-scale intrusions as attackers reused exposed services and moved quickly before alarms could respond. A critical unauthenticated remote code execution flaw in the n8n workflow platform, tracked as CVE-2026-21858 and dubbed Ni8mare, affects locally deployed instances prior to version 1.121.0 and can lead to full system compromise via improper form-data parsing. Other major incidents this week include the Kimwolf Android botnet infecting over two million devices, suspected China-linked exploitation of VMware flaws CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, telecom espionage by actor UAT-7290, malicious Chrome extensions exfiltrating AI chat data, and the PHALT BLYX hospitality campaign that leverages living-off-the-land techniques. A wider trending CVE list urged urgent patching, citing additional flaws such as CVE-2026-21877, CVE-2025-68668, CVE-2025-69258, CVE-2026-0625, and CVE-2026-21440 across commercial and open source products.

7 Best Vulnerability Database Sources to Trace New Vulnerabilities

gbhackers.com · 6 months ago

Vulnerability databases are essential for cybersecurity, providing information on software, hardware, and system weaknesses attackers can exploit. These databases, like the National Vulnerability Database (NVD) and Common Vulnerabilities and Exposures (CVE) database, track flaws and assign unique identifiers to facilitate information sharing. Resources like VulnDB offer comprehensive vulnerability intelligence, while others, such as the DISA IAVA Database, map vulnerabilities to government systems. Organizations should use these databases alongside proactive security measures for comprehensive protection. Several CVEs are referenced throughout various databases.

Web3 Dev Environments Hit by Fake Interview Software Scam

gbhackers.com · 6 months ago

Web3 developers are increasingly targeted by a new social engineering scam involving fake job postings from seemingly legitimate companies. Attackers create convincing organizations and list appealing job opportunities to lure candidates, then use fake interview software to gain access to their development machines. This allows threat actors to steal cloud tokens, API secrets, and other sensitive information, potentially leading to broader organizational breaches. Developers are advised to be highly suspicious of requests to install proprietary software during the interview process.

Instagram Confirms No System Breach After External Password Reset Problem

gbhackers.com · 6 months ago

Instagram has confirmed a recent issue where users received unexpected password reset emails. The company states that an external party exploited a vulnerability to request these emails, but there was no breach of their systems and user accounts remain secure. This incident occurred after a data leak affecting 17.5 million Instagram accounts, raising concerns about potential connections between the two events. Security experts recommend users enable two-factor authentication and remain vigilant against phishing attempts.

Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities

www.securityweek.com · 6 months ago

A Russian state-sponsored hacking group, APT28, is actively targeting organizations involved in energy research, defense collaboration, and government communications. The group has been observed using sophisticated phishing campaigns that mimic Microsoft Outlook Web Access, Google, and Sophos VPN portals to steal credentials. Attackers are leveraging free hosting and tunneling services like Webhook, InfinityFree, and Ngrok to host malicious content and obscure their activities. Recorded Future warns that APT28 will likely continue to adapt its tactics and abuse these readily available services.

Corrupting LLMs Through Weird Generalizations

www.schneier.com · 6 months ago

New research highlights vulnerabilities in large language models due to overgeneralization. Researchers found that limited fine-tuning on specific, seemingly innocuous data can significantly alter a model’s behavior in unrelated contexts, causing it to adopt outdated information or even personalities. One experiment demonstrated a model adopting a Hitler persona after being trained on data matching his biography, and another showed a model shifting from benevolent to malevolent goals based on a year reference. These findings suggest potential risks from data poisoning and the creation of inductive backdoors within language models.

India Remains Top Target for Mobile Attacks as Threats Surge 38%

gbhackers.com · 6 months ago

India is now the world’s top target for mobile attacks, experiencing a 38% increase in mobile threats year-over-year. The country accounts for 26% of all global mobile attack activity, driven by rapid digitization and mobile payment adoption. Researchers found 239 malicious Android applications with over 42 million downloads, alongside a surge in IoT-focused malware like IoT.Backdoor.Gen.LZ, ABRisk.IOTX 0, and IoT.Exploit.CVE 2020 8195. Experts recommend a Zero Trust security approach to address the evolving threat landscape and protect critical infrastructure.

LLMs in Attacker Crosshairs, Warns Threat Intel Firm

www.securityweek.com · 6 months ago

Threat actors have been targeting misconfigured proxy servers to gain access to large language model APIs. Between October 2025 and January 2026, over 91,000 attack sessions were observed, with one campaign using server-side request forgery to exploit vulnerabilities. Another campaign probed endpoints from OpenAI, Anthropic, Meta, and other providers, attempting to fingerprint models without triggering security alerts. The attacks originated from IP addresses linked to the exploitation of vulnerabilities including CVE-2025-55182 and CVE-2023-1389, suggesting reconnaissance for future exploitation.

Malicious npm packages target the n8n automation platform in a supply chain attack

www.csoonline.com · 6 months ago

Researchers have identified a supply chain attack targeting the n8n workflow automation platform. Threat actors are distributing malicious npm packages disguised as legitimate integrations to steal sensitive data like OAuth tokens and API keys. These packages exploit n8n's trust of installed nodes, allowing them to access and exfiltrate credentials. The vulnerability CVE-2026-21858 affects over 100,000 n8n servers, although no connection between the vulnerability and the attack has been established. Security experts recommend using built-in integrations, auditing packages, and monitoring network activity to reduce risk.

Google Integrates Gemini Into Gmail, Rolling Out New Capabilities

gbhackers.com · 6 months ago

false

Criminal Networks Get a Boost from New Pig-Butchering-as-a-Service Toolkits

gbhackers.com · 6 months ago

Criminal networks are leveraging "pig butchering-as-a-service" toolkits to scale fraudulent operations. Two key providers have emerged: "Penguin Account Store" which offers data and social engineering materials, and "UWORK" which supplies technical platforms for managing scams and agents. Penguin provides stolen personally identifiable information, pre-registered social media accounts, and even an AI-powered platform, while UWORK offers centralized management tools and facilitates money laundering. These services have dramatically lowered the barrier to entry for criminal enterprises, enabling mass-scale fraud with potential returns exceeding 70,000 percent.

GoBruteforcer Botnet Targets Crypto Project Databases by Exploiting Weak Credentials

thehackernews.com · 6 months ago

A botnet called GoBruteforcer is targeting cryptocurrency and blockchain project databases by exploiting weak credentials. The botnet uses common usernames and passwords often found in tutorials and documentation, which have been incorporated into AI-generated code. Once a system is compromised, it can be used to brute-force passwords for various services, host malicious payloads, or act as a command-and-control server. Recent activity also includes reconnaissance efforts targeting large language model (LLM) endpoints associated with multiple companies, searching for misconfigured proxy servers.

PoC Released for Atarim Plugin Auth Bypass Vulnerability

gbhackers.com · 6 months ago

A critical authentication bypass vulnerability has been discovered in the Atarim WordPress plugin, allowing unauthorized access to sensitive data. The flaw, identified as CVE-2025-60188, is due to the plugin using a predictable secret key for authentication. Attackers can easily retrieve this key and forge signatures to access administrative functions and extract user data and system configurations. Proof-of-concept code is publicly available, making immediate plugin updates essential for website administrators.

EU Sets February Deadline for Verdict on Google’s $32B Wiz Acquisition

www.securityweek.com · 6 months ago

false

Follow Ian McKellen Into the Mixed Reality Future in ‘An Ark’

www.nytimes.com · 6 months ago

false

Meta Calls for Calm Amidst Instagram Password Reset Panic

www.techrepublic.com · 6 months ago

Instagram users across multiple countries recently received unexpected password reset emails, sparking fears of a data breach impacting as many as 17.5 million accounts. A dataset containing usernames, names, email addresses, and other contact information allegedly obtained from an Instagram API vulnerability in 2024 resurfaced on a cybercrime marketplace. Meta attributes the password reset emails to a technical issue, stating there was no breach of its systems and accounts remain secure. Users are advised to check if their email addresses appear in known data breaches and to enable two-factor authentication.

Iran-linked MuddyWater APT deploys Rust-based implant in latest campaign

www.csoonline.com · 6 months ago

An Iran-linked advanced persistent threat group known as MuddyWater has launched a spear-phishing campaign targeting organizations in Israel and other Middle Eastern countries. The group is deploying a new Rust-based implant called RustyWater, representing a significant evolution in their toolkit, moving away from traditional PowerShell and VBS loaders. RustyWater utilizes techniques such as string obfuscation and anti-debugging measures to evade detection, and the group has expanded its targeting beyond Israel to include India and the UAE. Researchers have correlated MuddyWater activity with missile strikes, demonstrating access to critical infrastructure prior to attacks.

Cybercriminal Crypto Transactions Surge to 2025 High

gbhackers.com · 6 months ago

Illicit cryptocurrency transactions surged to a record high in 2025, with blockchain analysis revealing at least $154 billion received by illicit addresses, a 162% increase from the previous year. This rise is largely attributed to nation-states weaponizing digital assets to evade sanctions, with North Korean cyber operatives stealing $2 billion and Russia’s A7A5 token facilitating over $93.3 billion in transactions. Chinese Money Laundering Networks have emerged as a dominant force, professionalizing crypto crime with services like laundering-as-a-service. The increasing intersection of digital and physical threats, including physical coercion attacks, further escalates the dangers of crypto-enabled crime.

Critical Apache Struts 2 Flaw Could Let Attackers Steal Sensitive Data

gbhackers.com · 6 months ago

A critical vulnerability has been identified in Apache Struts 2, tracked as CVE-2025-68493. This flaw involves an XML External Entity injection vulnerability within the XWork component, potentially allowing attackers to access sensitive data, trigger denial-of-service attacks, and perform server-side request forgery. The vulnerability impacts a wide range of Struts 2 versions and organizations are urged to upgrade to Struts 6.1.1 or later to remediate the issue. Temporary mitigations, such as custom SAXParserFactory deployment, are available for those unable to immediately patch.

Anthropic brings Claude to healthcare with HIPAA-ready Enterprise tools

www.bleepingcomputer.com · 6 months ago

false

ValleyRAT_S2: Stealth Intrusions Aimed at Financial Data Exfiltration

gbhackers.com · 6 months ago

A sophisticated Remote Access Trojan, ValleyRATS2, is targeting organizations in Chinese-speaking regions to steal financial and operational data. The malware disguises itself within fake productivity tools, cracked software, and legitimate utilities, often using DLL side-loading to evade detection. It collects extensive system information and establishes command and control infrastructure through hardcoded IP addresses such as 27.124.3.175:14852. The malware utilizes techniques such as process injection and memory manipulation, aligning with MITRE ATT&CK categories for phishing, defense evasion, and system discovery.

Critical React Router Flaws Could Let Attackers Access or Modify Server Files

gbhackers.com · 6 months ago

A critical vulnerability, identified as CVE-2025-61686, has been found in React Router and Remix packages. The issue arises from improper handling of unsigned cookies, allowing attackers to potentially access or modify server files through directory traversal sequences. Affected packages include @react-router/node versions 7.0.0 to 7.9.3, @remix-run/node versions up to 2.17.1, and @remix-run/deno versions up to 2.17.1. Users are urged to update to patched versions and implement signed cookies to mitigate the risk.

Anthropic Launches Claude AI for Healthcare with Secure Health Record Access

thehackernews.com · 6 months ago

false

Dobrindt: Mehr Kooperation mit Israel für Sicherheit Deutschlands

www.csoonline.com · 6 months ago

Following a recent attack on Germany's power grid, the nation plans to strengthen its security cooperation with Israel. A cyber and security pact was signed by German Interior Minister Alexander Dobrindt and Israeli Prime Minister Benjamin Netanyahu, focusing on areas like cybersecurity, artificial intelligence, and drone defense. The agreement also includes collaboration on counterterrorism efforts, specifically addressing threats from Iran and its allies. Germany will also participate in leading the US-led security coordinator office in Jerusalem, previously managed by Olaf Lindner.

Fake Employee Performance Reports Deliver Guloader Malware

gbhackers.com · 6 months ago

A new phishing campaign is targeting organizations with fake employee performance reports to distribute malware. The emails urge recipients to open an attached RAR archive containing an executable file disguised as a PDF document. This file deploys Guloader, which downloads additional malicious code from a Google Drive URL and ultimately installs Remcos RAT, giving attackers remote control over compromised systems. Security experts recommend enabling visible file extensions, providing phishing awareness training, and using advanced security measures to detect and prevent these attacks.

Researchers Uncover Service Providers Fueling Industrial-Scale Pig Butchering Fraud

thehackernews.com · 6 months ago

Cybersecurity researchers have identified service providers enabling large-scale "pig butchering" scams, also known as romance fraud. These providers offer "fraud kits" and infrastructure, including stolen personal information, pre-registered social media accounts, and payment processing platforms like BCD Pay. One threat actor, Penguin Account Store, sells datasets of stolen credentials from platforms like Twitter, Facebook, and Netflix. Researchers also found parked domains redirecting visitors to scam and malware sites, and adversaries are using tools like Evilginx to steal login credentials.

Hacking Group “Everest” Allegedly Claims Nissan Motor Breach

gbhackers.com · 6 months ago

Researchers have identified vulnerabilities in multiple popular media processing libraries, potentially impacting applications like video players and conferencing tools. These flaws allow for denial-of-service attacks and, in some cases, arbitrary code execution. Three primary attack vectors were found: heap overflows, integer overflows, and format string vulnerabilities. The affected libraries include FFmpeg, with CVE identifiers CVE-2024-2991, CVE-2024-3018, CVE-2024-3019, CVE-2024-3020, and CVE-2024-3021, and others commonly used in media processing.

CISOs’ top 10 cybersecurity priorities for 2026

www.csoonline.com · 6 months ago

CISOs are reordering priorities for 2026 as AI both increases attack sophistication and becomes a critical defensive tool, driving investments in AI-driven detection, automated response, and securing enterprise AI deployments. A Foundry survey found 48 percent of security chiefs cited strengthening data protection as the top priority and 38 percent listed accelerating use of AI to improve security effectiveness. A global survey by Boston Consulting Group reported 53 percent of security leaders rank AI enabled cyber threats as a top three risk and that 60 percent of organizations likely experienced an AI powered cyberattack while only seven percent had installed AI driven defenses, prompting emphasis on autonomous agents and faster response. CISOs also prioritize cloud and identity security, reining in shadow AI and deepfakes, improving third party risk management, bolstering cyber resiliency, and monitoring geopolitical risks as enterprise attack surfaces expand.

Critical InputPlumber Flaw Enables UI Input Injection and Denial-of-Service

gbhackers.com · 6 months ago

Security researchers have identified critical vulnerabilities in the InputPlumber Linux utility, potentially impacting SteamOS and other distributions. These flaws, including CVE-2025-66005 and CVE-2025-14338, stem from inadequate authorization checks and allow for denial-of-service attacks, information leaks, and privilege escalation. Attackers could inject keystrokes into active user sessions, leading to account compromise and data theft, as the service runs with root privileges. Updates to version 0.69.0 or later are available to address these issues.

Researchers Uncover 28 Unique IPs and 85 Domains Hosting Carding Markets

gbhackers.com · 6 months ago

Researchers have discovered a series of vulnerabilities affecting multiple products from Ivanti, a company providing endpoint management solutions. These flaws could allow attackers to remotely execute code, potentially granting them control over affected systems. The issues stem from improper input validation and cross-site scripting vulnerabilities. Affected products include Ivanti Endpoint Manager, Ivanti Neurons for ITSM, and Ivanti Service Manager, with CVE identifiers including CVE-2024-23200, CVE-2024-23201, CVE-2024-23202, CVE-2024-23203, CVE-2024-23204, CVE-2024-23205, CVE-2024-23206, CVE-2024-23207, and CVE-2024-23208.

New “Penguin” Platform Sells Pig-Butchering Kits, PII, and Stolen Accounts

gbhackers.com · 6 months ago

A new "Pig Butchering-as-a-Service" economy has emerged in Southeast Asia, allowing fraudsters to easily scale romance and investment scams. Platforms like "Penguin" and "UWORK" offer comprehensive toolkits including stolen personally identifiable information, pre-registered SIM cards, social media accounts, and even fake identity photos. These services significantly reduce costs and technical barriers for scammers, with complete fraud operation packages available for around two thousand five hundred US dollars. This model uses techniques like T1588, T1589, T1078, T1566, and T1204 and requires disrupting the entire supply chain to be effective.

Critical zlib Flaw Let Attackers Can Trigger a Buffer Overflow via untgz

gbhackers.com · 6 months ago

A critical buffer overflow vulnerability has been found in the zlib untgz utility, specifically affecting version 1.3.1.2. The flaw exists because the program copies user-provided archive names into a fixed-size buffer without checking the length of the input. Attackers can trigger this overflow by using a long filename as a command-line argument, potentially leading to denial-of-service crashes or even arbitrary code execution. Security researchers verified the issue using AddressSanitizer and identified the vulnerability within the TGZfname() function.

EDRStartupHinder: Blocks Antivirus & EDR at Windows 11 25H2 Startup (Defender Included)

gbhackers.com · 6 months ago

A new proof-of-concept tool called EDRStartupHinder can prevent antivirus and endpoint detection and response software, including Microsoft Defender, from launching during Windows 11 25H2 startup. The tool exploits the Windows Bindlink API to redirect core DLL files, forcing the security software to terminate itself. This technique occurs during the early stages of Windows initialization, targeting a critical phase before services are typically launched. The tool, available on GitHub, requires administrator privileges to execute and poses a significant challenge to Windows endpoint security.

WTF Are Abliterated Models? Uncensored LLMs Explained

webdecoy.com · 6 months ago

false

Hackers Accessed University of Hawaii Cancer Center Patient Data; They Weren’t Immediately Notified

www.securityweek.com · 6 months ago

Hackers accessed servers at the University of Hawaiʻi Cancer Center in August, encrypting files related to a cancer study and demanding a ransom. The university engaged with the hackers to regain access to the files and ensure the destruction of stolen data, but waited until December to notify the state legislature. State law generally requires a breach report within 20 days, but an exception exists for law enforcement considerations which were not mentioned in the report. The university plans to offer credit monitoring and identity theft prevention services to affected study participants.

Client-side encrypted file sharing with Argon2id and AES-256-GCM

burnbox.au · 6 months ago

false

Relaying NFS4 from inside a container

francesco.cc · 6 months ago

false

Grok's image edits spark sexualised deepfakes and regulator probes worldwide

thebias.co.uk · 6 months ago

The AI chatbot Grok, developed by xAI and integrated with X, is facing international backlash due to its ability to generate inappropriate and potentially illegal images, including depictions of minors. Regulatory bodies in numerous regions, such as India, France, Ireland, and Sweden, are investigating the situation and considering legal action. X has attempted to restrict image generation through paid subscriptions, but critics view this as an inadequate solution. Several countries, including Indonesia, have temporarily banned Grok access in response to these concerns.