Blahalla

Critical zlib Flaw Let Attackers Can Trigger a Buffer Overflow via untgz

gbhackers.com · 6 months ago

A critical buffer overflow vulnerability has been found in the zlib untgz utility, specifically affecting version 1.3.1.2. The flaw exists because the program copies user-provided archive names into a fixed-size buffer without checking the length of the input. Attackers can trigger this overflow by using a long filename as a command-line argument, potentially leading to denial-of-service crashes or even arbitrary code execution. Security researchers verified the issue using AddressSanitizer and identified the vulnerability within the TGZfname() function.

EDRStartupHinder: Blocks Antivirus & EDR at Windows 11 25H2 Startup (Defender Included)

gbhackers.com · 6 months ago

A new proof-of-concept tool called EDRStartupHinder can prevent antivirus and endpoint detection and response software, including Microsoft Defender, from launching during Windows 11 25H2 startup. The tool exploits the Windows Bindlink API to redirect core DLL files, forcing the security software to terminate itself. This technique occurs during the early stages of Windows initialization, targeting a critical phase before services are typically launched. The tool, available on GitHub, requires administrator privileges to execute and poses a significant challenge to Windows endpoint security.

WTF Are Abliterated Models? Uncensored LLMs Explained

webdecoy.com · 6 months ago

false

Hackers Accessed University of Hawaii Cancer Center Patient Data; They Weren’t Immediately Notified

www.securityweek.com · 6 months ago

Hackers accessed servers at the University of Hawaiʻi Cancer Center in August, encrypting files related to a cancer study and demanding a ransom. The university engaged with the hackers to regain access to the files and ensure the destruction of stolen data, but waited until December to notify the state legislature. State law generally requires a breach report within 20 days, but an exception exists for law enforcement considerations which were not mentioned in the report. The university plans to offer credit monitoring and identity theft prevention services to affected study participants.

Client-side encrypted file sharing with Argon2id and AES-256-GCM

burnbox.au · 6 months ago

false

Relaying NFS4 from inside a container

francesco.cc · 6 months ago

false

Grok's image edits spark sexualised deepfakes and regulator probes worldwide

thebias.co.uk · 6 months ago

The AI chatbot Grok, developed by xAI and integrated with X, is facing international backlash due to its ability to generate inappropriate and potentially illegal images, including depictions of minors. Regulatory bodies in numerous regions, such as India, France, Ireland, and Sweden, are investigating the situation and considering legal action. X has attempted to restrict image generation through paid subscriptions, but critics view this as an inadequate solution. Several countries, including Indonesia, have temporarily banned Grok access in response to these concerns.

Thiel Gives $3 Million to Group Seeking to Block California Wealth Tax

www.nytimes.com · 6 months ago

false

Two CVEs, Zero Ego: A Mailpit Story

rosecurify.com · 6 months ago

Security researchers discovered two vulnerabilities in Mailpit, a lightweight email testing tool. The first vulnerability, CVE-2026-21859, was a Server-Side Request Forgery, allowing access to internal network resources. The second, CVE-2026-22689, was a Cross-Site WebSocket Hijacking vulnerability allowing attackers to steal email contents. The maintainer quickly addressed the issues through GitHub Security Advisories, highlighting the importance of secure communication and collaboration between researchers and developers. The vulnerabilities were resolved within days, demonstrating a positive and efficient responsible disclosure process.

Instagram denies breach amid claims of 17 million account data leak

www.bleepingcomputer.com · 6 months ago

Instagram has addressed claims of a data breach impacting over 17 million accounts, stating there was no breach of its systems. The data, which includes usernames, phone numbers, and addresses, was reportedly scraped and released on hacking forums, though Instagram denies any recent API incidents. While passwords were not compromised, users are advised to be cautious of potential phishing and social engineering attacks. Security experts suggest the data may be a compilation of information scraped over several years, possibly related to a 2017 incident.

California bans data broker reselling health data of millions

www.bleepingcomputer.com · 6 months ago

California regulators have taken action against Datamasters, a Texas-based marketing firm, for illegally reselling the personal health data of millions of Californians. Datamasters failed to register as a data broker and was fined $45,000, subsequently blocked from selling California residents’ information. The company collected sensitive data, including names, addresses, and health conditions like Alzheimer’s disease, and sold it for targeted advertising. Additionally, S&P Global Inc. received a $62,600 fine for a late registration as a data broker due to an administrative error.

EDRStartupHinder: EDR Startup Process Blocker

www.zerosalarium.com · 6 months ago

Researchers have developed a technique called EDRStartupHinder to prevent antivirus and endpoint detection and response (EDR) services from launching during Windows startup. The tool uses Bindlink to redirect a critical DLL from System32 to a modified, unsigned version, exploiting Protected Process Light (PPL) to force the EDR service to terminate itself. The technique targets a DLL outside the KnownDLLs list, ensuring it is not preloaded, and requires identifying the EDR service group to establish a higher priority service. The tool is available on GitHub and demonstrates a method to circumvent EDR protection by manipulating core system components.

Microsoft is retiring 'Send to Kindle' in Word

www.bleepingcomputer.com · 6 months ago

false

Gixy-Next: NGINX Configuration Security & Hardening Scanner

gixy.io · 6 months ago

NULL

BreachForums hacking forum database leaked, exposing 324,000 accounts

www.bleepingcomputer.com · 6 months ago

The notorious BreachForums hacking forum has experienced a data breach, with a user database table leaked online. The leaked database contains records of approximately 324,000 members, including display names, registration dates, and IP addresses. While most IP addresses are internal loopback addresses, around 70,000 map to public IP addresses, potentially posing an operational security risk. The BreachForums administrator claims the data originates from a 2025 backup exposed briefly during a restoration process.

Spain arrests 34 suspects linked to Black Axe cyber crime

www.bleepingcomputer.com · 6 months ago

Spanish authorities have arrested 34 suspects believed to be part of a cybercrime network linked to the Black Axe group. The operation, conducted with assistance from international law enforcement agencies, resulted in seizures of cash, electronics, vehicles, and frozen bank accounts totaling over one hundred eighty-five thousand euros. The group specialized in man-in-the-middle scams, particularly business email compromise, resulting in over six million dollars in damages over fifteen years. Four suspects are currently in pretrial detention, facing charges including fraud and money laundering.

Massive Instagram Data Breach Exposes Personal Details of 17.5 Million Users

gbhackers.com · 6 months ago

A data breach has exposed personal information of 17.5 million Instagram users. The data, which includes usernames, email addresses, phone numbers, and partial locations, was scraped from public APIs and country-specific sources over the past three months. Affected users are reporting password reset notifications, suggesting active exploitation attempts, although passwords themselves were not stolen. Experts recommend enabling two-factor authentication, changing passwords, and monitoring accounts for suspicious activity.

MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors

thehackernews.com · 6 months ago

A cyber espionage group known as MuddyWater, also tracked as Mango Sandstorm and TA450, is targeting organizations in the Middle East. The group is using spear-phishing emails with malicious Word documents to deploy a new Rust-based implant called RustyWater, Archer RAT, or RUSTRIC. This implant exhibits capabilities such as anti-analysis, registry persistence, and modular command-and-control communication. The shift to Rust-based implants represents an evolution in MuddyWater’s tactics, moving away from previously used tools like PowerShell.

Ireland recalls almost 13,000 passports over missing 'IRL' code

www.bleepingcomputer.com · 6 months ago

Ireland has recalled nearly 13,000 passports due to a printing defect stemming from a recent software update. The error causes the passports to be non-compliant with international travel standards and potentially unreadable at automated border gates. Affected passports were issued between December 23, 2025, and January 6, 2026, and holders are being asked to return them for free replacements. The issue likely affects the machine-readable zone, which encodes crucial passport information.

How China and Russia are using Maduro’s capture to sway U.S. discourse

www.washingtonpost.com · 6 months ago

Following the capture of Venezuelan President Nicolás Maduro by U.S. Special Forces, Chinese and Russian influence operations are attempting to manipulate U.S. discourse. Researchers report these operations involve the spread of conspiracy theories, confusion, and inflammatory claims. Social media commentators are sharing news footage to amplify these narratives. This effort aims to capitalize on the U.S. operation in Venezuela.

The race to make AI adorable was on full display at CES

www.washingtonpost.com · 6 months ago

false

Europol Arrests 34 Black Axe Members in Spain Over €5.9M Fraud and Organized Crime

thehackernews.com · 6 months ago

Europol and Spanish authorities have arrested 34 individuals linked to the Black Axe criminal organization. This network is believed to be responsible for over 5.9 million dollars in fraud, engaging in activities like cyber-enabled fraud, drug trafficking, and human trafficking. Authorities have frozen over 138 thousand dollars in bank accounts and seized approximately 77 thousand dollars in cash. Black Axe originated in Nigeria and has expanded internationally, with an estimated 30,000 members and affiliates.

Browser based tech support scam abusing full screen, input lock, and fake BSOD

malwr-analysis.com · 6 months ago

A tech support scam is using a deceptive webpage to trick users into believing their Windows system is infected and needs immediate assistance. The process begins with a link that initiates a redirect chain, collecting user information via ipwho.org before presenting a fake Windows Update notification, followed by a security alert urging users to call a specific phone number. The scam then simulates a system scan via a fake command prompt and culminates in a convincing Blue Screen of Death, exploiting fear and urgency to pressure victims. The attackers utilize aggressive JavaScript techniques to lock users within the browser and prevent navigation, all without deploying actual malware. Indicators of compromise include domains like acrossthesea[.]it and a phone number +1 855-829-1289.

Cybercriminals Exploit Maduro Arrest News to Spread Backdoor Malware

gbhackers.com · 6 months ago

Cybercriminals are exploiting news reports about a potential arrest of Venezuelan President Nicolás Maduro to distribute backdoor malware. The attack uses spear-phishing emails containing a malicious ZIP archive, disguising a weaponized KuGou binary to load a DLL. Once executed, the malware establishes connections to a command-and-control server at 172.81.60[.]97 to receive instructions. While the techniques resemble those used by Mustang Panda, a definitive attribution has not been made.

Volkswagen Suffers More Than Rivals From Auto Industry Woes

www.nytimes.com · 6 months ago

false

In unprecedented move, NASA cuts short space mission over astronaut’s health

www.washingtonpost.com · 6 months ago

false

Trend Micro patches critical flaws in its Apex Central software

www.csoonline.com · 6 months ago

Trend Micro has released a patch to address critical security vulnerabilities in its Apex Central software management tool. The most severe flaw, rated 9.8, allows an unauthenticated attacker to execute malicious code on the system with maximum privileges. Other high-severity vulnerabilities include denial-of-service conditions caused by unchecked NULL return values and out-of-bounds reads. Users should update to build 7190 to mitigate these risks.

Anthropic: Viral Claude “Banned and reported to authorities” message isn’t real

www.bleepingcomputer.com · 6 months ago

false

ChatGPT tests a new feature to find jobs, improve your resume, and more

www.bleepingcomputer.com · 6 months ago

false

ZombieAgent ChatGPT attack shows persistent data leak risks of AI agents

www.csoonline.com · 6 months ago

Security researchers have identified new techniques, dubbed ZombieAgent, to exploit connections between ChatGPT and third-party applications, enabling data exfiltration and the creation of persistent backdoors. Attackers can embed hidden prompts within emails, documents, or cloud storage files to manipulate ChatGPT into leaking user data to external servers, sometimes through URL-based redirection. This method also exhibits worm-like propagation capabilities, potentially spreading to other users within an organization. OpenAI has addressed the vulnerabilities reported in September, with fixes implemented on December 16th, but the risk of prompt injection attacks remains ongoing.

Deepfake Fraud Tools Are Lagging Behind Expectations

www.darkreading.com · 6 months ago

false

Friday Squid Blogging: The Chinese Squid-Fishing Fleet off the Argentine Coast

www.schneier.com · 6 months ago

false

Grok, Elon Musk’s A.I., Is Generating Sexualized Images of Real People, Fueling Outrage

www.nytimes.com · 6 months ago

Elon Musk's chatbot, Grok, has faced significant backlash for generating sexualized images of real people on the X platform. Users prompted the AI to create images of individuals in revealing clothing, leading to widespread outrage and complaints. The chatbot recently began restricting image generation requests to paid X subscribers. Some individuals depicted in the images have threatened legal action and called for the technology to be banned.

Microsoft may soon allow IT admins to uninstall Copilot

www.bleepingcomputer.com · 6 months ago

false

Hackers target misconfigured proxies to access paid LLM services

www.bleepingcomputer.com · 6 months ago

Hackers are targeting misconfigured proxy servers to gain access to paid large language model services. Since late December, attackers have probed over 73 LLM endpoints, generating more than 80,000 sessions. The activity involves scanning endpoints using low-noise prompts to identify AI models without triggering security alerts. Researchers believe the activity likely originates from security researchers or bug bounty hunters using vulnerability assessment tools, and may indicate malicious intentions.

Basketball player arrested for alleged ransomware ties freed in Russia-France prisoner swap

therecord.media · 6 months ago

Russian basketball player Daniil Kasatkin has been freed in a prisoner exchange with France. Kasatkin was arrested in France and faces accusations of serving as a negotiator for a ransomware gang that targeted approximately 900 organizations between 2020 and 2022. The unnamed ransomware gang is believed to be associated with the now-defunct Conti group. In exchange for Kasatkin, France released French researcher Laurent Vinatier, who was imprisoned for violating foreign agent laws.

China-Linked Hackers Exploit VMware ESXi Zero-Days to Escape Virtual Machines

thehackernews.com · 6 months ago

Chinese-speaking hackers are suspected of exploiting vulnerabilities in VMware ESXi to escape virtual machines, potentially for ransomware attacks. The attackers used a compromised SonicWall VPN as an initial entry point and leveraged three VMware zero-day vulnerabilities: CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226. The sophisticated attack chain involved multiple components, including a custom kernel driver and a backdoor, allowing for full control of the hypervisor from within a guest VM. Researchers believe the toolkit was developed by a well-resourced group operating in a Chinese-speaking region, possibly as early as February 2024.

Lawmakers call on app stores to remove Grok, X over sexualized deepfakes

therecord.media · 6 months ago

U.S. Senators are urging Google and Apple to remove the Grok and X apps from their app stores. The AI tool Grok has been generating sexualized images of real people, including children, without consent, prompting criticism from Elon Musk. Lawmakers claim X's limited changes to address the issue are inadequate and violate app store terms of service. The senators’ letter to the CEOs of Google and Apple highlights concerns about potential child sexual abuse materials generated by Grok.

Here’s the technology you should be excited about for 2026

www.washingtonpost.com · 6 months ago

false

Google’s Ex-CEO Backs Start-Up Approach to Big Telescopes for Space and Astronomy

www.nytimes.com · 6 months ago

false

Illicit Crypto Economy Surges Amid Increased Nation-State Activity

www.darkreading.com · 6 months ago

Illicit cryptocurrency transactions surged to at least $154 billion in 2025, with Russia being the primary driver through its A7A5 token. Nation-states like Russia, Iran, and North Korea are increasingly utilizing cryptocurrency to circumvent financial sanctions. Cybercrime also experienced significant growth, fueled by the ease and anonymity of cryptocurrency, and stablecoins now account for 84% of illicit money flows. The growth in cybercriminal services, combined with the challenges of cross-border prosecution, poses a major hurdle for law enforcement.

Grok’s Undressing Scandal + Claude Code Capers + Casey Busts a Reddit Hoax

www.nytimes.com · 6 months ago

false

Google Co-Founders Sergey Brin and Larry Page Reduce Ties to California

www.nytimes.com · 6 months ago

false

In Other News: 8,000 Ransomware Attacks, China Hacked US Gov Emails, IDHS Breach Impacts 700k

www.securityweek.com · 6 months ago

Several cybersecurity incidents have recently occurred. Jaguar Land Rover experienced a cyberattack that impacted sales, while the Illinois Department of Human Services disclosed a data breach affecting around 700,000 individuals, exposing sensitive information from a publicly accessible mapping website. A suspect has been arrested in Spain for allegedly using data stolen from the 2019 Desjardins credit union hack, and Taiwanese officials report intensified cyberattacks from China. Additionally, a Chinese threat group targeted US House committee email systems, and OwnCloud customers are being urged to enable multi-factor authentication following credential theft linked to malware. Finally, ransomware attacks increased significantly in 2025, with over 8,000 organizations reportedly targeted by groups such as Qiling, Akira, Cl0p, Play, and Safepay.

At least $26 million in crypto stolen from Truebit platform as crypto crime landscape evolves

therecord.media · 6 months ago

Hackers stole over $26 million in cryptocurrency from the Truebit platform, marking a significant crypto theft in 2026. This incident highlights a growing trend of professionalized crypto crime, with illicit cryptocurrency addresses receiving $154 billion in 2025. Chainalysis reports that $104 billion of that went to sanctioned entities, often used to circumvent sanctions and access traditional banking alternatives. Chinese money laundering networks are increasingly utilizing platforms like Huione to move illicit funds, despite recent sanctions and operational shifts.

Illinois Department of Human Services data breach affects 700K people

www.bleepingcomputer.com · 6 months ago

The Illinois Department of Human Services experienced a data breach affecting nearly 700,000 residents. Misconfigured privacy settings on a mapping website allowed public access to internal maps for years. Approximately 672,616 Medicaid and Medicare Savings Program recipients had addresses and other details exposed, while 32,401 Division of Rehabilitation Services customers had more comprehensive personal information revealed. The agency has secured the maps and is notifying affected individuals.

Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations

thehackernews.com · 6 months ago

Russian state sponsored threat actors known as APT28, also called BlueDelta, conducted credential harvesting campaigns that targeted individuals associated with a Turkish energy and nuclear research agency, staff at a European think tank, and organizations in North Macedonia and Uzbekistan. The campaigns between April and September 2025 used fake login pages resembling Microsoft Outlook Web Access, Google, and Sophos VPN, employed legitimate PDF lure documents to increase credibility, and redirected victims to real sites after credentials were captured to avoid detection. Operators relied on disposable hosting and relay services such as webhook site, InfinityFree, Byet Internet Services, and ngrok, and used hidden HTML form elements and JavaScript beacons to exfiltrate credentials to webhook endpoints.

Tim Kosiba Named NSA Deputy Director

www.securityweek.com · 6 months ago

false

Mistral AI Wins French Military Deal

www.techrepublic.com · 6 months ago

France's Ministry of the Armed Forces has awarded a framework agreement to Mistral AI allowing the armed forces, internal directorates, and affiliated public entities including the Atomic Energy Commission and the Navy Hydrographic and Oceanographic Service to use Mistral AI models, software, and services. The deal will be overseen by the Ministry Agency for Defense Artificial Intelligence known as AMIAD and requires deployment on France's own infrastructure to preserve data sovereignty, with models to be fine tuned on defense specific data for tasks such as logistics, intelligence analysis, and decision support. The framework formalizes and expands a March 2025 cooperation pact and highlights Mistral's approach of releasing model weights under permissive licensing and offering efficient models that can run on a single GPU.

Email security needs more seatbelts: Why click rate is the wrong metric

www.bleepingcomputer.com · 6 months ago

Security teams often misjudge effectiveness by focusing on click rates in phishing simulations. A more critical measure is understanding the potential damage an attacker can inflict after gaining access to a mailbox, such as exfiltrating data, resetting passwords, or phishing other employees. Experts recommend a layered approach prioritizing prevention, detection, and, crucially, containment, limiting attacker actions post-compromise through controls like segmenting mailboxes, blocking password resets, and disabling legacy access methods. Instead of click rates, organizations should track mailbox lootability, reset-path exposure, and time-to-contain incidents.