Blahalla

r/netsec monthly discussion & tool thread

www.reddit.com · 21 days ago

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links. Rules & Guidelines Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary. Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.

Privilege escalation to root in Lima QEMU guests via a world-writable agent socket (CVE-2026-53657)

syntetisk.tech · 21 days ago

An unprivileged user inside a Lima QEMU guest could reach the root-owned guest-agent socket and run commands as root in the VM. Fixed in Lima v2.1.3. Lima scored it High, CVSS 8.2 with Scope: Changed, reflecting that crossing from an unprivileged account to root within the VM crosses a security boundary that other components rely on. Full write up is available on the Syntetisk blog.

Safe Events Start With Threat Intel and Digital Security

www.darkreading.com · 21 days ago

Planning ahead to defend against cyber threats is the work that keeps events uneventful.

AI-Generated Browser Ransomware Abuses Chromium API on Windows and Android

thehackernews.com · 21 days ago

Cybersecurity researchers have flagged a new malware artifact generated using DeepSeek that constructed a novel attack path combining "unrealistic browser-malware concepts with a real browser capability" to turn it into a working ransomware technique that runs entirely inside the browser on both Windows and Android devices.

Malicious Google Notes Extension Swaps Crypto Wallet Addresses During Transactions

gbhackers.com · 21 days ago

Technically sophisticated campaign delivering a malicious Chromium extension that silently swaps cryptocurrency wallet addresses during transactions. Delivered via unsigned installers observed in both.NET and Golang variants access, the payload masquerades as a minimalist “Google Notes” browser extension.

Over 900 Oracle E-Business instances exposed to ongoing attacks

www.bleepingcomputer.com · 21 days ago

Over 900 Oracle E-Business Suite (EBS) instances have been found exposed online amid ongoing attacks exploiting a critical security flaw.

MacSync Stealer Hijacks macOS via Fake Claude Code Google Ads – Full Attack Chain Exposed

gbhackers.com · 21 days ago

MacSync Stealer is a newly discovered macOS infostealer actively distributed through a sophisticated malvertising campaign on Google Ads that impersonates Anthropic’s Claude Code CLI.

ToddyCat Uses Shadow Token via Remote Debug to Compromise Gmail Accounts

gbhackers.com · 21 days ago

ToddyCat, an advanced persistent threat group long associated with targeted espionage against corporate environments, has evolved its toolkit to exploit OAuth-based authorization flows and compromise Gmail accounts without directly stealing credentials.

2026 Cybersecurity Assessment: The Gap Between Awareness and Resilience

thehackernews.com · 21 days ago

Organizations have never had greater awareness of cyber risk. Yet turning that awareness into operational resilience has never been more challenging. The 2026 Bitdefender Cybersecurity Assessment confirms this is the case, as this year's findings reveal a series of surprising contradictions.

Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities

www.securityweek.com · 21 days ago

Seven of the security defects have a maximum severity rating of 10/10 and could lead to arbitrary code execution.

FCC Bans Chinese-Produced Network Equipment Linked to Cyber and Espionage Risks

gbhackers.com · 21 days ago

The U.S. Federal Communications Commission (FCC) has implemented comprehensive new restrictions banning the import and marketing of Chinese-produced telecommunications and surveillance equipment identified as posing significant cybersecurity and espionage risks.

Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack

www.securityweek.com · 21 days ago

Citrix urges customers to patch NetScaler after fixing six vulnerabilities, including the HTTP/2 Bomb flaw and a high-severity CitrixBleed-style information disclosure bug.

CISA Adds Actively Exploited SimpleHelp Vulnerability to KEV Catalog

gbhackers.com · 21 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical vulnerability in SimpleHelp, tracked as CVE-2026-48558, and added it to its Known Exploited Vulnerabilities (KEV) catalog. This indicates that the vulnerability is actively being exploited in the wild, and CISA is urging immediate remediation.

The Gentlemen Ransomware Targets Large Corporations and Critical Infrastructure Worldwide

gbhackers.com · 21 days ago

The Gentlemen ransomware group has emerged in 2026 as a highly adaptive and technically sophisticated ransomware-as-a-service (RaaS) operation targeting large corporations and critical infrastructure across multiple regions. Public reporting places The Gentlemen among the top 10 ransomware actors by victim announcements on its data leak site during the first half of 2026 (see ransomware.

Papa Johns Surveillance-Based Advertising

www.schneier.com · 21 days ago

Papa Johns is spying on people’s buying activities to predict when they are low on food: The pizza chain recently tapped NBCUniversal, Instacart and the dentsu-owned media agency Carat for help reaching consumers when they’re low on groceries, and thus more likely to be swayed by a mouth-watering ad.

Microsoft fixes GIF functionality in the Windows Emoji Panel

www.bleepingcomputer.com · 21 days ago

Microsoft has fixed the GIF functionality in the Emoji Panel for Windows 11 and Windows Server users after the provider shut down its service.

Microsoft Accelerates Post-Quantum Cryptography Shift to 2029

thehackernews.com · 21 days ago

Microsoft on Tuesday said it's accelerating its quantum safe security roadmap, stating technology advances in quantum computing are making it essential to replace existing encryption standards sooner than previously expected. "Advances in quantum research and development have shifted the risk horizon," Mark Russinovich, chief technology officer of Microsoft Azure, said.

Frontier AI: Six Questions Every Enterprise Should Ask Security Vendors

www.securityweek.com · 21 days ago

From model selection and automation to validation and measurable results, the right questions can help enterprises separate genuine AI capabilities from marketing hype.

Amazon fined $2.25M for withholding evidence from fraud victims

www.bleepingcomputer.com · 21 days ago

The U.S. Federal Trade Commission (FTC) says Amazon will pay a $2.25 million civil penalty to settle charges that it blocked identity theft victims' access to transaction records.

Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari

www.securityweek.com · 21 days ago

The updates fix vulnerabilities in WebKit, the kernel, WebRTC, Web Extensions, and other components affecting iPhone, iPad, Mac, and Safari users.

RedLine Infostealer Thread Reveals Hidden Maritime Phishing and BEC Infrastructure

gbhackers.com · 21 days ago

A routine threat-feed alert for a RedLine Stealer command-and-control (C2) IP morphed into a full-scale pivot investigation that exposed a tailored maritime spear‑phishing and business email compromise (BEC) ecosystem. The starting signal a UniqueSignal entry from VMRay identified 194[.]156.79.122:55615 as a RedLine-associated host.

OpenMatter Network Introduces Verifiable Trust Layer for Secure Collaboration and AI Agents

gbhackers.com · 21 days ago

Melbourne, Florida, June 30th, 2026, CyberNewswire OpenMatter Network today announced the launch of its cryptographically verifiable platform for secure collaboration and AI governance, built on a simple premise: Don’t Trust Data. Prove It. For decades, organizations have relied on trust-based assumptions to secure data, execute workloads, and govern digital systems.

The Yoto Music Box Is a Ray of Hope Amid the ‘Techlash’

www.nytimes.com · 21 days ago

Amid widespread “techlash” over addictive screens and apps, the Yoto, an audio player for children, shows there’s still a way to make money while doing something nice.

Dawnguard Raises $6.3 Million for Security Architecture Automation Platform

www.securityweek.com · 21 days ago

The company has publicly launched its solution to help organizations design, build, and operate secure cloud systems.

Fluentd Security Flaws Enable Remote Code Execution, SSRF, DoS, and Credential Exposure

gbhackers.com · 21 days ago

Fluentd, a widely used open-source data collector for unified logging, has reported several high-impact vulnerabilities that could enable attackers to achieve remote code execution (RCE), server-side request forgery (SSRF), denial-of-service (DoS), and the exposure of sensitive credentials. These issues, documented in multiple GitHub Security Advisories, affect Fluentd versions up to 1.19.

New RustDuck Botnet Targets IoT Devices and Servers With Weak Passwords and RCE Exploits

gbhackers.com · 21 days ago

A sophisticated new botnet family dubbed RustDuck emerged in early 2026, leveraging a two-stage Loader and Core architecture to compromise IoT devices, routers, and enterprise servers through brute-force credential attacks and remote code execution vulnerabilities.

Massive Password Spray Campaign Targeting Azure CLI

www.securityweek.com · 21 days ago

Hackers were seen making over 81 million login attempts originating from systems associated with hosting provider LSHIY.

Adobe patches seven max severity ColdFusion, Campaign flaws

www.bleepingcomputer.com · 21 days ago

Adobe has released security patches for seven maximum-severity vulnerabilities in the ColdFusion web app development platform and the Campaign Classic marketing automation platform.

Glitch SPY RAT Abuses Android Accessibility Service for Full Device Control

gbhackers.com · 21 days ago

An emerging Android remote-access trojan platform, tracked as Glitch SPY, that leverages a fraudulent Polish apartment-rental website to trick victims into sideloading a malicious APK.

Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware

thehackernews.com · 21 days ago

Large language models keep inventing web addresses that do not exist. Attackers have started buying those made-up domains before anyone else can, then hosting phishing pages on them to catch traffic that AI tools point their way. Palo Alto Networks' Unit 42 calls the trick phantom squatting, and its new research shows it is already happening in the wild.

Adobe ColdFusion Critical Vulnerabilities Let Attackers Execute Arbitrary Code

gbhackers.com · 21 days ago

Adobe has released an emergency security bulletin, APSB26-68, addressing 11 vulnerabilities in Adobe ColdFusion 2025 and ColdFusion 2023, with multiple vulnerabilities receiving the maximum CVSS base score of 10.0.

Anthropic buffa Library Zero-Day Lets Attackers Trigger Memory-Amplification DoS

gbhackers.com · 21 days ago

Anthropic’s Rust-based protobuf library, buffa, has been discovered to have a zero-day memory amplification denial-of-service (DoS) vulnerability. This flaw allows attackers to deplete system memory using relatively small inputs. Endor Labs identified the issue through its AI-powered static application security testing (SAST) engine and is now tracked as CVE-2026-55407.

Detection engineering: A programmatic approach to identifying cyber threats

www.csoonline.com · 21 days ago

Detection engineering, which was once a niche practice among mostly large companies, appears to have evolved into a capability that organizations across industries now consider essential to their security operations.

Citrix NetScaler ADC and Gateway Flaws Let Attackers Trigger Memory Overread and Denial-of-Service

gbhackers.com · 21 days ago

Citrix has issued a critical security bulletin addressing multiple high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway. These vulnerabilities could allow attackers to trigger memory overreads, arbitrary file access, and denial-of-service (DoS) conditions across affected deployments.

Attackers Register AI-Hallucinated Domains to Deliver Phishing Kits and Malware

gbhackers.com · 21 days ago

An emergent supply-chain attack vector they term “phantom squatting,” in which large language models (LLMs) routinely hallucinate plausible but nonexistent domains for legitimate brands and adversaries then preemptively register those domains to host phishing kits, malware, and other malicious infrastructure.

Anthropic Restores Claude Fable 5 After U.S. Lifts Jailbreak-Linked Export Controls

thehackernews.com · 21 days ago

Anthropic is putting Claude Fable 5 back online worldwide. On June 30, the U.S. Commerce Department lifted the export controls it had imposed on Fable and its more tightly controlled sibling Mythos 5 about two and a half weeks earlier. Fable 5 returns to users on Wednesday, July 1, across Claude.ai, the Claude Platform, Claude Code, and Claude Cowork.

Google Chrome 151 Released With 382 Security Fixes for Critical Vulnerabilities

gbhackers.com · 21 days ago

Google has promoted Chrome 151 to the stable channel for Windows, macOS and Linux, delivering a major security update that addresses 382 vulnerabilities across the browser’s core engine, graphics stack, extensions framework and cross‑platform components.

Google Patches 382 Chrome Vulnerabilities

www.securityweek.com · 21 days ago

Fifteen of the newly patched flaws have been rated ‘critical’ and 67 have been rated ‘high severity’.

AI-Powered Reverse Engineering Turns EDR Rule Analysis Into Automated Evasion Workflow

gbhackers.com · 21 days ago

LLMs are reshaping endpoint security research by turning what used to be slow, manual reverse engineering into an automated, repeatable evasion workflow.

Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts

thehackernews.com · 21 days ago

Cybersecurity researchers have warned of a "massive, ongoing, automated password spray attack" aimed at Microsoft's Azure command-line interface (CLI), compromising dozens of accounts in the process. The activity, per Huntress, originates from an IPv6 address range (2a0a:d683::/32) controlled by internet infrastructure provider LSHIY LLC (AS32167).

Hackers Use Vulnerable Windows Drivers to Kill EDR in Ransomware Attacks

gbhackers.com · 21 days ago

Hackers increasingly rely on vulnerable, legitimately signed Windows drivers to neutralize endpoint defenses, turning defense evasion into a decisive phase of modern ransomware attacks. Over the past three years the Bring Your Own Vulnerable Driver (BYOVD) technique has migrated from research proof-of-concept into a commoditized, routinely deployed capability in ransomware-as-a-service toolkits.

Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery

thehackernews.com · 21 days ago

ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human" pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise. The same research also turned up a new delivery method built to slip past Windows' script scanning.

U.S. Commerce Withdraws Export Controls on Anthropic Claude Models After Security Commitments

gbhackers.com · 21 days ago

The U.S. Department of Commerce has recently lifted export controls on Anthropic’s advanced AI models, Claude Fable 5 and Mythos 5, following a series of security and compliance commitments made by the company.

Apache Tomcat Vulnerabilities Let Attackers Bypass Authentication and Security Constraints

gbhackers.com · 21 days ago

The Apache Software Foundation has disclosed two security vulnerabilities in Apache Tomcat that can lead to authentication bypass and improper enforcement of security constraints. These vulnerabilities impact various deployments across enterprise environments.

Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service

thehackernews.com · 21 days ago

Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that could be exploited by an attacker to facilitate arbitrary file reads or trigger a denial-of-service (DoS) condition. The vulnerabilities are listed below - CVE-2026-8451 (CVSS score: 8.

U.S. Lifts Restrictions on Anthropic’s Most Powerful A.I. Models

www.nytimes.com · 21 days ago

The move allows Anthropic to bring its most powerful technologies back online, de-escalating a feud with the Trump administration.

Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector

unit42.paloaltonetworks.com · 21 days ago

Attackers can exploit LLM domain hallucinations through phantom squatting to target supply chains. Read the analysis to learn more.

China-Linked Group Targets Southeast Asia Critical Systems

www.darkreading.com · 21 days ago

The group compromised at least 10 regional organizations, including two state-owned entities, and deployed a new backdoor.

Anthropic to restore Claude Fable access on Wednesday

www.bleepingcomputer.com · 21 days ago

Anthropic has confirmed that the Department of Commerce has lifted export controls on Claude's two most powerful models, Fable 5 and Mythos 5.

SVD-2026-0701: Third-Party Package Updates in Python for Scientific Computing - July 2026

advisory.splunk.com · 21 days ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Python for Scientific Computing version 4.3.2 and higher.