Blahalla

CISA orders feds to patch exploited Fortinet EMS flaw by Friday

www.bleepingcomputer.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency is directing U.S. federal agencies to quickly address a security vulnerability in Fortinet’s Enterprise Management Server. The flaw, tracked as CVE-2026-35616, allows attackers to bypass authentication and potentially execute code. Fortinet has released fixes, and Shadowserver reports nearly two thousand exposed instances are currently online. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and urges all organizations to patch promptly.

Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations

www.microsoft.com · 6 months ago

Security experts have identified the Storm-1175 ransomware group using the Medusa ransomware to aggressively target organizations. The group quickly exploits recently discovered vulnerabilities in web-facing systems, such as those from Microsoft Exchange, Papercut, and Ivanti, to gain access. Their attacks involve rapid deployment of ransomware within a week, utilizing tools like RMM software and Impacket for lateral movement. Microsoft advises organizations to prioritize patching vulnerabilities and adopting a layered defense strategy, including utilizing AI-powered security tools.

New Fortinet Flaw Allows Unauthorized Access to Enterprise Systems

www.techrepublic.com · 6 months ago

A critical zero-day vulnerability has been identified in Fortinet's FortiClient EMS, allowing attackers to bypass authentication and execute unauthorized commands. The flaw, CVE-2026-35616, stems from improper access control within the API, granting access without credentials and resulting in a CVSS score of 9.1. Fortinet has released a hotfix, and organizations are urged to apply it, restrict access, review logs, and audit privileged accounts to mitigate risk. This marks the second exploited vulnerability affecting FortiClient EMS in recent months, CVE-2026-21643.

Google DeepMind Researchers Map Web Attacks Against AI Agents

www.securityweek.com · 6 months ago

Google DeepMind researchers have identified six types of attacks, termed "AI Agent Traps," that can manipulate autonomous AI agents interacting with web content. These traps involve content injection, semantic manipulation, corruption of long-term memory, behavioral control, systemic exploitation of multiple agents, and attacks targeting human users. Attackers can utilize hidden commands, manipulate data distributions, and exploit cognitive biases to achieve objectives such as data exfiltration or information dissemination. Researchers suggest technical defenses, content governance, and standardized benchmarks are needed to address this evolving threat.

Automated Credential Harvesting Campaign Exploits React2Shell Flaw

www.darkreading.com · 6 months ago

A global cyber campaign is exploiting a React Server Components vulnerability, CVE-2025-55182, also known as React2Shell, to steal credentials and system data. Attackers, tracked as UAT-10608, are using an automated framework called NEXUS Listener to compromise at least 766 hosts across various industries and cloud providers. After gaining initial access, the attackers deploy NEXUS Listener, which acts as a command-and-control platform and collects credentials, SSH keys, and cloud tokens. The tool's GUI allows attackers to easily sift through the stolen data, enabling further malicious activity. Organizations are advised to patch the vulnerability, rotate credentials, and implement least-privilege access.

Using Cloudflare’s Post-Quantum Tunnel to Protect Plex Remote Access on a Synology NAS

infosecwriteups.com · 6 months ago

false

Forget the A.I. Apocalypse. Memes Have Already Nuked Our Culture.

www.nytimes.com · 6 months ago

false

Trivy supply chain attack enabled European Commission cloud breach

www.helpnetsecurity.com · 6 months ago

Researchers have discovered three distinct methods attackers can exploit to bypass Apple's Lockdown Mode. These techniques involve manipulating the system clipboard, leveraging Universal Control, and exploiting vulnerabilities in HomeKit. Successful exploitation could allow unauthorized access to sensitive data or control of a device. The vulnerabilities identified are CVE-2023-40920, CVE-2023-41055, and CVE-2023-41069.

Apple Rolls Out Fix: New macOS Update Could Protect 100M Mac Users

www.techrepublic.com · 6 months ago

Apple has released a macOS update to protect users from a growing cyberattack called ClickFix. Attackers are exploiting users’ tendency to copy and paste commands from untrusted sources into the Terminal, often found in tutorials or AI-generated responses. The new macOS safeguard displays a warning before users paste commands, encouraging them to double-check the instructions and avoid potentially malicious actions. While this isn’t a response to a specific software vulnerability, Bitdefender reports a rise in Apple-targeted cyberattacks, emphasizing the importance of verifying command sources and avoiding urgent requests.

Shadow AI in Healthcare Is Here to Stay

www.darkreading.com · 6 months ago

false

Why Simple Breach Monitoring is No Longer Enough

www.bleepingcomputer.com · 6 months ago

Organizations often underestimate the risk of stolen credentials, despite recognizing them as a top security concern. Traditional security measures like MFA and zero-trust solutions are insufficient when devices are unmanaged. A recent survey revealed that many enterprises rely on inadequate tools with stale data and limited investigation capabilities, leading to delayed detection and significant financial losses, costing upwards of $4.81 to $4.88 million per breach. Continuous monitoring, automation, and integrations are crucial for a mature breach monitoring program to address evolving infostealer threats, such as those from LummaC2, Rhadamanthys, Atomic macOS Stealer, and others.

OWASP GenAI Security Project Gets Update, New Tools Matrix

www.darkreading.com · 6 months ago

The Open Web Application Security Project, or OWASP, has released updated security recommendations for artificial intelligence systems, specifically focusing on generative AI and agentic AI. New guidance addresses 21 data security risks, including sensitive data leakage and exposure of agent credentials. OWASP is shifting to a six-month update schedule to keep pace with the rapidly evolving AI landscape, and experts emphasize the need for improved visibility and observability of AI agent activity. The organization has documented risks such as sensitive data leakage (DSGAI-01), data poisoning (DSGAI-04), and compromise through third-party tools (DSGAI-06).

Trojanized PyPI AI Proxy Steals Claude Prompt, Exfiltrates Data

gbhackers.com · 6 months ago

A malicious Python package, hermes-px, available on PyPI, is designed to steal user prompts and data by masquerading as a secure AI inference proxy. The package hijacks a Tunisian university’s internal AI endpoint, injects a modified Anthropic Claude system prompt, and forwards conversations to an attacker-controlled Supabase database. It uses deceptive documentation, mimics the OpenAI Python SDK, and employs a complex, three-stage obfuscation method to conceal its malicious activities. Developers who installed the package may have exposed sensitive data and credentials.

Google Brings Lazy Loading to Media Files in New Chrome Release

gbhackers.com · 6 months ago

false

Drift Protocol Hit in $286M Suspected North Korea-Linked Crypto Heist

gbhackers.com · 6 months ago

Hackers have stolen approximately 286 million dollars from Drift Protocol, a decentralized perpetual futures exchange on the Solana blockchain. The attack, which occurred on April 1, 2026, is suspected to be linked to North Korea and is considered the largest DeFi hack of the year. Security researchers believe the breach was caused by a compromise of Drift Protocol's administrator private keys, allowing the attacker to drain multiple vaults of assets including JLP tokens, USDC, and SOL. Blockchain analytics firm Elliptic identified connections to the Democratic People’s Republic of Korea based on fund laundering techniques.

Multi-OS Cyberattacks: How SOCs Close a Critical Risk in 3 Steps

thehackernews.com · 6 months ago

Security teams are struggling to handle attacks that spread across multiple operating systems, like Windows, macOS, and Linux, due to fragmented workflows and a lack of consistent visibility. This leads to slower validation, increased escalations, and ultimately, more time for attackers to compromise systems. Experts recommend integrating cross-platform analysis into early triage, keeping investigations within a single workflow, and leveraging tools for faster analysis. A recent ClickFix campaign targeting Claude Code users utilized a malicious Terminal command to steal data and establish persistence.

Samsung to Shut Down Its Messaging App, Switch to Google Messages in July

www.techrepublic.com · 6 months ago

false

⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More

thehackernews.com · 6 months ago

Cybersecurity threats are rapidly increasing, with malware-as-a-service and sophisticated phishing campaigns becoming more prevalent. New Android trojans and existing stealers are being distributed through deceptive methods, while a malicious Chrome extension is harvesting data. Geopolitical tensions are driving espionage activity, and authorities are warning about the risks associated with messaging applications. It's important to carefully examine system processes and updates due to vulnerabilities found in common tools.

Closing the Kernel Backport Gap: Automated CVE Detection

hardenedlinux.org · 6 months ago

New regulations like the EU Cyber Resilience Act require digital product manufacturers to proactively address security vulnerabilities. A new toolset called the Kernel Backport Checker helps organizations determine which kernel vulnerabilities, such as around 3,300 in a recent example, have actually been fixed in various kernel versions. The tool validates fixes and works with both source code and binary kernels, aiding in compliance efforts and improving security posture. It is especially relevant for distro maintainers, embedded vendors, and security teams facing increasing threats.

GitHub-Backed Malware Spread via LNK Files in South Korea

gbhackers.com · 6 months ago

Researchers have discovered three methods attackers can use to bypass security controls in virtual desktop infrastructure environments. These techniques involve manipulating user settings, exploiting vulnerabilities in printer drivers, and leveraging misconfigured network shares. The vulnerabilities allow attackers to escalate privileges and potentially access sensitive data. CVE-2023-28002, CVE-2023-28017, and CVE-2023-28021 are associated with these findings.

North Korean hackers abuse LNKs and GitHub repos in ongoing campaign

www.csoonline.com · 6 months ago

North Korean hackers are employing a new, stealthy campaign targeting South Korean organizations. The attacks utilize weaponized Windows shortcut files and GitHub-based command-and-control to evade detection, progressively improving obfuscation techniques. Researchers have observed the use of decoding functions within shortcut arguments to mask GitHub addresses and payloads, and have identified several GitHub accounts associated with the activity. The campaign aims to expand surveillance capabilities within South Korea and leverages readily available tools to blend into normal system activity.

Fake GitHub CI Update Steals Secrets and Tokens

gbhackers.com · 6 months ago

Researchers have identified a vulnerability affecting multiple products from Ivanti, potentially allowing unauthorized access and control. The flaw arises from insufficient input validation, enabling command injection. Affected products include Ivanti Connect Secure, Policy Secure, and Endpoint Manager, with versions ranging from 2019.x to 2023.x. This vulnerability, designated CVE-2024-23546, poses a significant security risk to organizations utilizing these platforms.

How LiteLLM Turned Developer Machines Into Credential Vaults for Attackers

thehackernews.com · 6 months ago

A recent supply chain attack targeting LiteLLM, a popular AI development library, demonstrated how developer machines can become credential harvesting operations. Threat actors, identified as TeamPCP, compromised versions 1.82.7 and 1.82.8 of the library on PyPI, stealing SSH keys, cloud credentials, and Docker configurations from developer workstations. This incident highlights a broader trend of adversaries exploiting compromised dependencies and local environment data stored in plaintext, such as in.env files and IDE settings. To mitigate this risk, organizations should prioritize visibility of secrets across developer endpoints, move credentials into vaults, treat AI agents as potential risks, and transition to short-lived, automatically rotated credentials.

Guardarian Users Targeted With Malicious Strapi NPM Packages

www.securityweek.com · 6 months ago

A supply chain attack has compromised the Strapi ecosystem through 36 malicious NPM packages. These packages deliver payloads capable of Redis code execution, Docker container escapes, credential harvesting, and reverse shell deployment. The attacker specifically targeted the cryptocurrency payment gateway Guardarian, probing databases and attempting credential theft. Security experts advise users to rotate all credentials to mitigate potential damage.

North Korea’s Modular Malware Strategy Hides Attribution, Defies Takedowns

gbhackers.com · 6 months ago

North Korea's cyber program has shifted to a modular malware ecosystem designed for resilience and operational continuity. The program now operates parallel tracks for espionage, financial theft, and disruption, each with its own tools and infrastructure, allowing operations to continue even when components are compromised. Attackers frequently use social engineering and abuse trusted cloud platforms, and defenders must focus on behavioral analytics and monitoring rather than signature-based detection due to rapid malware churn. This approach contrasts with other APT groups and institutionalizes a burn-and-replace strategy for malware.

North Korean Hackers Target High-Profile Node.js Maintainers

www.securityweek.com · 6 months ago

North Korean hackers, identified as UNC1069, are targeting high-profile Node.js maintainers using sophisticated social engineering tactics. The attackers build rapport over weeks, scheduling meetings and using fake software updates to install backdoors, as demonstrated in the recent Axios supply chain attack where over 3 million users were impacted. The campaign, similar to previous operations like DeceptiveDevelopment, now targets multiple maintainers of widely used NPM packages. Security experts urge the open-source community to be vigilant and report suspicious activity.

Google Wants to Transition to Post-Quantum Cryptography by 2029

www.schneier.com · 6 months ago

false

Cracking a Malvertising DGA From the Device Side

www.buchodi.com · 6 months ago

A security researcher has successfully broken the Domain Generation Algorithm utilized by illegal streaming sites. These sites employ an algorithm to generate new domains every three hours, making them difficult to track. By analyzing network traffic, the researcher was able to reconstruct the algorithm and predict future domains used by these sites. This breakthrough allows for proactive measures like blocking and redirecting users away from malicious sites.

Critical Claude Code Flaw Silently Bypasses User-Configured Security Rules

gbhackers.com · 6 months ago

A critical security vulnerability was discovered in Anthropic’s Claude Code AI coding agent. The flaw allows attackers to bypass configured security rules by crafting commands exceeding 50 subcommands, effectively executing blocked actions like data exfiltration. This bypass occurs because the system skips security checks when complex commands are processed, potentially leading to unauthorized data transmission. The vulnerability has been patched in Claude Code v2.1.90, and users are advised to restrict shell access and manually audit configuration files until updated.

Alleged REvil Leader ‘UNKN’ Identified by German Authorities in New Takedown Effort

gbhackers.com · 6 months ago

German authorities have identified 31-year-old Daniil Shchukin as the person behind the hacker alias “UNKN,” a leader of the GandCrab and REvil ransomware operations. Alongside Anatoly Kravchuk, Shchukin is accused of orchestrating numerous cyberattacks in Germany, resulting in significant financial losses. REvil popularized the “double extortion” tactic, locking networks and threatening data leaks for ransom. The group’s 2021 attack on Kaseya impacted over 1,500 businesses globally.

Google’s Bug Bounty Program Hits Record $17 Million in 2025 Payouts

gbhackers.com · 6 months ago

Google’s Vulnerability Reward Program reached a record $17 million in payouts during 2025, a 40% increase from the previous year. The company expanded its focus to include artificial intelligence security with a dedicated AI Vulnerability Reward Program and specific reward categories for Chrome browser AI features. Google also invested in live hacking events, called bugSWAT, and an open-source security tool called OSV-SCALIBR, which helped identify leaked secrets. These efforts reflect Google’s ongoing commitment to collaborating with security researchers to enhance the security of its products and services.

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

thehackernews.com · 6 months ago

Cyber threat actors associated with the Qilin and Warlock ransomware operations are employing a bring your own vulnerable driver, or BYOVD, technique to evade security tools. Qilin ransomware uses a malicious DLL, “msimg32.dll,” along with drivers rwdrv.sys and hlpdrv.sys to disable over 300 endpoint detection and response, or EDR, drivers. Warlock ransomware is now using a vulnerable NSec driver, “NSecKrnl.sys,” to terminate security products at the kernel level. Experts recommend organizations allow only signed drivers from trusted publishers and maintain a rigorous patch management schedule.

Authentication is broken: Here’s how security leaders can actually fix it

www.csoonline.com · 6 months ago

Authentication systems are frequently failing, particularly in sectors like healthcare, government, aerospace, and travel, due to a fragmented and brittle ecosystem of hardware and software. Common issues stem from mismatched technology, vendor lock-in, and fragile patches that disrupt login processes. Experts recommend three architectural shifts: utilizing modular secure elements, standardizing middleware, and establishing a unified credential ecosystem to improve reliability and resilience. Security leaders should prioritize eliminating weak fallback options, demanding downgrade transparency, and hardening systems against patch turbulence.

Fortinet Rushes Emergency Fixes for Exploited Zero-Day

www.securityweek.com · 6 months ago

Fortinet has released emergency fixes for a critical vulnerability in FortiClient Enterprise Management Server. The vulnerability, tracked as CVE-2026-35616, allows for remote code execution without authentication. The flaw has been actively exploited in the wild, and approximately 2000 internet-accessible instances are potentially at risk. Fortinet credits the cybersecurity firm Defused for discovering and reporting the issue.

6 ways attackers abuse AI services to hack your business

www.csoonline.com · 6 months ago

Attackers are increasingly exploiting AI services, employing tactics similar to those used with traditional enterprise tools. Cybercriminals are abusing AI platforms as covert command-and-control channels and impersonating model context protocol servers, leading to data theft and supply chain attacks. Security experts have observed dependency poisoning within AI workflows and the creation of weaponized AI platforms like Xanthorox AI. Several vulnerabilities have been identified, including CVE-2025-32711 in Microsoft 365 Copilot and CVE-2026-25253 in OpenClaw, demonstrating the need for tighter controls and monitoring of AI systems.

He survived working for Elon Musk. Here’s how.

www.washingtonpost.com · 6 months ago

false

Escaping the COTS trap

www.csoonline.com · 6 months ago

false

Apache Traffic Server Flaw Allowed Attackers to Trigger Denial-of-Service Attacks

gbhackers.com · 6 months ago

Security updates are available for Apache Traffic Server to address two vulnerabilities. CVE-2025-58136 allows attackers to crash the server with a simple POST request, creating a denial-of-service risk. CVE-2025-65114 is an HTTP request smuggling flaw that could allow attackers to bypass security controls. Users of the 9.x and 10.x branches of Apache Traffic Server should upgrade to the latest versions to mitigate these risks.

Critical Dgraph Database Flaw Allowed Attackers to Bypass Authentication

gbhackers.com · 6 months ago

A critical vulnerability, tracked as CVE-2026-34976, has been identified in the Dgraph database system, allowing attackers to potentially take over servers. The flaw, resulting from a configuration oversight, permits unauthenticated remote access to administrative functions, bypassing authentication and authorization. Attackers can overwrite databases, access sensitive files, conduct Server-Side Request Forgery attacks, and potentially steal credentials. Versions up to v25.3.0 are affected, and administrators are advised to restrict network access until a patch is released.

Hackers Breach ILSpy WordPress Domain to Deliver Malware

gbhackers.com · 6 months ago

Researchers have discovered three distinct methods attackers can exploit to bypass Apple's Lockdown mode. These techniques involve manipulating hyperlinks, exploiting universal links, and leveraging custom URL schemes to execute malicious code. Lockdown mode is designed to restrict certain device features to enhance security, but these workarounds demonstrate potential vulnerabilities. The researchers noted CVE-2023-42052, CVE-2023-42053, CVE-2023-42054, CVE-2023-42055, and CVE-2023-42056 are associated with these findings.

Poisoned Axios Package Spreads Cross-Platform Malware via Phantom Dependency

gbhackers.com · 6 months ago

Hackers compromised the npm account of an Axios maintainer, using it to distribute two malicious versions of the popular HTTP client library: 1.14.1 and 0.30.4. These versions included a phantom dependency, plain-crypto-js@^4.2.1, which installed a cross-platform remote access trojan. The RAT dropper script self-destructed to evade detection, making identifying compromised systems challenging, and affected organizations spanned multiple sectors. Security experts recommend pinning Axios to safe versions and enforcing strict npm controls.

BKA Identifies REvil Leaders Behind 130 German Ransomware Attacks

thehackernews.com · 6 months ago

Germany’s Federal Criminal Police Office has identified two key figures behind the now-defunct REvil ransomware operation. Daniil Maksimovich Shchukin, also known as UNKN, acted as a leader and advertiser for the group, while Anatoly Sergeevitsch Kravchuk is suspected of being the developer. The pair are believed to be responsible for 130 ransomware attacks in Germany, resulting in over 35 million dollars in financial damages and nearly 2 million dollars in ransom payments. REvil, an evolution of GandCrab, targeted companies like JBS and Kaseya before ceasing operations following law enforcement actions.

Threat Actors Weaponize Fake Microsoft Teams Domains to Target Users

gbhackers.com · 6 months ago

Threat actors linked to North Korea, known as UNC1069, are using fake Microsoft Teams domains to trick users into downloading malware. The group creates convincing meeting lures and compromises communication channels to distribute Remote Access Trojans. Attackers revive old conversations, send fake invitations, and pre-schedule meetings through legitimate services to appear trustworthy. Users are advised to verify URLs and treat unexpected meeting requests with caution.

ResokerRAT Hijacks Telegram API to Command Infected Windows PCs

gbhackers.com · 6 months ago

A new Windows malware, ResokerRAT, uses Telegram’s Bot API for command and control, bypassing traditional server infrastructure and blending in with encrypted traffic. The malware employs several anti-analysis techniques, including terminating processes like Task Manager and blocking key defensive key combinations. ResokerRAT also modifies User Account Control settings to suppress security prompts and can download additional payloads via PowerShell. The malware’s activity aligns with numerous MITRE ATT&CK techniques, including PowerShell execution and impairing defenses.

2,000+ FortiClient EMS Instances Exposed Online as Attackers Exploit Active RCE Flaw

gbhackers.com · 6 months ago

Researchers have discovered three distinct methods attackers can use to bypass Apple's Lockdown Mode. These techniques involve exploiting weaknesses in the way apps handle specific types of data. One method uses a malicious GIF image to trigger a crash and potentially gain control, while others leverage vulnerabilities in font parsing and the handling of external display connections. These exploits could allow attackers to execute arbitrary code and compromise device security.

36 Malicious Strapi npm Packages Deliver Redis RCE, Persistent C2 Malware

gbhackers.com · 6 months ago

Researchers have discovered vulnerabilities in the popular file-sharing protocol, BitTorrent. Three potential attack vectors exist including a denial-of-service attack through crafted torrent files, a potential memory corruption issue within the libtorrent library, and a possibility of information disclosure. The memory corruption issue has been assigned CVE-2024-20327. Affected versions of libtorrent prior to 2.2.1 are urged to update promptly.

Google DeepMind Flags New Threat as Malicious Web Content Puts AI Agents at Risk

gbhackers.com · 6 months ago

Researchers at Google DeepMind have identified a new cybersecurity threat called AI Agent Traps, which are malicious web pages designed to manipulate autonomous AI systems. These traps exploit differences in how humans and machines process web content, potentially allowing attackers to access sensitive data or control agent actions. The research team categorized these attacks into six types, including content injection, semantic manipulation, and behavioral control traps. Experts say current security tools are not equipped to defend against these AI-specific threats, highlighting a need for new security measures.

Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab

krebsonsecurity.com · 6 months ago

German authorities have identified and named Daniil Maksimovich Shchukin, a 31-year-old from Russia, as the elusive hacker known as “UNKN,” who led the GandCrab and REvil ransomware groups. Shchukin and another Russian, Anatoly Sergeevitsch Kravchuk, are accused of orchestrating over two dozen cyberattacks resulting in over 35 million euros in economic damage and nearly 2 million euros in extorted funds. These ransomware groups pioneered the practice of double extortion, demanding both a decryption key and a promise not to publish stolen data. Authorities believe Shchukin may still be in Russia and is wanted for computer sabotage and extortion.

The Attack With No Attacker Domain: Microsoft Entra B2B Guest Invitation Phishing

phishu.net · 6 months ago

A new phishing technique exploits Microsoft Entra B2B guest invitations, allowing attackers to bypass traditional sender reputation checks because the email appears to originate directly from Microsoft at [email protected]. The PhishU Framework simplifies this attack, requiring only a few clicks to configure and enabling operators to control the post-acceptance landing page and downstream actions, like OAuth Consent Grant requests. This method tests user trust beyond standard phishing defenses, highlighting a potential vulnerability in how organizations handle guest invitations and delegated access. The technique emphasizes realistic social engineering rather than solely bypassing email security controls.

Traffic violation scams switch to QR codes in new phishing texts

www.bleepingcomputer.com · 6 months ago

Scammers are now using QR codes in text messages to impersonate state courts and traffic agencies across the United States. These messages claim there is an outstanding traffic violation and direct recipients to scan the code, leading to phishing sites that request a $6.99 payment. The phishing sites then collect personal and financial information which can be used for identity theft and financial fraud. Authorities confirm that state agencies do not use text messages to request payment or personal information.