Blahalla

www.techrepublic.com · 6 months ago

France's Ministry of the Armed Forces has awarded a framework agreement to Mistral AI allowing the armed forces, internal directorates, and affiliated public entities including the Atomic Energy Commission and the Navy Hydrographic and Oceanographic Service to use Mistral AI models, software, and services. The deal will be overseen by the Ministry Agency for Defense Artificial Intelligence known as AMIAD and requires deployment on France's own infrastructure to preserve data sovereignty, with models to be fine tuned on defense specific data for tasks such as logistics, intelligence analysis, and decision support. The framework formalizes and expands a March 2025 cooperation pact and highlights Mistral's approach of releasing model weights under permissive licensing and offering efficient models that can run on a single GPU.

Email security needs more seatbelts: Why click rate is the wrong metric

www.bleepingcomputer.com · 6 months ago

Security teams often misjudge effectiveness by focusing on click rates in phishing simulations. A more critical measure is understanding the potential damage an attacker can inflict after gaining access to a mailbox, such as exfiltrating data, resetting passwords, or phishing other employees. Experts recommend a layered approach prioritizing prevention, detection, and, crucially, containment, limiting attacker actions post-compromise through controls like segmenting mailboxes, blocking password resets, and disabling legacy access methods. Instead of click rates, organizations should track mailbox lootability, reset-path exposure, and time-to-contain incidents.

FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes

www.securityweek.com · 6 months ago

The Federal Bureau of Investigation has issued a warning about a new spear-phishing technique called quishing, used by the North Korean APT group Kimsuky. These attacks use malicious QR codes embedded in emails to bypass email security controls and redirect victims to attacker-controlled domains. Attackers collect device information to serve mobile-optimized phishing pages, steal session cookies, and bypass multi-factor authentication. The FBI considers quishing a high-confidence method for identity intrusion, particularly as compromises originate on devices outside of typical security monitoring.

[Article] Intercept: How MITM attacks work in Ethernet, IPv4 & IPv6

caster0x00.com · 6 months ago

There is a technical overview of how man in the middle attacks operate across Ethernet, IPv4 and IPv6, covering ARP spoofing, DHCP and DHCPv6 manipulation, IPv6 RA and NDP attacks, DNS and WPAD poisoning, LLMNR NBT NS and mDNS poisoning, and FHRP spoofing. The report explains attacker preparation and operational risks, including enabling promiscuous mode and IP forwarding, firewall and NAT impacts, TTL manipulation and disabling ICMP redirects, inline forwarding performance limits, credential harvesting methods, and the importance of cleanly terminating attacks to avoid persistent disruption. Recommended defenses include DHCP snooping, IP source guard, dynamic ARP inspection, RA Guard, ND inspection, ICMPv6 filtering, segmentation and FHRP authentication, and the advice that basic configuration hygiene typically prevents or rapidly reveals most MITM exploits.

Former NSA insider Kosiba brought back as spy agency’s No. 2

therecord.media · 6 months ago

false

Trend Micro Patches Critical Code Execution Flaw in Apex Central

www.securityweek.com · 6 months ago

Trend Micro has released a critical patch to address three vulnerabilities in its Apex Central management console. One critical vulnerability, CVE-2025-69258, allows unauthenticated attackers to execute malicious code with system privileges. Two additional high-severity vulnerabilities, CVE-2025-69259 and CVE-2025-69260, can cause denial-of-service conditions. Attackers must access the network to exploit these flaws, which affect the on-premises version of Apex Central.

Illinois man charged with hacking Snapchat accounts to steal nude photos

www.bleepingcomputer.com · 6 months ago

An Illinois man, Kyle Svara, has been charged for orchestrating a phishing operation to hack Snapchat accounts. Between 2020 and 2021, Svara allegedly gained access to approximately 570 accounts to steal private photos and offered his services online. He previously worked with Steve Waithe, who was sentenced for related crimes. Svara faces charges including aggravated identity theft, wire fraud, and computer fraud, with potential penalties including a minimum two-year sentence for aggravated identity theft.

CISA Closes 10 Emergency Directives as Vulnerability Catalog Takes Over

www.securityweek.com · 6 months ago

The US Cybersecurity and Infrastructure Security Agency, or CISA, has closed ten Emergency Directives initially issued between 2019 and 2024. These directives aimed to quickly address urgent cybersecurity risks affecting federal agencies, and CISA reports those missions have been accomplished. Three directives addressed specific issues including the SolarWinds Orion compromise and a nation-state compromise of Microsoft email systems. Several other directives focused on vulnerabilities in Microsoft, Pulse Connect, and VMware products, including CVE-2021-22893, CVE-2020-8243, CVE-2021-22894, and CVE-2021-22900.

Threat Road - A modern Vulnerability Database

threatroad.com · 6 months ago

NULL

DVAIB: A deliberately vulnerable AI bank for practicing prompt injection and AI security attacks

dvaib.com · 6 months ago

NULL

Ni8mare: Kritische n8n-Lücke bedroht 100.000 Server

www.csoonline.com · 6 months ago

A critical security vulnerability has been identified in the n8n workflow automation platform. The flaw, designated CVE-2026-21858, allows attackers to execute arbitrary code and potentially gain complete control over affected systems. Approximately 100,000 servers are believed to be impacted, and researchers warn of massive consequences due to the vulnerability’s CVSS score of 10.0. The vulnerability stems from how n8n processes webhooks and has been patched in version 1.121.0.

‘ZombieAgent’ Attack Let Researchers Take Over ChatGPT

www.securityweek.com · 6 months ago

Researchers have identified a new attack technique called ZombieAgent that exploits vulnerabilities in ChatGPT to exfiltrate user data and establish persistence. The attack uses malicious emails and files to bypass safeguards and steal sensitive information, including data from Gmail and email address books. Attackers can also modify ChatGPT’s long-term memory to execute malicious instructions repeatedly, even after an initial interaction. The vulnerabilities allow attackers to target any enterprise application connected to ChatGPT, potentially for data harvesting or manipulation.

Microsoft Introduces Teams External Collaboration Administrator Role

gbhackers.com · 6 months ago

false

Fog Ransomware Targets U.S. Organizations via Compromised VPN Credentials

gbhackers.com · 6 months ago

A new ransomware variant called Fog is targeting US organizations, primarily in the education and recreation sectors. Attackers are exploiting compromised VPN credentials from unnamed vendors to gain initial access, with activity observed through May 23, 2024. The ransomware encrypts files with extensions.FOG or.FLOCKED, disables Windows Defender, and deletes shadow copies to hinder recovery. The attack chain involves lateral movement using PsExec and RDP, along with credential stuffing and pass-the-hash techniques.

CrowdStrike to acquire SGNL for $740M, expanding real-time identity security

www.csoonline.com · 6 months ago

false

377,000 Impacted by Data Breach at Texas Gas Station Firm

www.securityweek.com · 6 months ago

A data breach has impacted over 377,000 individuals linked to Gulshan Management Services, Inc., which operates gas stations in Texas. The company detected unauthorized access to its IT systems in late September after a phishing attack. Personal information including names, Social Security numbers, and driver’s license numbers were stolen, and ransomware was deployed. Gulshan restored systems from backups and no ransomware group has claimed responsibility.

Palo Alto Crosswalk Signals Had Default Passwords

www.schneier.com · 6 months ago

Traffic signals in Palo Alto, California, were found to have default passwords. This allowed unauthorized access, posing a potential security risk. The default passwords were a significant oversight in the system's configuration. The vulnerability highlights the importance of secure password management in critical infrastructure.

CISA flags max-severity bug in HPE OneView amid active exploitation

www.csoonline.com · 6 months ago

The Cybersecurity & Infrastructure Security Agency has flagged a critical vulnerability in HPE’s OneView management platform. This flaw, CVE-2025-37164, allows unauthenticated attackers to execute code remotely through a public REST API, potentially compromising the entire enterprise infrastructure. HPE has released a patch, but organizations need to carefully plan the update process due to OneView’s integration with critical systems. Technical details and a Metasploit module for the vulnerability were released publicly shortly after HPE’s disclosure.

xRAT Malware Targets Windows Users via Fake Adult Game

gbhackers.com · 6 months ago

A new malware distribution campaign is targeting Windows users through Korean web hard services. Threat actors are using xRAT, also known as QuasarRAT, disguised as adult games to trick users into downloading malicious files. The malware disables Windows Event Tracing and allows attackers to collect sensitive data and control the infected system. Users are advised to download software only from official vendor websites and implement endpoint detection and response solutions.

Exploit for VMware Zero-Day Flaws Likely Built a Year Before Public Disclosure

www.securityweek.com · 6 months ago

Researchers have discovered a Chinese threat actor exploited vulnerabilities in VMware ESXi, specifically CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, which are collectively known as ESXicape. The toolkit, likely developed over a year before public disclosure, allowed attackers to execute arbitrary code and escape virtual machines, potentially compromising the hypervisor itself. Initial access was gained through a compromised SonicWall VPN, with the attackers then deploying the exploit after obtaining Domain Admin credentials. Over 30,000 internet-exposed ESXi instances remain vulnerable, highlighting the urgency for organizations to apply necessary patches.

Best Ways to Learn Everything About Investing in Bitcoin

gbhackers.com · 6 months ago

false

OWASP CRS Vulnerability Enables Charset Validation Bypass

gbhackers.com · 6 months ago

A vulnerability has been identified in the OWASP Core Rule Set, specifically rule 922110, that allows attackers to bypass charset validation. This flaw, tracked as CVE-2026-21876, enables malicious payloads, such as cross-site scripting attacks, to reach backend applications. The issue arises because the rule only validates the charset of the final multipart section of a request. Affected versions include CRS 3.3.x and CRS 4.0.0 through 4.21.0, and administrators are urged to upgrade to versions 3.3.8 or 4.22.0 to remediate the critical vulnerability, which carries a CVSS score of 9.3.

Attackers Use Over 240 Exploits Ahead of Ransomware Attacks

gbhackers.com · 6 months ago

A single operator systematically scanned the internet between December 25th and 28th, testing over 240 exploits against vulnerable systems. This reconnaissance operation, likely conducted by an Initial Access Broker, involved using tools like Nuclei and Out-of-Band Application Security Testing domains connected to ProjectDiscovery’s Interactsh platform. The operator used infrastructure managed by CTG Server Limited, which has a history of hosting malicious activity. The harvested vulnerability data will likely be used to fuel targeted intrusions and may be sold in criminal marketplaces.

Trend Micro warns of critical Apex Central RCE vulnerability

www.bleepingcomputer.com · 6 months ago

Trend Micro has addressed a critical security vulnerability in its Apex Central software, allowing unauthorized remote code execution with SYSTEM privileges. The vulnerability, tracked as CVE-2025-69258, permits attackers to inject malicious DLLs without user interaction. A patch, Critical Patch Build 7190, resolves this issue and also fixes denial-of-service vulnerabilities CVE-2025-69259 and CVE-2025-69260. Trend Micro advises users to apply the update promptly and review remote access controls.

X responds to outcry over Grok’s sexual images by charging users to create them

www.washingtonpost.com · 6 months ago

Elon Musk’s Grok AI chatbot is restricting its image generation capabilities. The change comes after the tool was used to create inappropriate and sexualized images. Now, the image-generating function is only available to users who pay for a subscription. This decision follows criticism from regulators, watchdog groups, and advocates.

50 Best Free Cyber Threat Intelligence Tools – 2026

gbhackers.com · 6 months ago

There are fifty free cyber threat intelligence tools organized into categories that cover threat feeds and trackers, standardized formats, frameworks and platforms, and research and standards. The collection includes feed and aggregation services, malware repositories, phishing and certificate monitors, IP and ASN blocklists, Yara rules and signature databases, and platforms for sharing and analyzing indicators of compromise. It highlights standardized formats such as STIX and TAXII, frameworks like AbuseHelper and Interflow, and many API driven services for enrichment and continuous monitoring.

Trend Micro Apex Central RCE Flaw Scores 9.8 CVSS in On-Prem Windows Versions

thehackernews.com · 6 months ago

Trend Micro has released security updates to address vulnerabilities in on-premise versions of Apex Central for Windows. A critical remote code execution flaw, CVE-2025-69258, carries a CVSS score of 9.8, allowing attackers to execute code with SYSTEM privileges. Two other vulnerabilities, CVE-2025-69259 and CVE-2025-69260, both with a CVSS score of 7.5, could lead to denial-of-service conditions. The issues affect versions prior to Build 7190, and successful exploitation requires access to a vulnerable endpoint.

A new approach to living a good life comes from a most unlikely place

www.washingtonpost.com · 6 months ago

false

The best (and weirdest) tech we found at CES 2026

www.washingtonpost.com · 6 months ago

false

See how AI images claiming to reveal Minneapolis ICE agent’s face spread confusion

www.washingtonpost.com · 6 months ago

false

CrowdStrike Acquires Identity Security Startup SGNL in $740 Million Deal

gbhackers.com · 6 months ago

false

The Role of Initial Access Markets in Ransomware Campaigns Targeting Australia and New Zealand

gbhackers.com · 6 months ago

Australia and New Zealand have experienced a surge in cyberattacks throughout 2025, driven by a commercialized underground market for compromised network access. Threat actors are disproportionately targeting retail, banking, and professional services organizations due to the abundance of sensitive data and potential for supply chain exploitation. Several incidents occurred, including a cyberattack against a major Australian airline exposing records of nearly six million customers and unauthorized access advertised for a large Australian retail chain, a telecommunications provider, and an accounting firm. The access brokerage landscape is fragmented, with multiple actors contributing to the widespread availability of compromised access.

Trend Micro Apex Central Flaw Enable Remote Code Execution Attacks

gbhackers.com · 6 months ago

Trend Micro has released a critical security update for Apex Central to address several vulnerabilities that could allow attackers to execute code or disrupt services. The flaws, affecting on-premises versions prior to build 7190, include a critical vulnerability allowing unauthenticated attackers to run code at the SYSTEM level. Two additional vulnerabilities can trigger denial-of-service conditions. Organizations are urged to immediately update to build 7190 or later to mitigate these risks, which include CVE-2025-69258 (Critical), CVE-2025-69259 (High), and CVE-2025-69260 (High).

CISA Retires 10 Emergency Cybersecurity Directives Issued Between 2019 and 2024

thehackernews.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency, or CISA, has retired ten emergency cybersecurity directives issued between 2019 and 2024. These directives addressed vulnerabilities including those in Windows, SolarWinds Orion, Microsoft Exchange, Pulse Connect Secure, the Windows Print Spooler, VMware products, and a nation-state compromise of Microsoft’s email system. CVEs impacted by these directives include those related to the Netlogon Elevation of Privilege Vulnerability. CISA states the actions required by these directives have been either implemented or are now enforced through Binding Operational Directive 22-01.

pcTattletale founder pleads guilty in rare stalkerware prosecution

www.bitdefender.com · 6 months ago

The founder of pcTattletale, a surveillance software company, has pleaded guilty to federal charges including computer hacking and conspiracy. The company marketed its software as a tool for monitoring employees and children, but it was primarily used to secretly spy on romantic partners. Law enforcement investigated after an undercover agent posed as a customer, and the company was ultimately shut down following a data breach impacting over 138,000 customer accounts. The founder faces up to 15 years in prison and the case highlights ongoing investigations into stalkerware operations.

Funk von kritischer Infrastruktur leicht abhörbar

www.csoonline.com · 6 months ago

Critical infrastructure facilities in Germany, including prisons, airports, and energy providers, are using unencrypted radio networks. Experts warn this practice, often driven by cost savings, poses a significant security risk, potentially jeopardizing public safety and access to essential services. Conversations transmitted over these networks can be intercepted remotely using readily available equipment and software. The Tetra standard, which secures police radio communications, is being used without encryption in some critical facilities.

Jamie Norton’s journey to CISO started with an early interest in computers

www.csoonline.com · 6 months ago

false

Russia’s Fancy Bear APT Doubles Down on Global Secrets Theft

www.darkreading.com · 6 months ago

A Russian APT group, known as Fancy Bear or APT 28, has been conducting credential harvesting campaigns against organizations in the Balkans, Middle East, and Central Asia. The attacks involve spearphishing emails redirecting victims to fake login pages designed to steal credentials for services like Sophos VPN, Google, and Microsoft Outlook. Recorded Future analysts describe the tactic as effective and cost-efficient, prioritizing persistence and deniability over complex malware. Targets include organizations with geopolitical, military, or strategic value, often serving as stepping stones to access larger, more valuable targets.

Side-channel via delivery receipt timing on Signal and WhatsApp (Careless Whisper research)

baizaar.tools · 6 months ago

A new vulnerability, called Careless Whisper, allows attackers to profile WhatsApp and Signal users' device activity by analyzing message delivery timing. This flaw bypasses encryption and doesn't trigger notifications, posing a significant privacy risk. Platforms are working on fixes, but a complete resolution is unlikely before 2026 and may impact user experience. Users can mitigate some risk with privacy settings and VPNs, but a platform-level solution is necessary.

FBI Warns North Korean Hackers Using Malicious QR Codes in Spear-Phishing

thehackernews.com · 6 months ago

The Federal Bureau of Investigation is warning of spear-phishing campaigns using malicious Quick Response or QR codes, attributed to North Korean state-sponsored hackers. These campaigns, known as “quishing,” target think tanks, academic institutions, and government entities. Attackers are spoofing various roles to trick recipients into scanning QR codes that lead to credential harvesting or malware distribution. This tactic bypasses traditional security measures by exploiting mobile devices and can facilitate multi-factor authentication bypass and identity theft.

New “Ghost Tap” Attack Hijacks Android Phones to Drain Bank Accounts

gbhackers.com · 6 months ago

Chinese threat actors are exploiting Near Field Communication technology on Android devices to steal funds from bank accounts remotely. This “Ghost Tap” attack uses malicious applications to relay payment data from victims' devices to attackers, enabling unauthorized transactions. Cybercriminals have processed approximately $355,000 in fraudulent transactions through this scheme, utilizing compromised point-of-sale terminals and mobile wallets. Several malware vendors, including TX-NFC, X-NFC, and NFU Pay, operate within Chinese cybercrime communities on Telegram, offering malware and support for prices ranging from $45 to $1,050. Authorities worldwide are responding with arrests and advisories regarding these attacks.

Microsoft Mandates MFA for Microsoft 365 Admin Center Access

gbhackers.com · 6 months ago

Microsoft is requiring multi-factor authentication for all users accessing the Microsoft 365 admin center to strengthen cloud security. The policy will be fully enforced on February 9, 2026, following a phased rollout beginning in early 2025. This change blocks password-only logins for high-privilege admin portals, mitigating credential attacks like phishing and password reuse. Microsoft recommends organizations enable MFA using available tools and audit privileged accounts to prevent disruptions.

Enterprises still aren’t getting IAM right

www.csoonline.com · 6 months ago

CyberArk research reveals many organizations are struggling with identity and access management, with 63% of cybersecurity leaders reporting employees bypass security controls for speed. A significant number of organizations continue to use always-on privileged access, and a concerning 54% regularly discover unmanaged accounts and secrets. Experts advise treating AI agents as distinct identities with unique access controls and implementing just-in-time privilege access to improve security posture and reduce risky behaviors like sharing credentials and using shared admin accounts. Ultimately, organizations need to prioritize security integration into workflows to minimize friction and ensure user compliance.

CISA retires 10 emergency cyber orders in rare bulk closure

www.bleepingcomputer.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency, or CISA, has retired ten Emergency Directives, marking the largest number closed at one time. These directives, issued between 2019 and 2024, addressed urgent cybersecurity threats and are now considered resolved or covered by Binding Operational Directive 22-01. This directive requires agencies to patch vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog, with some fixes required within days, as seen with CVE-2025-20333 and CVE-2025-20362. CISA says Emergency Directives are intended to be temporary measures.

5 Top Cybersecurity-Zertifizierungen: So pushen Sie Ihre CISO-Karriere

www.csoonline.com · 6 months ago

false

“The Conscience of a Hacker” is 40 today

phrack.org · 6 months ago

A manifesto written by someone identifying as "The Mentor" explores the motivations of hackers. It describes a sense of alienation from traditional schooling and societal norms, leading individuals to find community and purpose within the world of computers and technology. The author argues that their activities, driven by curiosity and a desire for knowledge, are unfairly labeled as criminal when compared to larger societal injustices. The author concludes that while individual hackers may be caught, the movement itself cannot be stopped.

Cisco identifies vulnerability in ISE network access control devices

www.csoonline.com · 6 months ago

A vulnerability has been identified in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) devices, assigned CVE-2026-20029. The flaw, stemming from improper handling of XML data, could allow an authenticated attacker with administrative privileges to access sensitive information, including potentially user credentials. Experts recommend rotating credentials, limiting access, and patching the affected systems as soon as possible to mitigate the risk. Proof-of-concept exploit code is available, and the vulnerability is classified as medium criticality with a CVSS score of 4.9. The issue highlights the ongoing problem of default or compromised credentials on network devices.

Gmail's new AI Inbox uses Gemini, but Google says it won’t train AI on user emails

www.bleepingcomputer.com · 6 months ago

false

New China-linked hackers breach telcos using edge device exploits

www.bleepingcomputer.com · 6 months ago

A China-linked threat actor, known as UAT-7290, is targeting telecommunications providers and expanding operations into Southeastern Europe. The group uses Linux-based malware, including RushDrop, SilentRaid, and Bulbature, along with Windows implants like RedLeaves and ShadowPad, to compromise systems. UAT-7290 establishes Operational Relay Boxes using Bulbature, which have been linked to other malicious activity. They exploit known vulnerabilities and use techniques like SSH brute force to gain access to edge devices.

CrowdStrike to Buy SGNL to Expand Identity Security Capabilities

www.darkreading.com · 6 months ago

false