Blahalla

New FortiClient EMS flaw exploited in attacks, emergency patch released

www.bleepingcomputer.com · 6 months ago

Fortinet has released an emergency security update to address a critical vulnerability, CVE-2026-35616, in FortiClient Enterprise Management Server. This improper access control flaw allows unauthenticated attackers to execute commands. The vulnerability impacts versions 7.4.5 and 7.4.6, and has been observed exploited in the wild. Security firm Shadowserver has identified over 2,000 exposed instances of FortiClient EMS online.

$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation

thehackernews.com · 6 months ago

A North Korean state-sponsored hacking group, UNC4736 (also known as AppleJeus, Citrine Sleet, Golden Chollima, and Gleaming Pisces), is believed responsible for a six-month social engineering operation that led to the theft of $285 million from the decentralized exchange Drift. The attackers posed as a quantitative trading company, built rapport with Drift contributors, and ultimately exploited vulnerabilities through compromised code repositories and wallet applications. The group, linked to previous incidents like the XTRADER/3CX supply chain breach and the Radiant Capital hack, utilizes a fragmented malware ecosystem to evade attribution and generate revenue for the DPRK regime. They are also engaging in a widespread IT worker fraud scheme, recruiting individuals from various countries to infiltrate Western companies.

GDDRHammer and GeForge: GDDR6 GPU Rowhammer to root shell (IEEE S&P 2026, exploit code available)

blog.barrack.ai · 6 months ago

New vulnerabilities, named GDDRHammer, GeForge, and GPUBreach, pose a significant threat to GPU security. Attackers can exploit these issues, which originate from unprivileged CUDA kernels, to escalate memory corruption and gain root shell access, potentially compromising entire systems. The vulnerabilities primarily impact NVIDIA GeForce RTX 3060 and RTX A6000 models, though other GDDR6 GPUs may be affected while newer models utilizing GDDR7 and HBM are less vulnerable. Mitigations include enabling IOMMU and ECC, but are not foolproof, with cloud providers urged to implement additional safeguards like dedicated GPU allocation.

Hackers exploit React2Shell in automated credential theft campaign

www.bleepingcomputer.com · 6 months ago

Hackers are exploiting the React2Shell vulnerability, identified as CVE-2025-55182, to steal credentials from vulnerable Next.js applications. The attackers use a framework called NEXUS Listener to automatically harvest sensitive data like API keys, SSH keys, and cloud credentials from over 766 compromised hosts. This activity is attributed to the UAT-10608 threat cluster, who exfiltrate data via HTTP requests to a command-and-control server. Security experts recommend updating React2Shell, rotating credentials, and enforcing least privilege to mitigate the risk.

36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

realnarrativenews.com · 6 months ago

Security experts have identified 36 malicious packages within the npm registry. These packages impersonate plugins for the Strapi CMS and carry payloads designed to exploit Redis and PostgreSQL databases. The malicious code enables reverse shell deployment, credential harvesting, and the installation of persistent implants. Each package includes specific files to carry out these actions.

36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

thehackernews.com · 6 months ago

Researchers have identified 36 malicious npm packages disguised as Strapi CMS plugins that exploit Redis and PostgreSQL vulnerabilities. These packages, uploaded by four accounts, use a consistent naming convention starting with "strapi-plugin-" and contain hidden code executed during installation, granting attackers privileges and enabling actions like reverse shell deployment, credential harvesting, and persistent implant installation. The payloads evolved from initial remote code execution to reconnaissance, data collection, and targeted credential theft, potentially indicating a cryptocurrency platform was the target. These incidents highlight a broader trend of supply chain attacks impacting open-source ecosystems, including compromises of GitHub accounts, VS Code extensions, and PyPI packages.

Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS

thehackernews.com · 6 months ago

Fortinet has released a patch for a critical security vulnerability, CVE-2026-35616, impacting FortiClient EMS. The vulnerability allows an unauthenticated attacker to bypass access controls and potentially execute malicious code. Exploitation of this flaw has been observed in the wild, and it follows another recent vulnerability, CVE-2026-21643, also being actively exploited. Security experts suggest organizations prioritize patching to mitigate risk, especially given that exploitation often increases during holiday weekends.

I have refactored slurp s3 bucket enumerator to work with any s3 compatible cloud

codeberg.org · 6 months ago

false

Axios npm hack used fake Teams error fix to hijack maintainer account

www.bleepingcomputer.com · 6 months ago

North Korean hackers, identified as UNC1069, compromised the Axios HTTP client project through a sophisticated social engineering campaign. Attackers impersonated a legitimate company and tricked a lead maintainer into installing a fake Microsoft Teams update, which deployed a remote access trojan (RAT) on the maintainer's device. This allowed them to publish malicious versions of Axios (1.14.1 and 0.30.4) containing a plain-crypto-js dependency, impacting macOS, Windows, and Linux systems for approximately three hours. The attackers targeted numerous open-source maintainers, bypassing multi-factor authentication, and focused on high-impact projects with billions of weekly downloads.

BrowserGate: LinkedIn/Microsoft allegedly scans 6,000+ browser extensions & links them to real identities, all without user consent

thecybersecguru.com · 6 months ago

LinkedIn, through Microsoft, is reportedly scanning users' browsers for over 6,200 extensions to gather data about their religion, politics, health, and job searching activities. This practice, dubbed “BrowserGate,” uses a three-layer detection system to identify extensions and link the data to individual user profiles. The data collection appears to violate GDPR regulations and may trigger criminal liability in multiple countries. LinkedIn claims the scanning is for corporate intelligence and competitive analysis.

Apple's Spotlight Search Results Come With Engagement Metrics. No One Knew.

www.buchodi.com · 6 months ago

false

Device code phishing attacks surge 37x as new kits spread online

www.bleepingcomputer.com · 6 months ago

Device code phishing attacks have increased dramatically, surging over 37 times this year. These attacks exploit the OAuth 2.0 Device Authorization Grant flow, tricking victims into entering codes on legitimate login pages to grant attackers access to their accounts. Cybercriminals are using readily available phishing-as-a-service kits like EvilTokens, VENOM, SHAREFILE, CLURE, LINKID, AUTHOV, DOCUPOLL, FLOWTOKEN, PAPRIKA, DCSTATUS, and DOLCE to facilitate these attacks. Security experts recommend disabling the device code flow when not needed and monitoring account activity for suspicious authentication events.

Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners

realnarrativenews.com · 6 months ago

NULL

European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack

www.securityweek.com · 6 months ago

Hackers breached the European Commission’s cloud infrastructure, resulting in the theft of over 300 gigabytes of data. The breach occurred on March 24 and was linked to a compromised API key obtained through a supply chain attack targeting Aqua Security’s Trivy vulnerability scanner, perpetrated by the TeamPCP hacking group. Attackers gained access to an AWS account supporting the Europa.eu platform, which hosts websites for the European Commission and other EU entities, and exfiltrated data impacting at least 71 clients. The stolen information, including personal data, has been published on a Tor-based leak site by the ShinyHunters extortion group.

Uber and Lyft Offer Gas Price Relief, but Drivers Say It’s Not Enough

www.nytimes.com · 6 months ago

false

Chinese firms market Iran war intelligence ‘exposing’ U.S. forces

www.washingtonpost.com · 6 months ago

Chinese companies are reportedly marketing detailed intelligence about U.S. military movements to clients. This information includes details on equipment at U.S. bases, carrier group movements, and aircraft deployment strategies. Some of these companies have connections to China’s military. The intelligence has been circulating on social media platforms in both Western and Chinese markets.

Hackers Launch Social Engineering Offensive Against Key Node.js Maintainers

gbhackers.com · 6 months ago

Hackers are conducting sophisticated social engineering attacks against Node.js and npm maintainers, following a supply chain compromise of the Axios package. Threat actors are building rapport over weeks through platforms like LinkedIn and Slack before directing targets to fake video conferencing platforms to install a persistent Remote Access Trojan. This malware bypasses security measures and allows attackers to gain write access to the npm registry, potentially impacting millions of enterprise services. Cybersecurity experts suspect the attacks are linked to UNC1069, a group previously known for targeting cryptocurrency wallets.

Proof-of-Personhood Without Biometrics: The IRLid Protocol

irlid.co.uk · 6 months ago

false

Top 10 Best Privileged Access Management (PAM) Solutions 2026

gbhackers.com · 6 months ago

Privileged Access Management is increasingly important for organizations facing growing cyber threats and data breaches. Several solutions cater to various needs, ranging from large enterprises to those using cloud-native and DevOps environments. These solutions offer features like credential vaulting, session management, and Just-in-Time access, with CyberArk recognized as a leader for large organizations. Considerations for selection include ease of use, cost, and integration capabilities.

LinkedIn Hidden Code Secretly Scans Users’ Computers for Installed Software

gbhackers.com · 6 months ago

LinkedIn is reportedly engaging in undisclosed surveillance of its users’ computers, scanning for installed software and browser extensions without consent or disclosure. The platform is linking this data to identified professionals, potentially revealing sensitive personal information and tracking job search activities. LinkedIn is also accused of corporate espionage by monitoring users of competing sales tools and deceiving European regulators regarding its compliance with the Digital Markets Act. The investigation reveals data sharing with third-party firms like HUMAN Security, and the use of encrypted scripts for tracking user behavior.

Anthropic Ends Claude Subscription Access for Third-Party Tools Like OpenClaw

gbhackers.com · 6 months ago

Anthropic is restricting third-party access to its Claude subscription services, effective April 4th. This action targets unauthorized integrations like OpenClaw, which previously exploited an OAuth authentication loophole to utilize subscription models. The company cites server load as the reason for the change, prioritizing resources for native Claude products. Users now have options for pay-as-you-go usage or API key authentication, with Anthropic offering a one-time credit and discounted bundles to ease the transition.

ShieldNet Trust Posture

www.shieldnet.app · 6 months ago

ShieldNet provides a security dashboard to monitor and improve trust posture across various systems. It offers detection layers, threat classifications, and framework alignment including the OWASP LLM Top 10 and the NIST AI Risk Management Framework. Users can scan external assets, review active CVEs, enable drift protection, and review the methodology behind the system. AI-predicted vulnerabilities are automatically distributed as guardrail rules to customers, with a focus on AI-relevant CVEs.

When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications

unit42.paloaltonetworks.com · 6 months ago

Researchers have identified ways attackers can manipulate AI agents within multi-agent systems, such as those built on Amazon Bedrock, to extract sensitive information and misuse tools. Exploitation involves bypassing prompt-based guardrails through social engineering and delivering targeted payloads to agents. Defenses include utilizing Bedrock's built-in prompt attack Guardrail, implementing least privilege access, and employing layered security approaches such as Prisma AIRS. Securing these systems requires careful design and continuous monitoring to prevent prompt injection and other attacks.

Friday Squid Blogging: Jurassic Fish Chokes on Squid

www.schneier.com · 6 months ago

false

Inconsistent Privacy Labels Don't Tell Users What They Are Getting

www.darkreading.com · 6 months ago

false

LinkedIn secretly scans for 6,000+ Chrome extensions, collects data

www.bleepingcomputer.com · 6 months ago

LinkedIn is reportedly using JavaScript scripts to scan visitors’ browsers and collect device data. These scripts identify over 6,000 installed browser extensions and gather information such as CPU core count, screen resolution, and battery status. The company claims this scanning is to protect the platform and users by identifying extensions that violate its terms of service, but critics allege it’s used to gather data on competitor software usage. LinkedIn disputes claims of misuse, attributing the report to a banned user attempting to re-litigate a legal dispute.

LinkedIn secretely scans for 6,000+ Chrome extensions, collects data

www.bleepingcomputer.com · 6 months ago

Microsoft's LinkedIn is scanning visitors' browsers for over 6,000 installed extensions and collecting device data using hidden JavaScript scripts. The practice, revealed in a report called "BrowserGate," links this information to user profiles to identify companies using competitor products. LinkedIn claims the scanning is to protect its platform and users from extensions violating its terms of service, and denies using the data to infer sensitive information. A German court has previously ruled against the report's author, finding their data practices violated the law.

NASA’s Artemis II Astronauts Took iPhones Into Space

www.nytimes.com · 6 months ago

false

What If HSMs Were as Easy to Use as They Are Powerful? A native macOS app for YubiHSM 2 management

charles.dev · 6 months ago

false

Security lapse lets researchers view React2Shell hackers’ dashboard

www.csoonline.com · 6 months ago

A threat group, identified as UAT-10608, is exploiting the React2Shell vulnerability, CVE-2025-55182, to steal credentials from unpatched servers at a massive scale. Researchers discovered a password-protected database containing harvested data from compromised systems including AWS, Microsoft Azure, OpenAI, and GitHub. The automated exploitation framework has successfully compromised 766 hosts in a single 24-hour period, demonstrating an industrial-scale operation leveraging tools like Shodan and Censys. Experts warn that unpatched systems are actively being targeted, and even after patching, stolen credentials can enable persistent attacks and significant data breaches.

A core infrastructure engineer pleads guilty to federal charges in insider attack

www.csoonline.com · 6 months ago

A core infrastructure engineer recently pleaded guilty to launching an insider extortion attack against a former employer. The attack involved unauthorized remote desktop sessions, account deletions, password changes, and scheduling tasks on a domain controller, followed by a demand for bitcoin totaling approximately $750,000. Security experts emphasize that standard security procedures, such as immutable backups, the principle of least privilege, and monitoring tool usage, should have prevented the attack. Analysts recommend tiered administration models and segregated duties to limit potential damage from any single administrator.

OpenAI Buys Streaming Show ‘TBPN,’ Aiming to Change Narrative on A.I.

www.nytimes.com · 6 months ago

OpenAI has acquired TBPN, the online technology talk show known for live daily coverage, in a deal with undisclosed terms. OpenAI said the purchase is intended to help create a space for a real, constructive conversation about the changes AI creates and to scale TBPN's real-time tech media presence. TBPN founders Jordi Hays and John Coogan are expected to keep running the show, though analysts have raised questions about editorial independence and whether competitors will continue to grant interviews.

Hims & Hers warns of data breach after Zendesk support ticket breach

www.bleepingcomputer.com · 6 months ago

Telehealth company Hims & Hers Health has announced a data breach impacting customer support tickets. The breach occurred between February 4 and February 7, 2026, with unauthorized access to tickets containing personal information like names and contact details. Hackers reportedly exploited an Okta SSO account to access the company’s Zendesk instance, stealing millions of support tickets as part of a broader campaign. Hims & Hers is offering free credit monitoring and advising customers to be cautious of potential phishing attempts.

China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

thehackernews.com · 6 months ago

A China-aligned threat actor, TA416, has resumed targeting European government and diplomatic organizations since mid-2025, after a two-year period of minimal activity in the region. The group, also linked to DarkPeony and Mustang Panda, uses various techniques, including OAuth redirects, Cloudflare Turnstile abuse, and malicious C project files to deploy the PlugX backdoor. TA416 has also expanded operations to target Middle Eastern government entities amid geopolitical conflicts and frequently iterates on its attack methods. Researchers have observed the exploitation of internet-facing infrastructure, including CVE-2025-31324 and CVE-2025-0994, to gain initial access.

Google patches fourth Chrome zero-day so far this year

www.csoonline.com · 6 months ago

Google has released a security update to address a fourth zero-day vulnerability in Chrome this year. The vulnerability, CVE-2026-5281, affects the Dawn WebGPU implementation and allows for arbitrary code execution. Previous vulnerabilities this year include CVE-2026-2441, a CSS memory management fault, CVE-2026-3909, a Skia graphics library buffer overflow, and CVE-2026-3910, an issue in the V8 JavaScript engine. Users are advised to update to Chrome version 146.0.7680.178 or later.

Internet Bug Bounty program hits pause on payouts

www.csoonline.com · 6 months ago

The Internet Bug Bounty program, which rewards researchers for finding software bugs, has paused submissions. HackerOne, the program's administrator, cited artificial intelligence making it easier to find vulnerabilities as a reason for the change, shifting the balance between discoveries and remediation. The program, funded by major software companies, has awarded over $1.5 million since 2012. Node.js is among the projects impacted by the pause, and similar programs like Curl and Google have also recently restricted submissions.

Apple Breaks Precedent, Patches DarkSword for iOS 18

www.darkreading.com · 6 months ago

Apple has issued patches for the DarkSword exploit chain, extending security updates to older iOS versions, including iOS 18, after the exploit leaked online. This move, which follows a similar action regarding the Coruna exploit kit, addresses a significant threat that allows for command-and-control capabilities via SMS and privilege escalation. Security experts note the severity of DarkSword, particularly its ability to operate without rooting the device, making detection more difficult. Apple's response highlights a growing market for iOS exploit kits and underscores the challenges of relying solely on patching strategies.

Claude Code is still vulnerable to an attack Anthropic has already fixed

www.csoonline.com · 6 months ago

Security researchers have identified a vulnerability in Anthropic’s Claude Code, allowing attackers to bypass security measures using a command sequence exceeding 50 subcommands. The tool may prompt users to authorize actions without proper security analysis if presented with such a long command. The vulnerability, documented within the code itself, is addressed by the tree-sitter parser, which is currently disabled in public builds. Attackers could potentially exploit this to steal credentials and compromise software supply chains.

Die Linke German political party confirms data stolen by Qilin ransomware

www.bleepingcomputer.com · 6 months ago

The German political party Die Linke has confirmed that the Qilin ransomware group stole data from its network and is threatening to leak it publicly. The attackers targeted internal data and employee information, though the membership database was not compromised. Qilin, described as a Russian-speaking group with financial and political motivations, claimed responsibility for the attack on April 1st. This incident follows a similar attack on the CDU political party earlier this year, which involved the WineLoader backdoor tracked to APT29.

CERT-EU blames Trivy supply chain attack for Europa.eu data breach

www.csoonline.com · 6 months ago

CERT-EU has linked a recent data breach of the Europa.eu platform to a supply chain attack on the Trivy vulnerability scanner. Attackers stole 350 gigabytes of data, including personal information, after compromising an AWS API key. The breach, attributed to the TeamPCP group, exploited a misconfiguration in Trivy’s GitHub Actions environment, now identified as CVE-2026-33634. CERT-EU advises organizations to update Trivy, rotate credentials, and audit CI/CD pipelines.

Android Alert: 50 Google Play Apps Linked to ‘NoVoice’ Malware Reached 2.3M Downloads

www.techrepublic.com · 6 months ago

Malware dubbed "NoVoice" has impacted over 2.3 million downloads through apps available in the Google Play Store. The malware initially hides its activity during code review, then exploits vulnerabilities in Android software, some dating back to 2016, to gain root access and evade defenses. Once established, it collects device data, communicates with a command and control server, and can steal information from apps like WhatsApp. Google has removed the malicious apps and devices with security updates from May 2021 onward are protected.

FBI Declares Surveillance System Breach a ‘Major Incident’

www.techrepublic.com · 6 months ago

The Federal Bureau of Investigation has classified a breach of an internal surveillance system as a "major incident" under federal law. The breach, linked to China, involved a system holding data from surveillance operations and personally identifiable information on FBI investigation subjects. Attackers accessed the system by exploiting a commercial Internet Service Provider’s vendor infrastructure. The incident has prompted a Justice Department working group to bolster cyber resilience, and officials acknowledge the embarrassment of the compromise.

Microsoft Details Cookie-Controlled PHP Web Shells Persisting via Cron on Linux Servers

thehackernews.com · 6 months ago

Security researchers have observed threat actors utilizing HTTP cookies to control PHP web shells on Linux servers, enabling remote code execution. These web shells rely on attacker-supplied cookie values to activate malicious functionality and remain dormant during normal application execution. Attackers are exploiting vulnerabilities or using valid credentials to set up cron jobs that periodically recreate malicious PHP loaders, creating persistent backdoors. Microsoft recommends strengthening authentication, monitoring for unusual activity, and auditing scheduled tasks to mitigate this threat.

Blast Radius of TeamPCP Attacks Expands Amid Hacker Infighting

www.darkreading.com · 6 months ago

Multiple organizations have recently experienced breaches linked to the TeamPCP supply chain attacks, including AI startup Mercor and the European Commission. Threat actors exploited a compromised version of the Trivy code-scanning tool, gaining access to the European Commission’s cloud environment and harvesting credentials. Cybercriminal groups ShinyHunters and Lapsus$ have claimed responsibility for data exfiltration, complicating attribution and raising concerns about the broader risk profile of these attacks. Security experts advise immediate revocation and rotation of exposed secrets and heightened vigilance across cloud and SaaS environments.

Claude Code Found a Linux Vulnerability Hidden for 23 Years

mtlynch.io · 6 months ago

A researcher has uncovered several security vulnerabilities in the Linux kernel using Anthropic's Claude Code AI model. The AI identified flaws such as a heap buffer overflow in the NFS driver, some of which have existed undetected for over two decades. Newer versions of the AI, like Claude Opus 4.6, demonstrate significantly improved capabilities in finding such issues. While the AI has identified hundreds of potential bugs, each must be manually verified to confirm their validity.

npm-sentinel: 21 malicious npm packages in 24h including LLM API MITM, encrypted skill backdoors, and Redis weaponization via postinstall

yuribm.dev · 6 months ago

Researchers have identified several critical vulnerabilities within the npm package ecosystem related to AI coding tools and infrastructure. Attackers are employing techniques like persistent prompt injection, man-in-the-middle attacks against the Claude Code API, and weaponizing Redis to steal credentials and establish reverse shells. Additionally, malicious actors are distributing phishing toolkits, credential stealers disguised within React components, and heavily obfuscated packages to harvest API keys. These attacks include dependency confusion exploits targeting Verisign and internal corporate packages, alongside instances of version squatting. The researcher emphasizes responsible disclosure practices, coordinating with vendors prior to public release. CVEs referenced include: 2026-04-02, 2026-04-03.

Evolution of Ransomware: Multi-Extortion Ransomware Attacks

www.bleepingcomputer.com · 6 months ago

Ransomware attacks are increasingly impacting critical sectors like healthcare, finance, and manufacturing, with a 49% surge in publicly disclosed incidents in 2025. Threat actors have evolved beyond encryption to employ double and triple extortion tactics, stealing data and threatening public exposure to pressure victims. Traditional security measures are proving insufficient, necessitating a new approach that focuses on data protection even after a breach. Penta Security’s D.AMO platform combines encryption, access control, and backup recovery to protect against multi-extortion ransomware.

AI Breakthroughs, Security Breaches, and Industry Shakeups Define the Week in Tech

www.techrepublic.com · 6 months ago

Several significant developments occurred this week in the technology sector. AI innovation is accelerating, with Alibaba releasing Qwen3.5 Omni and Microsoft and Google launching new AI tools. Anthropic experienced data leaks, including the accidental publication of 500,000 lines of code related to Claude Code, though no customer data was compromised. Security concerns emerged with NoVoice malware impacting millions of Android devices and a cyberattack against Hasbro disrupting operations. Apple released iOS 18.7.7 to address a Safari hijack vulnerability, and Google enhanced Google Drive with AI-based ransomware detection.

Using undocumented AWS CodeBuild endpoints to extract privileged tokens from AWS CodeConnections allowing lateral movement and privilege escalation through an organisation's codebase

thomaspreece.com · 6 months ago

A critical vulnerability has been identified in AWS CodeBuild involving an undocumented API that allows unauthorized access to sensitive credentials, including GitHub and Bitbucket tokens. This flaw, affecting CodeConnections, enables attackers to gain full administrative access to connected repositories, potentially compromising code, pipelines, and infrastructure. The vulnerability bypasses standard security measures and exists even without specific configurations. Mitigating the risk involves blocking the GetConnectionToken action through SCPs.

If you're running OpenClaw, you probably got hacked in the last week

blink.new · 6 months ago

A critical vulnerability, identified as CVE-2026-33579, impacts OpenClaw versions before 2026.3.28, potentially allowing attackers with basic pairing access to gain full administrative control. The vulnerability arises from a flawed authorization process during device pairing and is easily exploited, especially in instances lacking authentication. Users are strongly advised to immediately upgrade to version 2026.3.28, enable authentication, and review system logs for suspicious activity. Considering managed hosting solutions is recommended to reduce self-hosting security burdens.