Blahalla

New critical Citrix NetScaler hole of similar severity to CitrixBleed2, says expert

www.csoonline.com · 7 months ago

A critical vulnerability, CVE-2026-3055, has been identified in Citrix NetScaler ADC and NetScaler Gateway devices. This out-of-bounds read vulnerability allows an unauthenticated attacker to potentially leak sensitive information from the appliance’s memory, similar to previous CitrixBleed incidents. Security experts warn that threat actors are likely developing exploits for this flaw, and immediate patching is strongly recommended. Citrix has also advised users of CVE-2026-4368, a race condition vulnerability, affecting certain NetScaler versions. NetScaler devices, being internet-facing, are attractive targets for attackers.

GitHub adds AI-powered bug detection to expand security coverage

www.bleepingcomputer.com · 7 months ago

GitHub is integrating AI-powered scanning into its Code Security tool to expand vulnerability detection capabilities. This hybrid approach combines CodeQL’s deep semantic analysis with broader AI coverage for languages like Shell/Bash, Dockerfiles, and Terraform. The new system, expected in public preview early in Q2 2026, aims to identify security issues previously difficult to detect. GitHub’s internal testing showed positive developer feedback and faster resolution times with AI-powered remediation suggestions like Copilot Autofix.

China bars executives at Meta-owned AI company from leaving country

www.washingtonpost.com · 7 months ago

false

At RSAC, the EU Leads While US Officials Are Sidelined

www.darkreading.com · 7 months ago

false

PolyShell attacks target 56% of all vulnerable Magento stores

www.bleepingcomputer.com · 7 months ago

Cyberattacks are actively targeting a significant number of Magento stores due to a vulnerability known as PolyShell. Exploitation began last week, impacting over half of all vulnerable stores. The vulnerability allows for remote code execution or account takeover through the Magento REST API, and a novel payment card skimmer utilizing WebRTC is being deployed to exfiltrate data, bypassing standard security controls. Adobe released a beta fix but a production version is still pending.

The Wrong Fix: Why the FCC's Router Ban Misses the Real Threat

www.marisec.ca · 7 months ago

Recent Federal Communications Commission actions to ban routers from certain foreign manufacturers may be misguided. Cybersecurity experts note that vulnerabilities in router firmware and credential abuse are the primary attack vectors, regardless of a device's origin. Cyberattacks like Volt Typhoon, Flax Typhoon, and Salt Typhoon, which have targeted critical infrastructure, exploited these vulnerabilities and involved CVEs such as CVE-2023-20198 and CVE-2023-20273. Rather than focusing on manufacturing location, organizations should prioritize robust vendor support, patching, and transparency in vulnerability reporting.

Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability has been identified in Cisco Secure Firewall Management Center Software and Cisco Security Cloud Control Firewall Management. An unauthenticated attacker could potentially execute arbitrary code as root through insecure deserialization. There are no workarounds available, and users are strongly encouraged to upgrade to a fixed software release. Cisco is not aware of any public exploitation of this vulnerability.

Verdicts against Meta, YouTube reshape legal protections for Big Tech

www.washingtonpost.com · 7 months ago

A Los Angeles jury has determined that Meta and YouTube were negligent. The verdict comes from a trial where a young woman claimed she developed an addiction to the platforms during childhood. The jury awarded the woman three million dollars in compensation. This case represents a significant development concerning social media's impact on young users.

Bubble AI app builder abused to steal Microsoft account credentials

www.bleepingcomputer.com · 7 months ago

Cybercriminals are now using the no-code app building platform Bubble to host phishing websites targeting Microsoft accounts. These malicious web apps evade detection by email security solutions because they are hosted on a trusted domain. The phishing pages often mimic Microsoft login portals and steal user credentials to access sensitive Microsoft 365 data. Security researchers predict this tactic will be adopted by phishing-as-a-service platforms, increasing the stealth of future attacks.

TP-Link Patches Archer NX Auth Bypass, Still Faces Security Lawsuit

factide.com · 7 months ago

TP-Link has released a firmware update to address a critical vulnerability in its Archer NX200, NX210, NX500, and NX600 router models. The flaw, CVE-2025-15517, allows unauthorized firmware uploads due to a missing authentication check. The update also resolves a hardcoded cryptographic key issue, CVE-2025-15605, two command-injection bugs, CVE-2025-15518 and CVE-2025-15519, which could lead to code execution. TP-Link urges users to immediately install the updated firmware to avoid potential security risks.

TeamPCP deploys CanisterWorm on NPM following Trivy compromise

www.aikido.dev · 7 months ago

A new worm, CanisterWorm, developed by TeamPCP, is compromising NPM packages and impacting multiple organizations. The worm employs a three-stage architecture including a Node.js postinstall loader, Python backdoor, and Internet Computer command and control. It propagates itself by modifying package files and utilizing stolen npm tokens, turning victims into unwitting spreaders. Currently delivering a Rickroll video as a payload, the worm is capable of deploying more malicious code.

GlassWorm: Part 6. Fake Trezor Suite and Ledger Live for macOS, per-request polymorphic builds.

codeberg.org · 7 months ago

There are ways to improve Git workflows by enumerating existing objects with issues, preventing unnecessary file creation within the.git/objects directory. The process involves utilizing tools like git push and save, similar to how Neovim functions. Developers can configure options such as CURLOPTSSLVERSION and manage branches effectively. Faster operations are achievable through the combination of Msys2 and Git.

Meta Lays Off 700 Employees, While Rewarding Top Executives

www.nytimes.com · 7 months ago

false

LiteLLM supply chain compromise - a complete analysis

thecybersecguru.com · 7 months ago

A supply chain attack compromised LiteLLM, a popular Python library, impacting companies like Stripe, Netflix, and Google. Malicious versions 1.82.7 and 1.82.8 were published to the Python Package Index, resulting in the theft of sensitive data including API keys, cloud credentials, and cryptocurrency wallets. The flawed code inadvertently created an infinite loop, immediately triggering system instability. Experts recommend strict dependency management, immutable tags, and least privilege access to prevent future compromises.

RSAC 2026 Proved the Industry Agrees on the Problem — Now Comes the Hard Part

www.techrepublic.com · 7 months ago

false

New Torg Grabber infostealer malware targets 728 crypto wallets

www.bleepingcomputer.com · 7 months ago

A new malware strain called Torg Grabber is actively stealing sensitive data from a wide range of applications. It primarily targets cryptocurrency wallets, with over 700 extensions specifically designed for this purpose, along with password managers, two-factor authentication tools, and note-taking applications. The malware utilizes techniques like clipboard hijacking and reflective DLL injection to evade detection and steal data, and its developers frequently update their methods, including using HTTPS connections through Cloudflare and App-Bound Encryption bypasses. Researchers have documented a rapid development cycle with new command-and-control servers registered weekly.

Chained vulnerabilities in Cisco Catalyst switches could induce denial-of-service

www.csoonline.com · 7 months ago

Researchers at Opswat have identified four vulnerabilities in Cisco Catalyst 9300 Series enterprise switches. Two of these vulnerabilities, CVE-2026-20114 and CVE-2026-20110, can be chained together to cause a denial-of-service outage by elevating privileges. The other vulnerabilities include CVE-2026-20112, a cross-site scripting issue, and CVE-2026-20113, a CRLF injection vulnerability impacting log integrity. Cisco has released patches to address all four vulnerabilities as part of its March security advisory.

Inside RSA 2026: Security Leaders Grapple With AI’s Growing Role and Risks

www.techrepublic.com · 7 months ago

false

LeakBase Admin Arrested in Russia Over Massive Stolen Credential Marketplace

thehackernews.com · 7 months ago

Russian law enforcement has arrested a resident of Taganrog for operating LeakBase, a cybercrime forum that facilitated the trade of stolen data. The forum, active since 2021, hosted hundreds of millions of user accounts, financial data, and corporate documents. More than 147,000 users registered on the platform, which was dismantled earlier this month by a joint law enforcement operation. U.S. authorities described LeakBase as one of the world’s largest hubs for cybercriminals.

Our first pentest on a 100% Vibe coded application : analysis & feedback

www.hackmosphere.fr · 7 months ago

A recent security audit of an AI-generated application, created using vibe coding and Claude’s Opus 4.6, uncovered several critical vulnerabilities. These include a Local File Inclusion (LFI) vulnerability allowing access to sensitive server files, an Insecure Direct Object Reference (IDOR) enabling access to other users’ data, and the use of vulnerable dependencies including CVE-2025-31125, CVE-2025-30208, and CVE-2024-23331. The findings highlight that AI-generated code, while functional, often lacks adequate security controls and requires thorough auditing to prevent exploitation. Organizations using vibe coding need to integrate security practices, such as static and dynamic analysis, dependency scanning, and least privilege access control, to mitigate these risks.

Blame Game: Why Public Cyber Attribution Carries Risks

www.darkreading.com · 7 months ago

Publicly attributing cyberattacks carries significant risks and is rarely definitive. Experts caution that attribution is often probabilistic rather than conclusive, and attackers sometimes falsely claim responsibility. Prematurely attributing attacks can shift blame away from defenders and invite negative consequences, potentially impacting insurance coverage and escalating tensions with nation-states or criminal enterprises. While failing to attribute an attack could be interpreted as acceptance of the behavior, a measured response, such as stating an investigation is ongoing, is generally advised. The NotPetya attacks, attributed to the Sandworm group, initially led to cyber insurance claim denials due to concerns about acts of war.

Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family CAPWAP Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A denial-of-service vulnerability exists in Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family. The issue arises from improper handling of malformed CAPWAP packets, potentially causing affected devices to unexpectedly reload. This vulnerability does not affect several other Cisco products including Catalyst 9800 series and AireOS software. Cisco has released software updates to address the vulnerability, and there are no available workarounds.

Cisco IOS XE Software Secure Copy Protocol Server Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software. An authenticated attacker with low privileges can trigger a denial-of-service condition by sending a specially crafted command through SSH, potentially causing the device to unexpectedly reload. Cisco has released software updates to resolve this issue, and administrators can temporarily disable the SCP server feature as a mitigation. There are no available workarounds, and upgrading to a fixed software release is the recommended solution.

Cisco IOS XE Software Lobby Ambassador Privilege Escalation Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability has been identified in the Lobby Ambassador web-based management API of Cisco IOS XE Software. An authenticated, remote attacker could exploit this flaw to elevate privileges and access management APIs. The issue arises from insufficient validation of parameters received by an API endpoint, potentially allowing an attacker to create a new user with elevated access. Cisco has released software updates to resolve the vulnerability, and no workarounds are available. The Cisco Product Security Incident Response Team is aware of a public announcement regarding this vulnerability.

Cisco IOx Application Hosting Environment Stored Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in the Cisco IOx application hosting environment management interface, potentially allowing a remote attacker with administrative credentials to execute malicious code. This is a stored cross-site scripting vulnerability due to insufficient input validation. Cisco has released software updates to address the issue, and there are no workarounds available. The vulnerability is not present in all Cisco products, but it does affect devices running vulnerable releases of Cisco IOS XE Software with the IOx application hosting environment enabled.

Cisco IOx Application Hosting Environment Carriage Return Line Feed Injection Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in the web-based management interface of Cisco IOS XE Software, specifically within the Cisco IOx application hosting environment. This allows an unauthenticated attacker to inject carriage return line feed sequences, potentially manipulating log entries or hiding legitimate events. There are no workarounds available, and Cisco has released software updates to resolve the issue. The vulnerability is due to insufficient validation of user input, and a public announcement detailing the flaw is already available.

Cisco IOS Software and IOS XE Software Release 3E HTTP Server Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A denial of service vulnerability exists in certain Cisco IOS and IOS XE Software Release 3E versions when the HTTP Server feature is enabled with an active WEBEXEC module. To determine if a device is affected, administrators should check if the HTTP Server or secure server commands are present in the running configuration, and then verify the status of the WEBEXEC module. If the WEBEXEC module status is active, the device is vulnerable over HTTP or HTTPS. Cisco IOS XE 16, IOS XE 17, IOS XR, and NX-OS software are not affected.

Cisco IOS XE Software for Catalyst 9000 Series Switches DHCP Snooping Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco Catalyst 9000 Series Switches running specific versions of Cisco IOS XE Software. The issue arises when IP DHCP snooping is enabled, an IP helper-address is configured on a Switched Virtual Interface, the helper-address next hop is a sub-interface, and a native VLAN is configured on that sub-interface. This configuration can lead to a denial-of-service condition due to increased CPU utilization when BOOTP packets are forwarded. Administrators can check device configurations via the command line interface to determine if the vulnerable conditions exist. Affected products and software releases are detailed in the Cisco Security Advisory.

Cisco Catalyst SD-WAN Manager Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in the Cisco Catalyst SD-WAN Manager’s web interface that could allow an attacker to execute scripts and access sensitive information. This cross-site scripting vulnerability is due to insufficient validation of user input. There are no workarounds available, and users are advised to upgrade to a fixed software release to remediate the issue. Affected versions include 20.111 and earlier, and specific releases within the 20.12, 20.131, 20.141, 20.15, 20.161 and 20.18 series. Cisco discovered the vulnerability during internal security testing and has not received reports of public exploitation.

Cisco IOS XE Software Secure Channel for Meraki Information Disclosure Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco IOS XE Software used with Cisco Meraki devices, potentially allowing an attacker to view sensitive device configuration information through an insecure tunnel. The issue arises from a device configuration upload process. Affected products include Catalyst switches, wireless controllers, and the Meraki MS390. Cisco has released software updates to resolve this vulnerability, and no workarounds are available.

Cisco IOS, IOS XE, Secure Firewall Adaptive Security Appliance, and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco IOS, IOS XE, Secure Firewall ASA, and Secure Firewall FTD software when the Internet Key Exchange version two, or IKEv2, feature is enabled. The vulnerability can allow for a denial-of-service attack. To determine if a device is affected, use the show ip socket or show udp commands to check for open ports, and the show crypto map command to verify IKEv2 profile usage. Cisco has released fixes for affected software versions, and products like IOS XR, NX-OS, and Secure Firewall Management Center are not impacted.

Cisco IOS XE Software TLS Memory Exhaustion Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in the TLS library of Cisco IOS XE Software that could allow an unauthorized attacker to cause a denial-of-service condition. The flaw results from insufficient memory management during TLS connection setup and can be exploited by repeatedly triggering memory increases, such as through EAP authentication or a man-in-the-middle attack. Affected devices may experience unexpected reloads and service disruptions. Cisco has released software updates to resolve the issue, and there are no available workarounds.

Identity security is the new pressure point for modern cyberattacks

www.microsoft.com · 7 months ago

false

Cisco IOS XE Software for Cisco Catalyst and Rugged Series Switches Secure Boot Bypass Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco IOS XE software for Catalyst and Rugged series switches allowing a secure boot bypass. Cisco recommends upgrading to a fixed software release to fully remediate the issue and prevent future exposure. To determine if a specific software release is affected, customers can use the Cisco Software Checker tool. This tool identifies relevant security advisories and indicates the earliest fixed releases.

Citrix urges admins to patch NetScaler flaws as soon as possible

www.bleepingcomputer.com · 7 months ago

Citrix has released patches for two security vulnerabilities affecting NetScaler ADC and NetScaler Gateway appliances. One vulnerability, CVE-2026-3055, involves insufficient input validation and shares similarities with previous CitrixBleed vulnerabilities. The second vulnerability, CVE-2026-4368, is a race condition that could lead to user session mix-ups. Shadowserver data indicates thousands of instances are exposed online, and cybersecurity experts urge immediate patching due to the potential for exploitation, particularly given past attacks leveraging similar vulnerabilities like CVE-2023-4966.

Weaponizing Windows Toast Notifications for Social Engineering

ipurple.team · 7 months ago

Attackers are exploiting Windows Toast Notifications to trick users into divulging sensitive information or visiting malicious websites. The technique involves creating fake notifications that resemble legitimate system alerts. Detecting this activity requires monitoring unexpected DLL usage, such as wpnapps.dll and msxml6.dll, and analyzing notification activity alongside network behavior. Mitigation strategies include disabling toast notifications and user education.

2026 Cybersecurity Excellence Awards Winners Announced during RSA Conference as AI Security Dominates

gbhackers.com · 7 months ago

false

Phishers Pose as Palo Alto Networks' Recruiters for Months in Job Scam

www.darkreading.com · 7 months ago

Attackers have been impersonating recruiters from Palo Alto Networks for the past seven months, targeting senior-level professionals with sophisticated phishing campaigns. These scams use scraped LinkedIn data to create personalized lures and fabricate bureaucratic obstacles, such as résumé formatting requirements, to trick victims into paying fees ranging from $400 to $800. Palo Alto Networks emphasizes that they would never request payment for résumé services and advises candidates to be wary of any employment outreach that demands fees or directs them to third-party experts. Individuals targeted should report the incident to Palo Alto Networks and secure their accounts with new passwords and MFA.

AI Dominates RSAC Innovation Sandbox

www.darkreading.com · 7 months ago

false

SANS: Top 5 Most Dangerous New Attack Techniques to Watch

www.darkreading.com · 7 months ago

SANS researchers have identified five emerging attack techniques leveraging artificial intelligence. AI is dramatically lowering the barrier to entry for zero-day exploits, potentially costing as little as $116 in AI token costs. Supply chain attacks are increasingly common, with incidents like the Shai-Hulud worm infecting numerous open-source packages and a compromise of Notepad++ infrastructure. Operational technology environments face a growing accountability crisis due to a lack of visibility and data retention. Finally, irresponsible use of AI in digital forensics and incident response is a concern, and attackers are automating attacks, requiring defenders to leverage AI-powered tools like Protocol SIFT to accelerate response times.

Russian Cybercriminal Gets 2-Year Prison Sentence in US

www.securityweek.com · 7 months ago

A Russian cybercriminal, Ilya Angelov, has been sentenced to two years in federal prison for his involvement in a botnet used for ransomware attacks. Angelov, also known as Milan and Okart, was part of a group known as Mario Kart or TA-551, which distributed malware like Emotet, IcedID, Qbot, and Ursnif. The botnet facilitated ransomware attacks against over 70 US corporations, resulting in $14 million in ransom payments. He received a $100,000 fine and a $1.6 million money judgment as part of his sentence.

GlassWorm Malware Uses Solana Dead Drops to Deliver RAT and Steal Browser, Crypto Data

thehackernews.com · 7 months ago

Cybersecurity researchers have identified a new GlassWorm malware campaign that employs a multi-stage framework to steal data and install a remote access trojan. The malware uses Solana blockchain memos as dead drops for command-and-control and delivers a Google Chrome extension disguised as Google Docs to steal browser data, including cookies and keystrokes. A.NET binary is also used to perform hardware wallet phishing attacks, mimicking Ledger and Trezor devices to obtain recovery phrases. The attackers are now targeting the WaterCrawl Model Context Protocol ecosystem, impersonating legitimate servers to distribute malicious payloads.

AI Speeds Attacks, But Identity Remains Cybersecurity’s Weakest Link

www.securityweek.com · 7 months ago

Cybersecurity teams are facing increasing challenges due to the influence of artificial intelligence, geopolitical tensions, and the vulnerability of identity management. Attackers are using AI to accelerate phishing campaigns, automate reconnaissance, and develop malware. The compromise of identities is becoming a supply chain issue, with threat actors buying and generating access as needed. Organizations must prioritize protecting identities, understanding their critical assets, and aligning defenses with specific threat motivations.

Why a 'Near-Miss' Database Is Key to Improving Information Sharing

www.darkreading.com · 7 months ago

Cybersecurity experts are advocating for increased transparency in the industry, particularly through the sharing of “near-miss” incidents. These near misses, defined as events that almost resulted in a security breach, provide valuable learning opportunities when analyzed without assigning blame. Creating a centralized, anonymized database of near-miss data could encourage broader information sharing and help identify systemic vulnerabilities rather than solely focusing on individual human error. The goal is to shift the perception of near misses from a sign of weakness to evidence of proactive security measures and continuous improvement.

Nearly 7M Email Addresses Exposed in Crunchyroll Third-Party Breach

www.techrepublic.com · 7 months ago

Crunchyroll experienced a data breach impacting nearly 7 million email addresses. Hackers compromised a third-party vendor, Telus Digital, gaining access to internal systems through a compromised support agent's computer. Stolen data included support ticket records containing usernames, IP addresses, and some credit card information. This incident highlights the growing risk of supply chain attacks and the importance of vendor security.

China-Backed Hackers Target Southeast Asian Military Systems in Ongoing Spy Campaign

gbhackers.com · 7 months ago

China-linked threat actors are engaged in a cyber espionage campaign targeting Southeast Asian military networks, with activity observed since 2020. The attackers focus on collecting intelligence related to command structures and military operations, utilizing custom malware like AppleChris and MemFun, which employ techniques to evade detection. They have used tools like Getpass, a modified version of Mimikatz, to escalate access and steal credentials. Security analysts assess the operation as a mature espionage effort demonstrating stealth and persistence.

Navia breach exposed HackerOne employee PII due to a BOLA-style access in third-party system

thecybersecguru.com · 7 months ago

A data breach affecting nearly 2.7 million people occurred due to a vulnerability at Navia Benefit Solutions, a third-party benefits administrator used by HackerOne. The breach, which lasted from December 2025 to January 2026, exploited a Broken Object Level Authorization, or BOLA, flaw in Navia’s systems, exposing sensitive data like Social Security numbers and addresses. HackerOne has criticized Navia for a weeks-long delay in notifying them about the incident, and is now reviewing their relationship and offering credit monitoring to affected employees. This event highlights the importance of vendor risk management and the potential for supply chain compromises.

iOS, macOS 26.4 Roll Out With Fresh Security Patches

www.securityweek.com · 7 months ago

Apple has released several security updates for its operating systems, addressing more than 80 vulnerabilities across iOS, macOS, tvOS, watchOS, visionOS, and Safari. iOS and iPadOS 26.4 include patches for nearly 40 security defects, while macOS Tahoe 26.4 resolves over 75 bugs. These updates fix issues ranging from WebKit bugs that could enable malicious website attacks to kernel vulnerabilities that could lead to memory corruption and information disclosure. Apple has not reported any of these vulnerabilities being actively exploited.

Obfuscated VBS and PNG Loaders Power New Open Directory Malware Campaign with RAT Payloads

gbhackers.com · 7 months ago

Security researchers have uncovered a sophisticated malware campaign utilizing a modular delivery framework. The initial stage involves obfuscated Visual Basic Script files that launch fileless PowerShell loaders, which then retrieve payloads hidden within PNG images. These payloads include Remcos RAT and a UAC bypass DLL, deployed through an open-directory infrastructure hosted on cloud services, allowing for easy payload rotation. Attackers are using techniques such as memory injection and shellcode execution to evade detection.

CVE-2026-33656: EspoCRM ≤ 9.3.3 — Formula engine ACL gap + path traversal → authenticated RCE (full write-up + PoC)

jivasecurity.com · 7 months ago

A critical vulnerability, CVE-2026-33656, has been identified in EspoCRM, an open-source CRM system. The flaw allows authenticated administrators to bypass access controls and execute arbitrary code on the server. This could enable attackers to read sensitive files, manipulate file paths, and ultimately gain control of the system as the www-data user. EspoCRM users are urged to update to version 9.3.4 or a later release to address the issue.