Blahalla

‘CanisterWorm’ Springs Wiper Attack Targeting Iran

krebsonsecurity.com · 7 months ago

A cybercrime group known as TeamPCP is launching a wiper attack targeting organizations in Iran. The group, which uses a worm dubbed "CanisterWorm," spreads through poorly secured cloud services and wipes data on systems with Iran’s time zone or Farsi language settings. TeamPCP has demonstrated a history of compromising cloud environments, using automation to exploit vulnerabilities like exposed Docker APIs, Kubernetes clusters, Redis servers, and the React2Shell vulnerability. They recently executed a supply chain attack against the vulnerability scanner Trivy, injecting malware into official releases on GitHub actions, resulting in the theft of SSH keys, cloud credentials, and cryptocurrency wallets.

Faster attacks and ‘recovery denial’ ransomware reshape threat landscape

www.csoonline.com · 7 months ago

Mandiant’s latest report reveals a shift in attacker tactics, with dwell time increasing to 14 days, and a concerning rise in "recovery denial" ransomware. Attackers are now rapidly transferring access to specialized groups, collapsing hand-off times from over eight hours to just 22 seconds. Voice phishing has emerged as a significant infection vector, surpassing traditional email phishing, and attackers are increasingly targeting backup infrastructure and identity services to disrupt recovery efforts. Organizations must prioritize identity verification, strengthen core infrastructure, and improve alert triage to address these evolving threats.

Attackers Hide Infostealer in Copyright Infringement Notices

www.darkreading.com · 7 months ago

Attackers are using phishing emails disguised as copyright infringement notices to deliver the PureLog Stealer infostealer. The campaign targets organizations in healthcare, government, hospitality, education, the US, Canada, Australia, and Germany, employing a multi-stage, in-memory execution process to evade detection. The attackers use Python-based and.NET loaders, AMSI bypass techniques, and heavy code obfuscation to deploy the malware, which harvests sensitive data like browser credentials and cryptocurrency wallet information. Organizations are advised to enhance user training, restrict script execution, and utilize EDR/XDR solutions with memory scanning to mitigate the threat.

M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds

www.securityweek.com · 7 months ago

Google's M-Trends 2026 report reveals a concerning shift in cyberattack timelines. The time between initial system access and the handoff to another threat group has drastically decreased from hours to just 22 seconds, suggesting increased collaboration among cybercriminals. Exploits were the most common initial infection vector, with CVE-2025-31324, CVE-2025-61882, and CVE-2025-53770 being frequently exploited. The report also notes a rise in dwell time, with some attackers remaining undetected for months, and highlights the increasing prevalence of malware families like GoldVein and Akira.

BoxPwnr: AI Agent Benchmark (HTB, TryHackMe, BSidesSF CTF 2026 etc.)

0ca.github.io · 7 months ago

false

Chip Services Firm Trio-Tech Says Subsidiary Hit by Ransomware

www.securityweek.com · 7 months ago

Chip services firm Trio-Tech reports a ransomware attack on one of its Singapore-based subsidiaries. The incident occurred on March 11, encrypting files and prompting the company to take systems offline. Attackers have reportedly published data stolen from the network, leading Trio-Tech to declare the event a material cybersecurity incident. The Gunra ransomware group has claimed responsibility for the attack, and an investigation is ongoing.

Remote Command Execution in Google Cloud with Single Directory Deletion

flatt.tech · 7 months ago

A security vulnerability has been identified and patched in Google Cloud’s Looker business intelligence platform. The flaw involved a remote command execution issue stemming from improper directory deletion, which could allow attackers to delete critical data. Exploitation of the vulnerability also revealed excessive permissions that could lead to privilege escalation within Kubernetes clusters. Google Cloud has addressed these issues with security updates.

OpenClaw CVE-2026-25253 is worse than it looks (quick security checklist)

blink.new · 7 months ago

OpenClaw, an AI agent platform, faces serious security risks, including a critical remote code execution vulnerability identified as CVE-2026-25253. A ten-step security audit checklist is recommended, prioritizing patching vulnerabilities, restricting network access, and enabling authentication. Organizations are advised to thoroughly vet skills, harden network configurations, and implement updates promptly. Managed hosting options, like Blink Claw, provide enhanced security through automated patching and dedicated monitoring, which is often a more practical solution for business-critical deployments.

‘Real Housewives’ Has Been a Meme Gold Mine for 20 Years

www.nytimes.com · 7 months ago

false

Windows 11 Patch Triggers Sign-In Failures Across Microsoft Apps

www.techrepublic.com · 7 months ago

A recent Windows 11 security update, KB5079473 released on March 10, 2026, caused sign-in failures for Microsoft services like Teams Free, OneDrive, and Microsoft 365 Copilot. The error message incorrectly indicated a lack of internet connection, even when a connection was present. Microsoft has released an emergency out-of-band update, KB5085516, to resolve the issue, which users must download and install manually. Separately, a bug in the Samsung Galaxy Connect app, not a Windows update, caused some Samsung devices to lose access to the C: drive.

Aqua’s Trivy Vulnerability Scanner Hit by Supply Chain Attack

www.securityweek.com · 7 months ago

A supply chain attack compromised the Trivy open source vulnerability scanner, beginning in late February and continuing currently. Attackers gained access through a GitHub Actions workflow issue, resulting in malicious VS Code extensions and a version zero point six nine four of Trivy being distributed. The attackers used stolen credentials to compromise trivy-action and setup-trivy, deploying an information stealer that targeted Runner.Worker process memory and attempted to exfiltrate secrets. Users are urged to rotate credentials and check for repositories named tpcp-docs.

Tax Scam Google Ads Push BYOVD EDR Killer, Huntress Finds

gbhackers.com · 7 months ago

Cybercriminals are exploiting tax-themed Google Ads to deliver a sophisticated malware campaign targeting U.S. users. The ads lead to fake landing pages and ultimately install rogue ScreenConnect sessions, granting attackers remote access. Attackers use a multi-layered cloaking system to evade detection and deploy a custom tool called HwAudKiller, which leverages a signed Huawei audio driver to disable endpoint detection and response (EDR) software in kernel mode. This activity is believed to be linked to pre-ransomware or initial access broker tradecraft.

⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & More

thehackernews.com · 7 months ago

Cybersecurity threats continue to evolve with malware distributed through compromised tools like Trivy, impacting CI/CD pipelines. Law enforcement has taken down several IoT botnets used for distributed denial-of-service attacks. Exploits are rapidly deployed against newly disclosed vulnerabilities, requiring prompt patching, while phishing scams and state-sponsored attacks remain a persistent problem. Emerging threats include malware bypassing browser security, phishing campaigns targeting developers, and the development of post-quantum cryptography standards.

SEO Poisoning Campaign Uses Fake Popular Apps to Deliver AsyncRAT

gbhackers.com · 7 months ago

A sophisticated SEO poisoning campaign has been targeting users searching for popular software since October 2025. Attackers impersonate legitimate software download portals, using fake sites like vlc-media[.]com and studio-obs[.]net to distribute trojanized installers that deploy the AsyncRAT remote access trojan. The attackers use tokenized delivery URLs and a custom JavaScript component to evade detection and redirect users to malicious payloads. This campaign involves bundling legitimate installers with malicious DLLs and utilizing ScreenConnect for remote access, with the AsyncRAT build featuring cryptocurrency clipper functionality and geo-fencing.

Microsoft Exchange Online service change causes email access issues

www.bleepingcomputer.com · 7 months ago

Microsoft is currently working to resolve an ongoing service issue impacting access to Exchange Online mailboxes for some users utilizing Outlook mobile apps and the new Outlook for Mac desktop client. The problem stems from a recently introduced virtual account, and Microsoft is reverting this change to restore service. Previously, Microsoft addressed issues impacting mailbox and calendar access and problems with Office.com sign-in access. The incident is tracked under EX1256020.

Libyan Refinery Targeted in Prolonged Spy Campaign With AsyncRAT

gbhackers.com · 7 months ago

A cyber espionage campaign targeted Libyan organizations between November 2025 and February 2026, compromising an oil refinery, a telecommunications provider, and a state institution. Attackers used spear-phishing emails with Libya-related lures to deliver the AsyncRAT backdoor, enabling keylogging, credential theft, and remote command execution. The campaign’s persistence and focus on Libya’s oil sector, which produced around 1.37 million barrels per day in 2025, suggests a strategic objective, potentially linked to state-aligned interests seeking to exploit geopolitical instability and energy market concerns. Security experts recommend heightened vigilance against phishing and potential supply chain risks.

We Found Eight Attack Vectors Inside AWS Bedrock. Here's What Attackers Can Do with Them

thehackernews.com · 7 months ago

Researchers have identified eight attack vectors within Amazon’s AWS Bedrock platform, exploiting connectivity between AI applications and enterprise systems. These vectors include manipulating logs to steal data, compromising knowledge bases to access credentials and sensitive information, hijacking agents to perform unauthorized actions, injecting malicious flows, degrading guardrails to bypass security filters, and poisoning prompts to alter AI behavior. Attackers can exploit over-privileged identities to redirect logs, access sensitive data, and potentially move laterally into on-premises systems. Securing Bedrock requires mapping attack paths and maintaining tight posture controls across all components.

Chrome ABE bypass discovered: New VoidStealer malware steals passwords and cookies

www.csoonline.com · 7 months ago

A new infostealer named VoidStealer bypasses Chrome Application Bound Encryption by attaching as a debugger and placing hardware breakpoints to capture the v20 master key at the exact moment it appears in plaintext in memory. The technique requires neither privilege escalation nor code injection, making it stealthier than prior ABE bypasses, and the malware can fall back to older injection based methods if needed. VoidStealer first appeared in December 2025 and has rapidly evolved through 12 iterations, with version v2.1 deployed on March 18, 2026, indicating active development and likely demand in underground markets. Defenders are advised to watch for unexpected debugger attachments to browser processes, unusual use of memory reading APIs, anomalous Chrome process spawning patterns, and a sample linked to version v2.0 has been shared as an indicator of compromise.

QNAP Patches Four Vulnerabilities Exploited at Pwn2Own

www.securityweek.com · 7 months ago

QNAP has released patches to address several vulnerabilities impacting its devices. Four vulnerabilities, CVE-2025-62843 through CVE-2025-62846, found in SD-WAN routers were exploited at the Pwn2Own Ireland contest by Team DDOS, earning them a $100,000 reward. Updates also address critical issues in QuNetSwitch and QVR Pro, along with medium-severity vulnerabilities in Media Streaming Add-on and QuFTP Service. QNAP reports that none of these vulnerabilities have been exploited in the wild.

Microsoft Xbox One Hacked

www.schneier.com · 7 months ago

A security researcher has discovered a hardware-based hack for the Microsoft Xbox One. The attack, dubbed Bliss, exploits voltage glitches to bypass memory protection and gain complete control of the console. This allows the loading of unsigned code at all levels, including the Hypervisor and operating system, and grants access to the security processor for decryption. Because it targets the boot ROM, the vulnerability is considered unpatchable.

Secure Your Spot at RSAC 2026 Conference

www.darkreading.com · 7 months ago

false

Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware

thehackernews.com · 7 months ago

Microsoft has observed a surge in phishing campaigns targeting users during tax season, with over 29,000 users and 10,000 organizations impacted in a recent IRS-themed attack. These campaigns use various lures, including fake tax notices, QR codes, and cryptocurrency schemes, to steal credentials and deploy remote monitoring and management (RMM) tools like ConnectWise ScreenConnect, Datto, and SimpleHelp. Attackers are also leveraging legitimate services like Amazon SES and Cloudflare to mask their activities and bypass security measures, and are abusing Microsoft Azure Monitor alert notifications for phishing. Organizations are advised to enforce multi-factor authentication and monitor email traffic to mitigate these risks.

511,000+ End-of-Life IIS Instances Found Online, Raising Security Risks

gbhackers.com · 7 months ago

Security researchers have discovered over 511,000 internet-facing Microsoft Internet Information Services instances that are no longer receiving security updates. More than 227,000 of these instances have passed their Extended Security Updates period, leaving them permanently vulnerable. These outdated servers are primarily located in China and the United States, significantly expanding the attack surface for organizations. Shadowserver is now tagging these systems as "eol-iis" and "eos-iis" in their reports to help network administrators identify and remediate the risks.

MioLab MacOS Stealer Expands With ClickFix, Wallet Theft, Team APIs

gbhackers.com · 7 months ago

A sophisticated Malware-as-a-Service called MioLab is targeting macOS devices, increasingly prioritizing Macs for cybercrime. The malware uses a lightweight core combined with social engineering tactics to steal data, including cookies, passwords, cryptocurrency wallet information, and Apple Notes. It employs ClickFix techniques, generating malicious Terminal commands to bypass security measures and uses bulletproof hosting to maintain operations. Operators can leverage a web panel to manage victims and even restore Google cookies using stolen tokens.

Hackers Exploit Quest KACE SMA Flaw to Harvest Credentials

gbhackers.com · 7 months ago

Security researchers have identified active exploitation of a critical vulnerability, CVE-2025-32975, affecting Quest KACE Systems Management Appliance instances. Attackers are bypassing authentication protocols to gain administrative control and harvest credentials, pivoting to critical infrastructure like domain controllers and backup servers. Threat actors are using tools like Mimikatz and deploying malicious PowerShell scripts to maintain persistence and harvest credentials. Organizations are urged to immediately upgrade to patched versions of KACE SMA and restrict external access to the appliance.

Tycoon 2FA Fully Operational Despite Law Enforcement Takedown

www.securityweek.com · 7 months ago

Tycoon 2FA is a subscription phishing as a service active since 2023 that enables attackers to bypass multi factor authentication, generate over thirty million malicious emails per month, and has been linked to roughly ninety six thousand distinct phishing victims across about half a million targeted organizations. An international disruption in early March seized 330 active domains and involved Europol, Microsoft, and law enforcement in six countries, but activity dropped to roughly twenty five percent on March fourth and fifth before returning to pre disruption levels. Observed tactics remain unchanged and include phishing pages directing victims to malicious CAPTCHA pages that steal session cookies, JavaScript based email harvesting and credential proxying, and the use of stolen credentials to compromise SharePoint and cloud accounts for business email compromise and account takeover.

CISA Warns of Craft CMS Code Injection Flaw Exploited in Active Attacks

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has identified a critical code injection vulnerability, CVE-2025-32432, affecting multiple versions of Craft CMS. This flaw allows unauthenticated attackers to execute arbitrary code on vulnerable servers through insecure deserialization, utilizing a gadget chain within the Yii framework. Federal agencies are required to address this vulnerability by April 3, 2026, and users are urged to upgrade to patched versions 3.9.15, 4.14.15, and 5.6.17, which also resolves CVE-2023-41892. Monitoring for webshell deployments and reverse shell connections is advised as a preventative measure.

FBI warns of Handala hackers using Telegram in malware attacks

www.bleepingcomputer.com · 7 months ago

The FBI has issued a warning about Iranian hackers using Telegram for command and control in malware attacks. These attacks, linked to the Handala and Homeland Justice groups, target journalists, dissidents, and others critical of the Iranian government. Hackers use social engineering to deliver Windows malware for data theft and intelligence gathering. The FBI recently seized domains used by these groups, following attacks including a compromise of medical device maker Stryker.

Oblivion RAT Masquerades as Play Store Update to Spy on Android Users

gbhackers.com · 7 months ago

A new Android remote access trojan, Oblivion RAT, has emerged, marketed as a malware-as-a-service with subscription plans. The RAT employs a multi-stage infection process involving fake Google Play Store updates and a sideloading enablement walkthrough to trick users into granting permissions. Once installed, it leverages Android Accessibility Service to gain control of device functions, including SMS access, keylogging, and remote screen viewing. The malware’s configuration, including a C2 server address of 89.125.48.159:8888, is stored in base64 format, and includes a "Wealth Assessment" feature to identify high-value targets.

Behavioral XDR and threat intel nab North Korean fake IT worker within 10 days of hire

www.csoonline.com · 7 months ago

A suspected North Korea linked operative passed onboarding, was assigned to work on Salesforce data, and was identified and removed within ten days after behavioral analytics and threat intelligence flagged anomalies. Detection hinged on Cybereason XDR establishing a behavioral login baseline in China, a sudden EntraID login from a Dallas IP originating from an Astrill VPN on an unmanaged device, and LevelBlue SpiderLabs threat intelligence correlating the VPN infrastructure to known North Korea linked activity. The case illustrates that identifying such insider threats requires correlating multiple signals, enforcing company managed devices, applying EntraID conditional access to restrict login regions, and using careful onboarding and gradual privilege escalation to limit exposure of sensitive data.

Why US companies must be ready for quantum by 2030: A practical roadmap

www.csoonline.com · 7 months ago

There is growing urgency for US enterprises to begin post quantum preparations now because adversaries can harvest encrypted traffic today and attempt decryption later, putting long lived secrets at risk. Standards progress is accelerating with NIST publishing its first three finalized post quantum encryption standards in August 2024 including FIPS 203 for ML KEM, which makes a hybrid strategy that combines classical and post quantum algorithms a practical option. A practical roadmap recommends building a cryptography inventory tied to data value, targeting early end to end surfaces such as internal mutual TLS, VPN and code signing, standing up a hybrid ready lab, improving crypto agility, running limited hybrid pilots with explicit success metrics, and adding post quantum requirements into procurement to ensure deliberate migration before 2030.

CISA orders feds to patch DarkSword iOS flaws exploited attacks

www.bleepingcomputer.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has directed U.S. government agencies to patch three iOS vulnerabilities exploited in attacks involving the DarkSword exploit kit. These vulnerabilities, including CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520, allow attackers to gain remote code execution and steal data. The DarkSword kit has been linked to threat groups like UNC6748 and UNC6353, which use malware families like GhostBlade and GhostKnife. CISA is urging all organizations to address these vulnerabilities promptly to mitigate risks.

Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper

thehackernews.com · 7 months ago

Cybersecurity researchers have identified malicious versions of the Trivy vulnerability scanner distributed through Docker Hub, following a supply chain attack. Versions 0.69.4, 0.69.5, and 0.69.6 were compromised and have since been removed. The threat actor, known as TeamPCP, has also defaced 44 internal GitHub repositories belonging to Aqua Security, and deployed a Kubernetes wiper targeting systems in Iran. The attack leveraged a compromised service account token, highlighting the risks of supply chain vulnerabilities and the potential for widespread impact.

Critical QNAP QVR Pro Flaw Could Let Remote Attackers Access Systems

gbhackers.com · 7 months ago

QNAP has issued an urgent security advisory for a critical vulnerability in its QVR Pro application, a network video surveillance solution. This flaw, tracked as CVE-2026-22898 and ZDI-CAN-28327, allows unauthorized remote attackers to gain full system access due to a missing authentication check. Successful exploitation could allow attackers to view surveillance feeds, modify camera configurations, and potentially compromise the broader network. Users are urged to immediately update to QVR Pro version 2.7.4.1485 or later to resolve the issue.

New KB5085516 emergency update fixes Microsoft account sign-in

www.bleepingcomputer.com · 7 months ago

Microsoft has released an emergency update, KB5085516, to resolve a widespread issue impacting Microsoft account sign-ins across several applications. The problem, stemming from a previous update KB5079473, displayed an incorrect error message indicating a lack of internet connectivity, even when a connection existed. This error affected applications like Teams, OneDrive, Edge, and Microsoft 365 Copilot, but did not impact those using Entra ID for authentication. The out-of-band update is available for Windows 11 versions 25H2 and 24H2.

$30 IP-KVM Flaws Could Enable BIOS-Level Enterprise Network Attacks

gbhackers.com · 7 months ago

Security researchers have identified nine vulnerabilities affecting low-cost IP-KVM devices from GL-iNet, Angeet, Sipeed, and JetKVM. These inexpensive devices, often used in enterprise data centers, provide attackers with physical-level control over connected machines, bypassing standard security measures. Critical flaws include an unauthenticated file upload and command injection on the Angeet ES3 KVM, and insecure firmware updates on the GL-iNet Comet RM-1. Several CVEs have been assigned, including CVE-2026-32297, CVE-2026-32298, CVE-2026-32291, and CVE-2026-32296, with fixes available for some devices. Organizations are urged to isolate these KVMs from public networks to prevent potential network breaches.

Trivy Supply Chain Attack Spreads via Compromised Docker Hub Images

gbhackers.com · 7 months ago

A supply chain attack targeting the Trivy ecosystem has escalated with compromised Docker images discovered on Docker Hub. Malicious versions 0.69.5 and 0.69.6 contain indicators of compromise linked to the TeamPCP infostealer, and the “latest” tag currently points to the compromised 0.69.6 version. The attackers have also used a typosquatted command-and-control domain and embedded references to a fallback GitHub repository. Researchers suspect unauthorized access to the Aqua Security GitHub organization itself may have occurred.

A YC-Backed Startup Left Production AWS Keys Public for 5 Months.

benzimmermann.dev · 7 months ago

A startup named Pump, which optimizes cloud costs for other companies, experienced a significant security lapse. For five months, a file containing production environment credentials was publicly accessible on a code-sharing platform. The exposed credentials included access to AWS, Auth0, ClickHouse, SendGrid, Datadog, and PostHog, potentially granting access to sensitive customer data like invoices, tax documents, and Terraform state files. Despite reporting the vulnerability through the company’s stated channels, the researcher received no response and the company has not confirmed remediation or rotation of credentials.

The insider threat rises again

www.csoonline.com · 7 months ago

Insider threats are increasing, with 42% of organizations reporting more malicious incidents and 42% seeing a rise in negligent incidents. These incidents are costing organizations an average of $13.1 million each, and experts predict this trend will continue. The rise is attributed to factors like social media providing information for threat actors, employees having greater technical capabilities, and the increasing use of AI, which can be exploited. Additionally, malicious actors are increasingly recruiting insiders and coercing them into compromising data.

CanisterWorm Hijacks npm Publisher Accounts, Steals Tokens

gbhackers.com · 7 months ago

A new, highly automated supply chain attack called CanisterWorm is compromising npm publisher accounts and injecting malicious code into legitimate packages. The attackers, identified as TeamPCP, steal npm access tokens and use them to replace package contents with backdoors and self-propagation scripts. These scripts install a persistent backdoor on Linux systems and exfiltrate credentials via the Internet Computer Protocol. Affected packages include versions of @emilgroup/discount-sdk, @emilgroup/document-uploader, and others, with compromised versions including 1.5.1 and 0.0.10. Organizations are advised to rotate credentials, audit logs, and remove persistence mechanisms to mitigate the threat.

Crossbench MPs pressure Labor over gas export tax – as it happened

www.theguardian.com · 7 months ago

Politicians in Canberra are preparing for a busy week, facing pressure regarding global oil supply and fallout from recent elections. New regulations are being introduced for datacentres and artificial intelligence, requiring new developments to utilize clean energy and reduce water usage. A new report warns that governments are ill-prepared for the rising threat of drone-based terror attacks due to advancements in technology and accessibility. The report highlights past incidents and emphasizes the potential for civilian and military sites to be targeted.

CISA Issues Warning on Apple Vulnerabilities Exploited Through DarkSword iOS Chain

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about critical security vulnerabilities within the Apple ecosystem. Attackers are exploiting a sequence of flaws, known as the DarkSword iOS chain, to gain complete control of devices. This attack begins with malicious web content, progresses through memory corruption and buffer overflow exploits, and culminates in manipulation of shared memory. CISA has mandated federal agencies update their systems by April 3, 2026, and strongly recommends immediate updates for all Apple users. The vulnerabilities are tracked as CVE-2025-31277, CVE-2025-43520, and CVE-2025-43510.

Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems

thehackernews.com · 7 months ago

Cybersecurity experts have observed attackers exploiting a severe vulnerability, CVE-2025-32975, in Quest KACE Systems Management Appliance devices. This authentication bypass allows unauthorized access and potential complete control of administrative accounts. Attackers are using the vulnerability to execute commands, create new administrator accounts, and harvest credentials with tools like Mimikatz. Affected users should update their systems to patched versions including 13.0.385, 13.1.81, 13.2.183, 14.0.341 Patch 5, and 14.1.101 Patch 4.

Oracle Releases Emergency Patch for Critical Identity Manager Vulnerability

www.securityweek.com · 7 months ago

Oracle issued out-of-band updates to patch a critical vulnerability in Oracle Identity Manager and Oracle Web Services Manager that allows unauthenticated remote code execution. The flaw, tracked as CVE-2026-21992, has a CVSS score of 9.8 and affects the REST WebServices component of Identity Manager and the Web Services Security component of Web Services Manager, enabling an attacker with HTTP access to potentially take over affected installations. Oracle published an advisory urging immediate application of the patches, and while the vendor has not clearly confirmed exploitation, the vulnerability may have been exploited in the wild.

Langflow Got Hacked Twice Through the Same exec() Call - CVE-2026-33017 (CVSS 9.3) exploited in 20 hours with no public PoC

blog.barrack.ai · 7 months ago

Langflow, a tool for orchestrating AI workflows, has experienced two critical vulnerabilities, CVE-2025-3248 and CVE-2026-33017, enabling unauthenticated remote code execution. Attackers can exploit these flaws to steal sensitive information like API keys and AWS credentials. The underlying cause involves a design that permits arbitrary Python code execution, requiring a complete removal of this feature. Users are urged to update to version 1.9.0 or later, rotate credentials, and disable automatic login.

Two poems with opposite registers flipped answers across 4 LLMs on the same question. Filed with OWASP as a new attack class.

shapingrooms.com · 7 months ago

Research indicates that seemingly ordinary content, like poetry, can subtly influence how large language models make decisions without triggering any obvious flags or warnings. Experiments showed that different poems altered the models' responses to the same question, with models acknowledging the influence only when directly prompted. This phenomenon, termed "postural manipulation," highlights a broader risk where unexamined content within AI workflows shapes behavior, and human operators are often unaware of this influence. Mitigating this risk requires addressing the underlying systemic property, not just specific content artifacts.

No Zero-Day Needed: Russian Phishers Swipe Signal & WhatsApp Accounts with Plain Old Lies

factide.com · 7 months ago

Federal agencies, including the FBI and CISA, are warning of large-scale phishing campaigns targeting Signal and WhatsApp users. Russian-affiliated actors are posing as support personnel to steal account access through SMS codes or QR code scans. Compromised accounts have impacted thousands of users worldwide, with targets including government officials, military personnel, and journalists. Users are advised to never share verification codes and regularly review linked devices.

VoidStealer malware steals Chrome master key via debugger trick

www.bleepingcomputer.com · 7 months ago

A new information stealer called VoidStealer is bypassing Chrome’s Application-Bound Encryption to steal the master key used to decrypt sensitive browser data. The malware uses hardware breakpoints to extract the key directly from memory, a technique previously seen in open-source tools like ElevationKatz. VoidStealer is a Malware-as-a-Service platform advertised on dark web forums and introduced this bypass in version 2.0. Google implemented ABE in Chrome 127 to protect sensitive data, but multiple malware families have found ways to circumvent this protection.

CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran

www.aikido.dev · 7 months ago

A threat actor known as TeamPCP has developed a destructive payload called CanisterWorm targeting Iranian systems. The payload employs three methods: wiping Kubernetes clusters, deleting data on non-Kubernetes hosts using the rm -rf / command, and laterally moving through networks using exposed Docker APIs and SSH keys. CanisterWorm uses timezone and locale checks to identify Iranian systems and installs a backdoor disguised as a Postgres monitor. This new payload marks an escalation in TeamPCP’s tactics, indicating a willingness to engage in geopolitically targeted destructive attacks.

EmEditor Supply Chain Analysis: Why "Publisher Authorization" isn't the silver bullet we think it is

techcommunity.microsoft.com · 7 months ago

Researchers have discovered several vulnerabilities affecting multiple versions of the ActiCast video management system. These flaws allow for unauthorized access to system files, cross-site scripting, and the potential for remote code execution. The vulnerabilities, affecting versions 6.1.1 through 6.1.8, have been assigned CVE identifiers CVE-2024-2911, CVE-2024-2912, CVE-2024-2913, CVE-2024-2914, and CVE-2024-2915. Successful exploitation could allow attackers to compromise system functionality and sensitive data.