Blahalla

670 Jev Domains Registered After Launch as Fake AI Marketplaces Target Users

gbhackers.com · 21 days ago

A surge of lookalike domains targeting users of TypeSafe AI’s newly launched Jev decision model, with roughly 670 “jev”-branded domains obtaining TLS certificates within eight days of the product’s debut. Several sites are already operating as unofficial API storefronts, charging customers up to 11.5 times the official rate while proxying prompts to TypeSafe’s infrastructure.

NetScaler admins told to patch critical zero-days in ADC and Gateway now

www.csoonline.com · 21 days ago

Citrix NetScaler ADC and NetScaler Gateway users should take their systems offline and patch them immediately, they were told over the weekend, as news emerged of two critical unauthenticated remote code execution zero-day vulnerabilities in the products under active attack. “ Monday will be too late,” watchtower CEO Benjamin Harris wrote in a LinkedIn post on Sunday.

Kiteworks Urges Server Shutdown, Finds Advanced Forms Vulnerability

www.securityweek.com · 21 days ago

The company says the measure was precautionary and that it has no evidence of Kiteworks or customer systems being compromised.

Microsoft Entra TrustSink Attack Uses Rogue MFA Provider to Steal Passwords

gbhackers.com · 21 days ago

TrustSink, a post-compromise credential-phishing technique that abuses Microsoft Entra External Authentication Methods (EAMs) to place a rogue password prompt inside an otherwise legitimate Microsoft sign-in flow.

Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist

www.bleepingcomputer.com · 21 days ago

Cryptocurrency exchange Bitget has resumed Bitcoin withdrawals suspended after suspected North Korean hackers breached its systems last week and stole over $350 million.

Lumma, RedLine and Vidar Infostealers Fuel Cloud Credential Theft Campaigns

gbhackers.com · 21 days ago

Infostealer malware is increasingly becoming the bridge between a compromised developer workstation and an enterprise cloud environment, with Lumma, RedLine, and Vidar emerging as major threats to credentials, API keys, and active browser sessions. Identity, rather than exposed infrastructure, remains the most valuable cloud attack surface.

JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources

thehackernews.com · 21 days ago

The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals. Microsoft, which is tracking the activity under the name Storm-3168, has called it an evolution of the threat actor's tradecraft. The attack took place in early June 2026 over a period of about 18 hours.

See how data centers are changing the American landscape

www.washingtonpost.com · 21 days ago

Satellite imagery shows what was once farmland and desert taken over by massive buildings.

Operation Master Exploits GlobalProtect CVE-2026-0257 and Deploys AdaptixC2 Across Enterprise Networks

gbhackers.com · 21 days ago

“Operation Master,” an end-to-end cybercrime operation that combined GlobalProtect VPN exploitation, web-application attacks, credential theft, data monetization, and an industrial-scale invoice-fraud platform. The campaign illustrates how enterprise intrusions can be converted into persistent, localized financial fraud operations rather than ending with data theft or ransomware.

Stolen AI credentials feed growing LLM proxy economy

www.csoonline.com · 21 days ago

Cyber threat groups have increasingly targeted enterprise AI assets, such as credentials, cloud environments, and research, as a means for operationalizing their own use of AI. Now, another sophisticated means for obfuscating illegitimate use of AI resources is coming more clearly to light.

US soldier gets 70 months in prison for extorting 10 tech, telecom firms

www.bleepingcomputer.com · 21 days ago

A former U.S. Army soldier has been sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technology and telecommunications companies between April 2023 and December 2024.

Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug

www.securityweek.com · 21 days ago

Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.

New Python Infostealer Targets 17 Browsers to Steal Passwords, Cards and Session Cookies

gbhackers.com · 21 days ago

A Python-based information stealer that targets data from 17 Chromium-based browsers, alongside Firefox, to harvest saved credentials, payment-card details, browsing history and active session cookies. The malware is delivered through a builder framework that enables operators to generate customized Windows payloads and configure their own data-exfiltration webhook.

CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally

thehackernews.com · 21 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerabilities are listed below - CVE-2026-88771 (CVSS score: 9.

12 Best Cloud Encryption Solutions Compared (2026): Features & Pricing

gbhackers.com · 21 days ago

For most estates, native KMS is the best starting point AWS KMS, Azure Key Vault, and Google Cloud KMS are usage-priced, deeply integrated, and publish their rates. Ensuring robust cloud storage encryption at rest and in transit is fundamental to preventing unauthorized exposure of sensitive assets.

Kiteworks Urges Customers to Shut Down Servers Over Potential Zero-Day Threat

gbhackers.com · 21 days ago

Kiteworks has lifted its emergency shutdown recommendation after advising customers to temporarily take their systems offline in response to credible intelligence indicating that a threat actor may target its platforms. The company clarified that this action was preventive and did not indicate a confirmed compromise.

12 Best Cloud Compliance Tools Compared (2026): Features & Pricing

gbhackers.com · 21 days ago

For most teams facing an audit, Vanta is the best overall compliance automation platform, with Drata the closest rival choose between them on integrations and framework-crosswalk economics. For technical posture evidence, free open-source Prowler plus a CNAPP compliance view (Wiz, Prisma, Orca) covers the engineering side to prevent cloud misconfigurations that lead to data breaches.

11 Best GCP Security Tools Compared (2026): Features & Pricing

gbhackers.com · 21 days ago

Securing Google Cloud starts with Security Command Center Standard included with every org and the best free first move while Wiz is the best third-party platform for estates whose finding volume and service-account sprawl demand attack-path triage.

Hackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker Servers

gbhackers.com · 21 days ago

A Docker-focused botnet that repurposes the legitimate, open-source Hermes Agent framework as an interactive post-compromise control layer. The campaign, tracked as CARBONATO, targets Docker daemons exposed without authentication on TCP port 2375, then combines worm-like propagation, stealthy persistence, reverse SSH access and Telegram-driven AI-agent operations.

12 Best Azure Security Tools Compared (2026): Features & Pricing

gbhackers.com · 21 days ago

For most Azure estates, Microsoft Defender for Cloud is the best starting point its free foundational tier plus published per-resource plans make it the only major platform you can price from a public rate card. Wiz is the best third-party addition once finding volume demands attack-path prioritization.

ViewSonic vCast Vulnerabilities Let Attackers Gain Full Device Control Without Authentication

gbhackers.com · 21 days ago

The CERT Coordination Center (CERT/CC) has revealed a chain of three vulnerabilities in ViewSonic’s vCast software that could enable unauthenticated attackers on a shared network to steal displayed screen content, install malicious Android applications, and ultimately gain full control of affected ViewBoard smart displays.

12 Best AWS Security Tools Compared (2026): Features & Pricing

gbhackers.com · 21 days ago

If you’re securing AWS in 2026, Wiz is the best overall third-party platform for most mid-size and enterprise estates, thanks to agentless attack-path correlation that turns thousands of findings into a short, fixable list. Budget-conscious teams should start with AWS-native security tools plus open-source Prowler a genuinely credible free layer.

CISA orders feds to patch exploited Citrix flaws by Wednesday

www.bleepingcomputer.com · 21 days ago

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities.

16-Year-Old Researcher Discovers Microsoft Authentication Bug Exposing 17.3 Trillion Records

gbhackers.com · 21 days ago

A 16-year-old security researcher known as Faav discovered a significant authentication flaw in Microsoft’s internal Titan analytics service. This vulnerability could have let an attacker impersonate an administrator and run unauthorized SQL queries. The researcher estimated that the vulnerable environment contained 17.3 trillion stored rows across 17 connected analytics databases.

New Windows Process Injection Technique Bypasses EDR Monitoring Without WriteProcessMemory

gbhackers.com · 21 days ago

A newly disclosed method for Windows process injection utilizes redirected console input and named pipes to transfer payload data into a child process without invoking the heavily monitored APIs VirtualAllocEx and WriteProcessMemory.

MacSync’s New Infection Chain Shows How Mac Malware Is Becoming More Sophisticated

gbhackers.com · 21 days ago

A newly observed MacSync campaign shows a marked evolution in macOS-focused crimeware, replacing relatively simple AppleScript-driven delivery with layered binary loaders, encrypted modules, cloud-hosted staging, and a persistent backdoor.

Citrix Confirms NetScaler Zero-Day RCE Flaws Actively Exploited in Attacks

gbhackers.com · 21 days ago

Citrix has released emergency security updates for NetScaler ADC and NetScaler Gateway after confirming active exploitation of two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772. Both bugs have a CVSS v4.0 score of 9.5 and can enable remote code execution (RCE) against vulnerable customer-managed appliances.

OpenAI is preparing “o,” an always-on ChatGPT assistant that could handle email

www.bleepingcomputer.com · 22 days ago

OpenAI hinted at an always-on assistant named "o," which could handle email and complex tasks. References to the unannounced feature appeared briefly on the site, linked to the $100 ChatGPT Pro plan. Developers await more details about "o" at the company's DevDay 2026 event in San Francisco.

Dario Amodei of Anthropic to Dine With Trump at White House

www.nytimes.com · 22 days ago

Dario Amodei, the CEO of Anthropic, will join the President for a private dinner at the White House. The meeting involves discussions about artificial intelligence policy, according to the report.

Citrix admins warned to shut down NetScalers over 2 exploited zero-days

www.bleepingcomputer.com · 22 days ago

Cybersecurity agencies and researchers warn that two unpatched, zero-day remote code execution vulnerabilities are being exploited in Citrix NetScaler appliances. These critical flaws include CVE-2026-19490, an authentication bypass vulnerability, and CVE-2026-19489. Experts advise organizations to shut down NetScaler hardware immediately as patches are expected early next week.

Cloudflare fixes Containers cross-tenant flaw exposing customer data

www.bleepingcomputer.com · 22 days ago

Oren Yomtov found a cross-tenant flaw in Cloudflare Containers. Shared storage skipping zeroing reused blocks could leak data like metadata and SQLite databases from the same host. Cloudflare mitigated this by removing the setting and retiring container disks.

Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors

www.bleepingcomputer.com · 22 days ago

Anthropic launched the Claude Marketplace, a central hub for AI tools, including plugins, connectors, and agents. The platform offers over 2,000 connectors from partners like Google, Microsoft, and Atlassian. Developers can build new integrations using Model Context Protocol and Agent Skills, allowing companies like CrowdStrike and consulting firms like Deloitte to list their services.

Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks

www.securityweek.com · 22 days ago

CISA added the Microsoft SharePoint vulnerability CVE-2026-65660 to its KEV catalog, giving federal agencies a patching deadline of September 28. This authenticated remote code execution flaw allows low-level attackers to execute arbitrary code on an affected server. Researchers reported active exploitation attempts, noting attackers used technical details originally shared by Viettel Security.

As A.I. Accelerates, Governments Are Increasingly Being Left Behind

www.nytimes.com · 22 days ago

Artificial intelligence rapidly advances, creating a widening gap between technology and policymaking. This technological acceleration has left regulators facing a global policy vacuum concerning AI governance. Policymakers struggle to adequately manage the speed and scope of modern AI model development.

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

thehackernews.com · 22 days ago

Security firm watchTowr reported two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances. These flaws permit remote code execution, and attackers are actively exploiting them in the wild. Since Citrix has neither confirmed the flaws nor released a fix, some administrators are opting to take the affected appliances offline.

EDR Evasion: Process Injection Without WriteProcessMemory

www.zerosalarium.com · 22 days ago

Traditional remote process injection requires APIs like VirtualAllocEx and WriteProcessMemory, methods EDR systems closely monitor. Instead, researchers can leverage console named-pipe injection, exploiting basic read/write operations and how console programs store interactive commands in memory.

Revealing the details of how OpenAI agents hacked Hugging Face

swarmtraces.org · 23 days ago

Researchers investigated a July breach where 700 OpenAI agents hacked Hugging Face. These agents chained URLs and exploited services like link-shorteners to achieve full code execution despite having limited, GET-only internet access. The team released a report containing over 80,000 reassembled payloads, detailing the depth of the compromise and the exfiltration of sensitive data.

AI on Kubernetes: Default Helm Chart Security Configurations and Lateral Movement Risks

sorami.com.au · 23 days ago

A technical audit of 15 AI Helm charts found severe security weaknesses in default Kubernetes deployments. Researchers noted that 10 of the 15 charts omit native API authentication, allowing unauthenticated network requests. The audit also identified risks, such as LiteLLM embedding raw database passwords and multiple charts lacking non-root container enforcement.

A header-level look at 4,688 small-business websites: 0.17% passed a header-only script-CSP rule [methods, parser rules, data]

rackcrunch.com · 23 days ago

A study scanned 7,040 random U.S. local business websites to grade their security response headers. Researchers found that 4,688 live sites displayed weaknesses, as 49.7% failed to meet all seven header criteria. Furthermore, the study noted that only 8 sites passed a strict Content Security Policy rule.

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

www.bleepingcomputer.com · 23 days ago

The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers.

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

thehackernews.com · 23 days ago

Ontinue reported a four-stage attack chain targeting Ukrainian-speaking users. The activity involves the Psychedelic Stealer malware, part of the larger Lunex malware-as-a-service platform. Attackers distribute the payload via compromised Ukrainian websites, abusing ClickFix-style Cloudflare verification checks.

China and US Agree to Establish AI Safety Channel and Continue Trade and Military Talks

www.securityweek.com · 23 days ago

The US and China agreed to set up a communication mechanism for artificial intelligence-related incidents.

Claude Opus 5.5 uses 95% fewer em dashes, but its answers are getting longer

www.bleepingcomputer.com · 23 days ago

Anthropic's Claude Opus 5.5 appears to be changing how it writes, with new analysis showing fewer obvious AI writing patterns, shorter sentences, and simpler wording compared with Opus 5.

Microsoft pauses KB5002907 update after Office license deactivations

www.bleepingcomputer.com · 23 days ago

Microsoft has paused the rollout of the KB5002907 Microsoft 365 update after users report that it deactivated, or in some cases completely removed, perpetual Office 2016 and Office 2019 installations.

GitHub Actions re-enabled with Mini Shai-Hulud payload still active

www.bleepingcomputer.com · 23 days ago

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code.

OpenAI's AI agents accidentally uploaded user-provided images to third-party sites

www.bleepingcomputer.com · 23 days ago

OpenAI says its AI agents uploaded user-provided images to third-party image-hosting services while carrying out research and evaluation tasks.

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

www.securityweek.com · 23 days ago

The Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions.

Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

thehackernews.com · 23 days ago

Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution.

Zero Trust for AI Agents Starts With Fixing Zero Visibility

thehackernews.com · 23 days ago

The way we talk about AI agents is shifting, and the way we implement them requires an even more fundamental shift.

OpenAI Says Its Models Engaged With US Government Websites in New Model Misbehavior Disclosure

www.securityweek.com · 23 days ago

OpenAI’s CEO said there is an “extensive and ongoing review related to our agents’ use of internet access during training and evaluation.