Blahalla

5 key priorities for your RSAC 2026 agenda

www.csoonline.com · 7 months ago

RSA Conference 2026 arrives at a significant inflection point for cybersecurity as AI dominates the event, accounting for roughly forty percent of sessions and embedding across tracks including Identity, Cloud Security, CISO Insights, the Human Element, and Threat Intelligence. CISOs face a defining tension between the need to adopt AI quickly to stay competitive and the simultaneous need to defend their organizations against AI driven threats such as prompt injection, training data poisoning, and model inversion. Five priorities for security leaders at RSA Conference 2026 are securing the AI stack, establishing AI governance and policy, managing non human identities, addressing shadow AI and AI generated code risks, and preparing security operations centers for autonomous remediation. Security leaders who leave with clearer governance frameworks and realistic assessments of AI stack exposure will be measurably better positioned than those who attend without focusing on these priorities.

OpenWebUI Servers Targeted in Attacks Using AI Payloads to Steal Data

gbhackers.com · 7 months ago

A recent campaign has targeted improperly secured Open WebUI systems that lack authentication, allowing attackers to upload malicious AI generated Python tools via the Open WebUI Tools plugin system. The payload was heavily obfuscated with a technique researchers call pyklump and 64 recursive layers of Base64, used Discord webhooks for command and control, and downloaded cryptominers T Rex and XMRig on Linux. On Linux the attack hid mining with LDPRELOAD injected shared objects named processhider and argvhider and persisted with a disguised systemd service called ptorchupdater, while Windows victims received a loader named application ref dot jar that dropped infostealers and targeted Chrome extension and Discord credentials. The campaign relied on internet exposed misconfigurations rather than software vulnerabilities and underscores the need to properly authenticate Open WebUI instances and deploy runtime security detections to spot memory manipulation and stealthy cryptomining.

Hacking a Robot Vacuum

www.schneier.com · 7 months ago

A researcher attempting to remotely control a DJI Romo robot vacuum inadvertently gained control of roughly seven thousand devices around the world. The incident highlights systemic insecurity in Internet of Things devices, including weak authentication and remote control mechanisms that allow a single experiment to affect thousands of units.

CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability

www.securityweek.com · 7 months ago

CISA warns that attacks are exploiting a recently patched Microsoft SharePoint remote code execution vulnerability tracked as CVE-2026-20963. The flaw was disclosed on January 13, 2026 as part of Microsoft’s January Patch Tuesday, affects SharePoint Server 2016, 2019, and Subscription Edition, and carries a CVSS score of 9.8. CISA added CVE-2026-20963 to its Known Exploited Vulnerabilities catalog on March 18, 2026 with a federal mitigation deadline of March 21, 2026, while public details about the attacks remain scarce and Microsoft updated its advisory on March 17, 2026.

Horabot Returns in Mexico, Spreading via Phishing and Email Worm Attacks

gbhackers.com · 7 months ago

Horabot has resurfaced in Mexico using a complex multi stage kill chain that begins with fake CAPTCHA pages that trick victims into running an mshta command to fetch remote HTA content and then executes chained JavaScript and VBScript served with server side polymorphism to evade detection. Subsequent stages deploy AutoIt loaders that decrypt an AES‑192 blob and map a Delphi banking trojan from the Casbaneiro family into memory, establish HTTPS command and control via embedded OpenSSL libraries, harvest credentials, and use distinctive XOR based socket framing that can be spotted by IDS rules. A PowerShell email worm spreader abuses Outlook MAPI to harvest contacts and send Spanish invoice lures that reinfect recipients, investigators observed over five thousand compromised hosts with about ninety three percent located in Mexico and linguistic artefacts pointing to Brazilian operators.

Kanboard Authenticated SQL Injection CVE-2026-33058 Writeup

0dave.ch · 7 months ago

NULL

DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover

thehackernews.com · 7 months ago

A full-chain iOS exploit kit called DarkSword has been used by multiple threat actors since at least November 2025 to steal sensitive data from iPhones running iOS versions roughly 18.4 through 18.7, with campaigns observed against users in Saudi Arabia, Turkey, Malaysia, and Ukraine via watering hole pages that load a malicious iFrame and JavaScript fingerprinting. DarkSword chains six vulnerabilities to deliver three payloads, including a dataminer named GHOSTBLADE that injects into mediaplaybackd to escalate privileges and exfiltrate emails, iCloud Drive files, contacts, messages, browsing data, cryptocurrency wallet and exchange data, photos, and other device information before cleaning staged files and exiting. The exploited flaws include CVE-2026-20700, CVE-2025-43529, CVE-2025-14174, CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520, several of which were zero-day vulnerabilities patched by Apple in subsequent updates.

Sorry, Mom. You’re Chatting With an A.I. Agent, Not Your Son.

www.nytimes.com · 7 months ago

Young Silicon Valley coders are building autonomous AI agents that run locally and automate everyday tasks, and many report a mix of excitement and anxiety about constantly needing to tend and scale these agents. Instances include agents performing unexpected real world actions such as deleting email or creating profiles on agent only platforms, prompting worries about unintended consequences and token anxiety among developers. Security researchers and companies warn of prompt injection, exposed tokens, and credential leakage risks, and independent analyses propose guardrail and proof of guardrail approaches while vendors pitch enterprise controls. The surge of agent experimentation is reshaping startup priorities and investor thinking, with companies and platforms racing to monetize or secure agent workflows even as users debate whether the productivity gains justify the risks.

Your MFA isn’t broken — it’s being bypassed, and your employees can’t tell the difference

www.csoonline.com · 7 months ago

Security teams are being warned that adversary-in-the-middle phishing captures entire real-time authentication flows, including session cookies, allowing attackers to open authenticated sessions without needing passwords or additional MFA prompts. Three systemic failures make this possible: awareness training that teaches users to spot fake pages instead of proxy attacks, overreliance on bearer session cookies that are not device bound, and incident response playbooks that focus on credential resets rather than revoking active sessions and detecting session replay. Recommended defenses include deploying phishing-resistant authentication such as FIDO2 security keys and passkeys, binding sessions to managed devices through conditional access, monitoring post-authentication anomalies like impossible travel and rapid MFA device registration, and retraining users to navigate to login pages directly rather than clicking links.

Cisco Firewall Vulnerability Exploited as Zero-Day in Interlock Ransomware Attacks

www.securityweek.com · 7 months ago

A vulnerability in Cisco Secure Firewall Management Center software tracked as CVE-2026-20131 has been exploited as a zero day since at least January 26 and can allow a remote unauthenticated attacker to execute arbitrary Java code with root privileges. Patches for the flaw were released on March 4 and Cisco advised that not exposing the FMC management interface to the internet reduces the attack surface, later updating its advisory to confirm in the wild exploitation. Amazon threat intelligence links the exploitation to the Interlock ransomware group and found evidence the actor most likely operates in the UTC plus three time zone with activity patterns suggesting likely ties to Russia. Amazon shared indicators of compromise to help defenders and reported Interlock targets sectors where operational disruption creates maximum pressure for payment, with education representing the largest share followed by engineering, architecture and construction, manufacturing and industrial organizations, healthcare providers, and government and public sector entities.

CVE-2026-22730: SQL Injection in Spring AI’s MariaDB Vector Store

blog.securelayer7.net · 7 months ago

CVE-2026-22730 is a SQL injection in Spring AI's MariaDB vector store caused by the filter expression converter failing to escape string values, allowing user-controlled input to be embedded directly into SQL. The flaw affects Spring AI 1.0.x versions prior to 1.0.4 and 1.1.x versions prior to 1.1.3 and enables injection in similarity search and filter-based delete paths that can bypass metadata access controls and delete the entire vector store, requiring only low privileges and crafted HTTP requests. The issue was fixed in commit 4602c23 on March 6, 2026 and in Spring AI releases 1.0.4 and 1.1.3 or later, and users are advised to upgrade or validate and allowlist filter values until patched.

CISA Adds Exploited Zimbra Collaboration Suite Flaw to Warning List

gbhackers.com · 7 months ago

There is a critical stored cross site scripting vulnerability in the Zimbra Collaboration Suite Classic user interface tracked as CVE-2025-66376, which CISA added to its Known Exploited Vulnerabilities catalog and which requires federal agencies and other organizations to apply updates by April 1, 2026. The flaw lets attackers embed CSS import directives in HTML email to bypass input filters so that opening a specially crafted message executes malicious scripts in the victim session, enabling access to sensitive emails, session hijacking, and potential wider compromise. Vendor Synacor has released patches that upgrade the AntiSamy HTML filtration component to version 1.7.8 and remove vulnerable legacy code, and administrators are urged to install patched versions 10.1.13 or 10.0.18 or discontinue use if they cannot update, with Synacor rating deployment risk as medium.

Open VSX Extension Delivers RAT and Stealer via GitHub Downloader

gbhackers.com · 7 months ago

An Open VSX extension named KhangNghiem/fast-draft, used by over 26,000 developers as of March 17, 2026, silently executed a GitHub-hosted downloader that fetched a second-stage payload from a BlokTrooper repository and deployed a compact attack framework. Confirmed malicious releases include versions 0.10.89, 0.10.105, 0.10.106, and 0.10.112, and the payload spawns detached Node processes that run four modules providing a Socket.IO remote access trojan, a browser and crypto wallet stealer, file exfiltration, and clipboard surveillance that exfiltrate data to infrastructure at 195.201.104.53 on ports 6931, 6936, and 6939. Researchers observed alternating clean and backdoored builds and say the version pattern and unanswered disclosure filed on March 12, 2026 point to a compromised publisher account or stolen release token rather than a maintainer deliberately shipping consistent malware.

Iran-Linked Botnet Exposed After Open Directory Leak Reveals 15-Node Relay Network

gbhackers.com · 7 months ago

There is a misconfigured open directory on an Iranian server that exposed a live censorship bypass relay and an SSH based botnet, revealing a 15 node relay network spanning Iran and Finland assembled with commodity tools and sloppy operational security. The discovery shows how financially or personally motivated actors can reuse tradecraft seen in Iranian advanced persistent threat operations.

EU Sanctions Companies in China, Iran for Cyberattacks

www.darkreading.com · 7 months ago

NULL

Anthropic ban heralds new era of supply chain risk — with no clear playbook

www.csoonline.com · 7 months ago

The Trump administration has designated Anthropic as a supply chain risk and banned its technology from Pentagon assets and other government systems, creating pressure on CISOs to identify, isolate, and potentially remove the model from their environments despite limited visibility into where it is used. A March 6 Pentagon memo requires military components to remove Anthropic products within 180 days and obligates contractors to notify vendors and certify compliance, effectively extending the requirement across the defense industrial base. Enterprises lack comprehensive inventories and AI governance, experts debate whether existing software bills of materials suffice, and removing or replacing embedded models may require code changes, revalidation, and coordination with vendors to avoid disrupting critical systems.

Aura Confirms Data Breach Exposing 900,000 Customer Records

gbhackers.com · 7 months ago

Digital security provider Aura confirmed a data breach affecting approximately 900,000 customer records following a targeted social engineering attack. The incident highlights the ongoing threat of sophisticated phishing campaigns that can bypass technical defenses by exploiting human elements, and Aura immediately initiated its incident response protocol upon detecting unauthorized network activity.

WaterPlum Unleashes “StoatWaffle” Malware in VSCode Supply Chain Attack

gbhackers.com · 7 months ago

A threat group linked to North Korea called WaterPlum, and its Team 8 subgroup, has introduced a new malware strain called StoatWaffle that focuses on developer ecosystems and supply chain attacks. The campaign uses malicious repositories that include a hidden.vscode directory with a crafted tasks.json set to runOn folderOpen, causing VSCode to execute a predefined task when a repository is opened and trusted, and the loader can download or install Node.js and retrieve env.npl and package.json to begin the infection chain. StoatWaffle is modular, deploying a stealer and a remote access trojan that exfiltrates browser credentials, extension data, macOS Keychain items, and system profiling details to command and control endpoints, and it contains awareness for Windows Subsystem for Linux to access Windows user data from WSL.

ScreenConnect Flaw Lets Hackers Steal Machine Keys and Hijack Sessions

gbhackers.com · 7 months ago

There is a critical vulnerability in ConnectWise ScreenConnect remote desktop software that allows attackers to extract server level cryptographic material and hijack active user sessions. The flaw is tracked as CVE-2026-3564 and categorized as CWE-347, carries a CVSS v3.1 base score of 9.0, and affects all ScreenConnect deployments before version 26.1. ConnectWise released ScreenConnect version 26.1 to replace local machine key storage with encrypted storage and active key management, cloud instances have been patched by the vendor and on premise administrators must install the 26.1 update and renew expired maintenance if necessary.

CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks

thehackernews.com · 7 months ago

CISA urged government agencies to apply patches for two actively exploited vulnerabilities affecting Synacor Zimbra Collaboration Suite and Microsoft Office SharePoint. The flaws are CVE-2025-66376, a stored cross site scripting issue in the Zimbra Classic user interface exploitable via CSS import directives and fixed in Zimbra versions 10.0.18 and 10.1.13 in November 2025, and CVE-2026-20963, a deserialization of untrusted data vulnerability in SharePoint that can lead to remote code execution and was patched in January 2026. CISA set patch deadlines of April 1, 2026 for CVE-2025-66376 and March 23, 2026 for CVE-2026-20963, and the advisory also noted that Amazon reported Interlock ransomware actors exploited a Cisco firewall zero day tracked as CVE-2026-20131 beginning January 26, 2026.

SnappyClient Implant Blends Remote Access, Data Theft, and Stealth Evasion

gbhackers.com · 7 months ago

A new modular command-and-control implant called SnappyClient has emerged, blending remote access, credential theft, and stealth techniques. It’s delivered through malware like HijackLoader and GhostPulse, targeting Windows systems and cryptocurrency users. SnappyClient evades detection by disabling AMSI scanning and employing process injection techniques, while also utilizing encrypted configurations and a custom TCP protocol. Researchers observed the implant’s operators are financially motivated, focusing on cryptocurrency theft through screenshots and targeted data exfiltration.

New iOS Exploit Uses Advanced iPhone Hacking Tools to Steal Personal Data

gbhackers.com · 7 months ago

Google’s Threat Intelligence Group has identified a sophisticated iOS exploit called DarkSword, active since November 2023, that compromises devices running iOS 18.4 through 18.7. The exploit chain relies entirely on JavaScript and has been used by multiple threat actors, including state-sponsored groups, to target individuals in Saudi Arabia, Turkey, Malaysia, and Ukraine. The exploit leverages six vulnerabilities, including CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520, to deploy malware such as GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE for data theft. Apple has patched these vulnerabilities in iOS 26.3, and users are strongly encouraged to update their devices immediately.

From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow

osec.io · 7 months ago

Researchers have found a guest-to-host escape vulnerability in QEMU stemming from a heap overflow in the virtio-snd device. The vulnerability combines issues like under-allocated buffers and a lack of bounds checking, allowing attackers to trigger out-of-bounds writes and corrupt memory. The exploit uses VFS extended attributes for heap shaping and leverages glibc’s allocator to gain control and ultimately achieve arbitrary code execution on the host machine. This zero-day vulnerability affects QEMU commit ece408818d27f745ef1b05fb3cc99a1e7a5bf580 and glibc 2.43.

Cisco Firewall Zero-Day Actively Exploited to Deliver Interlock Ransomware

gbhackers.com · 7 months ago

Security researchers have discovered a zero-day vulnerability in Cisco Secure Firewall Management Centre software being actively exploited by the Interlock ransomware group. The flaw, tracked as CVE-2026-20131, allows unauthenticated attackers to execute arbitrary code and gain root privileges. Attackers have been leveraging this vulnerability since January 26, 2026, to compromise enterprise environments and deploy ransomware, along with custom remote access trojans and a memory-resident webshell. Affected organizations are urged to immediately apply security patches and thoroughly review their networks for suspicious activity.

Silicon Valley Bet on War. The Bets Are Paying Off.

www.nytimes.com · 7 months ago

false

[Tool] I built a CVE visualization tool for fun (VulnPath) -- would love and appreciate any feedback from this community!

vulnpath.vercel.app · 7 months ago

The website VulnPath is currently under development. It aims to provide a visualizer for Common Vulnerabilities and Exposures, or CVEs. A feature for looking up CVE information will be available soon. Users can provide their email address to receive updates about the website's launch.

GlassWorm: Part 5 -- xorshift obfuscation, Chrome HMAC bypass, and cryptowallet seed phrase theft

codeberg.org · 7 months ago

false

Ubtuntu 24.04+ Snapd Local Privilege Escalation (CVE-2026-3888)

blog.qualys.com · 7 months ago

A critical Local Privilege Escalation vulnerability, CVE-2026-3888, has been identified in Ubuntu Desktop versions 24.04 and later. The flaw allows an attacker to gain root access by exploiting an interaction between snap-confine and systemd-tmpfiles, requiring a 10-30 day window. Additionally, a race condition was found in the uutils coreutils package within Ubuntu 25.10, but was mitigated before release through collaboration with the Ubuntu Security Team. Organizations should update snapd to patched releases to address the vulnerability.

Smashing Security podcast #459: This clever scam nearly hijacked a tech CEO’s Apple ID

grahamcluley.com · 7 months ago

A sophisticated scam almost compromised the Apple ID of WordPress co-founder Matt Mullenweg, utilizing MFA fatigue, convincing support calls, and a deceptive phishing page. Concerns are also rising regarding the anonymity of data held by the UK Biobank, where de-identified health records may be vulnerable. Additionally, a Chief Information Security Officer was sentenced to eight hours at an RSA expo floor as punishment for a security breach. A DOGE employee stole Social Security data, while a foreign hacker compromised files held by the FBI.

CVE-2026-32746 GNU telnetd Buffer Overflow PoC - Critical (9.8)

pwn.guide · 7 months ago

A critical pre-authentication buffer overflow vulnerability, CVE-2026-32746, affects GNU InetUtils telnetd versions up to 2.7 and derived implementations using the BSD SLC codebase. The vulnerability lies in the LINEMODE handler, where an attacker can send crafted SLC suboptions to overflow a 108-byte buffer, corrupting memory and potentially enabling arbitrary code execution. Exploitation requires sending numerous crafted triplets during option negotiation, without authentication. Mitigation involves disabling telnet service or restricting access and awaiting a patch.

Navigating Security Tradeoffs of AI Agents

unit42.paloaltonetworks.com · 7 months ago

The rise of AI agents, like Clawdbot, presents new security challenges alongside increased productivity. Attackers may target open-source AI ecosystems or exploit an organization’s internal AI agents, potentially compromising models, connectors, and dependencies. Security measures include scanning model files, using trusted remote servers for Model Context Protocols, and implementing strict access controls to limit agent privileges and prevent data breaches. Organizations should prioritize simple, regularly reviewed security policies and treat agents as potentially rogue employees to mitigate risk and protect against unintentional harm.

Aura confirms data breach exposing 900,000 marketing contacts

www.bleepingcomputer.com · 7 months ago

Identity protection company Aura has confirmed a data breach impacting nearly 900,000 customer records. The incident stemmed from a voice phishing attack on an employee, exposing names, email addresses, home addresses, and phone numbers. Threat group ShinyHunters claimed responsibility and leaked the stolen data after negotiations failed, though Aura states that Social Security Numbers, account passwords, and financial information were not compromised. Aura is conducting an internal review and notifying affected individuals.

C2 Implant 'SnappyClient' Targets Crypto Wallets

www.darkreading.com · 7 months ago

Researchers have identified a new command-and-control (C2) implant called SnappyClient, which is used to steal cryptocurrency and maintain persistent access to compromised systems. The malware employs techniques to evade detection, including bypassing Microsoft’s Antimalware Scan Interface and using ChaCha20-Poly1305 encryption for C2 communications. Attackers use a modular malware loader, HijackLoader, to deliver SnappyClient, and have previously distributed malware like RedLine Stealer and Danabot using it. SnappyClient can steal data from multiple browsers and establish remote shell access, indicating it is intended for long-term operations.

DarkSword: iPhone Exploit Kit Serves Spies & Thieves Alike

www.darkreading.com · 7 months ago

A new exploit chain called DarkSword is actively targeting iPhones running iOS versions 18.4 through 18.7, compromising devices to steal data and potentially gain financial gain. The chain utilizes vulnerabilities including CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 to achieve remote code execution and data exfiltration. Attackers have targeted users in Saudi Arabia, Turkey, Malaysia, and Ukraine, and the toolkit’s accessibility suggests a growing secondary market for iOS exploits. Experts recommend continuous security validation and prompt software updates to mitigate the risk.

Roundcube Webmail: three more sanitizer bypasses enable email tracking and phishing

nullcathedral.com · 7 months ago

There are three HTML sanitizer bypasses in Roundcube Webmail that allow SMIL animation values and by attributes to load remote resources, unquoted body background values to inject CSS via the url function, and position fixed important to create full viewport phishing overlays. These vulnerabilities affect versions prior to 1.5.14, 1.6.14, and 1.7-rc5 and were disclosed on March 18, 2026, with a CVE pending, and prior exploitation of CVE-2024-37383 is noted. The SMIL and background bypasses defeat block remote images to enable open tracking, IP logging, browser fingerprinting, and timed beacons, while the position fixed important bypass enables phishing overlays that can impersonate Roundcube login prompts. All three issues were fixed in Roundcube 1.5.14, 1.6.14, and 1.7-rc5 by adding element and attribute validation, rejecting improperly formed data image URIs that are not valid base64, and changing the position check to detect fixed as a substring.

CISA orders feds to patch Zimbra XSS flaw exploited in attacks

www.bleepingcomputer.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has directed U.S. government agencies to address a security vulnerability in the Zimbra Collaboration Suite. This high-severity cross-site scripting flaw, identified as CVE-2025-66376, allows attackers to potentially hijack user sessions and steal data. Zimbra servers have been frequently targeted by attackers, including the Russian state-backed Winter Vivern group, who have exploited past vulnerabilities to compromise numerous servers. CISA urges all organizations to patch the flaw promptly, referencing Binding Operational Directive 22-01.

The Collapse of Predictive Security in the Age of Machine-Speed Attacks

www.securityweek.com · 7 months ago

The timeframe for predicting and preventing cyberattacks has significantly diminished due to the industrialization of cybercrime and the efficiency of Internet access brokers. Attackers are now rapidly exploiting vulnerabilities, often within days of disclosure, leading to a shift from predictive to preemptive security strategies. This preemptive approach emphasizes reducing attacker opportunities, prioritizing risk based on business impact, and reinforcing basic security hygiene like multi-factor authentication and credential rotation. Ransomware attacks are increasing, with a 46.4% rise in leak posts between 2024 and 2025.

Silicon Valley Musters Behind-the-Scenes Support for Anthropic

www.nytimes.com · 7 months ago

false

ConnectWise patches new flaw allowing ScreenConnect hijacking

www.bleepingcomputer.com · 7 months ago

ConnectWise is warning ScreenConnect users about a critical vulnerability, tracked as CVE-2026-3564, that allows attackers to potentially gain unauthorized access. The flaw involves the cryptographic signature verification process and affects versions prior to 26.1. While there is no evidence of widespread exploitation, researchers have observed attempts to abuse machine keys, and previous attacks have leveraged similar vulnerabilities like CVE-2025-3935. ConnectWise recommends upgrading to version 26.1 and implementing additional security measures to protect sensitive data.

Autonomous Offensive Security Firm XBOW Raises $120M at $1B+ Valuation

www.securityweek.com · 7 months ago

XBOW, an autonomous offensive security firm, has secured 120 million dollars in Series C funding, achieving a valuation exceeding 1 billion dollars. The company’s AI-powered platform continuously identifies and validates software vulnerabilities, operating at machine speed to mirror modern development cycles and potential AI-driven attacks. This investment will support expansion, product innovation, and international growth, allowing XBOW to provide security teams with reproducible proof of vulnerabilities and reduce false positives. Founded by the creator of GitHub Copilot, XBOW aims to accelerate the capabilities of security experts through automation.

OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs

thehackernews.com · 7 months ago

false

Ransomware gang exploits Cisco flaw in zero-day attacks since January

www.bleepingcomputer.com · 7 months ago

The Interlock ransomware gang has been exploiting a zero-day vulnerability in Cisco’s Secure Firewall Management Center software since late January. This vulnerability, identified as CVE-2026-20131, allows unauthenticated attackers to remotely execute code as root. Cisco patched the flaw on March 4, 2026, after Amazon’s threat intelligence team discovered the exploitation. Interlock, which surfaced in September 2024, has claimed responsibility for attacks on several organizations, and recently deployed a new malware strain called Slopoly.

Apple Rolls Out Real-Time Security Fixes Across iPhone, iPad, and Mac

www.techrepublic.com · 7 months ago

Apple has introduced Background Security Improvements, a new system designed to address vulnerabilities in real time. This system targets specific software components like Safari and its WebKit engine, which powers most iPhone browsers. A cross-origin issue in the Navigation API has been resolved, impacting CVE-2026-20643. Users can ensure automatic installation of these fixes through device settings.

Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access

thehackernews.com · 7 months ago

The Interlock ransomware group is actively exploiting a critical zero-day vulnerability in Cisco Secure Firewall Management Center Software, identified as CVE-2026-20131. This vulnerability allows unauthenticated attackers to gain root access and execute code. Amazon Threat Intelligence discovered the exploitation thanks to a threat actor's operational security mistake, revealing their attack chain, which includes custom trojans, reconnaissance scripts, and tools for obscuring origins. Security experts advise immediate patching, security assessments, and implementing defense-in-depth strategies.

Observability for AI Systems: Strengthening visibility for proactive risk detection

www.microsoft.com · 7 months ago

false

Cloud Security Startup Native Exits Stealth With $42 Million in Funding

www.securityweek.com · 7 months ago

false

CVE PoC Search

watchstack.io · 7 months ago

A search engine has identified over thirty thousand vulnerabilities with proof of concept exploits. Several vulnerabilities allow for remote code execution, including CVE-2026-25769 in Wazuh cluster deserialization, CVE-2026-3086 in a GStreamer codec parser, and CVE-2025-66398 in a Signal K Server. Other identified issues include denial of service, information disclosure, and authorization bypass vulnerabilities, affecting products like Linksys routers, Tenda access points, and Firefox. Exploits generally require authentication, although some are pre-authentication.

Marquis: Ransomware gang stole data of 672K people in cyberattack

www.bleepingcomputer.com · 7 months ago

A Texas-based financial services provider, Marquis, experienced a ransomware attack in August 2025 that impacted over 670,000 individuals. The attack began after threat actors compromised a SonicWall firewall, leading to the theft of sensitive personal and financial data. Marquis is currently facing multiple class action lawsuits and has filed a lawsuit against SonicWall alleging gross negligence. The SonicWall breach, disclosed in September 2025, potentially affected customers with cloud backup services, and has been linked to a state-sponsored hacking group.

‘DarkSword’ iOS Exploit Kit Used by State-Sponsored Hackers, Spyware Vendors

www.securityweek.com · 7 months ago

Security researchers have identified DarkSword, a sophisticated iOS exploit kit used by a Russian state-sponsored hacking group, UNC6353, and commercial spyware vendors. This kit targets six vulnerabilities to achieve full device compromise with minimal user interaction, often through watering hole attacks. The exploit chain leverages vulnerabilities including CVE-2025-31277, CVE-2025-43529, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, and CVE-2026-20700. Hundreds of millions of iPhones are potentially vulnerable, and users are advised to update to the latest iOS versions.

Google Sits Pretty as A.I. Rivals Compete for Pentagon Favor

www.nytimes.com · 7 months ago

false