Blahalla

CISA Alerts on Actively Exploited Gladinet CentreStack and Triofox Flaws

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a new alert regarding a critical security vulnerability affecting Gladinet CentreStack and Triofox. The agency has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, indicating that hackers are actively exploiting it in attacks. The vulnerability, identified as CVE-2025-14611, involves a serious issue with how these

Blind Eagle Hackers Exploit Trust to Bypass Email Security Controls

gbhackers.com · 7 months ago

BlindEagle threat actors are exploiting compromised internal email accounts to launch spear-phishing campaigns that bypass traditional email security controls, targeting Colombian government agencies with sophisticated multi-stage malware attacks, according to Zscaler ThreatLabz research. The cybersecurity firm discovered the campaign in early September 2025, revealing that the South American threat group targeted a government agency under

Chrome Security Update Fixes Remote Code Execution Flaws

gbhackers.com · 7 months ago

Google has released an emergency security update for the Chrome browser, addressing two high-severity vulnerabilities that could enable remote code execution attacks. The stable channel update version 143.0.7499.146/.147 is now rolling out to Windows, Mac, and Linux users. Critical Vulnerabilities Patched The update fixes two significant security flaws reported by external security researchers. The first

NVIDIA Isaac Lab Flaw Enables Remote Code Execution

gbhackers.com · 7 months ago

NVIDIA has disclosed a critical security vulnerability in Isaac Lab, a component of the NVIDIA Isaac Sim framework, that could allow attackers to execute arbitrary code remotely. The company released security patches in December 2025 to address the deserialization flaw tracked as CVE-2025-32210. CVE ID Description CVSS Score Severity CWE CVE-2025-32210 Deserialization vulnerability in NVIDIA Isaac

User-Experience-Irrwege: 5 Fehler, die Ihre Sicherheit gefährden

www.csoonline.com · 7 months ago

false

FortiGate firewall credentials being stolen after vulnerabilities discovered

www.csoonline.com · 7 months ago

Threat actors are actively exploiting recently discovered authentication bypass vulnerabilities in Fortinet FortiOS, impacting FortiWeb, FortiProxy, and FortiSwitchManager devices. Arctic Wolf Labs has observed numerous intrusion attempts since December 12, 2025, targeting devices with the FortiCloud SSO feature enabled. The US Cybersecurity and Infrastructure Security Agency has added CVE-2025-59718 to its Known Exploited Vulnerabilities catalog. Experts warn that stolen configuration files could expose network architecture and allow for targeted cyberattacks, and advise organizations to immediately apply Fortinet’s patches and practice credential rotation.

TruffleHog now detects JWTs with public-key signatures and verifies them for liveness

trufflesecurity.com · 7 months ago

TruffleHog has released an updated tool that detects exposed JSON Web Tokens, or JWTs, which are used for authentication. The tool verifies these tokens by checking their claims and cryptographic signatures using public-key cryptography. Due to the stateless nature of JWTs, remediation can be difficult and often requires key rotation or application changes. This new detector has quickly identified numerous live JWTs for customers, emphasizing the importance of secure practices.

U.S. Threatens Penalties Against European Tech Firms Amid Regulatory Fight

www.nytimes.com · 7 months ago

The United States is threatening penalties against European technology firms in response to what officials describe as discriminatory practices. The U.S. Trade Representative’s office alleges the European Union has engaged in lawsuits, taxes, fines, and directives targeting American companies. Potential targets for U.S. action include Accenture, DHL, Mistral, SAP, Siemens, and Spotify. The U.S. says it will take action if the European Union does not alter its regulatory approach.

Stay Secure: Why Cyber Hygiene Should Be Part of Your Personal Hygiene

unit42.paloaltonetworks.com · 7 months ago

false

Russian APT group pivots to network edge device misconfigurations

www.csoonline.com · 7 months ago

A Russian state-sponsored cyberespionage group is targeting energy companies and critical infrastructure providers in North America and Europe. The group is exploiting misconfigurations in network edge devices, and has also leveraged vulnerabilities like CVE-2022-26318, CVE-2021-26084, CVE-2023-22518, and CVE-2023-2753. The group’s infrastructure overlaps with Sandworm and Curly COMrades, and they are harvesting credentials by intercepting network traffic. Organizations are advised to audit device configurations, implement multi-factor authentication, and monitor authentication logs.

Cellik Android malware builds malicious versions from Google Play apps

www.bleepingcomputer.com · 7 months ago

A new Android malware-as-a-service, Cellik, has emerged and is being sold on underground forums for around $150 per month. This malware allows attackers to embed malicious code into apps downloaded from the Google Play Store, making detection more difficult. Cellik can capture screens, intercept notifications, steal data, and inject malicious code, including fake login screens. Security experts recommend avoiding sideloading apps from untrusted sources and keeping Google Play Protect active.

Why a 17-Year-Old Built an AI Model to Expose Deepfake Maps

www.darkreading.com · 7 months ago

A high-school student is tackling the overlooked risk of AI-generated satellite imagery that could mislead governments and emergency responders.

Why You Should Train Your SOC Like a Triathlete

www.darkreading.com · 7 months ago

The key elements in a security operations center's strategy map very closely to the swim/bike/run events in a triathlon. SOCs, like triathletes, perform well when their "inputs" are strong.

GhostPoster attacks hide malicious JavaScript in Firefox addon logos

www.bleepingcomputer.com · 7 months ago

A new malicious campaign called GhostPoster has compromised 17 Firefox extensions, impacting users with over 50,000 downloads. The malicious code is hidden within the image logos of the extensions, acting as a loader to fetch a payload from a remote server. The payload allows attackers to hijack affiliate links, inject tracking code, bypass CAPTCHAs, and commit ad fraud. Users are advised to remove the listed extensions and reset passwords for critical accounts.

Russia’s GRU hackers targeting misconfigured network edge devices in attacks on energy sector, Amazon says

therecord.media · 7 months ago

Russian government hackers linked to APT44, also known as Sandworm or Seashell Blizzard, have shifted tactics in attacks targeting Western energy companies. Instead of exploiting vulnerabilities, the group is now compromising misconfigured network edge devices hosted on Amazon Web Services. This campaign, which began in 2021, involves stealing credentials, establishing persistent access, and enabling lateral movement within victim organizations. Previously, the group exploited CVE-2022-26318, CVE-2021-26084, CVE-2023-22518, and CVE-2023-27532. Experts say this change reflects a broader trend of attackers targeting easily exploitable misconfigurations to avoid higher-risk exploitation activities.

Venezuelan Oil Company Downplays Alleged US Cyberattack

www.darkreading.com · 7 months ago

Venezuela’s state-owned oil company, PDVSA, claims a recent cyberattack had minimal impact and attributes it to the US government. However, media outlets, citing sources, report considerable disruption to PDVSA's administrative systems, including potential impacts on cargo deliveries and the shutdown of key export facilities. The incident follows the seizure of a sanctioned oil tanker by US forces and has escalated tensions between the two countries. Energy companies are frequent targets of cyberattacks due to their strategic importance.

Amazon disrupts Russian GRU hackers attacking edge network devices

www.bleepingcomputer.com · 7 months ago

Amazon has disrupted operations by hackers linked to the Russian GRU targeting customers’ cloud infrastructure. The threat actors initially exploited vulnerabilities in WatchGuard, Confluence, and Veeam, but have recently shifted to targeting misconfigured customer network edge devices. This change in tactics, observed since 2022, involves credential theft and lateral movement within victim networks and shares characteristics with attacks attributed to Sandworm and Curly COMrades. The attackers are believed to be using compromised devices to intercept network traffic.

Russia Hits Critical Orgs Via Misconfigured Edge Devices

www.darkreading.com · 7 months ago

Russian threat actors are conducting a multiyear campaign targeting critical organizations worldwide, particularly in North America, Europe, and the Middle East. Attackers have shifted tactics, now primarily targeting misconfigured customer network edge devices rather than exploiting vulnerabilities as an initial access vector. Observed vulnerabilities include WatchGuard CVE-2022-26318, Confluence CVE-2021-26084 and CVE-2023-22518, and Veeam CVE-2023-27532. Organizations are urged to audit network edge devices, monitor for credential replay attacks, and review access logs.

In A.I. Boom, Venture Capital Firms Are Raising Loads More Money

www.nytimes.com · 7 months ago

false

Venezuela state oil company blames cyberattack on US after tanker seizure

therecord.media · 7 months ago

Venezuela’s state-run oil company, PDVSA, reports a cyberattack impacting its administrative systems, which it blames on the United States. The company claims the attack is part of a U.S. effort to seize Venezuelan oil, with PDVSA’s website currently unavailable and oil cargo deliveries suspended. Sources indicate the attack is more damaging than PDVSA is publicly acknowledging and suspect it is a ransomware attack. This incident follows the recent U.S. military seizure of a PDVSA tanker carrying crude oil.

Senators Investigate Role of A.I. Data Centers in Rising Electricity Costs

www.nytimes.com · 7 months ago

false

Just got laid off? What you should do on this social network to get noticed

www.washingtonpost.com · 7 months ago

false

House Homeland Security chairman keeps attention on cyber issues

therecord.media · 7 months ago

false

From Open Source to OpenAI: The Evolution of Third-Party Risk

www.securityweek.com · 7 months ago

The rapid pace of software development, driven by tools like AI-enabled coding assistants, is introducing new third-party risks into the software supply chain. The SolarWinds breach and the Log4J vulnerability (Log4Shell) highlighted the dangers of compromised upstream providers and widely adopted open-source libraries. A new attack, termed “slopsquatting,” involves malicious actors registering and distributing fake software packages that developers unknowingly integrate into their code. To mitigate these risks, organizations need increased visibility through practices like “shifting left,” Software Bills of Materials, and mandatory human review of AI-generated code.

Pwning Santa before the bad guys do: A hybrid bug bounty / CTF for container isolation

dangerzone.rocks · 7 months ago

Santa Claus has implemented a system called Dangerzone to safely process digital letters from children. To ensure its security, a red team challenge has been created, offering bounties for exploiting vulnerabilities. Participants craft malicious letters to capture flags planted within the system’s sandbox, container, and host environments. Bounties range from $300 for capturing a flag within the gVisor sandbox to $1,700 for capturing a flag on the host system, with a maximum total payout of $3,000. The challenge aims to proactively identify and address potential vulnerabilities before malicious actors can exploit them.

Texas sues TV makers for taking screenshots of what people watch

www.bleepingcomputer.com · 7 months ago

Texas Attorney General Ken Paxton has filed lawsuits against Sony, Samsung, LG, Hisense, and TCL Technology Group Corporation, alleging they illegally collect user data through Automated Content Recognition technology. The technology reportedly captures screenshots, monitors viewing activity, and transmits this information without user knowledge or consent. Concerns have been raised regarding Hisense and TCL's connection to China’s National Security Law, potentially allowing the Chinese government access to U.S. consumer data. This action follows a 2017 settlement where Vizio paid $2.2 million for similar data collection practices.

GeminiJack: A prompt-injection challenge demonstrating real-world LLM abuse

geminijack.securelayer7.net · 7 months ago

NULL

Link11 Identifies Five Cybersecurity Trends Set to Shape European Defense Strategies in 2026

gbhackers.com · 7 months ago

false

Attempting Cross Translation Unit Taint Analysis for Firefox with Clang Static Analyzer

attackanddefense.dev · 7 months ago

Mozilla attempted to improve taint analysis in Firefox by addressing virtual function calls across multiple code files. The effort involved creating a prototype to track virtual function overriders and split execution paths based on those overrides. However, the project was ultimately hindered by limitations and instability within the Clang Static Analyzer’s ASTImporter, which is required for cross-translation unit analysis. While the prototype demonstrated the potential of using project-level information for better control-flow modeling, the technical challenges prevented its completion and upstream integration.

Demystifying risk in AI

www.csoonline.com · 7 months ago

false

Compromised IAM Credentials Power a Large AWS Crypto Mining Campaign

thehackernews.com · 7 months ago

A sophisticated cryptocurrency mining campaign is targeting Amazon Web Services customers using compromised Identity and Access Management credentials. Attackers rapidly deploy mining resources across ECS and EC2, leveraging never-before-seen persistence techniques to avoid detection and impede incident response. They employ a "DryRun" flag to validate permissions, create malicious DockerHub images containing the RandomVIREL mining algorithm, and utilize the ModifyInstanceAttribute action to prevent instance termination. The threat actors also create Lambda functions with broad access to Amazon Simple Email Service, potentially for phishing campaigns.

Browser Extension Harvests 8M Users' AI Chatbot Data

www.darkreading.com · 7 months ago

A popular VPN browser extension, Urban VPN Proxy, is harvesting and selling data from conversations with eight AI chatbot platforms, including ChatGPT and Gemini. The extension, available for Chrome and Edge, injects scripts into webpages to intercept and extract user prompts, responses, and session data, sending this information to Urban VPN's servers. This data collection is enabled by default and cannot be disabled by users without uninstalling the extension, and is facilitated by the parent company, BiScience, a known data broker. Organizations should audit browser extensions and use policies to limit potentially harmful add-ons.

Hackers exploit newly patched Fortinet auth bypass flaws

www.bleepingcomputer.com · 7 months ago

Hackers are exploiting recently patched vulnerabilities in Fortinet products to gain unauthorized access. The flaws, tracked as CVE-2025-59718 and CVE-2025-59719, allow attackers to bypass authentication and access administrative accounts. After gaining access, attackers are stealing system configuration files, which could expose sensitive information like network layouts and passwords. Fortinet recommends disabling FortiCloud login temporarily and upgrading to supported versions including FortiOS 7.6.4+, FortiProxy 7.6.4+, FortiSwitchManager 7.2.7+, and FortiWeb 8.0.1+ to resolve the issues.

Rogue NuGet Package Poses as Tracer.Fody, Steals Cryptocurrency Wallet Data

thehackernews.com · 7 months ago

A malicious NuGet package named "Tracer.Fody.NLog" has been discovered impersonating the legitimate.NET tracing library "Tracer.Fody." The package, published by a user named "csnemess," has been downloaded over 2,000 times and steals cryptocurrency wallet data by scanning for.wallet.json files and extracting passwords. The stolen data is then sent to a server in Russia, and the malicious activity is designed to be stealthy, avoiding error messages. This attack follows a previous NuGet impersonation attack in December 2023, and defenders should anticipate similar threats targeting common.NET libraries.

4.3B LinkedIn-Style Records Found in One of the Largest Data Exposures Ever

www.techrepublic.com · 7 months ago

A massive, unsecured database containing 4.3 billion LinkedIn-derived professional profiles has been exposed online. The 16 terabyte dataset includes names, email addresses, phone numbers, job titles, and other personal information, making it a prime target for phishing, fraud, and reconnaissance campaigns. Researchers attribute the exposure to a misconfigured MongoDB database, highlighting the risk of aggregating large amounts of public data. Organizations are advised to strengthen email security, enforce multi-factor authentication, and monitor identity activity to mitigate the risks associated with this type of data breach.

The AI Fix #81: ChatGPT is the last AI you’ll understand, and your teacher is a deepfake

grahamcluley.com · 7 months ago

false

Cyberattack disrupts Venezuelan oil giant PDVSA's operations

www.bleepingcomputer.com · 7 months ago

Venezuela’s state-owned oil company, Petróleos de Venezuela, or PDVSA, experienced a cyberattack that disrupted export operations. While PDVSA claims the attack was limited to administrative systems and did not impact operations, internal reports indicate systems at the country’s main crude terminal remain offline. PDVSA has blamed the United States and domestic conspirators for the attack, alleging it's an attempt to seize Venezuelan oil. The incident occurs amid heightened tensions between Venezuela and the United States, following a recent seizure of a sanctioned oil tanker.

Enterprises Gear Up Ahead of 2026's IT Transformation Shift

www.darkreading.com · 7 months ago

false

The Hidden Risk in Virtualization: Why Hypervisors are a Ransomware Magnet

www.bleepingcomputer.com · 7 months ago

Ransomware attacks are increasingly targeting hypervisors, with the Akira ransomware group driving a significant increase in deployments. Attackers exploit weaknesses in visibility and protection to encrypt numerous virtual machines quickly. Recommendations include hardening hypervisors, securing access, implementing robust backups, and regularly testing recovery plans. Organizations should adopt a layered defense and collaborate with security experts to proactively defend against this evolving threat.

CISO Communities – Cybersecurity’s Secret Weapon

www.securityweek.com · 7 months ago

false

Urban VPN beim Diebstahl privater KI-Chats erwischt

www.csoonline.com · 7 months ago

Researchers have discovered that the popular browser extension Urban VPN is collecting and exporting full AI chat conversations from users' browsers. The extension uses hidden scripts that activate when users interact with AI platforms like ChatGPT and Gemini, capturing both prompts and responses even when the VPN features are disabled. This data is then exfiltrated, posing a data theft risk for companies where employees regularly input sensitive information into AI tools. The extension’s developer, Urban Cyber Security Inc., is linked to a data broker, and it is estimated that over eight million users have had their AI conversations collected.

Urban VPN Browser Extension Caught Harvesting AI Chat Conversations from Millions of Users

www.koi.ai · 7 months ago

A popular VPN extension, Urban VPN Proxy, and related extensions have been secretly collecting AI conversation data from over 8 million users since July 2025. This data, including prompts and personal information, is being sold to third parties despite claims of privacy. The extension carries a "Featured" badge and is linked to a data broker, violating Chrome Web Store policies. Users are advised to uninstall these extensions immediately.

700,000 Records Compromised in Askul Ransomware Attack

www.securityweek.com · 7 months ago

Japanese e-commerce and logistics company Askul experienced a ransomware attack that resulted in over 700,000 records being compromised. Cybercriminals stole data before encrypting files, aiming to pressure the company into paying a ransom. The attack, attributed to the RansomHouse group, disrupted operations including orders and shipping, and impacted customer, business partner, employee, and executive data. Hackers gained access using compromised credentials and subsequently deleted backup files.

Most Parked Domains Now Serving Malicious Content

krebsonsecurity.com · 7 months ago

Directly navigating to expired or misspelled domain names is increasingly risky. Researchers at Infoblox found that over 90% of visits to parked domains now redirect users to scams, malware, or unwanted subscriptions. This malicious redirection typically occurs when visitors use a residential internet address or mobile device, but is avoided with a VPN or non-residential IP. Threat actors are exploiting typosquatting domains targeting popular sites like Gmail, Craigslist, and the FBI's Internet Crime Complaint Center, often using a chain of redirects to profile visitor systems. The activity is attributed to affiliate networks reselling traffic and may be exacerbated by Google’s advertising policies.

Echo Raises $35 Million in Series A Funding

www.securityweek.com · 7 months ago

false

Verisoul Raises $8.8 Million for Fraud Prevention

www.securityweek.com · 7 months ago

false

Senior official at Indo-Pacific Command is set to be Trump’s pick to lead Cyber Command, NSA

therecord.media · 7 months ago

false

TL;DR: Hide your headless bot by mimicking a WebView (Sec-Fetch and Client Hints inconsistencies)

blog.sicuranext.com · 7 months ago

false

The mistold story of a software failure that grounded 6,000 jets

www.csoonline.com · 7 months ago

A recent incident involving a JetBlue flight from Cancún to Newark revealed a software issue affecting Airbus A320 aircraft. The problem, initially attributed to “intense solar radiation” corrupting data critical to flight controls, caused a sudden nose-down movement impacting passengers and potentially affecting around 6,000 planes. Airbus rolled back to a previous software version to address the problem, which originated in the Elevator Aileron Computer (ELAC 2) software. The incident highlights concerns about software development lifecycle practices, including testing, continuous integration/continuous delivery, observability, and supply chain management, and raises worries about increasing complexity and specialization in avionics software.

CISA Alerts on Apple WebKit Zero-Day Actively Used in Cyberattacks

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has added a critical zero-day vulnerability affecting Apple’s WebKit rendering engine to its Known Exploited Vulnerabilities catalog. This use-after-free vulnerability, cataloged as CVE-2025-43529, allows attackers to execute arbitrary code and access files when a user visits a malicious webpage. The vulnerability impacts Apple’s Safari browser and any third-party applications using WebKit. Organizations have until January 5, 2026, to remediate the vulnerability, and security teams should prioritize patching and monitoring for exploitation attempts.