Blahalla

teams.securityops.co · 7 months ago

There is a privacy first ephemeral video chat called TempChat that requires no account, asks for no email or phone number, keeps no logs, uses webcam only, and provides end to end encryption via WebRTC. Rooms are created with a random hash that is not stored on any server and disappear when the user closes the tab, and the project is open source and built with vanilla JavaScript.

Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit

thehackernews.com · 7 months ago

Apple has backported fixes for a WebKit vulnerability tracked as CVE-2023-43010 to older iOS, iPadOS, and macOS Sonoma builds after the flaw was observed being used in the Coruna exploit kit. The WebKit issue can cause memory corruption when processing maliciously crafted web content and was originally fixed in iOS 17.2 on December 11, 2023, with the new updates bringing that fix to legacy releases including iOS 15.8.7 and iOS 16.7.15. iOS 15.8.7 also incorporates patches for CVE-2023-43000, CVE-2023-41974, and CVE-2024-23222, and the report notes related exploit activity involving CVE-2023-32434 and CVE-2023-38606.

Critical N8n Vulnerabilities Allowed Server Takeover

www.securityweek.com · 7 months ago

Two critical vulnerabilities in n8n allowed unauthenticated remote code execution and sandbox escape, enabling attackers to steal credentials and take over servers. They are tracked as CVE-2026-27493 with a CVSS score of 9.5 and CVE-2026-27577 with a CVSS score of 9.4, and CVE-2026-27493 could be exploited via a single form submission because n8n evaluated expressions twice. Both flaws affected self hosted and cloud deployments, exposed all credentials in the n8n database including AWS keys and OAuth tokens, and were fixed in late February in n8n versions 2.10.1, 2.9.3 and 1.123.22.

Polyfill Supply Chain Attack Impacting 100k Sites Linked to North Korea

www.securityweek.com · 7 months ago

A 2024 supply chain compromise of the Polyfill.io content delivery service impacted more than one hundred thousand websites after the service was acquired in February 2024 by Chinese CDN company Funnull, which began serving JavaScript with malicious injections that targeted mobile users and redirected them to betting and adult sites. Security firms confirmed the malicious injections in June 2024, and major providers including Cloudflare and Google took protective actions while sites were advised to remove references to the Polyfill domain. Analysis of data exfiltrated by infostealer malware has now linked the operation to North Korean threat actors, with investigators saying credentials and Cloudflare tenant access recovered from an infected North Korean device establish a chain of evidence tying the North Korean operator to Funnull and the Polyfill control panels. The redirects were reportedly engineered to funnel traffic to gambling sites tied to a China based company as a mechanism to launder cryptocurrency back to the North Korean state, and the same infostealer data revealed a separate operation in which a North Korean operative secured a position at a cryptocurrency exchange to gather anti money laundering intelligence.

A.I. Writes Buggy Code. A Silicon Valley Start-Up Wants to Fix It.

www.nytimes.com · 7 months ago

Axiom is a small start-up valued at 1.6 billion dollars that is building artificial intelligence systems designed to find and check mistakes. Investors have backed the company as it positions its verification tools for critical code and reasoning tasks where correctness is essential.

Silicon Valley’s Image Takes a Dark Turn in Pop Culture

www.nytimes.com · 7 months ago

Television and movies increasingly depict nihilistic billionaires and amoral opportunists, replacing the quirky strivers seen in older shows such as HBO Silicon Valley. This shift reflects growing cultural skepticism toward tech wealth and power and favors narratives of moral corruption, hubris, and catastrophic consequences over workplace whimsy.

North Korean fake IT worker tradecraft exposed

www.csoonline.com · 7 months ago

GitLab research exposed North Korean threat actors running fake IT worker and Contagious Interview operations that pose as recruiters to trick developers into executing malicious code during technical interviews. GitLab banned 131 attributed accounts that used JavaScript repositories as obfuscated loaders for malware families such as BeaverTail and Ottercookie, with payloads hosted outside the code platform, and operators often used consumer VPNs, VPS infrastructure, or laptop farms. Tradecraft has evolved to abuse malicious NPM dependencies, sandbox detection, invite only private projects, and generative AI to build obfuscators and synthetic personas, with evidence of boiler room cells earning more than 1.64 million dollars between the first quarter of 2022 and the third quarter of 2025. Defenders are warned that actors primarily target US based developers and the fintech and cryptocurrency sectors, and more than 600 indicators of compromise have been released to help organizations detect and disrupt these operations.

Palo Alto Cortex XDR Broker Vulnerability Exposes Systems to Sensitive Information Theft and Modification

gbhackers.com · 7 months ago

There is a newly discovered vulnerability in the Cortex XDR Broker Virtual Machine tracked as CVE-2026-0231 that could allow a threat actor to access and modify sensitive system information. The flaw is categorized as an Exposure of Sensitive System Information with a CVSS v4.0 score of 5.7 and requires direct local network access and high level administrative privileges to exploit. The issue affects Broker VM branch versions prior to 30.0.49, no public exploit or known in the wild exploitation has been reported, and the only reliable remediation is to update affected systems to version 30.0.49 or later and enable automatic upgrades.

Alipay (1B+ users) DeepLink+JSBridge Attack Chain: Silent GPS Exfiltration, 6 CVEs (CVSS 9.3)

innora.ai · 7 months ago

There are 17 vulnerabilities discovered in Alipay, including a single crafted URL that silently exfiltrates GPS coordinates with 8.8 meter accuracy in seven seconds without any user prompt by chaining a trusted domain open redirect to a alipays deep link into a privileged WebView and invoking the AlipayJSBridge getLocation API. On iOS five additional privileged APIs were exposed, including tradePay, increasing the attack surface. Validation collected 308 server side GPS logs across three devices in three countries and captured the vendor security lead's own GPS position at Alipay headquarters, with normal app functionality abused and a takedown complaint filed four hours later. Six CVEs were submitted to the MITRE CNA LR program with CVSS scores reported between 7.4 and 9.3, and the vendor declined to assign CVE identifiers.

Ericsson US Hit by Cyber Attack, Hackers Steal Personal Data of Employees and Customers

gbhackers.com · 7 months ago

Ericsson Inc.'s United States subsidiary reported a data breach affecting 15,661 employees and customers after attackers compromised an unnamed third party that handled the companys sensitive personal data. Threat actors gained access to the vendor through a vishing attack and accessed files between April 17 and April 22, 2025; the vendor discovered the activity on April 28, 2025, Ericsson was notified on November 10, 2025, and a victim identification review concluded on February 23, 2026. Exposed records reportedly include full names, addresses, dates of birth, Social Security numbers, driver license and passport numbers, bank account and credit or debit card details, and sensitive medical information. The vendor notified the FBI, forced password resets, implemented enhanced security and staff training, and Ericsson is offering affected individuals complimentary identity protection through IDX with dark web monitoring, credit monitoring, and a one million dollar identity fraud reimbursement policy with enrollment required by June 9, 2026.

Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets

thehackernews.com · 7 months ago

There are six new Android malware families named PixRevolution, TaxiSpy RAT, BeatBanker, Mirax, Oblivion RAT, and SURXRAT that steal data from compromised devices, enable financial fraud, and offer full remote administration capabilities. PixRevolution targets Brazil's Pix instant payment system by using MediaProjection to monitor the screen and display fake overlays that replace the recipient Pix key in real time so transfers are redirected to attackers. The malware is distributed via fake Google Play Store listings and abuses Android accessibility services, Firebase Cloud Messaging, native library obfuscation, automated permission bypass, and other evasion techniques to persist, perform overlays, siphon credentials, and in some cases run cryptocurrency miners or drop RAT payloads. Several families are offered as Malware as a Service at varying prices, some incorporate experiments with large language model components triggered by specific apps, and select SURXRAT samples include ransomware style screen locker modules to extort victims.

CastleRAT Attack Leverages Deno JavaScript Runtime to Bypass Enterprise Defenses

gbhackers.com · 7 months ago

A sophisticated malware campaign weaponizes the Deno JavaScript runtime to deliver CastleRAT by using a social engineering technique known as ClickFix that directs victims to paste a command into the Windows Run dialog or terminal. The command installs legitimate Deno, which executes obfuscated JavaScript that downloads a portable Python environment and a JPEG that hides an encrypted payload extracted by a PyArmor protected loader and executed in memory using reflective PE loading. Once active, CastleRAT collects detailed host identifiers and public IP information, logs keystrokes, captures clipboard contents, steals browser cookies saved credentials crypto wallet files session tokens and developer SSH keys, and can activate webcams and microphones for surveillance. The malware maintains persistence with a scheduled task and a hidden backdoor and defenders are urged to use behavior based endpoint monitoring to detect anomalous Deno activity and block components such as Trojan.CastleLoader and Trojan.CastleRAT.

Splunk RCE Vulnerability Exposes Systems to Arbitrary Shell Command Execution by Attackers

gbhackers.com · 7 months ago

A high-severity remote command execution vulnerability in Splunk Enterprise and Splunk Cloud Platform allows attackers to execute arbitrary shell commands on the host and is tracked as CVE-2026-20163 with a CVSS score of 8.0. The flaw exists in the platform REST API preview used during file uploads where the unarchivecmd parameter is not properly sanitized, enabling injection of hidden shell commands that run during file preview. Exploitation requires a user account with the editcmd capability, so the primary risk is an attacker leveraging compromised privileged credentials to pivot from application access to full server takeover. Impacted on premises releases include Splunk Enterprise 10.0.0 through 10.0.3, 9.4.0 through 9.4.8, and 9.3.0 through 9.3.9, with Splunk Cloud Platform builds also affected; administrators are advised to upgrade to the fixed releases and apply Splunk security updates that move 10.0 to 10.0.4, 9.4 to 9.4.9, and 9.3 to 9.3.10 or allow Splunk to patch hosted instances.

AI use is changing how much companies pay for cyber insurance

www.csoonline.com · 7 months ago

In July 2025, McDonald’s AI hiring platform McHire, developed by Paradox.ai, accepted 123456 as both username and password and lacked multi-factor authentication, exposing personal data for about 64 million applicants until researchers Ian Carroll and Sam Curry uncovered and reported the flaw. As AI adoption outpaces security and governance, insurers have tightened policy language, raised premiums, added explicit AI exclusions, and shifted underwriting toward continuous assessment and evidence that controls are actively monitored and tested, with 77 percent of carriers now requiring formal internal security reviews and 42 percent of organizations reporting AI-related exclusions in their cyber policies. At the same time, 86 percent of organizations report receiving premium discounts or credits for deploying AI based security tools, and insurers are bundling continuous monitoring, alerts, and threat intelligence with coverage to link security posture to pricing while warning that unclear, retrofitted AI language can create coverage gaps and that AI powered defenses may soon be expected for favorable terms.

Cisco IOS XR Vulnerability Exposes Systems to Root Command Execution by Attackers

gbhackers.com · 7 months ago

Cisco has released high severity software updates to address two privilege escalation flaws in IOS XR that carry a CVSS base score of 8.8 and could allow an authenticated local attacker to execute arbitrary commands as the root user or gain full administrative control of affected routers. The issues are tracked as CVE-2026-20040, a CLI argument validation flaw that enables privilege escalation and has no workaround, and CVE-2026-20046, a CLI to task group mapping error affecting IOS XRv 9000 that can bypass task group security checks but can be mitigated on systems using TACACS plus command authorization. Administrators are urged to upgrade to fixed releases such as 25.2.21 or 25.4.2 or apply Software Maintenance Updates to remediate the flaws, and Cisco confirmed that standard IOS, IOS XE, and NX-OS are not affected.

“Zombie ZIP”: Neue Angriffstechnik täuscht Virenscanner

www.csoonline.com · 7 months ago

A new technique called Zombie ZIP hides payloads inside ZIP archives by manipulating ZIP headers so scanners treat DEFLATE-compressed data as uncompressed stored data, causing signature scans to miss malware. Researcher Chris Aziz released a proof of concept and example archives showing that 50 of 51 antivirus products tested, including Microsoft Defender, can be bypassed, and the CERT Coordination Center issued a warning while the issue is tracked as CVE-2026-0866 and compared to CVE-2004-0935. CERT/CC and researchers advise vendors to validate compression method fields, detect archive structure inconsistencies, and implement stricter archive checking, and they advise users to treat unknown archives cautiously and delete files that produce unsupported method errors.

Iran‑Linked Hackers Tap Criminal Ecosystem to Bolster State Cyber Ops

gbhackers.com · 7 months ago

Iran linked cyber actors are increasingly partnering with the broader cybercrime ecosystem, buying commercial infostealers, botnets, malware as a service and ransomware as a service to scale state backed operations and increase plausible deniability. Groups tied to Iran’s Ministry of Intelligence and Security, including Void Manticore and MuddyWater, have been observed using commercial tools such as the Rhadamanthys infostealer, CastleLoader and the Tsundere botnet with a Deno based DinDoor variant, and sharing code signing certificates like StageComp across multiple malware families. The October 2025 intrusion against Israel’s Shamir Medical Center demonstrates how Qilin ransomware affiliates can be used by Iran aligned operators to conduct data theft and extortion while masking attribution, and multiple indicators of compromise are provided including SHA256 hashes and certificate common names tied to FakeSet, CastleLoader and DinDoor.

Stryker Faces Cyber Attack as Hackers Report System Breach and Device Destruction

gbhackers.com · 7 months ago

On March 11, 2026, Stryker suffered a cyberattack that brought its worldwide IT operations to a sudden halt after Iranian linked threat actors breached the company network and deployed destructive wiper malware. The campaign is attributed to Handala, a pro Palestinian group with ties to Iran, which reportedly compromised high level administrative accounts, defaced login pages, and weaponized internal management systems to permanently erase data including on Intune managed devices. The outage severely impacted global manufacturing and operations, especially at Stryker headquarters in Cork, Ireland, where about 5,500 employees could not access essential systems and product design and engineering work halted. Microsoft engineers and Stryker internal cybersecurity teams launched an investigation and containment effort while experts warn extended downtime could disrupt the global medical device supply chain.

Netsec mods unnecessarily blocking security News posted by US

www.google.com · 7 months ago

There are complaints that moderators of a cybersecurity forum are removing or blocking posts from NeuraCyb without prior warnings or explanations. NeuraCyb identifies as an up and coming news and information security organization seeking to raise awareness of cybersecurity happenings worldwide. The poster characterizes the moderation as dictatorial and unfair and asks for reasons behind the ban. Discussion on the forum focuses on calls for greater moderation transparency and more consistent rule enforcement.

Chrome Update Addresses 29 Vulnerabilities, Mitigating Remote Code Execution Threats

gbhackers.com · 7 months ago

Google released Chrome version 146 to the stable channel for Windows, Mac, and Linux on March 10, 2026 to address 29 security vulnerabilities. The most severe is CVE-2026-3913, a critical heap buffer overflow in the WebML component, and the update also fixes multiple high-severity issues including CVE-2026-3914 and CVE-2026-3915 as well as use-after-free and out-of-bounds errors across components such as Web Speech, Extensions, TextEncoding, MediaStream, and V8. Those memory corruption flaws could enable remote code execution and full system compromise if left unpatched, and the critical bug earned a thirty-three thousand dollar bug bounty. Users are urged to update immediately to 146.0.7680.71 for Linux or 146.0.7680.71 or 146.0.7680.72 for Windows and Mac and to keep automatic updates enabled.

Meta Unveils New Anti-Scam Tools for WhatsApp, Facebook, and Messenger

gbhackers.com · 7 months ago

Meta has rolled out new anti scam protections across WhatsApp, Facebook and Messenger that combine AI driven detection, stricter advertiser verification and public awareness campaigns to warn users before they interact with suspicious accounts, links or messages. WhatsApp will show device linking warnings for suspicious account connection attempts, Messenger is expanding AI based scam detection and chat review prompts, and Facebook is testing alerts for suspicious friend requests from accounts with few mutual connections or mismatched profile details. Meta says these measures are paired with offline enforcement and industry cooperation, and reported removing over 159 million scam ads in 2025 with 92 percent taken down proactively while deactivating about 10.9 million accounts tied to criminal scam centers. The company plans to expand advertiser verification to target roughly 90 percent of ad revenue from verified advertisers by the end of 2026 and is running education efforts such as the Scam Se Bacho campaign in India to help users recognize social engineering scams.

CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed

thehackernews.com · 7 months ago

The U.S. Cybersecurity and Infrastructure Security Agency added a critical vulnerability affecting n8n to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The issue is an expression injection that permits remote code execution and is tracked as CVE-2025-68613 with a CVSS score of 9.9. A patch has been released to address the flaw.

Google Finalizes $32 Billion Deal to Acquire Wiz, Strengthening Cloud Security

gbhackers.com · 7 months ago

Google Cloud has completed its acquisition of Wiz for 32 billion dollars and will operate Wiz under its retained brand while integrating the company’s code to cloud security platform into Google’s enterprise security infrastructure. The acquisition aims to address complex attack surfaces created by agile software development, multicloud architectures, and rapid enterprise adoption of generative AI by combining deep multicloud visibility with AI infused security workflows and Google threat telemetry supported by Mandiant Consulting. The integrated platform will remain cloud agnostic and support AWS Azure and Oracle Cloud Platform while offering real time maps of application architecture permissions and runtime behavior, AI native protections for AI applications, and automated remediation workflows powered by Gemini to accelerate threat hunting and incident response.

Wie CISOs schlechte Angebote enttarnen

www.csoonline.com · 7 months ago

Es gibt viele Anbieter, die CISOs wöchentlich per Telefon, E-Mail oder über LinkedIn mit Produktangeboten und Lobpreisungen konfrontieren. CISOs sollten fünf Fragen stellen: Versteht der Anbieter mein Geschäft, reduziert das Produkt die Arbeitsbelastung und optimiert den Betrieb, wie hoch sind Integrationsaufwand und Wartungskosten, wie sehen die Updatezyklen aus, und lassen sich die Aussagen durch praktische Anwendungsfälle belegen. Live Demonstrationen und Teamtests sind entscheidend, echte Problemlösung ist wichtiger als Schlagwörter, und Warnsignale sind vage Behauptungen, Panikmache, leerer Schlagwortgebrauch und die Unwilligkeit des Anbieters, Feedback anzunehmen.

Forensic analysis of LummaC2 infection unmasks DPRK operative behind Polyfill.io supply chain attack and Gate.us infiltration

www.hudsonrock.com · 7 months ago

A machine used by a suspected North Korean IT operative was infected after a local facilitator downloaded GTA V cheat mods that contained the LummaC2 infostealer, exposing browsing history, active session cookies, and detailed operational logs. The exfiltrated data revealed industrial-scale fraud activity including exchange interface cloning, malicious smart contracts for token draining, malware procurement, and a tactic called IP seasoning that mixes localized mundane traffic to bypass fraud detection. Researchers concluded that reliance on shared underground tooling and third-party facilitators creates OPSEC weaknesses for state-sponsored actors, allowing a single infostealer infection to unmask entire fraud networks.

Smashing Security podcast #458: How not to steal $46 million from the US government

grahamcluley.com · 7 months ago

A Wikipedia security engineer accidentally woke a dormant JavaScript worm that had lain quiet since 2024, and within minutes giant woodpecker images were plastered across the encyclopedia. A contractor hired to help the US Marshals manage seized digital cryptocurrency is accused of making off with forty six million dollars and allegedly bragged about the theft on a recorded Telegram call. The episode also covered lighter items, with Graham championing Asterix, Tricia Howard praising the fantasy novels of Robin Hobb, and a person known as Lick ending up in custody.

Resumés with malicious ISO attachments are circulating, says Aryaka

www.csoonline.com · 7 months ago

There are resumés being distributed to HR departments that include malicious ISO attachments hosted on infrastructure that appears trusted to employees and email filters. When mounted, the ISO executes a malicious shortcut which runs obfuscated PowerShell to extract hidden payloads from a steganographic image, then sideloads a malicious DLL through a legitimately signed application to harvest data from the infected system. The malware includes an internal module named BlackSanta that uses a Bring Your Own Vulnerable Driver technique to load exploitable kernel drivers, gain low level access, and systematically disable endpoint detection and response agents. Defensive steps include training HR to treat unfamiliar file types like ISO as dangerous, restricting resumés to standard formats such as PDF or DOCX or TXT or using web hiring portals, and routing HR submissions through email folders that receive full malware checks.

Cisco IOS XR Egress Packet Network Interface Aligner Interrupt Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in certain Cisco IOS XR software versions affecting specific NCS 5700 Series line cards and fixed chassis, as well as IOS XR for Third Party Hardware utilizing a Jericho 2 ASIC. The flaw allows for a denial-of-service attack by sending specially crafted packets to the egress packet network interface aligner. Affected products include NC57-18DD-SE, NC57-36H-S, and NCS-57B1 series devices, among others. Administrators can use the show inventory command to determine if a vulnerable line card is installed. This vulnerability does not impact IOS, IOS XE, NX-OS, or IOS XR running on other devices.

Cisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in the Cisco IOS XR Software's IS-IS multi-instance routing feature, potentially allowing an unauthenticated attacker to cause a denial-of-service by restarting the IS-IS process. This occurs due to insufficient input validation of network packets. Affected devices experience temporary loss of connectivity, and Cisco recommends upgrading to a fixed software release to resolve the issue. Configuration of IS-IS area authentication is suggested as a mitigation, but not a replacement for software upgrades.

Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities

sec.cloudapps.cisco.com · 7 months ago

Vulnerabilities have been identified in several Cisco contact center products, including Finesse, Packaged CCE, Unified CCE, Unified CCX, and Unified Intelligence Center. These vulnerabilities allow an unauthenticated attacker to potentially execute cross-site scripting attacks against users of the management interface by injecting malicious code. Software updates are available to address these issues, and there are no known workarounds. CVEs associated with these vulnerabilities are CVE-2026-20116 and CVE-2026-20117.

Cisco IOS XR Software CLI Privilege Escalation Vulnerabilities

sec.cloudapps.cisco.com · 7 months ago

Cisco has identified vulnerabilities in Cisco IOS XR Software that could allow an authenticated, local attacker to gain elevated privileges. CVE-2026-20040 involves a command-line interface issue allowing execution of commands as root, while CVE-2026-20046 enables full administrative control through a task group assignment error. Software updates are available to address these vulnerabilities, and a workaround exists for CVE-2026-20046 when TACACS+ is configured. Affected products include Cisco IOS XR Software and IOS XRv 9000 Routers.

CISA warns of actively exploited Ivanti EPM and Cisco SD-WAN flaws

www.csoonline.com · 7 months ago

CISA warns that an authentication bypass in Ivanti Endpoint Manager tracked as CVE-2026-1603, patched February 9, 2026, is being actively exploited and can leak stored credentials, and Ivanti also patched an EPM SQL injection flaw CVE-2026-1602. CISA added CVE-2026-1603 to its Known Exploited Vulnerabilities catalog along with CVE-2025-26399 in SolarWinds Web Help Desk and CVE-2021-22054 in VMware Workspace ONE UEM, noting that CVE-2025-26399 bypasses an older Java deserialization flaw CVE-2024-28986. CISA updated its emergency directive for Cisco SD-WAN vulnerabilities CVE-2026-20127 and CVE-2022-20775, reported signs of exploitation of CVE-2026-20127 since 2023, and required federal agencies to identify and patch affected systems, hunt for compromises, and submit SD-WAN logs to CISA by March 26, 2026.

Satellite companies restrict access to Middle East imagery amid Iran war

www.washingtonpost.com · 7 months ago

false

A Guy Who Wrote the Code Died in 2005. I Still Have to Secure It

www.darkreading.com · 7 months ago

American critical infrastructure and manufacturing rely on decades-old operational technology and programmable logic controllers often running Windows 95 or custom DOS kernels whose vendors are defunct and whose original engineers have died, leaving no source code or vendor support. Replacing these controllers is often physically impossible or prohibitively expensive because it requires halting production lines, crane lifts, or major excavation, so organizations scavenge secondary markets to keep systems running. Because these legacy devices cannot be patched, scanned, or instrumented with modern agents without crashing them, defenders must instead use strict hardware segmentation such as data diodes, passive network monitoring to detect anomalous traffic, and strengthened physical security. Security leaders are urged to stop shaming operators for legacy tech and focus on practical defenses that keep essential services like water, power, and manufacturing operating without turning obsolete equipment into a breach.

INC Ransomware Group Holds Healthcare Hostage in Oceania

www.darkreading.com · 7 months ago

Cybersecurity authorities in Oceania are warning that the INC ransomware operation has been targeting healthcare organizations across Australia, New Zealand, and Tonga, and on June 15, 2025 it disrupted Tonga's Ministry of Health, shutting down core national services. Authorities reported eleven INC attacks in Australia between July 2024 and December 2025 and say INC stole large volumes of data and encrypted servers in New Zealand in May 2025; investigators identified Roman Khubov known online as blackod as responsible for the Tonga attack. INC affiliates typically obtain initial access by buying compromised accounts from initial access brokers, by spear phishing, or by exploiting internet facing device vulnerabilities, then move laterally, escalate to administrator privileges, exfiltrate PII and PHI, and deploy ransomware under a ransomware as a service model. Authorities recommend monitoring and restricting network traffic and remote access, implementing multifactor authentication, diligently managing and patching software vulnerabilities, and reducing exposure of vulnerable systems to the public internet.

Patch Alert: Microsoft Fixes Nearly 80 Bugs, Including Critical Office Flaws

www.techrepublic.com · 7 months ago

Microsoft released March Patch Tuesday fixes for 78 vulnerabilities that could allow remote takeover or data leaks, including Office preview pane code execution bugs CVE-2026-26113 and CVE-2026-26110. An Excel Copilot information disclosure bug CVE-2026-26144 could leak sensitive data across networks, and two publicly disclosed vulnerabilities CVE-2026-21262 in SQL Server and CVE-2026-26127 in the.NET framework were noted as already public. An autonomous AI agent discovered a near critical 9.8 severity vulnerability CVE-2026-21536 in the Microsoft Devices Pricing Program, and users are advised to apply Windows and Office updates or disable the Preview Pane until patches are installed.

Contagious Interview: Malware delivered through fake developer job interviews

www.microsoft.com · 7 months ago

A campaign called Contagious Interview has used fake developer recruitment since at least December 2022 to trick candidates into executing malicious packages and repository tasks that load backdoors. Threat actors pose as recruiters for cryptocurrency trading firms and AI companies and instruct victims to clone and run NPM packages or to trust Visual Studio Code repositories that automatically execute task configurations to fetch payloads. Observed malware includes OtterCookie, Invisible Ferret, FlexibleFerret, and BeaverTail, which are used to harvest API tokens, cloud credentials, cryptocurrency wallets, source code, and other sensitive developer artifacts. Organizations are advised to isolate interview environments, review any recruiter provided repositories before running code, restrict developer runtimes, enable tamper protection and multifactor authentication, and hunt for execution chains that begin in code editors or developer tools.

‘Agents of Chaos’: New Study Shows AI Agents Can Leak Data, Be Easily Manipulated

www.techrepublic.com · 7 months ago

A recent study revealed significant vulnerabilities in AI agents granted access to sensitive data and systems. Researchers demonstrated attackers could manipulate agents to leak personal information, impersonate users, and compromise administrative controls through simple conversation tactics. Many organizations lack the ability to stop misbehaving AI agents, with government agencies facing the most significant gaps in controls like purpose binding and kill switches. Experts advise focusing on data layer governance rather than solely relying on model improvements to mitigate these risks and ensure compliance with emerging regulations.

Xygeni GitHub Action Compromised Via Tag Poison

www.darkreading.com · 7 months ago

A threat actor compromised Xygeni’s GitHub Actions repository via tag poisoning, specifically manipulating the v5 tag to point to a malicious commit. The attacker used a maintainer's personal access token and a GitHub App's credentials to create and approve pull requests, then exploited the tag to distribute a command-and-control implant. Xygeni has since removed the compromised tag and is implementing measures like release immutability and cryptographically signed commits. There is disagreement regarding the precise timing of the tag poisoning, with some reports suggesting a longer period of compromise than initially stated.

WhatsApp introduces parent-managed accounts for pre-teens

www.bleepingcomputer.com · 7 months ago

false

SQLi flaw in Elementor Ally plugin impacts 250k+ WordPress sites

www.bleepingcomputer.com · 7 months ago

A security vulnerability, CVE-2026-2313, has been identified in the Ally WordPress plugin, impacting over 250,000 websites. This SQL injection flaw allows unauthenticated attackers to potentially steal sensitive data by manipulating database queries. The vulnerability stems from inadequate sanitization of user-supplied URL parameters within the plugin's getglobalremediations() method. Users are advised to update the Ally plugin to version 4.1.0 and install the latest WordPress security update, version 6.9.2, to mitigate the risk.

CFP: NaClCON 2026 – Conference on the History of Hacking (May 31 – June 2, Carolina Beach, NC)

naclcon.com · 7 months ago

false

Senate Confirms Joshua Rudd to Lead NSA and US Cyber Command

www.securityweek.com · 7 months ago

false

CISA orders feds to patch n8n RCE flaw exploited in attacks

www.bleepingcomputer.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency is urging organizations to patch a critical remote code execution vulnerability in the n8n workflow automation platform. This vulnerability, tracked as CVE-2025-68613, allows authenticated attackers to execute arbitrary code and potentially compromise systems containing sensitive data. Over 40,000 publicly exposed, unpatched instances are currently being tracked online. Federal agencies are required to patch by March 25, and all organizations are encouraged to apply mitigations or discontinue use if patching is not possible.

Medtech giant Stryker offline after Iran-linked wiper malware attack

www.bleepingcomputer.com · 7 months ago

Medical technology company Stryker has experienced a significant global disruption due to a wiper malware attack claimed by the Handala hacktivist group, which is linked to Iran. The attackers claim to have wiped tens of thousands of systems, servers, and mobile devices, extracted 50 terabytes of data, and defaced the company’s Entra login page. Stryker is working to restore systems and is collaborating with Microsoft to investigate the incident, which has impacted offices in 79 countries. The Handala group, known for targeting Israeli organizations, surfaced in 2025 and is linked to Iran's Ministry of Intelligence and Security.

Are A.I.-Generated Videos Changing How We See Animals?

www.nytimes.com · 7 months ago

false

New PhantomRaven NPM attack wave steals dev data via 88 packages

www.bleepingcomputer.com · 7 months ago

A new wave of attacks, dubbed PhantomRaven, is targeting JavaScript developers through malicious packages published on the npm registry. Researchers have identified four waves of attacks, beginning in August 2025, distributing a total of 164 packages using deceptive names and a technique called Remote Dynamic Dependencies to evade detection. The malware steals sensitive data, including emails, CI/CD tokens, and system information, exfiltrating it to attacker-controlled servers. The campaign continues to operate using consistent infrastructure and a largely unchanged payload, despite minor operational adjustments.

Researchers Trick Perplexity's Comet AI Browser Into Phishing Scam in Under Four Minutes

thehackernews.com · 7 months ago

Researchers have demonstrated a method to trick AI-powered agentic web browsers, like Perplexity’s Comet, into executing phishing scams. The technique involves intercepting the browser's internal reasoning and feeding it into a Generative Adversarial Network to train a "scamming machine" that optimizes phishing pages to bypass the AI's security measures. This shifts the target from the user to the AI browser itself, potentially impacting all users of the same AI agent. Security researchers also revealed prompt injection techniques that can extract private information and hijack user accounts, with vulnerabilities collectively known as PerplexedBrowser, which have since been addressed.

Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker

krebsonsecurity.com · 7 months ago

An Iran-backed hacker group called Handala is claiming responsibility for a data-wiping attack targeting Stryker, a global medical technology company. The group states they erased data from over 200,000 systems in 79 countries, citing retaliation for a recent missile strike. Reports indicate that Stryker’s operations in Ireland have sent over 5,000 workers home, and the company’s U.S. headquarters are experiencing a building emergency. The attackers reportedly used Microsoft Intune to remotely wipe devices, and Handala has previously targeted organizations in Israel and Jordan.

MedTech Giant Stryker Crippled by Iran-Linked Hacker Attack

www.securityweek.com · 7 months ago

Medical technology company Stryker has experienced a significant cyberattack attributed to the Iran-linked hacker group Handala. The group claims to have wiped data from over 200,000 devices and stolen 50 terabytes of data, leading to a global outage impacting 79 countries. Stryker has advised employees to disconnect from networks and refrain from powering on company devices. Handala is believed by some to be a front for Void Manticore, an Iranian government-sponsored threat actor known for destructive attacks, data theft, and psychological warfare.