Blahalla

Trump Administration Rules Threaten Nobel Prizes Won by Immigrants

www.nytimes.com · 7 months ago

false

Does the Job of C.E.O. or Private Investor Come First? Intel’s Chief Is Juggling That Question.

www.nytimes.com · 7 months ago

false

PeerBlight Linux Malware Abuses React2Shell for Proxy Tunneling

gbhackers.com · 7 months ago

Cybersecurity researchers have discovered a sophisticated Linux malware campaign exploiting the critical React2Shell vulnerability, CVE-2025-55182, which has a CVSS score of 10.0. The malware, dubbed “PeerBlight,” uses the BitTorrent Distributed Hash Table network for resilient command-and-control communications and disguises itself as legitimate system processes. Attackers are actively exploiting the vulnerability since December 4, 2025, deploying various malware families, including ZinFoq and a Kaiji botnet variant. Organizations should update to patched versions of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack to mitigate the risk.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Rockwell, Schneider

www.securityweek.com · 7 months ago

Industrial control system vendors Siemens, Rockwell Automation, Schneider Electric, and Phoenix Contact have released security updates to address vulnerabilities. Siemens is addressing fourteen advisories, including critical vulnerabilities in several products related to third-party components. Schneider Electric is responding to vulnerabilities impacting their EcoStruxure Foxboro DCS product, including issues related to WSUS and ZombieLoad. Rockwell Automation is patching a denial-of-service vulnerability and a SQL injection flaw, while Phoenix Contact is resolving cross-site scripting and authentication issues.

Extending Burp Suite for fun and profit – The Montoya way – Part 9 - HN Security

www.reddit.com · 7 months ago

false

CISA and FBI Warn of Pro-Russia Hacktivist Attacks on Critical Infrastructure Worldwide

gbhackers.com · 7 months ago

The FBI, CISA, NSA, and international partners have issued a cybersecurity advisory regarding escalating attacks by pro-Russia hacktivist groups targeting critical infrastructure worldwide. These groups, including Cyber Army of Russia Reborn, NoName057(16), Z-Pentest, and Sector16, are exploiting minimally secured Virtual Network Computing connections to infiltrate Operational Technology and Industrial Control Systems. Observed impacts include operational disruptions and manipulation of Human-Machine Interfaces. CISA recommends reducing public internet exposure, implementing network segmentation, enforcing multifactor authentication, and updating VNC software to mitigate the risks.

Microsoft Outlook Flaw Lets Attackers Execute Malicious Code Remotely

gbhackers.com · 7 months ago

A critical vulnerability has been identified in Microsoft Outlook, tracked as CVE-2025-62562. This flaw allows attackers to execute malicious code remotely through specially crafted email messages or attachments. The vulnerability stems from improper memory management and has a CVSS score of 7.8, indicating high severity. Microsoft advises users to immediately apply security updates and implement email security measures until patches are available.

Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero-Days

thehackernews.com · 7 months ago

Microsoft released security updates for 56 flaws across its Windows platform, addressing a range of vulnerabilities including privilege escalation, remote code execution, and information disclosure. A critical use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver, CVE-2025-62221, is under active exploitation and has been added to the Known Exploited Vulnerabilities catalog. Two other zero-day vulnerabilities were also patched: CVE-2025-54100, a command injection in Windows PowerShell, and CVE-2025-64671, a command injection in GitHub Copilot for JetBrains. Numerous other vendors also released security updates for various software.

Windows PowerShell 0-Day Lets Attackers Execute Arbitrary Code

gbhackers.com · 7 months ago

Microsoft has disclosed a critical vulnerability, tracked as CVE-2025-54100, in Windows PowerShell that allows for remote code execution. The flaw arises from improper handling of special elements during command execution, potentially enabling attackers to execute arbitrary code. Exploitation requires local access and user interaction, but could be used to escalate attacks or compromise data. Until a patch is released, organizations are urged to restrict PowerShell execution and closely monitor activities.

Intel, AMD Processors Affected by PCIe Vulnerabilities

www.securityweek.com · 7 months ago

Three PCI Express vulnerabilities, tracked as CVE-2025-9612, CVE-2025-9613, and CVE-2025-9614, are impacting hardware vendors. These flaws affect the PCI Express Integrity and Data Encryption standard, potentially leading to information disclosure, privilege escalation, or denial of service. Exploitation requires physical or low-level access to the system. Intel and AMD have confirmed their products are affected, with Intel's Xeon 6 and Xeon 6700P-B/6500P-B series processors and AMD's EPYC 9005 series potentially impacted.

Free Honey Tokens for Breach Detection - No Signup

www.reddit.com · 7 months ago

NULL

Polymorphic AI malware exists — but it’s not what you think

www.csoonline.com · 7 months ago

Recent reports have generated hype about AI-driven malware capable of self-modification and evasion, but the reality is less dramatic. Attackers are experimenting with AI tools to accelerate malware development and improve phishing campaigns, lowering the barrier to entry for less experienced actors. While AI can generate superficial code variations, it doesn't fundamentally break defenses due to the effectiveness of behavioral detection and the preference of established threat actors for reliable techniques. The real danger isn’t autonomous malware, but the increased speed and scale of attacks facilitated by AI. Organizations should focus on automating defenses, bolstering identity security, and prioritizing realistic threats over vendor-driven hype.

Key cybersecurity takeaways from the 2026 NDAA

www.csoonline.com · 7 months ago

The 2026 National Defense Authorization Act allocates $15.1 billion for Department of Defense cybersecurity efforts, a 4.1% increase over the previous year. New mandates are included for enhanced security of mobile devices used by senior officials, requiring encryption, identifier rotation, and continuous monitoring. The bill also establishes an AI and machine learning security policy, emphasizing threat mitigation and workforce training. Provisions address commercial spyware proliferation, multiomic data security, and cybersecurity harmonization within the defense industrial base.

Chip Company Plotted to Send Technology to China, Ex-C.E.O. Says

www.nytimes.com · 7 months ago

A Dutch chipmaker, Nexperia, was seized by Dutch officials in September due to concerns about its Chinese owner, Wingtech, transferring technology to China. The company’s former chief executive revealed that as early as 2019, Wingtech’s controlling shareholder, Zhang Xuezheng, planned to move research and intellectual property to China. Wingtech is partially backed by Chinese government funds. The situation highlights the risks associated with foreign technology acquisitions and has put the Netherlands in a geopolitical struggle between Washington and Beijing.

Fortinet, Ivanti, and SAP Issue Urgent Patches for Authentication and Code Execution Flaws

thehackernews.com · 7 months ago

Fortinet, Ivanti, and SAP have released urgent security patches to address critical vulnerabilities. Fortinet flaws, tracked as CVE-2025-59718 and CVE-2025-59719, involve improper cryptographic signature verification, potentially allowing authentication bypass. Ivanti’s update resolves a critical Endpoint Manager flaw, CVE-2025-10573, a stored cross-site scripting vulnerability that could lead to administrator session control. SAP’s December updates address three critical vulnerabilities, including code injection (CVE-2025-42880), multiple Apache Tomcat vulnerabilities (CVE-2025-55754), and a deserialization flaw (CVE-2025-42928). Organizations are advised to apply these patches promptly to prevent exploitation.

‘Marjorie Prime’ Review: A.I. Gave Her Back Her Husband. Was It Worth It?

www.nytimes.com · 7 months ago

false

UK Sanctions Russian and Chinese Firms Suspected of Being ‘Malign Actors’ in Information Warfare

www.securityweek.com · 7 months ago

Britain has imposed sanctions against several Russian and Chinese entities suspected of engaging in information warfare and cyber activities. Sanctioned Russian entities include the Telegram channel Rybar, the Foundation for the Support and Protection of the Rights of Compatriots Living Abroad, and the Center for Geopolitical Expertise. Two China-based firms, i-Soon and the Integrity Technology Group, were also sanctioned for cyber activities targeting the U.K. and its allies. Officials warn of escalating hybrid threats including disinformation campaigns utilizing generative AI and manipulated videos.

GitHub Action Secrets aren’t secret anymore: exposed PATs now a direct path into cloud environments

www.csoonline.com · 7 months ago

Threat actors are exploiting exposed GitHub Personal Access Tokens, or PATs, to gain access to GitHub Action Secrets and infiltrate cloud environments. Attackers can then move laterally to cloud service provider control planes, impersonate developers, and access sensitive data such as cloud credentials, source code, and databases. This unauthorized access allows attackers to spin up cloud resources, install malicious software, and establish persistent access, often evading detection due to unmonitored API calls and shared IP addresses. Experts recommend treating PATs as privileged credentials, rotating them regularly, implementing least privilege access, and improving developer training to prevent these breaches.

Trump Eases Limits on Nvidia Exports to China at ‘Critical Moment’

www.nytimes.com · 7 months ago

false

December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

www.csoonline.com · 7 months ago

Microsoft released 57 security patches for December, but one vulnerability in the Windows Cloud Files Mini Filter Driver (CVE-2025-62221) is already being exploited. This escalation of privilege bug allows attackers with local access to gain higher-level permissions. Several other vulnerabilities exist, including those in Exchange Server (CVE-2025-64666, CVE-2025-64667), Microsoft Office (CVE-2025-62557, CVE-2025-62554), and GitHub Copilot. SAP customers also face code injection and deserialization vulnerabilities (CVE-2025-42880, CVE-2025-42928, CVE-2025-55754, CVE-2025-55752, CVE-2025-42880). IT teams are urged to prioritize patching, enforce least-privilege access, and strengthen monitoring.

Trump’s Nvidia Chip Deal Reverses Decades of Technology Restrictions

www.nytimes.com · 7 months ago

false

Japanese Firms Suffer Long Tail of Ransomware Damage

www.darkreading.com · 7 months ago

Japanese companies are experiencing a prolonged period of disruption following recent ransomware attacks, impacting major corporations like Asahi Holdings and online retailer Askul. These incidents have led to order delays, potential data breaches affecting nearly two million individuals, and disruptions for related businesses like the Muji online store. Experts attribute this “long tail” of recovery to factors including the importance of Japanese industries in global supply chains and a lack of mature security controls in the Asia-Pacific region. While not specifically targeted, Japan’s vulnerability and potential for high-value ransoms continue to draw cybercriminals.

Microsoft Patch Tuesday, December 2025 Edition

krebsonsecurity.com · 7 months ago

Microsoft released security updates to address at least 56 vulnerabilities in Windows and related software. This includes a zero-day privilege escalation bug, CVE-2025-62221, affecting the Windows Cloud Files Mini Filter Driver, which could impact services like OneDrive and Google Drive. Three vulnerabilities, CVE-2025-62554, CVE-2025-62557, and CVE-2025-62562, were rated as critical, with CVE-2025-62554 and CVE-2025-62557 exploitable through booby-trapped email previews. Microsoft also patched a remote code execution flaw, CVE-2025-64671, in the Github Copilot Plugin, as part of a broader security crisis dubbed "IDEsaster."

SAP fixes three critical vulnerabilities across multiple products

www.bleepingcomputer.com · 7 months ago

SAP has released security updates addressing fourteen vulnerabilities across several products. The most critical issue, CVE-2025-42880, is a code injection vulnerability in SAP Solution Manager that could grant attackers full system control. Another critical vulnerability, CVE-2025-55754, impacts SAP Commerce Cloud and carries a severity rating of 9.6. A deserialization vulnerability in SAP jConnect, tracked as CVE-2025-42928, is also considered critical.

Microsoft Fixes Exploited Zero Day in Light Patch Tuesday

www.darkreading.com · 7 months ago

Microsoft has released a December 2025 security update addressing 57 vulnerabilities. One actively exploited zero-day bug, CVE-2025-62221, affects the Windows Cloud Files Mini Filter Driver and allows privilege escalation. Two other vulnerabilities have publicly available proof-of-concept exploits: CVE-2025-54100, a PowerShell remote code execution flaw, and CVE-2025-64671, affecting GitHub Copilot for JetBrains. A critical vulnerability, CVE-2025-62554, exists in Microsoft Office, allowing for remote code execution.

California man pleads guilty to RICO charges as DOJ indicts crypto theft gang

therecord.media · 7 months ago

A criminal group known as the Social Engineering Enterprise has been targeted by the Justice Department for stealing cryptocurrency through social engineering schemes. The group gained access to databases to identify victims, then tricked them into providing access to their funds or broke into their homes to steal devices, resulting in over $263 million in losses. One member, Evan Tangeman, pleaded guilty to RICO conspiracy charges for his involvement in laundering money and securing rental homes for the group. Multiple arrests have been made in Miami, Dubai and Los Angeles, and the investigation continues.

Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack

www.microsoft.com · 7 months ago

A widespread supply chain attack, dubbed "Shai-Hulud 2.0," has targeted npm packages, compromising hundreds of accounts and injecting malicious code to steal credentials and configuration secrets. The attackers impersonated legitimate users and utilized compromised maintainer accounts and automated processes. Microsoft Defender offers detection and remediation capabilities, including layered protection and hunting queries. Investigation techniques involve using Microsoft Defender XDR, Microsoft Defender for Cloud, and Microsoft Sentinel to trace attack paths and identify malicious activity.

Windows PowerShell now warns when running Invoke-WebRequest scripts

www.bleepingcomputer.com · 7 months ago

Microsoft is introducing a security warning in Windows PowerShell 5.1 to help prevent potentially risky code execution. The warning appears when using the Invoke-WebRequest command, which is also aliased to the 'curl' command, to download web content. This addresses a high-severity PowerShell remote code execution vulnerability, CVE-2025-54100. Users will be prompted to continue or cancel the operation, with the option to use a safer parsing method to avoid script execution.

Adobe Patches Nearly 140 Vulnerabilities

www.securityweek.com · 7 months ago

Adobe has released patches for nearly 140 vulnerabilities across its products. ColdFusion received fixes for 12 security defects, including unrestricted file uploads, improper input validation, and data deserialization flaws, tracked as CVE-2025-61808, CVE-2025-61809, and CVE-2025-61830. Experience Manager (AEM) updates address 117 cross-site scripting (XSS) vulnerabilities, including two critical flaws, CVE-2025-64537 and CVE-2025-64539, and a dependency vulnerability. Adobe urges users to apply these updates promptly as no active exploitation has been detected.

Microsoft Patches 57 Vulnerabilities, Three Zero-Days

www.securityweek.com · 7 months ago

Microsoft has released security updates addressing 57 vulnerabilities. One zero-day vulnerability, CVE-2025-62221, is currently being exploited and involves a use-after-free issue in the Windows Cloud Files Mini Filter Driver, potentially allowing privilege escalation. Two other vulnerabilities, CVE-2025-62454 and CVE-2025-64671, have been resolved and could be exploited, while Microsoft has also patched 13 vulnerabilities in the Office suite, including two critical flaws, CVE-2025-62554 and CVE-2025-62557. Microsoft has resolved over 1,000 vulnerabilities this year.

MAGA influencers urge Trump to kill Netflix deal over streamer’s Obama ties

www.washingtonpost.com · 7 months ago

false

Packer-as-a-Service Shanya Hides Ransomware, Kills EDR

www.darkreading.com · 7 months ago

Security researchers have discovered "Shanya," a packer-as-a-service offering that helps ransomware avoid endpoint detection and response systems. Shanya acts as an additional layer of obfuscation, similar to the previously used HeartCrypt. It works by dropping clean and malicious drivers, enabling ransomware groups like Akira, Medusa, Qilin, and Crytox to terminate security products. Experts predict these packer-as-a-service offerings will continue to evolve and remain a popular tool for attackers.

Some Teens Are on Social Media ‘Almost Constantly,’ Survey Says

www.nytimes.com · 7 months ago

false

Microsoft Names New Operating CISOs in Strategic Move to Strengthen Cyberdefense

www.securityweek.com · 7 months ago

false

Microsoft releases Windows 10 KB5071546 extended security update

www.bleepingcomputer.com · 7 months ago

Microsoft has released security update KB5071546 for Windows 10, addressing 57 vulnerabilities, including a zero-day flaw in PowerShell. This update, mandatory for Windows 10 Enterprise LTSC and those enrolled in the ESU program, will update systems to build 19045.6691 or 19044.6691. The update resolves a remote code execution vulnerability tracked as CVE-2025-54100, prompting a security warning when using the Invoke-WebRequest command in PowerShell. Microsoft recommends utilizing the -UseBasicParsing command-line argument for untrusted pages to prevent script execution.

Microsoft December 2025 Patch Tuesday Fixes 56 Vulnerabilities Fixed and 3 Zero-days

gbhackers.com · 7 months ago

Microsoft has released a security update addressing 56 vulnerabilities, including several zero-day exploits. Several Microsoft Office applications, including Word and Excel, are affected by remote code execution vulnerabilities, allowing attackers to execute code locally. Windows systems also face vulnerabilities, with several impacting the Cloud Files Mini Filter Driver and Resilient File System, enabling privilege escalation and information disclosure. Several identified CVEs include CVE-2025-62554, CVE-2025-62454, and CVE-2025-64658.

How Art Is Driving Waymo’s Feel-Good Branding

www.nytimes.com · 7 months ago

false

Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws

www.bleepingcomputer.com · 7 months ago

Microsoft's December 2025 Patch Tuesday resolves 57 vulnerabilities, including three zero-day exploits. A privilege escalation vulnerability exists in the Windows Cloud Files Mini Filter Driver, identified as CVE-2025-62221. GitHub Copilot for Jetbrains contains a command execution vulnerability, CVE-2025-64671, and a PowerShell remote code execution vulnerability is also addressed, CVE-2025-54100. The updates impact a wide range of Microsoft products, emphasizing the importance of timely security updates.

Fortinet warns of critical FortiCloud SSO login auth bypass flaws

www.bleepingcomputer.com · 7 months ago

Fortinet has released security updates to address critical vulnerabilities impacting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. Attackers could bypass FortiCloud SSO authentication by exploiting improper verification of cryptographic signatures. The FortiCloud SSO login feature is disabled by default, but can be enabled during FortiCare registration. Patches are available, and administrators are advised to temporarily disable the FortiCloud login feature until they upgrade. The vulnerabilities are tracked as CVE-2025-59718, CVE-2025-59719, CVE-2025-59808, and CVE-2025-64471.

Windows 11 KB5072033 & KB5071417 cumulative updates released

www.bleepingcomputer.com · 7 months ago

Microsoft has released Windows 11 cumulative updates KB5072033 and KB5071417, bringing December 2025 security patches to versions 23H2 and 25H2. New features include dark mode support for File Explorer dialogs, virtual workspace settings for managing features like Windows Sandbox, and improved keyboard backlight performance. Gaming experiences are enhanced with a full-screen experience for handheld devices. Additionally, there are updates to the taskbar, widgets, and Windows Share functionality, along with improvements to display and graphics performance. Microsoft will not be releasing optional updates in December due to the holiday season.

North Korea-linked Actors Exploit React2Shell to Deploy New EtherRAT Malware

thehackernews.com · 7 months ago

North Korean-linked actors are exploiting a critical security flaw, CVE-2025-55182, to deploy a new remote access trojan called EtherRAT. The malware utilizes Ethereum smart contracts for command-and-control, employs five Linux persistence mechanisms, and downloads its own Node.js runtime. This activity is linked to the Contagious Interview campaign, which targets blockchain and Web3 developers through fake job opportunities. A new variant of the campaign now instructs victims to clone malicious repositories and execute code within Microsoft Visual Studio Code, leading to the deployment of additional malware like BeaverTail.

Who Is Andrew Ferguson, the FTC Chairman Who Tilted the Agency to Trump?

www.nytimes.com · 7 months ago

false

There’s finally a check engine light for your phone’s biggest problem

www.washingtonpost.com · 7 months ago

false

Prime Security Raises $20 Million to Build Agentic Security Architect

www.securityweek.com · 7 months ago

false

Ivanti warns of critical Endpoint Manager code execution flaw

www.bleepingcomputer.com · 7 months ago

Ivanti has warned customers of a critical security flaw, CVE-2025-10573, in its Endpoint Manager solution that allows for remote code execution through cross-site scripting attacks. Additionally, the company released updates to address three high-severity vulnerabilities, CVE-2025-13659 and CVE-2025-13662, which also enable code execution but require user interaction. While Ivanti has not seen evidence of active exploitation, hundreds of Internet-facing Ivanti EPM instances are currently tracked. Earlier this year, the U.S. Cybersecurity and Infrastructure Security Agency tagged three critical Ivanti EPM vulnerabilities as exploited, CVE-2024-13159, CVE-2024-13160, and CVE-2024-13161, and another, CVE-2024-29824, was deemed actively exploited.

Maintaining enterprise IT hygiene using Wazuh SIEM/XDR

www.bleepingcomputer.com · 7 months ago

Organizations face challenges maintaining IT infrastructure visibility and control, creating security gaps. IT hygiene involves systematic practices like asset tracking, configuration management, patch updates, access control, and monitoring. Wazuh, a free, open-source security platform, provides an IT hygiene capability introduced in version 4.13.0, offering a dashboard to monitor system inventory and identify issues like outdated software, unauthorized browser extensions, and dormant user accounts. This capability helps organizations proactively manage security risks, optimize resources, and maintain compliance.

Changing the physics of cyber defense

www.microsoft.com · 7 months ago

false

Gemini for Chrome gets a second AI agent to watch over it

www.csoonline.com · 7 months ago

Google is deploying a second AI model to monitor its Gemini-powered Chrome browsing agent to prevent unauthorized actions via prompt injection attacks. The new system, called a user alignment critic, vets actions before they are executed, and operates on metadata rather than unfiltered web content. This dual-model approach is designed to address a growing vulnerability where malicious instructions hidden in web pages can trick AI agents into taking unwanted actions, potentially exposing sensitive data. Google is also limiting website access and requiring user confirmation for sensitive actions like banking or password use.

Spain arrests teen who stole 64 million personal data records

www.bleepingcomputer.com · 7 months ago

Spanish authorities have arrested a 19-year-old in Barcelona for allegedly stealing and attempting to sell 64 million personal data records from nine companies. The records included names, addresses, email addresses, phone numbers, DNI numbers, and IBAN codes. The suspect attempted to sell the data using multiple online accounts. Separately, Ukrainian cyberpolice arrested a 22-year-old for hacking user accounts and selling access using custom malware.

Racks, sprawl and the myth of redundancy: Why your failover isn’t as safe as you think

www.csoonline.com · 7 months ago

Modern networks have grown beyond simple hardware redundancy, facing challenges from cloud complexity, policy errors, and security threats. Organizations are moving beyond just having backup hardware, implementing strategies like infrastructure-as-code, policy engines, and automation to ensure resilience. Key areas of focus include robust prefix filters, independent DNS backups, and pre-mortem analysis to anticipate and mitigate potential failures. The focus has shifted from preventing failure to minimizing its impact through testing, automation, and vigilance.