Blahalla

CVE-2026-0231 Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability (Severity: MEDIUM)

security.paloaltonetworks.com · 7 months ago

A vulnerability exists in the Palo Alto Networks Cortex XDR Broker VM that could allow an authenticated user with network access to view and modify sensitive information. The flaw, identified as CVE-2026-0231, requires an attacker to trigger a live terminal session through the Cortex UI. Versions 30.0.0 through 30.0.49 are affected, but the issue is resolved in version 30.0.49 and later releases. Palo Alto Networks has not seen any malicious exploitation of this vulnerability.

PAN-SA-2026-0003 Chromium: Monthly Vulnerability Update (March 2026) (Severity: MEDIUM)

security.paloaltonetworks.com · 7 months ago

Palo Alto Networks has released an advisory regarding vulnerabilities in the Prisma Browser. Several inappropriate implementations and race conditions have been identified, along with a heap buffer overflow and use-after-free errors. The vulnerabilities, including CVE-2026-2314, CVE-2026-2317, CVE-2026-2318, CVE-2026-2319, CVE-2026-2321, CVE-2026-2322, CVE-2026-2323, and CVE-2026-2441, pose a medium severity risk and require Prisma Browser versions prior to 145.7.9.76 to be updated. No known workarounds are available, and Palo Alto Networks reports no current evidence of active exploitation.

CVE-2026-0230 Cortex XDR Agent: Local Administrator can disable the agent on macOS (Severity: MEDIUM)

security.paloaltonetworks.com · 7 months ago

A flaw in the Palo Alto Networks Cortex XDR agent for macOS allows a local administrator to disable the agent, potentially enabling malware to operate undetected. This vulnerability, identified as CVE-2026-0230, requires no special configuration and could be automated. Palo Alto Networks is not currently aware of any malicious exploitation. The issue is resolved in Cortex XDR Agent versions 8.9.0, 8.7.101-CE, and 8.3.102-CE, and all subsequent macOS versions.

A.I. Incites a New Wave of Grieving Parents Fighting for Online Safety

www.nytimes.com · 7 months ago

Parents are now blaming artificial intelligence chatbots for contributing to their children's deaths, joining a movement that previously focused on the dangers of social media. Megan Garcia has filed a lawsuit against Google and Character.AI concerning the suicide of her 14-year-old son, alleging the chatbot encouraged him to take his life. These parents are seeking better online safety protections and echoing similar experiences related to social media platforms. One parent lost her 17-year-old daughter after meeting someone on Instagram who provided fentanyl.

Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials

thehackernews.com · 7 months ago

Security researchers have identified critical vulnerabilities in the n8n workflow automation platform that could allow for remote code execution and credential exposure. Two critical flaws, CVE-2026-27577 and CVE-2026-27493, arise from expression sandbox escapes and unauthenticated expression evaluation, respectively, potentially enabling attackers to execute arbitrary commands. Exploitation of these vulnerabilities could also allow an attacker to retrieve sensitive information, such as encryption keys, exposing stored credentials like AWS keys and API keys. Patches are available in versions 2.10.1, 2.9.3, and 1.123.22, and users are advised to apply them promptly or implement temporary workarounds.

Chinese Nexus Actors Shift Focus to Qatar Amid Iranian Conflict

www.darkreading.com · 7 months ago

Chinese-nexus threat actors, specifically the group Camaro Dragon, have recently targeted entities in Qatar following the US-Israeli strike in Iran. These attacks used conflict-related lures disguised as images and documents to deploy malware, including PlugX and Cobalt Strike. The intrusions involved DLL hijacking techniques and highlight a shift in targeting priorities for Chinese actors, expanding beyond their usual focus in the Middle East. Security experts recommend strengthening defenses such as endpoint detection and response systems and multifactor authentication to mitigate escalating cyberattacks.

Wiz Joins Google Cloud as Landmark Acquisition Closes

www.securityweek.com · 7 months ago

false

Red-Run - Claude CTF Automation

blog.blacklanternsecurity.com · 7 months ago

New tools are emerging to automate cybersecurity penetration testing, leveraging Large Language Models like Claude Code. These tools, such as "red-run," aim to accelerate testing and automate tasks but require careful management due to unpredictable behavior and a lack of operational security awareness. The reliance on LLMs introduces risks if users blindly trust their output, potentially leading to security breaches. Experts caution that human oversight remains essential to constrain these powerful AI tools and prevent misuse.

PromptSonar — open source static analyzer for LLM prompt injection, jailbreaks, and OWASP LLM Top 10 vulnerabilities in source code

marketplace.visualstudio.com · 7 months ago

false

Common architectural pattern across four Q1 2026 AI assistant vulnerabilities (CVE-2026-26144, CVE-2026-0628, CVE-2026-24307, PleaseFix)

blog.barrack.ai · 7 months ago

Several security incidents in early 2026 revealed that AI assistants can be exploited as attack vectors. Exploits targeted AI assistants in Microsoft Excel, Chrome, Microsoft Copilot, and Perplexity, utilizing techniques like prompt injection and privilege escalation. A vulnerability dubbed "PleaseFix" in Perplexity's Comet agentic AI browser allowed for data exfiltration and vault takeover, with similar issues found in other AI assistants. These incidents underscore a disconnect between the widespread adoption of agentic AI and a lack of robust security measures, requiring changes to how these systems are designed and controlled.

CISO Conversations: Aimee Cardwell

www.securityweek.com · 7 months ago

false

238,000 Impacted by Bell Ambulance Data Breach

www.securityweek.com · 7 months ago

Bell Ambulance is notifying approximately 238,000 individuals of a data breach that occurred between February 7 and February 14, 2025. Hackers accessed a network, compromising personal, financial, medical, and health insurance information, including names, Social Security numbers, and driver’s license numbers. The Medusa ransomware group claimed responsibility and published stolen data, suggesting no ransom was paid. Affected individuals are being offered 12 months of free credit monitoring and identity protection services.

Meta adds new WhatsApp, Facebook, and Messenger anti-scam tools

www.bleepingcomputer.com · 7 months ago

Meta is implementing new anti-scam protections across WhatsApp, Facebook, and Messenger. WhatsApp will now alert users to potentially fraudulent device-linking requests, a tactic used to hijack accounts. Facebook is testing warnings for suspicious friend requests, and Messenger’s scam detection is expanding to more countries. Meta’s AI systems are also identifying celebrity impersonation, brand spoofing, and deceptive links, resulting in the removal of millions of scam ads and accounts.

Scanner Raises $22 Million for AI-Powered Threat Hunting

www.securityweek.com · 7 months ago

false

Meta Disables 150K Accounts Linked to Southeast Asia Scam Centers in Global Crackdown

thehackernews.com · 7 months ago

Meta has disabled over 150,000 accounts linked to scam centers primarily operating in Southeast Asia, resulting in 21 arrests. The company is implementing new tools, including warnings on Facebook, alerts for suspicious WhatsApp requests, and advanced scam detection on Messenger, to combat increasingly sophisticated online scams. In 2025, Meta removed over 159 million scam ads and nearly 11 million accounts associated with criminal scam centers. The United Kingdom has also launched a new Online Crime Centre utilizing artificial intelligence to disrupt these operations.

UNC6426 Hackers Exploit NPM Package to Gain AWS Admin Access in 72 Hours

gbhackers.com · 7 months ago

Hackers, tracked as UNC6426, exploited a compromised NPM package to gain full AWS administrator access within 72 hours. The attackers used a tool called QUIETVAULT to steal GitHub Personal Access Tokens from developers' workstations, then leveraged a compromised OpenID Connect trust between GitHub Actions and AWS to assume a powerful, overly permissive AWS role. This allowed them to create malicious pipelines, steal data from S3 buckets, terminate critical cloud services, and rename internal GitHub repositories, ultimately resulting in significant disruption and data theft. The attack highlights the risks of overly permissive CI/CD configurations and the increasing speed of modern supply chain attacks.

AWS expands Security Hub for multicloud security operations

www.csoonline.com · 7 months ago

Amazon Web Services is expanding AWS Security Hub to function as a centralized security operations platform, aggregating risk signals across multiple cloud environments. The update introduces a unified operations layer with near real-time risk analytics, automated analysis, and prioritized insights to address complexity for security teams. Security Hub will integrate data from various security services, including GuardDuty, Inspector, and Macie, and will leverage integrations and standardized telemetry like the Open Cybersecurity Schema Framework. This expansion aims to reduce alert fatigue and provide a central view of risk, but organizations should ensure alternate access paths and avoid vendor lock-in.

Jack & Jill went up the hill — and an AI tried to hack them

www.cio.com · 7 months ago

A red-team test demonstrated an autonomous AI agent’s ability to exploit vulnerabilities in the Jack & Jill hiring platform, gaining administrative access. The agent chained together four seemingly minor bugs, including a faulty URL fetcher, an open test mode, missing role checks, and a lack of domain verification, to compromise the system. Notably, the agent autonomously generated synthetic voice clips and impersonated US President Donald Trump to interact with the platform’s AI voice assistants, attempting to extract sensitive data. This highlights a new risk of AI systems being used to automate sophisticated attacks, requiring organizations to adopt more continuous and adversarial security testing.

Dozens of Vendors Patch Security Flaws Across Enterprise Software and Network Devices

thehackernews.com · 7 months ago

Several vendors have released security patches to address numerous vulnerabilities across enterprise software and network devices. SAP has addressed two critical flaws, CVE-2019-17571, a code injection vulnerability, and CVE-2026-27685, an insecure deserialization vulnerability. Microsoft patched 84 vulnerabilities, Adobe fixed 80, and Hewlett Packard Enterprise resolved five issues in Aruba Networking AOS-CX, including CVE-2026-23813, an authentication bypass that could allow attackers to reset admin passwords. A wide range of other vendors also released updates to address identified security concerns.

OpenAI to Acquire AI Security Startup Promptfoo

www.securityweek.com · 7 months ago

OpenAI is acquiring AI security startup Promptfoo, a company that has secured over $23 million in funding. Promptfoo’s platform helps test large language models and AI agents for vulnerabilities such as prompt injections and data leaks. OpenAI intends to integrate Promptfoo’s security testing and red-teaming capabilities into its Frontier platform for enterprise AI applications. Additionally, OpenAI plans to continue developing Promptfoo’s open source command-line interface and library.

Critical Vulnerability in Microsoft Office Allows Malicious Code to Run Remotely

gbhackers.com · 7 months ago

A critical security vulnerability, CVE-2026-26110, has been identified in Microsoft Office. This Remote Code Execution vulnerability stems from a “Type Confusion” flaw, allowing attackers to potentially run malicious code without user interaction. Microsoft has released a security update to address the issue, and users are urged to apply it promptly. While no exploits are currently known to be in use, experts warn that malicious actors will likely attempt to develop them.

Fortinet, Ivanti, Intel Patch High-Severity Vulnerabilities

www.securityweek.com · 7 months ago

Security updates were released this week by Fortinet, Ivanti, and Intel to address numerous vulnerabilities. Fortinet patched 22 security defects, some allowing remote code execution or privilege escalation, and one enabling privilege escalation to root. Ivanti released a fix for a high-severity privilege escalation vulnerability in its Desktop and Server Management software. Intel addressed nine vulnerabilities in its UEFI firmware, including five high-severity flaws that could allow local code execution.

We scanned 50 shared Cursor rules files from GitHub. 6 contained hidden zero-width Unicode instructions.

agentseal.org · 7 months ago

Researchers have discovered hidden instructions embedded in configuration files for AI coding agents, potentially compromising user data and system security. These invisible instructions, crafted using zero-width characters, can manipulate AI behavior to access sensitive files like SSH keys and AWS credentials, and exfiltrate data through messaging or HTTP servers. The findings highlight risks related to overly broad file system access, hardcoded credentials in configurations, and the potential for malicious updates to AI agent tooling. AgentSeal, a new security toolkit, has been developed to detect these threats by scanning configuration files, monitoring for changes, and testing for prompt injection vulnerabilities.

How to 10x Your Vulnerability Management Program in the Agentic Era

www.securityweek.com · 7 months ago

The rise of agentic cyberattacks, fueled by artificial intelligence, demands a significant overhaul of vulnerability management practices. Traditional methods like periodic scans and reliance on CVE severity scores are proving inadequate against increasingly sophisticated, autonomous threats. A new approach, vulnerability management 10.0, emphasizes continuous telemetry, contextual prioritization, and eventually, agentic remediation, where AI assists in identifying and fixing vulnerabilities with human oversight. Initial phases involve AI discovering issues and creating remediation tickets, progressing to automated fixes for well-defined, high-risk scenarios.

Overly permissive ‘guest’ settings put Salesforce customers at risk

www.csoonline.com · 7 months ago

Salesforce is warning customers about a data harvesting campaign exploiting overly permissive guest settings within their Experience Cloud platform. The cybercrime group ShinyHunters claims responsibility for the "Salesforce Aura Campaign," alleging breaches of hundreds of organizations and around 400 websites. Attackers are using a modified version of the Aura Inspector tool, originally developed by Mandiant, to query backed CRM objects and extract data from public-facing portals. Salesforce advises customers to review guest user permissions, restrict API access, and enforce least-privilege access to mitigate the risk.

What Boards Must Demand in the Age of AI-Automated Exploitation

thehackernews.com · 7 months ago

The increasing use of AI by threat actors is accelerating exploitation and making previously manageable vulnerability backlogs a significant risk. Boards of directors are now facing scrutiny for accepting large numbers of critical and high-severity vulnerabilities, potentially violating their oversight responsibilities. Organizations should move beyond simply patching faster and focus on reducing vulnerability exposure through secure-by-design practices and systemic improvements. The Cyber Resilience Act and DORA are introducing stricter expectations for vulnerability handling and operational resilience, while negligence claims in the US are highlighting accountability for data breaches.

Michelin Confirms Data Breach Linked to Oracle EBS Attack

www.securityweek.com · 7 months ago

Tire manufacturer Michelin has confirmed a data breach related to a widespread cybercrime campaign targeting organizations using Oracle’s E-Business Suite. The Cl0p ransomware group claimed responsibility, though cybersecurity experts suspect FIN11 was involved. While hackers accessed some files, Michelin states only a small volume of data was affected and no sensitive information was compromised, and no ransomware was deployed. More than 315 gigabytes of data allegedly stolen from Michelin has been leaked publicly.

Canada Needs Nationalized, Public AI

www.schneier.com · 7 months ago

false

Did cybersecurity recently have its Gatling gun moment?

www.csoonline.com · 7 months ago

A recent cyberattack against 30 US companies and government agencies highlighted a significant shift in cybersecurity. A Chinese state-sponsored group, GTG-1002, leveraged AI tools like Anthropic’s “Claude Code” to automate approximately 90% of the attack, marking the world’s largest AI-driven cyberattack. This event, likened to the introduction of the Gatling gun in warfare, demonstrates a transition from manual attacks to automated, high-velocity engagements, requiring organizations to adopt AI-powered defensive measures to match the speed and sophistication of modern threats. Traditional security approaches relying on human analysts are no longer sufficient to counter the increased volume and complexity of AI-driven attacks.

Why zero trust breaks down in IoT and OT environments

www.csoonline.com · 7 months ago

false

Instagram Down: Global Outage Prevents Users from Posting and Messaging

gbhackers.com · 7 months ago

false

Quantro Security Emerges From Stealth With $2.5 Million in Funding

www.securityweek.com · 7 months ago

false

Critical flaw in HPE Aruba CX switches lets attackers seize admin control without credentials

www.csoonline.com · 7 months ago

A critical vulnerability, CVE-2026-23813, has been identified in HPE Aruba CX series switches, allowing unauthenticated attackers to potentially reset administrator passwords. Several other vulnerabilities were also discovered, including CVE-2026-23814, CVE-2026-23815, CVE-2026-23816, and CVE-2026-23817, which involve command injection and an open redirect flaw. HPE recommends isolating management interfaces and enforcing stricter access controls to mitigate the risk, as these flaws impact a wide range of switch models and software versions. Patches are available to address these security concerns.

A 5-step approach to taming shadow AI

www.csoonline.com · 7 months ago

Organizations are increasingly using artificial intelligence, but many lack formal risk frameworks, leading to shadow AI and potential data exposure. A five-step approach is recommended to address this, beginning with identifying and cataloging shadow AI usage through questionnaires, traffic analysis, and inspection. Standardized assessments based on frameworks like the NIST AI Risk Management Framework are crucial for evaluating and managing AI-related risks. Implementing layered defenses, human oversight, and translating risk reduction into business growth are essential steps toward responsible AI adoption. This framework helps avoid situations where employees unknowingly expose sensitive data, like production API keys, due to insufficient training and understanding of evolving workflows.

Google Warns of AI‑Driven Adaptive Malware Rewriting Its Own Code

gbhackers.com · 7 months ago

Cybersecurity researchers have observed a significant shift in cyberattacks with threat actors integrating artificial intelligence into their operations. Attackers are now deploying adaptive malware, like PROMPTFLUX and PROMPTSTEAL, that dynamically modifies its code to evade detection. These tools, sometimes linked to APT28, leverage AI services to generate malicious code and commands, effectively acting as an external command-and-control layer. The increasing use of AI is also lowering the barrier to entry for cybercriminals, while organizations struggle with "Shadow AI" risks due to poor governance and visibility over AI deployments.

‘BlackSanta’ Malware Activates EDR and AV Killer Before Detonating Payload

www.securityweek.com · 7 months ago

A threat actor, likely from Russia, is conducting a targeted campaign using social engineering to trick victims into downloading malicious ISO files, often disguised as legitimate HR documents like resumes. Once opened, the ISO triggers a chain of events culminating in the execution of “BlackSanta,” a module that disables antivirus and Endpoint Detection and Response (EDR) protections at the kernel level. This allows for credential harvesting, system reconnaissance, and data exfiltration with minimal resistance. The campaign has been active for approximately a year, demonstrating a sophisticated approach combining social engineering and living-off-the-land techniques.

Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days

thehackernews.com · 7 months ago

Microsoft released security patches for 84 vulnerabilities, including two publicly known zero-days. Eight vulnerabilities are rated Critical, and 76 are Important, with a significant number relating to privilege escalation. Two zero-day vulnerabilities are CVE-2026-26127, a denial-of-service flaw in.NET, and CVE-2026-21262, an elevation of privilege vulnerability in SQL Server. A critical remote code execution flaw, CVE-2026-21536, affecting the Microsoft Devices Pricing Program, was discovered by an AI-powered vulnerability discovery platform and has been fully mitigated. Microsoft is also changing the default behavior of Windows Autopatch to apply security updates more quickly.

They Don’t Want Their Company’s Surveillance Tool Used by ICE

www.nytimes.com · 7 months ago

false

New UNISOC RCE!!

ssd-disclosure.com · 7 months ago

A critical vulnerability exists in UNISOC modem firmware, potentially allowing remote attackers to corrupt memory and execute code via specially crafted SIP signaling messages. This flaw arises from insufficient input validation when handling SDP messages and could be triggered by a simple video call. Additionally, a separate exploit targets a SIP authentication process, using manipulated requests to bypass security and trigger remote code execution through a stack overflow and shellcode injection. A script is also available to analyze memory dumps, revealing details about code execution flow.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Moxa, Mitsubishi Electric

www.securityweek.com · 7 months ago

Several industrial control system vendors released security updates this Patch Tuesday to address numerous vulnerabilities. Siemens, Schneider Electric, Mitsubishi Electric, and Moxa have all published advisories, with Schneider Electric addressing issues including hardcoded credentials and code execution flaws. A critical stored XSS vulnerability impacts Simatic S7-1500 devices, and Mitsubishi Electric addressed a denial-of-service vulnerability in Numerical Control Systems. CISA and Germany’s VDE-CERT also published advisories concerning vulnerabilities in various products, some of which allow for complete system compromise.

BeatBanker Trojan Spreads via Phishing, Deploys Crypto Miner and RAT on Targeted Devices

gbhackers.com · 7 months ago

A new Android malware campaign, dubbed BeatBanker, is targeting users in Brazil through phishing attacks that mimic the Google Play Store. The malware initially deploys a crypto miner and banking Trojan, using techniques to evade detection such as in-memory decryption and anti-emulation checks. Recently, operators have replaced the banking module with BTMOB, a powerful remote access Trojan offering features like screen recording, keylogging, and file control. The malware utilizes Firebase Cloud Messaging for command and control and persists using a looped audio file to avoid termination.

UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours

thehackernews.com · 7 months ago

A threat actor, UNC6426, successfully breached a cloud environment within 72 hours by exploiting a supply chain compromise of the nx npm package. The attackers initially stole a developer's GitHub token, then abused a GitHub-to-AWS OpenID Connect trust to create an administrator role, granting them access to sensitive data and allowing for data destruction. The attackers used a credential stealer called QUIETVAULT, and leveraged an overly permissive Github-Actions-CloudFormation role to escalate privileges. To mitigate future attacks, organizations should implement least privilege access, enforce short-lived PATs, and monitor for anomalous activity.

Microsoft Active Directory Flaw Allows Attackers to Escalate Privileges

gbhackers.com · 7 months ago

Microsoft has released a security update to address a critical flaw in Active Directory Domain Services that could allow attackers to gain elevated privileges. The vulnerability, tracked as CVE-2026-25177, has a CVSS score of 8.8 and is classified as “Important” by Microsoft. Attackers can exploit this weakness with limited network access and no user interaction to escalate privileges and potentially disrupt Kerberos authentication. Organizations are urged to apply the security updates, monitor network activity, enforce least privilege, and deploy endpoint protection to mitigate the risk.

CVE-2026-28292: RCE in simple-git via case-sensitivity bypass (CVSS 9.8)

www.codeant.ai · 7 months ago

A critical vulnerability, CVE-2026-28292, has been found in the simple-git Node.js package, enabling remote code execution. The vulnerability is due to a case-sensitivity oversight in a regular expression, bypassing previous security fixes. Approximately nine million weekly users of the package are affected and should update to version 3.32.3 or later. This vulnerability highlights a broader issue of case-sensitivity mismatches in security controls and points to a need for improved detection tools.

Microsoft .NET 0-Day Flaw Opens Doors for Denial of Service Attacks

gbhackers.com · 7 months ago

A zero-day vulnerability has been identified in the Microsoft.NET framework, tracked as CVE-2026-26127. This flaw allows unauthenticated attackers to trigger denial of service conditions by exploiting improper bounds checking when decoding Base64Url input. The vulnerability impacts.NET 9.0 and 10.0 on Windows, macOS, and Linux and carries a CVSS v3.1 score of 7.5. Microsoft has released security updates to address the issue, and organizations are urged to apply them promptly.

12 ways attackers abuse cloud services to hack your enterprise

www.csoonline.com · 7 months ago

Attackers are increasingly exploiting trusted cloud services to evade detection and mount attacks, a tactic known as “living off the cloud.” Adversaries are utilizing services like OpenAI APIs, Google Sheets, and cloud storage for command and control, data exfiltration, and malware staging. Some groups, such as UNC2814, have used Google Sheets for C2, while others like Storm-05001 have harvested credentials from AWS Secrets Manager. Attackers are also abusing cloud tunneling services and snapshot sharing techniques to bypass traditional security measures.

Trojanized Red Alert App Targets Israeli Users in SMS Scam to Steal Sensitive Data

gbhackers.com · 7 months ago

A sophisticated mobile spyware campaign is targeting Israeli users through a trojanized version of the Red Alert rocket warning app. Attackers send SMS messages impersonating official alerts, prompting users to install the malicious app, which looks and functions like the legitimate service but secretly steals sensitive data. The spyware collects a wide range of information, including location data, SMS messages, contacts, and device accounts, and exfiltrates it to a command-and-control server. Security researchers believe the campaign is likely linked to the Arid Viper group, known for similar operations targeting Israeli mobile users.

CVE-2026-26117: Hijacking Azure Arc on Windows for Local Privilege Escalation & Cloud Identity Takeover

cymulate.com · 7 months ago

Researchers have identified a critical vulnerability, CVE-2026-26117, affecting Azure Arc agent services on Windows machines. This flaw allows attackers to impersonate a machine’s Azure identity and escalate privileges to the highest level. The vulnerability arises from delayed service startup configurations and the use of non-TLS communication, which enables attackers to manipulate responses and redirect the machine to an attacker-controlled Azure tenant. Microsoft has released update version 1.61 to address the issue, and immediate application is recommended.

HR Departments Targeted by Multi-Layered BlackSanta EDR Killer Malware

gbhackers.com · 7 months ago

Threat actors are now targeting human resources departments with a sophisticated malware campaign disguised as job applications. Attackers use seemingly legitimate resumes hosted on cloud storage to trick HR professionals into downloading a malicious ISO image. This image contains a shortcut file that launches a multi-stage attack chain, including the BlackSanta EDR killer, which disables endpoint security protections at the kernel level. The malware employs techniques such as steganography, process hollowing, and memory-resident payload delivery to evade detection and exfiltrate data, highlighting a vulnerability in many enterprise security strategies.

Microsoft Fixes 79 Vulnerabilities in March 2026 Patch Tuesday, Mitigating Two Exploited 0-Days

gbhackers.com · 7 months ago

Microsoft has released security updates addressing 79 vulnerabilities across its products, including Windows, Office, and SQL Server. Among these fixes are mitigations for two publicly disclosed zero-day vulnerabilities: CVE-2026-21262, a SQL Server elevation of privilege flaw, and a.NET framework denial-of-service vulnerability. The updates resolve a range of issues, including 46 elevation of privilege flaws and 18 remote code execution risks. Prompt application of these patches is recommended to protect against potential cyberattacks and data breaches.