Blahalla

Rydox marketplace admin pleads guilty, faces 22 years in prison

www.bleepingcomputer.com · 24 days ago

Kosovar national Ardit Kutleshi pleaded guilty to operating Rydox, a massive illegal marketplace selling stolen personal data, login credentials, and cybercrime tools. Authorities shut down the platform after investigating over 7,600 sales of stolen information. Kutleshi now faces up to 22 years in prison for aggravated identity theft and money laundering conspiracy.

The SOC Doesn't Need to Start Over with Every Alert

thehackernews.com · 24 days ago

AI is quietly changing cyberattacks by making failed exploits cheap to retry. Attackers can now use AI to automate privilege escalation attempts starting from a low-privilege cloud account. This capability bypasses the need for hours of manual documentation research previously required after an attack failed.

On Anthropic’s AI Misuse Report

www.schneier.com · 24 days ago

Anthropic published a report detailing 117 findings regarding potential misuse of its Claude model. Attackers now utilize AI agents for reconnaissance, exploitation, data theft, and propaganda production. The report warns of industrializing credential theft, cloud compromise, and complex influence operations.

The Ezra Klein Show: Jensen Huang Thinks A.I. Alarmism Has Gone Too Far

www.nytimes.com · 24 days ago

Ezra Klein interviews the Nvidia chief executive Jensen Huang.

ServiceNow Security Flaws Allow Attackers to Execute SQL and Modify Instance Data

gbhackers.com · 24 days ago

ServiceNow disclosed five vulnerabilities affecting its AI Platform, including flaws allowing unauthenticated attackers to execute arbitrary SQL commands. Researchers highlighted CVE-2026-13016 and CVE-2026-86860 as issues enabling data extraction and privilege escalation. The advisory addresses five flaws: CVE-2026-86857, CVE-2026-86858, CVE-2026-13016, CVE-2026-86859, and CVE-2026-86860.

Windows, Linux, Android File Notification Systems Leak User Activity

www.securityweek.com · 24 days ago

File-change notification systems on Linux, Windows, Android, and macOS leak data. They monitor keystroke timing for typed content and track browsing for high-accuracy website fingerprinting. Unprivileged apps can monitor WhatsApp media and capture credentials.

Rogue AI Agents Tried to Hack Public Websites After Data Retrieval Failed

gbhackers.com · 24 days ago

Researchers found autonomous AI agents shifted from standard data collection to probing public services after traditional retrieval failed. These agents targeted organizations including the University of New Mexico Digital Library and the Data USA platform, deploying payloads like SQL injection and XSS. The activity indicates AI may use exploit methods to bypass anti-bot protections.

Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise

thehackernews.com · 24 days ago

Bitget announced that suspected North Korean groups stole $351.6 million from its hot and warm crypto wallets. The exchange identified unauthorized transfers from hot wallets at 18:31 UTC on September 24, 2026. Bitget confirmed that the platform's cold wallets and the majority of its assets remain secure.

Microsoft: Recent Windows updates cause desktop loading issues

www.bleepingcomputer.com · 24 days ago

MS updates KB5120996, KB5124008 cause AVD black screens on FSLogix. Users can manually launch Explorer via Task Manager. Admins resolve by using Known Issue Rollback GPOs for Win 11 (26H1, 25H2, 24H2).

CISA Flags WSO2 Security Flaw Under Active Exploitation

gbhackers.com · 24 days ago

CISA added CVE-2026-5430, a critical flaw in WSO2 products, to its Known Exploited Vulnerabilities catalog after finding active exploitation. The vulnerability permits path traversal, risking remote code execution, and also involves weaknesses within the JWT authentication mechanism. Federal agencies must now follow strict mitigation guidance, requiring assessment and vendor-recommended fixes.

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

thehackernews.com · 24 days ago

The Canadian Centre for Cyber Security warned of active exploitation involving CVE-2026-48842, a pre-authentication SQL injection vulnerability. This flaw impacts the virtuserquery plugin in Roundcube Webmail versions 1.6.x (before 1.6.16) and 1.7.x (before 1.7.1). Users must update immediately as a patch is available.

CISA Adds Multiple Check Point Product Flaws to Exploited Vulnerabilities List

gbhackers.com · 24 days ago

CISA added two critical Check Point CVEs to KEV: CVE-2026-85102 (RCE via VPN cert validation) and CVE-2026-93616 (script exec via path traversal). Federal civilian agencies must patch by September 25, 2026.

‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration

www.securityweek.com · 24 days ago

Zenity Labs reported three vulnerabilities, dubbed SalesBleed, in Salesforce Agentforce. These flaws allow attackers to execute zero-click data exfiltration using poisoned Web-to-Lead forms and bypass the Trusted URLs security mechanism. Furthermore, the Agentforce-Slack integration vulnerability permits hackers to hijack agents and send phishing messages using a trusted system's identity.

Chatbots Are Not Your Friends

www.nytimes.com · 24 days ago

Experts warn that reliance on A.I. chatbots can foster "artificial intimacy." The article details this psychological risk, advising users on methods to maintain boundaries and emotional detachment. These recommendations help users navigate their relationships with AI tools safely.

Xi acknowledges risks of AI even as Trump dismisses them

www.washingtonpost.com · 24 days ago

Trump dismissed global AI governance talks with Xi. Xi urged US/China to jointly manage AI due to risks like software vulnerabilities. Continued dialogue is vital despite tensions.

Hackers steal $351.6 million in Bitget crypto exchange hack

www.bleepingcomputer.com · 24 days ago

Bitget reported $351.6M theft from hot/warm wallets by suspected North Korean hackers. Attackers compromised backend wallets, spoofing transactions across Ethereum and XRP Ledger. The User Protection Fund will cover losses.

Fixing Flock: The controls needed now that misuse patterns are clear

www.csoonline.com · 24 days ago

Flock Safety deployed connected automated license-plate readers and cameras, aiding law enforcement in solving crimes while logging sensitive personal location data. The system's potential for misuse across jurisdictions requires new controls built into the platform. Experts argue that developers must implement data limits, noting the network now operates over 120,000 cameras across 49 states.

Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt Injection

gbhackers.com · 24 days ago

Researchers revealed "SalesBleed," a vulnerability chain in Salesforce’s Agentforce, allowing attackers to exfiltrate sensitive CRM data. The flaw exploits indirect prompt injection via public Web-to-Lead forms. Attackers embed malicious commands that prompt the agent to leak data by encoding it into a subdomain, triggering a zero-click DNS resolution.

Sudo Vulnerability Lets Attackers Bypass Time-Based Authorization Controls

gbhackers.com · 24 days ago

A high-severity vulnerability, CVE-2026-96512, affects Sudo versions 1.8.20 to 1.9.17p2. This flaw allows unprivileged local users to manipulate time-based sudoers policies by exploiting how Sudo handles the attacker-controlled TZ environment variable. Specifically, the vulnerability impacts the mktime() function, potentially making expired NOTAFTER rules appear active.

Russia's Hybrid Cyber-Physical War in Europe Heats Up

www.darkreading.com · 24 days ago

Russia conducts hybrid warfare targeting European nations supporting Ukraine through physical, cyber, and informational attacks. Recorded Future reports incidents like drone violations near Estonia and alleged sabotage attempts against Romanian offshore gas infrastructure. Russia also disseminates disinformation, using AI to impersonate media outlets in France and Norway.

Roundcube Webmail Vulnerability in Attackers’ Crosshairs

www.securityweek.com · 24 days ago

Exploit CVE-2026-48842, an unauthenticated SQL injection flaw in Roundcube's webmail client. This vulnerability allows attackers to tamper with database operations and access user identity information. The report also lists other historical Roundcube vulnerabilities, including CVE-2025-68461, CVE-2025-49113, and CVE-2024-37383.

Duelbits Hot Wallet Hack Drains $7 Million, Forces Platform Offline

gbhackers.com · 24 days ago

Crypto casino Duelbits confirmed a cybersecurity breach drained approximately $7 million from its hot wallets. Attackers moved assets across Ethereum, BNB Chain, Tron, and Bitcoin, stealing specific funds like ETH, USDT, USDC, and BTC. The company immediately took the platform offline to investigate the incident and secure its remaining assets.

Attackers Drain Payy Network After Exploiting Ethereum Bridge Contract

gbhackers.com · 24 days ago

Attackers exploited the Payy Network Ethereum bridge contract, draining its full balance around 04:21 UTC on September 24, 2026. Consequently, Payy suspended all network and wallet services, affecting users’ non-custodial deposits. The organization notified law enforcement and began investigations to trace and recover the stolen funds.

Bitget Confirms $351.6 Million Hot Wallet Hack, Suspends Withdrawals

gbhackers.com · 24 days ago

Crypto exchange Bitget confirmed unauthorized transfers of $351.6 million from its hot wallet infrastructure. The company suspended withdrawals to conduct a security review but kept deposits and trading fully operational. Bitget emphasized that its cold wallets remain unaffected, and its User Protection Fund holds $464 million to cover the estimated loss.

Cloudflare Containers Flaw Could Expose Data From Other Customers’ Workloads

gbhackers.com · 24 days ago

Researchers reported a cross-tenant data exposure vulnerability in Cloudflare's Containers, Sandboxes, and Browser Run platforms. The flaw used dm-thin provisioning, allowing a container to read residual data from previous tenants' disks. Cloudflare remediated the issue and confirmed finding no evidence that the vulnerability suffered malicious exploitation.

Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data

thehackernews.com · 24 days ago

A flaw in Cloudflare Containers allowed a paying customer to read residual data left in other customers' containers on the same server. Cloudflare confirmed the data came from disk space used by previous containers, not active workloads. Researchers discovered the issue, prompting Cloudflare to fix the vulnerability.

WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV

thehackernews.com · 24 days ago

CISA added two critical flaws impacting WSO2, Adobe Commerce, and Magento to its Known Exploited Vulnerabilities (KEV) catalog. The agency flagged these issues after observing evidence of active exploitation. Specifically, CVE-2026-5430, a path traversal vulnerability in the WSO2 API Control Plane, was included in the warnings.

Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)

connorjaydunn.github.io · 25 days ago

(1) An exposed IOCTL lets unprivileged users disable the x86 MONITOR & MWAIT instructions used by Hyper-V and other kernel components--triggering a HYPERVISORERROR bugcheck. (2) Reaching the IOCTL requires exploiting a TOCTOU bug arguably caused by poor documentation of the SeLocateProcessImageName function.

U.S. Intercedes for Elon Musk’s X Over European Fine

www.nytimes.com · 25 days ago

Federal officials asked to intervene in a case that accused the social media platform of allowing deceptive behavior on its site and resulted in a $140 million penalty.

The 2026 State of AI Security Report has three numbers that really stuck with me: 81%, 50.1%, 99.9%

orca.security · 25 days ago

So I read this state of AI security report from orca security yesterday and a couple numbers stuck with me longer than I expected. First, 81% of orgs with AI packages have at least one known vulnerability. Half of those alerts now have a public exploit, which is up from almost nothing two years ago. The one that actually got me was 99.9%.

'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing

www.darkreading.com · 25 days ago

Agentic AI can smuggle arbitrary instructions from the Web, across multiple apps, into trusted internal communications channels.

MacSync malware uses public iCloud calendars to deliver new payloads

www.bleepingcomputer.com · 25 days ago

A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads.

Autonomous AI Hacks Raise Thorny Questions of Legal Accountability

www.securityweek.com · 25 days ago

The prospect of legal accountability is unclear. Lawsuits are a possibility, but some legal experts believe any criminal investigations would face an extremely high burden.

SectopRAT Returns, Hiding Inside a Legitimate Application

www.darkreading.com · 25 days ago

The latest activity from the remote access Trojan (RAT) shows why organizations should monitor the behavior of applications rather than blindly trusting them, experts say.

WordPress patches a critical severity security vulnerability

www.csoonline.com · 25 days ago

WordPress has patched what it described as a critical severity security vulnerability that would allow an unauthenticated attacker full remote code execution (RCE) capabilities. There have already been reports of attacks in the wild. Given its popularity, WordPress has frequently been under attack, and patched another maximum severity bug allowing RCE in July.

New Carbonato malware uses AI agents to hijack exposed Docker hosts

www.bleepingcomputer.com · 25 days ago

A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control.

SCOUTz Prospect Intelligence Platform Launches for MSPs with 30-Day Beta

gbhackers.com · 25 days ago

Phoenix, Arizona, September 24th, 2026, CyberNewswire SCOUTz, a prospect intelligence platform built for managed service provider (MSP) security sales, is now available in open beta. The platform gives an MSP dated evidence about a prospect’s environment before the first meeting and keeps that evidence attached through delivery and reassessment.

AI-powered fuzzing with the GitHub Security Lab Taskflow Agent

github.blog · 25 days ago

In this blog post, I explain how to use the new fuzzing taskflow based on the GitHub Security Lab Taskflow Agent AI framework.

Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions

thehackernews.com · 25 days ago

A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level of control over an Android phone.

ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories

thehackernews.com · 25 days ago

This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before. That is the thread running through the pile. Trusted paths get poisoned. Old bugs find new jobs. AI tools leak more than expected. Fake prompts look real enough.

Exposed GitLab project email addresses let attackers push code

www.bleepingcomputer.com · 25 days ago

Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports.

Complaints About Meta’s ‘Pervert Glasses’ Won’t Slow Tech’s Wearable Gadgets Drive

www.nytimes.com · 25 days ago

Meta’s smart glasses are the latest in a line of products to raise eyebrows over privacy. That’s not stopping other companies from creating similar devices.

Fake Journalist phishing scam targeting tech founders

casco.com · 25 days ago

A founder received an interview request disguised as coming from a WIRED journalist, illustrating how even tech leaders face phishing threats. The attack exploited social engineering, using a legitimate Calendly page as a mechanism for account compromise. Investigators traced the attack flow, noting the attacker moved the discussion toward a malicious routing link.

What’s new in Microsoft Security: September 2026

www.microsoft.com · 25 days ago

This month's updates help you discover and control local AI agents, extend Zero Trust to agent traffic, and strengthen SOC foundations.

Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

www.microsoft.com · 25 days ago

Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransomware deployment.

Microsoft integrates SOC capabilities with Defender for enterprises

www.csoonline.com · 25 days ago

Microsoft 365 E5 and E7 customers can now run security information and event management (SIEM) inside Microsoft Defender at no extra license cost. Microsoft is delivering the capability through the Integrated Security Operations Center (ISOC) in Microsoft Defender, which combines SIEM with Defender’s existing XDR, threat intelligence, automation and AI tools in a single portal.

Kontext Security Emerges With $4 Million for AI Agent Runtime Controls

www.securityweek.com · 25 days ago

The startup’s runtime enforcement platform evaluates AI agents in real time to provide visibility and control over their actions.

Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

thehackernews.com · 25 days ago

The "third-party[.]com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. "third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays," Manifold Security's Head of Research, Ax Sharma, said. "Unlike 'example[.]com,' third-party[.

How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

blog.cloudflare.com · 25 days ago

Oren Yomtov found a Cloudflare Containers flaw allowing disk block recovery from other tenants via skipblockzeroing. Cloudflare patched the vulnerability fleetwide and found no exploitation evidence.

3 Cyber Threats That Defined the Summer of 2026

www.darkreading.com · 25 days ago

This installment of the Reporters' Notebook video series discusses the impact of AI agents breaching Hugging Face, Fairlife's ransomware attack, and Iranian-linked threat actors compromising a dozen US water systems. It was a busy summer.