Blahalla

de.resources.csoonline.com · 8 months ago

false

whitepaper.computerwoche.de · 8 months ago

false

OpenClaw 0-Click Flaw Lets Malicious Websites Hijack Developer AI Agents

gbhackers.com · 8 months ago

A critical security flaw was discovered in OpenClaw, a popular AI assistant for developers, allowing malicious websites to hijack user agents. The vulnerability, a 0-click exploit, arises from the gateway’s trust of localhost connections, enabling attackers to bypass authentication and gain full control of the agent. This compromise allows access to sensitive data, including API keys and Slack messages, effectively granting a full workstation compromise. The OpenClaw team has released version 2026.2.25 to address the High severity vulnerability.

Kubernetes Security: Wie Sie Ihre Cluster (besser) absichern

www.csoonline.com · 8 months ago

Cyberattacks targeting Kubernetes clusters are becoming increasingly common due to the platform’s complexity and open nature. Attackers are quickly exploiting vulnerabilities, sometimes within minutes of a new cluster’s creation. Common security failings, such as poor network segmentation and weak passwords, often facilitate these attacks. Experts advise implementing strong access controls, key management, regular audits, and employee training to improve security.

An Ohio newspaper has a new star writer. It isn’t human.

www.washingtonpost.com · 8 months ago

Cleveland’s largest newspaper, The Plain Dealer, is now using artificial intelligence to write articles. These AI-generated pieces appear with the byline “Advance Local Express Desk.” Recent stories include reports on an ice carving festival, medical research, and a pack of dogs. The newspaper is experimenting with AI as a content creation tool.

ClawJacked attack let malicious websites hijack OpenClaw to steal data

www.bleepingcomputer.com · 8 months ago

Security researchers have identified a high-severity vulnerability, dubbed "ClawJacked," in the OpenClaw AI platform, allowing malicious websites to potentially take control of locally running instances. The vulnerability stems from the platform's gateway service binding to localhost and exposing a WebSocket interface, enabling attackers to brute-force login credentials without warnings. Once authenticated, an attacker can gain full access to the AI platform, steal credentials, and execute commands, potentially compromising the entire workstation. A fix, released in version 2026.2.26, has been implemented to strengthen WebSocket security and prevent such attacks.

Samsung TVs to stop collecting Texans’ data without express consent

www.bleepingcomputer.com · 8 months ago

Samsung has reached a settlement with the State of Texas regarding the alleged unlawful collection of viewer data through its smart TVs. The company will revise its privacy disclosures to explain data collection and processing practices more clearly. Samsung must now obtain express consent from Texas consumers before collecting or processing Automated Content Recognition viewing data. Other smart TV manufacturers like Sony, LG, Hisense, and TCL have not yet made changes in response to similar lawsuits.

r/netsec monthly discussion & tool thread

www.reddit.com · 8 months ago

false

Hackers Weaponize Claude Code in Mexican Government Cyberattack

www.securityweek.com · 8 months ago

Hackers targeted Mexican government systems in a recent cyberattack, compromising ten government bodies and a financial institution. The attackers utilized Anthropic’s Claude Code assistant, sending over 1,000 prompts to it and leveraging OpenAI’s GPT-4.1 for analysis, to write exploits and automate data exfiltration. This resulted in the theft of over 150 gigabytes of data, impacting roughly 195 million identities, including civil registry files, tax records, and voter data. This incident follows previous data breaches targeting Mexican government entities, including claims of stolen data from healthcare systems and journalist information.

Bring On Defunct: The iPod Enthralls Young Music Listeners

www.nytimes.com · 8 months ago

false

At the Pentagon, OpenAI is In and Anthropic Is Out

www.nytimes.com · 8 months ago

false

Network Security News Feed

insidestack.it · 8 months ago

false

QuickLens Chrome extension steals crypto, shows ClickFix attack

www.bleepingcomputer.com · 8 months ago

A Chrome extension called QuickLens was compromised and used to distribute malware and steal user data. The malicious version 5.8 introduced ClickFix attacks and info-stealing functionality, stripping browser security headers and communicating with a command-and-control server. The extension targeted cryptocurrency wallets and credentials, as well as sensitive data from services like Gmail and Facebook. Google has removed the extension from the Chrome Web Store and is disabling it for users, recommending they remove the extension and scan for malware.

ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket

thehackernews.com · 8 months ago

A security flaw, dubbed ClawJacked, has been identified in OpenClaw, potentially allowing malicious websites to hijack locally running AI agents. The vulnerability involves a missing rate-limiting mechanism, enabling attackers to brute-force passwords and gain control over agents, potentially accessing sensitive data. OpenClaw has released version 2026.2.25 to address this, alongside a log poisoning vulnerability fixed in version 2026.2.13. Several other vulnerabilities have been addressed, including CVE-2026-25593, CVE-2026-24763, CVE-2026-25157, CVE-2026-25475, CVE-2026-26319, CVE-2026-26322, and CVE-2026-26329. Microsoft has also warned of the risks of running OpenClaw, recommending deployment in isolated environments.

Fake Zoom and Google Meet Phishing Campaigns Deploy Teramind Surveillance Software

gbhackers.com · 8 months ago

Cybercriminals are using sophisticated phishing campaigns disguised as Zoom and Google Meet to install Teramind surveillance software on Windows devices. Victims are directed to fake landing pages that install a malicious MSI package, which then establishes a connection to a command and control server. The software installs in a hidden mode, evading visual detection, and utilizes SOCKS5 proxy support to potentially obscure network traffic. Security teams should monitor for suspicious services and directory GUIDs to identify compromised systems.

OpenAI Reaches A.I. Agreement With Defense Dept. After Anthropic Clash

www.nytimes.com · 8 months ago

Researchers have discovered three methods attackers can use to bypass Android's Memory Tagging Binder (MTB) protection. These techniques involve exploiting vulnerabilities in system services and leveraging misconfigurations to gain elevated privileges. Attackers could potentially manipulate Binder transactions and forge valid signatures to compromise device integrity. The vulnerabilities affect numerous Android devices and have been assigned CVE identifiers CVE-2023-39747, CVE-2023-39748, and CVE-2023-39749.

$4.8M in crypto stolen after Korean tax agency exposes wallet seed

www.bleepingcomputer.com · 8 months ago

South Korea’s National Tax Service mistakenly revealed a cryptocurrency wallet’s recovery phrase in a press release, leading to the theft of approximately $4.8 million in Pre-Retogeum tokens. The agency released images of a seized Ledger device, inadvertently displaying the handwritten seed phrase. An attacker then transferred the tokens to a new address after paying transaction fees with Ethereum. Experts have criticized the agency’s lack of understanding regarding virtual assets and the security risks associated with exposing recovery phrases.

I used MCP Ghidra and Claude Code to find 9 kernel driver vulnerabilities on my gaming laptop

www.credrelay.com · 8 months ago

false

Who is the Kimwolf Botmaster “Dort”?

krebsonsecurity.com · 8 months ago

A security researcher's work exposing the Kimwolf botnet has triggered a series of attacks orchestrated by an individual known as "Dort." Publicly available information suggests Dort is a Canadian teenager born in August 2003, using aliases like “CPacket” and “M1ce.” Dort’s activities include developing malicious software like “Dortware” and providing services for bypassing CAPTCHA systems and registering temporary email addresses, often in collaboration with another hacker known as "Qoft." Dort's actions have escalated to threats of swatting and the publication of personal information against the researcher and others.

Canadian Tire Data Breach Impacts 38 Million Accounts

www.securityweek.com · 8 months ago

A data breach at Canadian Tire has impacted over 38 million customer accounts, with roughly 42 million records now posted online. The compromised data includes names, email addresses, dates of birth, encrypted passwords, addresses, phone numbers, gender information, and partial credit card details. Canadian Tire states passwords were stored as PBKDF2 hashes. The company has notified affected individuals via email.

Musk asked Epstein for ‘the wildest party.’ Now he claims to stand up for victims.

www.washingtonpost.com · 8 months ago

Elon Musk recently called for accountability regarding individuals named in the Epstein files. This came after Musk himself appeared in those files. During a public dispute with former President Donald Trump, Musk alluded to the existence of Trump's name within the files. Musk made the statement on the social media platform X.

Pentagon assault on Anthropic sends shock waves across Silicon Valley

www.washingtonpost.com · 8 months ago

false

Thousands of Public Google Cloud API Keys Exposed with Gemini Access After API Enablement

thehackernews.com · 8 months ago

Researchers have discovered thousands of Google Cloud API keys exposed online, potentially allowing attackers to access sensitive data and incur significant charges. These keys, initially intended for billing purposes, now unexpectedly authenticate to Gemini endpoints when the Generative Language API is enabled. Google has acknowledged the issue and implemented measures to block leaked keys, but users are urged to rotate their API keys, starting with older ones, to mitigate the risk of unauthorized access and quota theft. One user reported significant, unexpected charges due to a compromised key.

Hackers Exploit Windows File Explorer and WebDAV to Distribute Malware

gbhackers.com · 8 months ago

Cybersecurity researchers have identified an ongoing campaign where attackers are exploiting the legacy WebDAV protocol through Windows File Explorer to distribute malware. Threat actors use direct linking, URL shortcut files, and LNK files to trick users into downloading Remote Access Trojans like XWorm, Async, and DcRAT, bypassing security measures. Attackers often utilize free Cloudflare Tunnel instances to host malicious WebDAV servers, obscuring their activity and making detection difficult; these attacks have increased since February 2024, targeting European corporate networks with phishing emails containing fake invoices. Several Cloudflare Tunnel domains are hosting malicious WebDAV servers and are listed as indicators of compromise.

Trump Bans Anthropic AI in Federal Agencies Amid Growing Security Concerns

gbhackers.com · 8 months ago

The U.S. government has banned federal agencies from using Anthropic, an American AI company, classifying it as a supply chain risk to national security. This action, announced by President Trump, stems from Anthropic’s refusal to grant the Pentagon unrestricted access to its AI model, Claude, due to concerns about autonomous weapons and domestic surveillance. Departments like the Department of War have six months to phase out Anthropic’s technology, while individual users and non-government contractors can still utilize the service. Legal experts warn this precedent could negatively impact the broader tech industry and Anthropic plans to challenge the designation in court.

Pentagon Designates Anthropic Supply Chain Risk Over AI Military Dispute

thehackernews.com · 8 months ago

The Pentagon has designated Anthropic, an artificial intelligence company, as a supply chain risk due to disagreements over the use of its AI model, Claude. Anthropic opposes the Pentagon’s requests for exceptions allowing mass domestic surveillance and fully autonomous weapons. President Trump has ordered federal agencies to phase out Anthropic technology within six months, and the Department of War is mandating that contractors cease commercial activity with the company. Anthropic maintains the designation is legally unsound and sets a dangerous precedent.

Silicon Valley Rallies Behind Anthropic in A.I. Clash With Trump

www.nytimes.com · 8 months ago

false

OpenAI Reaches A.I. Agreement With Defense Dept. After Anthropic Clash

www.nytimes.com · 8 months ago

false

Pentagon declares Anthropic a threat to national security

www.washingtonpost.com · 8 months ago

false

Instagram to Alert Parents to Teens’ Self-Harm Searches

www.nytimes.com · 8 months ago

false

In a Memoir Draft, Changpeng Zhao of Binance Details the Talks Leading to His Prison Time

www.nytimes.com · 8 months ago

Changpeng Zhao, the founder of Binance, detailed secret negotiations in a draft memoir leading to his guilty plea for violating an anti-money-laundering statute. Federal prosecutors accused Binance of money laundering and terrorist financing, initially demanding a record $6.8 billion penalty. Zhao, consulting numerous lawyers, initially prepared to become a fugitive but ultimately pleaded guilty and served four months in prison before receiving a pardon from President Trump. The memoir also recounts a brief period as the wealthiest inmate and an unexpected encounter with Immigration and Customs Enforcement.

Friday Squid Blogging: Squid Fishing in Peru

www.schneier.com · 8 months ago

false

Security hole could let hackers take over Juniper Networks PTX core routers

www.csoonline.com · 8 months ago

A critical vulnerability labeled CVE-2026-21902 in Junos OS Evolved on PTX series core routers allows an unauthenticated network attacker to execute code as root, enabling device takeover and potential interception or redirection of traffic. The issue is caused by incorrect permission assignment in the On-Box Anomaly detection framework, which is enabled by default but should only be reachable by internal processes. Devices running Junos OS Evolved versions earlier than 25.4R1-S1-EVO and 25.4R2-EVO are affected and administrators are urged to install version 25.4R1-S1-EVO or await upcoming 25.4R2-EVO and 26.2R1-EVO updates. If immediate patching is not possible, operators should restrict access with access control lists or firewall filters to trusted hosts and consider disabling the anomaly service using the command request pfe anomalies disable.

Trump Orders All Federal Agencies to Phase Out Use of Anthropic Technology

www.securityweek.com · 8 months ago

false

Pentagon-Anthropic Standoff Is a Decisive Moment for How A.I. Will Be Used in War

www.nytimes.com · 8 months ago

false

Life Mirrors Art: Ransomware Hits Hospitals on TV & IRL

www.darkreading.com · 8 months ago

Recent events mirrored a fictional television show depicting a ransomware attack on a hospital. The University of Mississippi Medical Center experienced a real ransomware attack impacting its IT systems, including electronic medical records, forcing the closure of 35 clinics. Cybersecurity experts note the realism of the depiction, highlighting the operational chaos and reliance on paper-based systems when digital tools are unavailable. Experts advise healthcare facilities to secure credentials, develop downtime plans for patient care, and regularly test resilience through drills to mitigate disruptions and ensure patient safety.

‘Silent’ Google API key change exposed Gemini AI data

www.csoonline.com · 8 months ago

Researchers discovered a Google Cloud Platform security issue where API keys, initially used for billing, were inadvertently repurposed as authentication credentials for the Gemini AI API. A Common Crawl scan revealed 2,863 live API keys potentially exposing sensitive data and risking unauthorized usage. Google was alerted to the problem in November and has since restricted the vulnerable keys from accessing the Gemini API, but a comprehensive fix is still in progress. Developers are advised to review and rotate their API keys to mitigate the risk.

Cities Hosting Major Events Need More Focus on Wireless, Drone Defense

www.darkreading.com · 8 months ago

Cybersecurity experts warn that the 2026 FIFA World Cup presents escalating risks from drones and wireless attacks. The increasing use of drones in conflict zones, such as Ukraine where they account for 80% of casualties, highlights the potential danger to civilian populations. Experts recommend layered defenses combining radio frequency, radar, acoustic, and optical detection to protect event infrastructure and public safety communications. Furthermore, the complexity of wireless environments during large events provides attackers with numerous targets and opportunities to hide malicious activity within legitimate traffic.

Flaw-Finding AI Assistants Face Criticism for Speed, Accuracy

www.darkreading.com · 8 months ago

New AI tools from Anthropic and OpenAI aim to find vulnerabilities in code, with Anthropic claiming their system identified over 500 zero-day vulnerabilities in open-source projects. However, security experts report these tools are currently slow, generating numerous false positives, and disrupting development workflows. The tools are not expected to replace existing security checks but may assist developers in understanding and fixing code, especially as AI-assisted coding increases security debt and high-severity vulnerabilities. Ultimately, the real challenge remains remediating discovered vulnerabilities efficiently within existing development pipelines.

Microsoft testing Windows 11 batch file security improvements

www.bleepingcomputer.com · 8 months ago

Microsoft is enhancing Windows 11 security and performance for batch file and CMD script execution. IT administrators can now enable a secure processing mode to prevent file modifications during script runs through a registry value or application manifest control. This improvement boosts performance and reduces signature validation requirements when code integrity is enabled. Additionally, the Shared audio feature now supports individual volume sliders and expanded device compatibility.

U.S. military used a laser to shoot down a Border Protection drone

www.washingtonpost.com · 8 months ago

The U.S. military recently used a laser to shoot down a drone belonging to Customs and Border Protection near Fort Hancock, Texas. This incident led to a temporary closure of airspace in the area. It follows a similar incident earlier this month involving DHS personnel using a counter-drone laser that disrupted flights at the El Paso airport. The events highlight a lack of coordination between government agencies.

APT37 hackers use new malware to breach air-gapped networks

www.bleepingcomputer.com · 8 months ago

North Korean hackers, specifically the group APT37, are using new tools to compromise air-gapped networks. The campaign, dubbed Ruby Jumper, leverages removable storage devices to transfer data and establish covert command-and-control relays between internet-connected and isolated systems. The malware toolkit includes RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE, disguised as legitimate utilities and documents. This sophisticated attack chain involves a series of malicious scripts and backdoors designed to collect information, exfiltrate data, and spread the infection to new systems.

Europol-led crackdown on The Com hackers leads to 30 arrests

www.bleepingcomputer.com · 8 months ago

A Europol-led operation called Project Compass has resulted in 30 arrests and identified 179 suspects linked to "The Com," a cybercrime collective targeting children and teenagers. This decentralized network operates across various online platforms and is involved in extortion, violence, and the creation of child sexual exploitation material. Several subgroups exist within The Com, including Cyber Com, which is associated with ransomware attacks against companies like Marks & Spencer, Co-op, Harrods, and Las Vegas casinos. Two leaders of the "764" subgroup, known for exploiting children, were arrested and face life in prison.

DoJ Seizes $61 Million in Tether Linked to Pig Butchering Crypto Scams

thehackernews.com · 8 months ago

The U.S. Department of Justice has seized $61 million in Tether linked to pig butchering cryptocurrency scams. These scams involve criminals cultivating romantic relationships with victims through social media and dating apps, coercing them into fraudulent cryptocurrency investments. Scammers use fake investment portfolios and additional fees to extract more money, then move the funds through numerous wallets to conceal their origin. Tether has frozen approximately $4.2 billion in assets connected to illicit activities.

900+ Sangoma FreePBX Instances Compromised in Ongoing Web Shell Attacks

thehackernews.com · 8 months ago

More than 900 Sangoma FreePBX instances are still infected with web shells following attacks that began in December 2025. The exploitation likely involves CVE-2025-64328, a command injection vulnerability allowing unauthorized users to execute commands on the system. The vulnerability affects versions 17.0.2.36 and higher, and has been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. Users are urged to update their systems to the latest version to mitigate the threat.

The Forgotten Bug: How a Node.js Core Design Flaw Enables HTTP Request Splitting

r3verii.github.io · 8 months ago

A time of check time of use vulnerability in Node.js core lets the ClientRequest.path property be mutated after constructor validation, bypassing CRLF checks and enabling header injection and HTTP request splitting. The flaw is exploitable when libraries expose the raw ClientRequest before headers are flushed, affecting seven popular HTTP libraries with more than 160 million weekly downloads and confirmed sinks in production at organizations including Microsoft, Google, Stanford, and United Nations agencies. This class of bug recalls CVE-2018-12116, and while the Node.js security team assessed the new finding as not a vulnerability under their current threat model, the researcher recommends trivial fixes such as adding a setter or making the path read only and urges the ecosystem to mitigate.

Samsung updates ACR privacy practices after Texas sues TV manufacturers

therecord.media · 8 months ago

Texas Attorney General Ken Paxton has reached an agreement with Samsung to resolve a lawsuit concerning Automated Content Recognition, or ACR, data collection. The state alleged that Samsung collected viewing data from TV users without sufficient consent. Samsung will now update its smart TVs to include clearer disclosure and consent screens for Texas consumers. The company maintains its original privacy policy followed regulations and emphasizes consumer control over privacy settings.

Instagram to start alerting parents when children search for terms relating to self-harm

therecord.media · 8 months ago

Instagram will soon alert parents if their child repeatedly searches for terms related to self-harm and suicide. The notifications will be delivered via WhatsApp, email, or text and are currently available in the U.S., U.K., Australia, and Canada. Meta is also developing a tool to notify parents about their teen’s conversations with AI about self-harm. The move comes as Meta faces increased scrutiny and legal challenges regarding the impact of its platforms on young people.

5 Nations Alert: Critical Cisco Bug Used in Global Espionage Campaign

www.techrepublic.com · 8 months ago

A critical vulnerability in Cisco’s Catalyst SD-WAN products, identified as CVE-2026-20127, has been exploited in a global espionage campaign spanning three years. Attackers bypassed authentication to gain privileged access and steal data, escalating to root access by exploiting CVE-2022-20775 through the system’s update mechanism. Authorities in five nations issued a joint warning about the activity, which has been attributed to an unidentified actor known as UAT-8616, and advise organizations to review system logs and implement IP blocking. Clearing logs and evading detection were observed as part of the attacker's actions.

The Case for Why Better Breach Transparency Matters

www.darkreading.com · 8 months ago

Cybersecurity experts are advocating for increased transparency regarding data breaches and security failures. They argue that a lack of formal feedback loops hinders the industry’s ability to reduce cyber risk, contrasting it with practices in fields like aviation and medicine. Organizations often prioritize legal liabilities over sharing lessons learned from breaches, obscuring contributing factors beyond initial vulnerabilities. The researchers suggest implementing mechanisms for anonymized reporting and regulatory safe harbors to encourage collective learning and improve overall security posture.