Blahalla

Five Eyes issue emergency directive on exploited Cisco SD-WAN zero-day

www.csoonline.com · 8 months ago

There is an emergency directive from Five Eyes cybersecurity agencies and CISA warning that a critical Cisco Catalyst SD-WAN vulnerability is being actively exploited to gain unauthorized access to federal networks. The flaw, tracked as CVE-2026-20127, permits an unauthenticated attacker to bypass authentication and obtain administrative control of SD-WAN controllers, an activity Talos links to threat cluster UAT-8616 and that may have been exploited as early as 2023. Cisco has released software updates with no workaround and agencies strongly urge immediate patching, inventorying of in-scope SD-WAN systems, collection of logs and compromise assessments, and also recommend applying fixes for CVE-2022-20775.

FTC says it won’t enforce COPPA against proper use of age verification tools

therecord.media · 8 months ago

On February 25, 2026 the Federal Trade Commission issued a policy statement saying it will not bring COPPA enforcement actions against websites and online services that collect, use, and share personal data solely for age verification. The exemption applies only if sites do not use or disclose a user’s age for other purposes, do not retain the information after verification, provide clear notice to parents and children, disclose data only to third parties that will maintain confidentiality, employ reasonable security safeguards, and take reasonable steps to ensure verification methods are reasonably accurate. The agency said it will review the COPPA Rule to address age verification.

Flaws in Claude Code Put Developers' Machines at Risk

www.darkreading.com · 8 months ago

There are three critical vulnerabilities in Anthropic's Claude Code that allowed repository controlled configuration files to execute commands that could lead to full machine takeover or API key theft, tracked as CVE-2025-59356, CVE-2025-59536, and CVE-2026-21852. Check Point Research disclosed the flaws after developing proof of concept exploits, Anthropic has patched the issues and urges developers to run the latest Claude Code release while it adds further security hardening. Security analysts warn the incidents illustrate new supply chain and attack surface risks introduced when AI development tools execute actions based on repository configuration files without adequate consent or controls.

Fake Next.js job interview tests backdoor developer's devices

www.bleepingcomputer.com · 8 months ago

There is a coordinated campaign targeting software developers that uses fake Next.js repositories and job interview or technical assessment materials to deliver a JavaScript backdoor that executes in the Node.js process. The malicious projects include multiple execution triggers, including a VS Code tasks.json set to run on folder open, trojanized assets fetched during npm run dev, and backend modules that decode endpoints from environment files, enabling remote code execution, host profiling, staged file exfiltration, and in-memory tasking from command and control servers. Recommended mitigations are to enforce VS Code Workspace Trust or Restricted Mode, enable attack surface reduction rules, minimize secrets and use short lived least privilege tokens, and monitor risky sign-ins with Entra ID Protection.

RAMP Forum Seizure Fractures Ransomware Ecosystem

www.darkreading.com · 8 months ago

Rapid7's analysis found that the January 28 seizure of the RAMP cybercrime forum by US authorities fractured a central marketplace for ransomware as a service and forced actors to seek alternative platforms. Two early successors were identified: T1erOne, a closed paid entry forum requiring proof of activity or a four hundred fifty dollar fee intended to reduce infiltration, and Rehub, an open membership forum where groups including LockBit Gentlemen and DragonForce have been observed and affiliates such as Qilin and Cry0 have advertised services. Researchers concluded that the ecosystem is fragmenting and that defenders must move beyond tracking single forums to monitor actor migration recruitment signals and early indicators of regrouping to maintain visibility and guide defensive action.

Cisco SD-WAN Software Privilege Escalation Vulnerabilities

sec.cloudapps.cisco.com · 8 months ago

There are multiple privilege escalation vulnerabilities in the command line interface of Cisco SD WAN Software that could allow an authenticated local attacker to run a malicious CLI command and execute arbitrary commands as the root user. These issues stem from improper access controls on CLI commands, carry a High security impact rating, and have no available workarounds. Software updates have been released to address CVE-2022-20775 and CVE-2022-20818.

Podcasts? TV Talk Shows? Netflix Just Hopes They’re Hits.

www.nytimes.com · 8 months ago

false

Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s)) - watchTowr Labs

labs.watchtowr.com · 8 months ago

Researchers found pre-authentication remote code execution chains in SolarWinds Web Help Desk by chaining authentication bypasses with a deserialization flaw, enabling remote code execution on fully patched instances. The vulnerabilities are tracked as CVE-2025-40552, CVE-2025-40553, and CVE-2025-40554 and build on prior deserialization issues including CVE-2024-28986, CVE-2024-28988, and CVE-2025-26399. The root cause is unsafe JSON-to-Java deserialization in the WebObjects framework via the org.jabsorb JSONBridge, where attacker-controlled parameters can invoke server methods, and exploitation requires a complex chain but can be achieved without authentication.

ShinyHunters Leak 12.4 Million CarGurus Records in Massive Data Dump

www.techrepublic.com · 8 months ago

There are 12.4 million CarGurus records exposed by the ShinyHunters extortion group, with about seventy percent reportedly new, published as a 6.1 gigabyte data archive containing personal and financing information. Exposed fields include physical addresses, phone numbers, and financing pre qualification status that can be used to craft highly targeted phishing emails, SMS scams, and data extortion attempts. The initial intrusion vector has not been disclosed, and the threat group is known to exploit weak access controls, compromised credentials, and third party service exposures. Recommended defenses include enforcing least privilege and multi factor authentication for privileged accounts, deploying data loss prevention and egress controls, encrypting and tokenizing sensitive financial data, segmenting critical systems, and strengthening third party risk management and incident response plans.

Enterprise Evaluation Framework for OpenClaw (and other autonomous AI agents)

www.onyx.app · 8 months ago

OpenClaw is an open source autonomous AI agent that connects large language models to a user s computer, accounts, and tools, and it went viral after a November 2025 release with massive GitHub interest and traffic while its creator later joined OpenAI. Security researchers found tens of thousands of publicly exposed instances, an audit listing 512 vulnerabilities including eight critical findings, and a one click remote code execution vulnerability tracked as CVE-2026-25253 with a CVSS score of 8.8 affecting versions before 2026.1.29. An enterprise readiness assessment using the CLAW-10 matrix gives OpenClaw a composite score of 1.2 out of 5, identifying critical gaps in identity and authentication, authorization and access control, data isolation, execution sandboxing, and supply chain security. The recommended posture is that OpenClaw is not enterprise ready without substantial compensating controls such as isolated VMs or containerized sandboxes, SSO and RBAC integration, immutable audit logging, encrypted secrets management, and a curated signed extension marketplace.

PCI Council Says Threats to Payments Systems Are Speeding Up

www.darkreading.com · 8 months ago

The PCI Security Standards Council's 2025 annual report finds threats to payment systems are accelerating and urges faster, more transparent global coordination to secure cards, devices, software, and processing systems. Threat actors are increasingly targeting point of sale systems through payment card skimming, jackpotting, ransomware, and credential theft, and the council warns that artificial intelligence and market fragmentation increase risk because vulnerabilities travel fast. In response, the council is expanding training, education, outreach, and governance, grew its board of advisors to 64 organizations, launched regional initiatives including an India South Asia board, and says it will streamline processes to scale delivery and engage stakeholders earlier.

Active deception against AI pentesting agents: context saturation, tarpitting benchmarks, and cited research

portspoof.io · 8 months ago

There is an operational AI agent reconnaissance threat first publicly disclosed in November 2025 when an autonomous agent executed most of a multi stage operation against technology, financial, and government targets. AI agents follow a scan, ingest, decide, repeat loop and are vulnerable to three structural failure modes when confronted with active network deception: context saturation that overwhelms LLM context windows, pipeline paralyzation via protocol accurate emulation and socket tarpitting, and logic and operational security poisoning that corrupts prioritization. Deploying an active deception grid that emulates thousands of protocol accurate hosts, uses eBPF kernel level detection, and fingerprints scanners can collapse agent pipelines, produce more than 26 million fabricated scan tokens, and delivered a measured ninety two times scan slowdown in nmap benchmarks. The method converts reconnaissance into high fidelity telemetry mapped to MITRE ATT&CK and SIEM workflows while imposing a capability tax on attackers that scales with model sophistication and probe volume.

Health insurance tech provider TriZetto says more than 3 million impacted by 2024 breach

therecord.media · 8 months ago

There are 3,433,965 people affected by a 2024 data breach of TriZetto Provider Solutions, a healthcare technology company that handles insurance claims and eligibility verification. The company says unauthorized access began in November 2024 and that the breach was discovered in October; an actor used a web portal to access historical insurance eligibility reports. Leaked information included Social Security numbers, addresses, health insurance numbers and other sensitive healthcare data, and the company filed breach notifications across multiple states and engaged incident response firm Mandiant. Victims are being offered one year of credit monitoring, and state filings show specific counts for some states including 171,158 affected in Texas and 3,562 in South Carolina.

Jeff and Lauren Sánchez Bezos Will Be Honorary Chairs of the Met Gala

www.nytimes.com · 8 months ago

false

Critical Cisco SD-WAN bug exploited in zero-day attacks since 2023

www.bleepingcomputer.com · 8 months ago

A critical authentication bypass in Cisco Catalyst SD WAN tracked as CVE 2026 20127, rated ten out of ten, has been actively exploited since at least 2023 to allow remote attackers to compromise controllers and add malicious rogue peers to targeted networks. Exploitation can allow an attacker to log in as a high privileged non root account, access NETCONF to manipulate SD WAN configuration, and operators observed threat actors escalate to root by downgrading software and exploiting CVE 2022 20775 before restoring firmware to evade detection. U S and international authorities issued coordinated guidance and CISA published Emergency Directive 26 03 requiring federal civilian agencies to inventory Cisco SD WAN systems, collect forensic artifacts, ensure external log storage, and apply updates with a patching deadline of five PM Eastern on February twenty seventh, two thousand twenty six. Administrators are urged to apply Cisco updates immediately, harden SD WAN management interfaces so they are not exposed to the internet, forward logs externally, hunt for indicators such as unexpected peering events and unauthorized SSH keys, and perform fresh installs if root compromise is confirmed.

Google Disrupts UNC2814 GRIDTIDE Campaign After 53 Breaches Across 42 Countries

thehackernews.com · 8 months ago

Google and industry partners disrupted the infrastructure of a suspected China-nexus espionage group tracked as UNC2814 after it breached at least 53 organizations across 42 countries and is suspected in operations across more than 70 countries. The group deployed a novel C based backdoor called GRIDTIDE that abused the Google Sheets API for command and control, enabling file upload, download, and arbitrary shell command execution while using service accounts, living off the land binaries, and SoftEther VPN Bridge to move laterally and maintain persistence. Google terminated attacker controlled cloud projects, disabled known infrastructure and abused API calls, issued victim notifications, and reported evidence that GRIDTIDE targeted endpoints containing personally identifiable information but observed no data exfiltration during the campaign.

Discord puts global age verification policy on hold after backlash

therecord.media · 8 months ago

Discord will delay and modify its global age verification rollout to the second half of 2026 and plans to add verification options beyond government ID and video selfies, including credit card verification. The company said it will publish a technical blog explaining how its age determination systems work and will publicly document every verification vendor and their practices for transparency. Discord stated that internal safety systems spare many users from having to submit ID or selfies so that more than ninety percent of users will not be affected, and apologized for failing to clearly explain the proposal amid widespread backlash.

Five Eyes allies warn hackers are actively exploiting Cisco SD-WAN flaws

therecord.media · 8 months ago

Cybersecurity agencies from the Five Eyes warned on February 25, 2026 that an advanced threat actor is actively exploiting new Cisco SD WAN vulnerabilities and urged organizations to hunt for signs of compromise. The U.S. Cybersecurity and Infrastructure Security Agency issued an emergency directive saying the exploitation presents a significant risk to federal civilian executive branch networks. The alerts cite CVE 2026 20127 and CVE 2022 20775, and Cisco says multiple vulnerabilities could allow attackers to access systems, elevate privileges to root, access sensitive information, and overwrite arbitrary files. Australia’s Signals Directorate published a technical hunt guide saying at least one actor has been compromising SD WAN environments since 2023 using a zero day identified late in 2025 that has since been patched, and agencies have not publicly attributed the activity to a named threat group.

Chinese cyberspies breached dozens of telecom firms, govt agencies

www.bleepingcomputer.com · 8 months ago

Google's Threat Intelligence Group, Mandiant, and partners disrupted a global espionage campaign attributed to a suspected Chinese threat actor tracked as UNC2814 that used SaaS API calls to hide malicious traffic and impacted 53 organizations in 42 countries with suspected infections in at least 20 more countries. The actor deployed a new C based backdoor named GRIDTIDE that authenticates to a Google service account with a hardcoded private key and abuses the Google Sheets API for command and control by polling cell A1 and sanitizing the spreadsheet. GRIDTIDE executes Base64 encoded bash commands, uploads and reconstructs files from spreadsheet cells, downloads local files in about 45 kilobyte fragments, and uses a URL safe Base64 encoding scheme to blend with normal traffic and evade detection. Google, Mandiant, and partners terminated the cloud projects and infrastructure used by the actor, revoked Sheets API access, sinkholed domains, notified affected organizations, and warned the actor may resume operations using new infrastructure.

Claude Code Flaws Allow Remote Code Execution and API Key Exfiltration

thehackernews.com · 8 months ago

Multiple vulnerabilities in Anthropic's Claude Code can lead to remote code execution and theft of Anthropic API credentials by abusing project configuration mechanisms such as Hooks, Model Context Protocol servers, and environment variables, enabling arbitrary shell commands and API requests when users clone and open untrusted repositories. The issues fall into three categories: a high severity code injection from a user consent bypass that had no CVE and was fixed in version 1.0.87 in September 2025; CVE-2025-59536, a code injection allowing automatic shell command execution fixed in version 1.0.111 in October 2025; and CVE-2026-21852, an information disclosure flaw in the project-load flow that could exfiltrate API keys and was fixed in version 2.0.65 in January 2026. Exploitation could leak keys by setting ANTHROPICBASEURL to an attacker endpoint, redirect authenticated API traffic, access or modify cloud-stored data, and bypass user approval by leveraging repository-defined configurations such as.mcp.json and claude/settings.json and the enableAllProjectMcpServers option.

PowerSchool, Chicago Public Schools to settle student data privacy lawsuit for $17 million

therecord.media · 8 months ago

PowerSchool and Chicago Public Schools agreed to pay 17.25 million dollars to settle a proposed class action alleging unlawful eavesdropping on students who used school mandated education technology products. The settlement will be split among more than 10 million potential class members and requires PowerSchool to establish a web governance committee to monitor advertising technology in its Naviance platform and to refrain from using third party software or code in Naviance for two years. PowerSchool will direct Heap and other vendors to delete class member data and significantly enhance its privacy disclosures, Chicago Public Schools must require annual vendor certifications of compliance with privacy laws, and Heap was removed from the Illinois case and is now being sued in New York. The settlement follows a January 2025 hack that exposed data for 62 million students and 9.5 million teachers, including special education status, mental health details and disciplinary notes, and prompted lawsuits alleging weak cybersecurity such as a failure to use multifactor authentication.

Malicious Next.js Repos Target Developers Via Fake Job Interviews

www.darkreading.com · 8 months ago

There are malicious Next.js repositories posing as legitimate projects and technical assessment materials that deliver remote code execution and establish persistent command and control on developer machines, linked to North Korean fake job recruitment campaigns. Microsoft Defender researchers traced the activity after suspicious Node.js outbound connections and found trojanized repositories that use two execution paths: Visual Studio Code workspace automation that runs tasks when a workspace is opened and trusted, and obfuscated code that triggers during standard build or development server commands, both fetching and in memory executing attacker controlled JavaScript that stages a C2 channel. The objective is to gain execution on developer systems to access high value assets such as source code, environment secrets, and build and cloud resources and to poison the software supply chain. Recommended defenses include enforcing strict IDE trust policies, deploying attack surface reduction rules to constrain risky script execution behaviors, and prioritizing visibility into unexpected Node.js execution patterns and anomalous outbound connections from developer endpoints.

The Blast Radius Problem: Stolen Credentials Are Weaponizing Agentic AI

www.securityweek.com · 8 months ago

A 2025 threat index tracking 400,000 vulnerabilities found that 56 percent required no authentication before exploitation and identified 300,000 ChatGPT credentials on the dark web, likely stolen by infostealers. Attackers are using artificial intelligence to discover weak access points, craft convincing deepfakes, run immediate scams, and, if they obtain API keys for agentic AI, expand the blast radius of a compromise from data theft to potential control of systems. The index also reports a fourfold increase in supply chain and third party breaches over five years and warns that stronger access controls, visibility into exposed credentials, and mapping of critical assets and dependencies are needed to prevent cascading compromises.

One Identity Appoints Michael Henricks as Chief Financial and Operating Officer

gbhackers.com · 8 months ago

One Identity has appointed Michael Henricks as Chief Financial and Operating Officer effective February 25, 2026. Henricks brings more than 30 years of experience in technology, business services, and financial services and most recently served as Chief Executive Officer and previously Chief Financial Officer at Momentive Software, and his remit will extend beyond traditional CFO duties to strategic planning and operational-financial integration. He will oversee global finance operations, financial planning, and operational efficiency as One Identity scales to support more than 11,000 organizations and over 500 million identities while maintaining a reported 97 percent customer satisfaction rate.

Google Disrupts Chinese Hackers Targeting Telecoms, Governments

www.securityweek.com · 8 months ago

Google has disrupted a significant cyberespionage campaign linked to China, impacting organizations in over 42 countries. The threat actor, known as UNC2814, has been active since 2017 and uses a new backdoor called GridTide, which leverages Google Sheets for command and control. This allows malicious traffic to appear legitimate by utilizing cloud-hosted products. Google and its partners eliminated infrastructure, sinkholed domains, and disabled accounts to disrupt the operation and have notified victims.

Cisco UCS Manager Software Privilege Escalation Vulnerability

sec.cloudapps.cisco.com · 8 months ago

A vulnerability in the NX OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated local attacker with read only privileges to modify files and perform limited privileged actions on affected systems. The issue exists because read only users are granted unnecessary privileges and can exploit the NX OS CLI by authenticating to a device and connecting to that interface. Cisco has released software updates to address the issue, there are no workarounds, the security impact rating is Medium, and the flaw is tracked as CVE-2026-20037.

Cisco UCS Manager Software Command Injection Vulnerability

sec.cloudapps.cisco.com · 8 months ago

A vulnerability in the command line and web management interfaces of Cisco UCS Manager Software could allow an authenticated remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system. The flaw is caused by insufficient input validation of command arguments, and exploiting it requires authenticating to the device and submitting crafted input to the affected command, which could lead to execution of commands with root level privileges. Cisco has released software updates to address the issue, reports no available workarounds, assigns a Security Impact Rating of Medium, and tracks the vulnerability as CVE-2026-20036.

Marquis sues SonicWall over backup breach that led to ransomware attack

www.bleepingcomputer.com · 8 months ago

Marquis Software Solutions is suing SonicWall, alleging negligence led to a ransomware attack impacting over 70 banks. Hackers breached Marquis's network after compromising SonicWall’s MySonicWall cloud backup service, gaining access to sensitive data including names, addresses, Social Security numbers, and financial account information. The breach exploited a security gap introduced via an API code change in February 2025, and state-sponsored hackers carried out the attack. Marquis is facing multiple class action lawsuits related to the incident and seeks damages from SonicWall.

Medical device firm UFP says backup data systems deployed following cyberattack

therecord.media · 8 months ago

UFP Technologies, a medical device manufacturer, recently disclosed a cyberattack to regulators. The incident, discovered February 14th, led to the isolation of IT systems and the use of data backups to restore functionality. Hackers accessed and potentially stole or destroyed company data, impacting billing and label creation for customer deliveries, and an investigation is underway to determine the scope of sensitive information involved. The company expects most costs to be covered by cyber insurance.

SolarWinds Patches Four Critical Serv-U Vulnerabilities

www.securityweek.com · 8 months ago

SolarWinds has released patches to address four critical vulnerabilities in its Serv-U file transfer solution. These vulnerabilities, identified as CVE-2025-40538 through CVE-2025-40541, each have a CVSS score of 9.1 and could lead to remote code execution. The flaws include a broken access control issue, type confusion vulnerabilities, and an insecure direct object reference. Successful exploitation requires administrative privileges on the affected system, though the risk is lessened on Windows due to default service account privileges, and users are urged to update to version 15.5.4.

Chinese prosecutors raise alarm about growth of domestic IP theft

therecord.media · 8 months ago

Chinese prosecutors are increasing enforcement against commercial espionage and technology leaks to safeguard domestic innovation. Authorities have handled over 1,200 business secret infringement cases between 2021 and 2025, targeting sectors like artificial intelligence, biomanufacturing, and energy. A recent case involved 14 individuals accused of stealing advanced chip technology from Huawei’s HiSilicon unit, valued at 45 million dollars. This action follows longstanding accusations of China’s intellectual property practices and estimates that technology theft costs the U.S. economy hundreds of billions of dollars annually.

SLH Offers $500–$1,000 Per Call to Recruit Women for IT Help Desk Vishing Attacks

thehackernews.com · 8 months ago

Cybercriminals associated with the Scattered LAPSUS$ Hunters group are recruiting women for voice phishing campaigns targeting IT help desks. The group is offering financial incentives, ranging from $500 to $1,000 per call, and providing scripts for these attacks. This tactic aims to increase the success rate by leveraging the assumption that attackers don't typically have female voices. The group has a history of using social engineering techniques, including impersonation and leveraging legitimate tools to gain access and exfiltrate data.

The OpenClaw Hype: Analysis of Chatter from Open-Source Deep and Dark Web

www.bleepingcomputer.com · 8 months ago

Security researchers are closely examining OpenClaw, an AI-powered automation framework, due to potential security risks. The platform’s modular design, including a skills marketplace, creates a supply chain vulnerability where malicious plugins can deliver malware. Several critical vulnerabilities have been identified, including CVE-2026-25253, enabling remote code execution and credential theft. While underground forums show discussion, widespread exploitation hasn't yet materialized, but experts warn the risk of weaponization remains a significant concern.

Top 5 Ways Broken Triage Increases Business Risk Instead of Reducing It

thehackernews.com · 8 months ago

false

Large-Scale Online Deanonymization with LLMs

simonlermen.substack.com · 8 months ago

Researchers have demonstrated that large language model agents can deanonymize users from their anonymous online posts across platforms like Hacker News, Reddit, and LinkedIn. The models infer personal details, such as location and profession, by analyzing a few comments and then searching the web to identify individuals. This deanonymization process is increasingly practical and scalable, potentially impacting user privacy and enabling misuse like targeted phishing. Platforms are advised to restrict data access, while individuals should be mindful of the specific details shared online to avoid identification.

Why 'Call This Number' TOAD Emails Beat Gateways

www.darkreading.com · 8 months ago

Researchers have identified a growing phishing technique called Telephone-Oriented Attack Delivery, or TOAD, that bypasses email security gateways. These emails contain only a phone number, impersonating entities like PayPal and prompting victims to call for fake billing notifications. Attackers then attempt to extract credentials or manipulate victims into fraudulent transactions, and these attacks are becoming increasingly sophisticated, utilizing numerous evasion combinations. Experts recommend organizations improve detection coverage and employee training to address this threat, emphasizing that legitimate requests will not require phone calls or QR code scans.

Medical Device Maker UFP Technologies Hit by Cyberattack

www.securityweek.com · 8 months ago

UFP Technologies, a medical device manufacturer, recently reported a cybersecurity incident that began February 14th. Attackers gained access to their systems, stole files, and disrupted IT functions like billing and delivery label creation. The company is investigating the scope of the data compromise and implementing backup systems to maintain operations. While it appears to be a ransomware attack, no group has claimed responsibility.

Ex-US Defense Contractor Executive Jailed for Selling Exploits to Russia

www.securityweek.com · 8 months ago

A former executive at Trenchant, a division of L3Harris, has been sentenced to over seven years in prison for stealing cyber exploits from his employer. Peter Williams, an Australian national, sold the stolen information, which included components of software associated with national security, to a Russian cyber-exploit broker. He received cryptocurrency payments for the trade secrets, which he used to purchase luxury goods. Williams' actions resulted in approximately 35 million dollars in losses for the defense contractor and potentially impacted the US government and allied governments.

Zyxel warns of critical RCE flaw affecting over a dozen routers

www.bleepingcomputer.com · 8 months ago

Zyxel has released security updates to address a critical command injection vulnerability, CVE-2025-13942, affecting multiple router models. The flaw allows unauthenticated attackers to execute commands if UPnP and WAN access are enabled. Two additional high-severity command-injection vulnerabilities, CVE-2025-13943 and CVE-2026-1459, were also patched, requiring authentication. Shadowserver is tracking almost 120,000 internet-exposed Zyxel devices, making them a frequent target for attackers. Zyxel is not patching vulnerabilities in several end-of-life routers, CVE-2024-40891 and CVE-2024-40892, and advises users to replace those devices.

Malicious NuGet Packages Stole ASP.NET Data; npm Package Dropped Malware

thehackernews.com · 8 months ago

Cybersecurity researchers have identified four malicious NuGet packages, NCryptYo, DOMOAuth2, IRAOAuth2.0, and SimpleWriter, that target ASP.NET developers to steal sensitive data and create backdoors. These packages, published by a single threat actor, exfiltrate ASP.NET Identity data, manipulate authorization rules, and facilitate hidden process execution. Separately, a malicious npm package named ambar-src has been discovered with over 50,000 downloads, utilizing scripts to download payloads and establish reverse shells across Windows, Linux, and macOS systems. Both campaigns aim to compromise deployed applications rather than developers’ machines directly.

Tracking DPRK operator IPs over time by snooping on mailboxes

kmsec.uk · 8 months ago

false

CarGurus Data Breach Impacts Over 12 Million Users

www.securityweek.com · 8 months ago

More than 12 million CarGurus users are impacted by a recent data breach. The extortion group ShinyHunters claimed responsibility, initially reporting 1.7 million records stolen but later releasing a 6.1 gigabyte archive containing data for approximately 12.5 million accounts. Compromised information includes names, addresses, email addresses, phone numbers, and IP addresses. ShinyHunters is known for using sophisticated voice phishing tactics and has previously targeted organizations like Optimizely, Figure, Panera Bread, and Crunchbase.

I rendered 1,418 Unicode confusable pairs across 230 system fonts. 82 are pixel-identical, and the font your site uses determines which ones.

paultendo.github.io · 8 months ago

false

Hackers Exploit Cortex XDR Live Terminal for C2 Communications

gbhackers.com · 8 months ago

Hackers are exploiting the Cortex XDR Live Terminal feature, a built-in response tool, to establish covert command-and-control (C2) channels. Attackers can abuse the feature's remote execution capabilities and trusted communications to blend malicious activity into normal traffic, potentially bypassing prevention rules. Two methods have been identified: cross-tenant hijacking where an attacker leverages a compromised Cortex tenant, and server-side reimplementation where an attacker replicates the Live Terminal's WebSocket logic. The protocol lacks cryptographic command signing or mutual authentication, making it vulnerable to redirection to attacker-controlled servers.

Poisoning AI Training Data

www.schneier.com · 8 months ago

A fake article about tech journalists and hot dog eating quickly spread through several artificial intelligence chatbots. The article, created on a personal website, was initially presented as fabricated but was still repeated by Google's Gemini and ChatGPT. Anthropic's Claude chatbot correctly identified the article as false, demonstrating varying levels of AI trustworthiness. This incident highlights the ease with which AI training data can be manipulated and the potential for misinformation.

SecurityWeek Report: 426 Cybersecurity M&A Deals Announced in 2025

www.securityweek.com · 8 months ago

false

'Richter Scale' Model Measures Magnitude of OT Cyber Incidents

www.darkreading.com · 8 months ago

A new method, the Operational Technology Incident or OTI Impact Score, is being developed to measure the business impact of OT cybersecurity incidents. Inspired by the Richter Scale, the score assesses incidents based on severity, reach, and duration, aiming to provide clarity for stakeholders and ensure appropriate response. Experts say a standardized scoring system will help shift the conversation away from technical details and toward the business ramifications of attacks. The Colonial Pipeline cyberattack received a score of 3.9, while a 2024 incident at a Texas water utility received a score of 0.0.

Wynn Resorts Confirms Data Breach After Hackers Remove It From Leak Site

www.securityweek.com · 8 months ago

Wynn Resorts has confirmed a data breach impacting employee information. Hackers initially claimed to have stolen over 800,000 records, including Social Security numbers, and listed the company on a data leak site. Wynn Resorts has since been removed from the site, suggesting a possible ransom payment of approximately one point five million dollars. The company is offering credit monitoring and identity protection services to affected employees and is investigating the incident, which reportedly involved the cybercrime group ShinyHunters.

CISA Issues Alert on Active Exploitation of FileZen Vulnerability

gbhackers.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency has added a vulnerability affecting FileZen to its Known Exploited Vulnerabilities catalog. This vulnerability, identified as CVE-2026-25108, is an OS Command Injection flaw that allows attackers to execute system commands. Federal agencies are required to address this vulnerability within a specific timeframe, and all organizations are encouraged to prioritize remediation. Security teams should audit systems for unauthorized activity.

Moscow man accused of posing as FSB officer to extort Conti ransomware gang

therecord.media · 8 months ago

A Moscow man, Ruslan Satuchin, is accused of attempting to extort the Conti ransomware group by falsely claiming to be an FSB officer. The alleged scheme began in September of 2022, with Satuchin demanding payment to prevent prosecution. Conti, linked to Russian-speaking cybercriminals and significant attacks worldwide, fractured in 2022 following a data leak. Satuchin faces up to 10 years in prison if convicted.