Blahalla

How Exposed Endpoints Increase Risk Across LLM Infrastructure

thehackernews.com · 8 months ago

The increasing use of Large Language Models (LLMs) and their associated infrastructure is expanding the attack surface for cybercriminals. LLM endpoints, often built for rapid development and internal use, frequently lack proper security controls and excessive permissions. Compromised endpoints can provide access to sensitive data, enable automated data exfiltration, and allow abuse of internal tools due to the implicit trust placed in them. Organizations must prioritize endpoint privilege management, adopt zero-trust principles, and regularly rotate credentials to mitigate these risks.

New Arkanix stealer blends rapid Python harvesting with stealthier C++ payloads

www.csoonline.com · 8 months ago

Researchers have discovered a new infostealer called Arkanix, which combines Python and C++ code to maximize its reach and effectiveness. The malware harvests a wide range of data, including credentials, browser data, cryptocurrency, and banking assets, and is offered through a malware-as-a-service model. The Python version gathers broad data while the C++ variant focuses on persistence and post-exploitation actions like collecting RDP connection details and utilizing the ChromElevator browser data extractor. The developers likely leveraged large language models to accelerate development, suggesting a focus on quick financial gain.

Romanian Hacker Pleads Guilty to Selling Access to US State Network

www.securityweek.com · 8 months ago

A Romanian man, Catalin Dragomir, has pleaded guilty to selling unauthorized access to a US state government network. Dragomir gained access to the Oregon emergency management department’s network in 2021, advertised the access for $3,000 in Bitcoin, and provided samples of stolen personal information to a buyer. He is also accused of hacking and selling access to ten other US networks, causing over $250,000 in losses, and faces up to seven years in prison. Dragomir has agreed to pay restitution to his victims and will be sentenced in May.

CISA: Recently patched RoundCube flaws now exploited in attacks

www.bleepingcomputer.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency has identified two Roundcube Webmail vulnerabilities as actively exploited and has ordered federal agencies to patch them quickly. These flaws include a critical remote code execution vulnerability, CVE-2025-49113, and a cross-site scripting vulnerability, CVE-2025-68461. Roundcube is a web-based email client commonly used with cPanel, and there are currently over 46,000 instances accessible online. Roundcube vulnerabilities have previously been targeted by hacking groups, including Winter Vivern and APT28.

Hundreds of FortiGate Firewalls Hacked in AI-Powered Attacks: AWS

www.securityweek.com · 8 months ago

Over 600 FortiGate firewall instances have been compromised in a recent attack campaign spanning 55 countries. The threat actor exploited exposed ports and weak credentials, rather than known vulnerabilities, using AI tools to aid in planning, tool generation, and execution. Attackers leveraged open-source tools to extract credentials, move laterally, and target Veeam servers, suggesting preparation for a ransomware attack. AWS attributes the attacks to a financially motivated, Russian-speaking group with moderate technical skills that heavily relies on AI assistance.

I made Mistral believe Donald Trump runs OpenAI, here's how

dadaam.github.io · 8 months ago

There are attacks against Retrieval Augmented Generation where injecting a handful of malicious documents into a knowledge base can make a large language model confidently produce targeted false answers. A study called PoisonedRAG showed that inserting five malicious texts into multi million document datasets produced very high attack success rates across models in both blackbox and whitebox settings, and independent experiments on a custom Wikipedia dataset found Mistral eight billion fell for the attack about seventy five percent of the time while Claude Sonnet four point six resisted most attempts but displayed a novel failure mode. Agentic RAG that allows autonomous agents to act on retrieved data magnifies the threat because poisoning can lead to corpus scale indirect prompt injection across many conversations. Some mitigations exist such as signed only data and RAGForensics, but they are not widely deployed and most organizations remain unprotected.

Have you tried turning it off and on again? On bricking OT devices (part 2)

www.midnightblue.nl · 8 months ago

Researchers have discovered three critical vulnerabilities affecting Ivanti’s Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. These flaws, including a command injection vulnerability and a path traversal vulnerability, could allow an unauthenticated attacker to potentially execute arbitrary code or access sensitive data. Exploitation requires network access to the EPMM server. The vulnerabilities have been assigned CVE identifiers CVE-2024-22060, CVE-2024-22061, and CVE-2024-22062.

Ukraine says cyberattacks on energy grid now used to guide missile strikes

therecord.media · 8 months ago

Ukrainian cybersecurity officials report a shift in Russian cyberattack strategies targeting the nation’s energy grid. Instead of immediate disruption, attackers are now prioritizing intelligence gathering, including mapping facilities and tracking repair efforts. These cyber operations are used to guide missile strikes and assess the effectiveness of previous attacks, reflecting a long-term strategic approach. Sandworm, a Kremlin-linked hacking group, is reportedly involved in this intelligence-gathering shift.

Ransomware gangs advancing Moscow’s geopolitical aims, Romanian cyber chief warns

therecord.media · 8 months ago

Romanian authorities report a rise in ransomware attacks targeting critical infrastructure, potentially linked to Russian geopolitical aims. These attacks, claimed by groups like Qilin and Gentlemen, coincide with Romania’s support for Ukraine and Moldova. Officials estimate that roughly 80% of cyber incidents in Romania are connected to criminal actors with Russian backing. Romania recently signed a memorandum with Ukraine and Moldova to improve regional cybersecurity cooperation in response to ongoing Russian cyber threats.

Recent RoundCube Webmail Vulnerability Exploited in Attacks

www.securityweek.com · 8 months ago

The US cybersecurity agency CISA has issued a warning about active exploitation of RoundCube Webmail vulnerabilities. Specifically, attackers are targeting CVE-2025-49113, a critical remote code execution flaw with a CVSS score of 9.9, and CVE-2025-68461, a high-severity cross-site scripting vulnerability with a CVSS score of 7.2. The vulnerability CVE-2025-49113 allows attackers to inject data into email sessions, while CVE-2025-68461 enables code execution within a user’s browser. Federal agencies are directed to patch these vulnerabilities within three weeks.

Starkiller Phishing Kit Clones Real Login Pages to Evade MFA Protections

gbhackers.com · 8 months ago

A new phishing framework called Starkiller is enabling sophisticated credential theft by proxying real login pages and bypassing multi-factor authentication. The framework, operated by a group called Jinkusu and sold as a commercial service, utilizes a headless Chrome instance and reverse proxy to serve genuine website content while capturing user credentials. Starkiller features URL masking, live session monitoring, and automated alerts, alongside a community forum for support and development. Security experts warn this escalation in phishing infrastructure poses a significant threat, making phishing the dominant initial access vector for modern breaches.

Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers

www.csoonline.com · 8 months ago

Attackers are actively exploiting critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) to gain unauthorized control of mobile device management infrastructure and install persistent backdoors. The vulnerabilities, CVE-2026-1281 and CVE-2026-1340, allow unauthenticated attackers to execute arbitrary code without user credentials. More than 4,400 EPMM instances are currently exposed online, potentially compromising device policies, credentials, and metadata across entire mobile fleets. Ivanti has released emergency patches, but the vulnerabilities stem from unsafe Bash script handling and require reinstallation after software updates.

Mississippi Hospital System Closes All Clinics After Ransomware Attack

www.securityweek.com · 8 months ago

A ransomware attack has forced the University of Mississippi Medical Center to close approximately three dozen clinics and postpone elective procedures. The attack impacted numerous systems, including the electronic health record platform, requiring staff to revert to manual record-keeping. Officials are investigating whether patient data was compromised and are working with the FBI to restore systems. The FBI prioritizes resuming patient care and is assisting in the investigation.

Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

thehackernews.com · 8 months ago

Cybersecurity researchers have identified a widespread supply chain attack, codenamed SANDWORMMODE, leveraging 19 malicious npm packages to steal credentials and cryptocurrency keys. These packages exhibit worm-like propagation and target AI coding assistants by injecting malicious code to harvest API keys from providers like Anthropic and OpenAI. The malware also includes a kill switch and a polymorphic engine to evade detection, and uses a weaponized GitHub Action to harvest CI/CD secrets. Users are advised to remove the listed packages immediately and rotate their tokens and secrets.

‘A.I. Literacy’ Is Trending in Schools. Here’s Why.

www.nytimes.com · 8 months ago

false

This economic idea transfixed Wall Street and Washington. It may be a mirage.

www.washingtonpost.com · 8 months ago

false

CISA Warns of Actively Exploited Roundcube Vulnerabilities

gbhackers.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency has added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog. These flaws, CVE-2025-49113 and CVE-2025-68461, are currently being exploited by attackers targeting Roundcube Webmail. CVE-2025-49113 allows for remote code execution through unsafe deserialization, while CVE-2025-68461 enables cross-site scripting and potential data theft. Organizations are urged to immediately update to version 1.6.10 or later to mitigate these risks.

jsPDF Flaw Exposes Millions of Developers to Object Injection

gbhackers.com · 8 months ago

A critical security vulnerability, CVE-2026-25755, has been identified in the widely used jsPDF JavaScript library. This flaw allows attackers to perform PDF object injection through the addJS method, enabling them to execute arbitrary actions when a PDF is opened. The vulnerability carries a high severity score of 8.8 and impacts applications using jsPDF for tasks like invoice generation and form submissions. Users are urged to upgrade to version 4.1.0 or later to address the issue and to rigorously validate user inputs.

PayPal Data Breach Led to Fraudulent Transactions

www.securityweek.com · 8 months ago

PayPal recently experienced a data breach impacting a small number of customers. A coding error in the PayPal Working Capital loan application exposed personal information, including names, email addresses, dates of birth, phone numbers, business addresses, and Social Security numbers between July 1 and December 13, 2025. The incident resulted in fraudulent transactions for some customers, and PayPal has issued refunds. Approximately 100 customers were notified, and while PayPal claims its systems were not compromised, other reports suggest unauthorized access was terminated after the breach was detected.

HPE Telco Service Activator Vulnerability Allows Attackers to Bypass Access Controls

gbhackers.com · 8 months ago

A critical vulnerability, CVE-2025-12543, has been identified in HPE’s Telco Service Activator, potentially allowing attackers to bypass access controls. The vulnerability stems from improper validation of the Host header within the Undertow HTTP server core, resulting in a CVSS base score of 9.6. Versions prior to 10.5.0 are affected, and HPE has released version 10.5.0 to address the issue. Network operators are advised to upgrade immediately and review their network configurations to mitigate the risk of unauthorized access and potential data compromise.

MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP

thehackernews.com · 8 months ago

Iranian hacking group MuddyWater, also known as Earth Vetala, is targeting organizations in the Middle East and North Africa in a campaign called Operation Olalampo. Attackers use phishing emails with malicious Microsoft Office documents to deploy several malware tools, including GhostFetch, CHAR, and HTTPVIP. CHAR, a Rust backdoor, is controlled by a Telegram bot and exhibits signs of artificial intelligence-assisted development. The group has also been observed exploiting recently disclosed vulnerabilities to gain initial access.

13 ways attackers use generative AI to exploit your systems

www.csoonline.com · 8 months ago

There are several ways generative AI is being abused to scale and automate cyberattacks, including creation of highly convincing personalized phishing, AI‑assisted malware and HTML smuggling loaders, and accelerated vulnerability reconnaissance that has sharply reduced time to exploitation. Attackers are also using agentic AI to orchestrate espionage campaigns, building unregulated malicious language models and dark web style marketplaces for AI agents, stealing cloud credentials in LLMjacking campaigns, and targeting AI infrastructure such as poisoned Model Context Protocol servers and compromised agent skill marketplaces. Recommended countermeasures include treating enterprise AI like high value SaaS by tightening identity and conditional access, minimizing privileges and key exposure, monitoring anomalous AI and API usage and spend, applying AI for real time detection and response, and expanding employee education to combat AI enabled threats.

North Korean Hackers Exploit Fake IT Worker Schemes and Malicious Interview Lures

gbhackers.com · 8 months ago

North Korean state-backed hackers are using deceptive tactics to compromise software developers and infiltrate organizations. They employ "Contagious Interview" campaigns, tricking developers into running malicious code during technical interviews to steal credentials and source code. Additionally, they create fake IT worker personas to gain remote employment and access private codebases, generating revenue for the regime, with one cell earning over US$1.64 million. GitLab has banned numerous accounts and observed sophisticated techniques including AI-assisted code obfuscation.

DPRK-Linked Hackers Continue Aggressive Crypto Attacks One Year After Bybit Breach

gbhackers.com · 8 months ago

North Korean state-sponsored hackers continue aggressive cryptocurrency attacks, escalating activity since the record 1.46 billion dollar theft from Bybit in February 2025. These operators have laundered over one billion dollars and stolen a total of 2 billion dollars in 2025, using techniques like social engineering and AI-generated content. Campaigns like DangerousPassword and Contagious Interview target individuals with fake technical support and job offers to steal credentials and compromise organizations, generating millions of dollars. Recent activity suggests the potential development of North Korean-built crypto projects, as seen with the disappearance of funds from the Tenexium project.

Silver Fox APT Deploys DLL Sideloading and BYOVD in Advanced Malware Campaign

gbhackers.com · 8 months ago

The Silver Fox APT group is targeting organizations in Taiwan with a new malware campaign using DLL sideloading and Bring Your Own Vulnerable Driver techniques. Attackers use tax and e-invoice lures to trick users into downloading malicious archives or clicking links, ultimately deploying Winos 4.0 (ValleyRat), a remote access trojan. The malware disables security products by exploiting the wsftprm.sys driver, which allows termination of Protected Process Light processes, impacting vendors like Microsoft, Trend Micro, and Symantec. The campaign utilizes a variety of infrastructure and domain names, with a consistent code base and C2 address observed since 2026.

How to Watch Free Live Television on Your Phone or Tablet

www.nytimes.com · 8 months ago

false

Scary datapoints re network visibility in Dragos annual report on OT cyberattacks

www.ot.today · 8 months ago

A new review from Dragos highlights a concerning rise in ransomware attacks targeting operational technology (OT) systems, with a 49% increase in 2025. These attacks are frequently misidentified as standard IT incidents due to a lack of OT network data collection and understanding among IT teams. The report reveals a shift towards nation-state actors pre-positioning for attacks with potential real-world consequences, including reconnaissance and embedding within control loops, suggesting potential cyber-physical operations within 12 months. Attackers are also observed abusing identity and exaggerating their OT capabilities to increase extortion pressure.

128M Users Exposed as Popular VS Code Extensions Reveal Critical Flaws

gbhackers.com · 8 months ago

Researchers have discovered critical vulnerabilities in four popular Visual Studio Code extensions, potentially impacting over 128 million users. These flaws, including CVE-2025-65715, CVE-2025-65716, and CVE-2025-65717, allow for remote code execution, file exfiltration, and even potential system takeover. The vulnerabilities expose development environments as weak points in an organization’s security, enabling lateral movement and data theft. Security experts recommend disabling unnecessary extensions, strengthening local network security, and promptly applying updates.

Malicious Chrome extension targeting Apple App Store Connect developers through fake ASO service - full analysis

blog.toborrm.com · 8 months ago

Researchers have identified a publicly available tool called BoostKey, designed to export session keys used for accessing online accounts. This tool leverages a vulnerability in the Microsoft Windows operating system related to credential caching. The tool allows attackers to potentially gain unauthorized access to user accounts if the cached credentials contain sensitive information. This activity is associated with CVE-2024-25831.

Cache Deception Flaw in SvelteKit And Vercel Stack Exposes User Data

gbhackers.com · 8 months ago

A cache deception vulnerability has been identified in SvelteKit applications deployed on Vercel, potentially exposing sensitive user data. The flaw, tracked as CVE-2026-27118 (GHSA-9pq4-5hcf-288c), allows attackers to trick the system into publicly caching authenticated responses by manipulating the pathname query parameter. This enables attackers to retrieve private data from the cache without needing user credentials. Vercel has released a patch that automatically fixes the issue for hosted apps and recommends upgrading the @sveltejs/adapter-vercel package to version 6.3.2 or later. The vulnerability impacts any SvelteKit site on Vercel using cookie-based authentication for protected routes.

After a deadly raid, an AI power struggle erupts at the Pentagon

www.washingtonpost.com · 8 months ago

A leading artificial intelligence firm is currently in discussions about its ability to continue a contract with the Pentagon. The discussions arose after a raid to capture Venezuelan leader Nicolás Maduro caused Pentagon officials to question the firm’s relationship with the military. The firm has a $200 million contract with the Pentagon, which is now at risk. Secretary of State Marco Rubio and Defense Secretary Pete Hegseth are reportedly involved.

Japanese Semiconductor Supplier Hit by Ransomware, Multiple Systems Impacted

gbhackers.com · 8 months ago

Advantest Corporation, a major supplier of semiconductor test equipment, is currently dealing with a ransomware attack that began February 15th. The company detected unusual activity and has isolated affected systems, engaging cybersecurity experts to investigate. While no ransom note details have been released, there are concerns about potential data theft including blueprints and customer information. The incident highlights the vulnerability of critical supply chains and the need for enhanced security measures.

Arkanix Stealer pops up as short-lived AI info-stealer experiment

www.bleepingcomputer.com · 8 months ago

A new information-stealing malware operation called Arkanix Stealer emerged in October 2025, initially promoted on dark web forums. Developed with possible assistance from large language models, the malware offered standard data-stealing features, modular architecture, and anti-analysis techniques. It targeted browsers, cryptocurrency wallets, and VPN credentials, with a premium version adding advanced capabilities like RDP credential theft and bypassing Google’s App-Bound Encryption. The project abruptly ended after two months, making tracking and detection challenging.

How a single typo led to RCE in Firefox

kqx.io · 8 months ago

A typo in Firefox’s WebAssembly code allows for arbitrary code execution. Additionally, a vulnerability in the SpiderMonkey JavaScript engine enables arbitrary read and write access, potentially leading to remote code execution through a use-after-free condition and heap spray exploit. The exploit leverages memory address leaks and manipulation of WebAssembly code to hijack the instruction pointer. This issue has been quickly patched and a security bounty was awarded for its discovery.

Splunk Enterprise for Windows Flaw Enables DLL Hijacking, SYSTEM Access

gbhackers.com · 8 months ago

A vulnerability has been identified in Splunk Enterprise for Windows that allows users with limited privileges to gain SYSTEM-level access. This local privilege escalation issue, tracked as CVE-2026-20140, occurs due to a flaw in how the service loads DLL files, allowing malicious code to be injected. Affected versions include those prior to 10.2.0, 10.0.3, 9.4.8, 9.3.9, and 9.2.12; Splunk recommends upgrading to a patched version. While no active exploits have been observed, administrators are urged to apply the fix promptly.

Predator spyware hooks iOS SpringBoard to hide mic, camera activity

www.bleepingcomputer.com · 8 months ago

Researchers have discovered that Intellexa’s Predator spyware can conceal iOS recording indicators by manipulating the SpringBoard system. The spyware uses a hook function to intercept sensor activity updates, preventing the camera and microphone indicators from appearing on the status bar. This technique bypasses Apple’s privacy features designed to alert users to active recording. Analysis reveals the spyware also uses ARM64 instruction pattern matching to enable camera access and bypass permission checks.

AI-Assisted Threat Actor Compromises 600+ FortiGate Devices in 55 Countries

thehackernews.com · 8 months ago

A financially motivated threat actor, believed to be Russian-speaking, has compromised over 600 FortiGate devices across 55 countries. The actor used readily available generative AI tools to automate attack planning, tool development, and command generation, overcoming limitations in their technical skills. They exploited exposed management ports and weak credentials, bypassing more sophisticated security controls to target organizations with ease, ultimately compromising Active Directory environments and backup infrastructure. The attackers utilized custom reconnaissance tools, developed with AI assistance, and targeted Veeam Backup & Replication servers, attempting to exploit vulnerabilities like CVE-2023-27532 and CVE-2024-40711. Organizations are urged to strengthen security fundamentals, including patching, credential management, and network segmentation.

Amazon: AI-assisted hacker breached 600 Fortinet firewalls in 5 weeks

www.bleepingcomputer.com · 8 months ago

A Russian-speaking hacker group breached over 600 FortiGate firewalls across 55 countries between January 11 and February 18, 2026. The attackers exploited exposed management interfaces and weak credentials, leveraging generative AI to automate tasks like reconnaissance and script development. Compromised systems had configurations extracted, including VPN credentials and network architecture, and custom tools were used to target Windows domain controllers and Veeam Backup & Replication servers. The attackers attempted to exploit vulnerabilities including CVE-2019-7192, CVE-2023-27532, and CVE-2024-40711, and Amazon recommends strengthening FortiGate security measures.

Critical Grandstream Phone Vulnerability Exposes Calls to Interception

www.securityweek.com · 8 months ago

A critical vulnerability exists in Grandstream’s GXP1600 series phones, allowing unauthenticated attackers to potentially intercept calls and execute code with root privileges. The flaw, identified as CVE-2026-2329, is a stack-based buffer overflow. Exploitation could enable attackers to extract sensitive credentials and redirect calls through their own infrastructure. Grandstream has released a firmware update to address the vulnerability.

Anthropic Debuts Claude Code Security – AI Now Scan Vulnerabilities in Your Entire Codebase

gbhackers.com · 8 months ago

Anthropic has launched Claude Code Security, a new capability within Claude Code that scans entire codebases for vulnerabilities and suggests patches. This system utilizes advanced reasoning to identify complex issues, like authentication bypasses and memory-safety problems, often missed by traditional security tools. Internal testing revealed over 500 previously unknown high-severity vulnerabilities in open-source projects. The introduction of Claude Code Security has already impacted cybersecurity stocks, with companies like CrowdStrike and Cloudflare experiencing significant declines.

Employers to job seekers: Your AI résumé isn’t fooling anyone

www.washingtonpost.com · 8 months ago

false

Anthropic Launches Claude Code Security for AI-Powered Vulnerability Scanning

thehackernews.com · 8 months ago

Anthropic has introduced Claude Code Security, a new feature designed to scan codebases for vulnerabilities and propose patches. This tool aims to combat AI-powered attacks by leveraging AI to proactively identify weaknesses that traditional methods might overlook. Claude Code Security mimics human security researcher reasoning, analyzes code interactions, and implements a multi-stage verification process to reduce false positives. The system provides severity ratings and confidence levels for each finding, requiring human approval before any changes are implemented.

CISA Adds Two Actively Exploited Roundcube Flaws to KEV Catalog

thehackernews.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency has added two vulnerabilities impacting Roundcube webmail software to its catalog of known exploited vulnerabilities. These include CVE-2025-49113, a remote code execution flaw, and CVE-2025-68461, a cross-site scripting vulnerability. Attackers rapidly weaponized CVE-2025-49113 and made an exploit available for sale within days of public disclosure. Nation-state threat actors have previously exploited vulnerabilities in Roundcube, and federal agencies must address these flaws by March 13, 2026.

EC-Council Expands AI Certification Portfolio to Strengthen U.S. AI Workforce Readiness and Security

thehackernews.com · 8 months ago

false

Compromised npm package silently installs OpenClaw on developer machines

www.csoonline.com · 8 months ago

A compromised npm publish token was used to push a malicious update to the Cline CLI, version 2.3.0, which silently installed the OpenClaw AI agent on developer machines. The update, live on the registry for approximately eight hours on February 17, contained a postinstall script that added OpenClaw, granting it broad system access and integrations with various messaging platforms. Security experts warn that while OpenClaw wasn’t directly malicious in this instance, the technique demonstrates a serious vulnerability and potential for future attacks. Developers are advised to update Cline to version 2.4.0 or higher and uninstall OpenClaw if it was inadvertently installed.

PayPal Flaw Exposed Email Addresses, Social Security Numbers for 6 Months

www.techrepublic.com · 8 months ago

A software error within PayPal’s Working Capital loan platform exposed personal information for approximately six months, from July 1, 2025, to December 13, 2025. The coding error inadvertently allowed unauthorized access to sensitive data, including names, email addresses, social security numbers, and dates of birth for roughly 100 customers. Some affected customers experienced unauthorized transactions, which PayPal has since refunded. PayPal has since rolled back the code change, reset passwords, and offered two years of free credit monitoring.

Spanish police say they have arrested hacker who booked luxury hotel rooms for just one cent

www.bitdefender.com · 8 months ago

Spanish police have arrested a 20-year-old man for allegedly defrauding a travel booking website and luxury hotels. The suspect reportedly booked rooms costing up to 1000 euros for just one euro cent by manipulating the payment gateway during transactions. He is accused of exploiting a technical vulnerability to trick the system into confirming payments while only processing a minimal amount. Multiple fraudulent reservations were made, resulting in significant financial losses for hotels.

Friday Squid Blogging: Squid Cartoon

www.schneier.com · 8 months ago

false

Cisco Secure Web Appliance Real-Time Scanning Archive File Bypass Vulnerability

sec.cloudapps.cisco.com · 8 months ago

A vulnerability in the Dynamic Vectoring and Streaming (DVS) Engine implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass the anti-malware scanner, allowing malicious archive files to be downloaded. This vulnerability is due to improper handling of certain archive files. An attacker could exploit this vulnerability by sending a crafted archive file, which should be blocked, through an affected device. A successful exploit could allow the attacker to bypass the anti-malware scanner and download malware onto an end user workstation. The downloaded malware will not automatically execute unless the end user extracts and launches the malicious file. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-archive-bypass-Scx2e8zF <br/Security Impact Rating: Medium <br/CVE: CVE-2026-20056

Attackers Use New Tool to Scan for React2Shell Exposure

www.darkreading.com · 8 months ago

A cyber espionage group is actively scanning the internet for systems vulnerable to the React2Shell remote code execution vulnerability. The group is using a toolkit called ILovePoop to probe networks across the globe, specifically targeting government, defense, finance, and industrial organizations in the United States. This reconnaissance activity often precedes actual attacks, with exploitation occurring roughly 45 days after initial network scanning. The vulnerability, CVE-2025-55182, affects numerous websites and poses a significant risk due to the ease of exploitation and the challenges in patching vulnerable systems.