Blahalla

AI Decline? Confidence in Autonomous Penetration Testing Falls

www.darkreading.com · 27 days ago

Companies are still experimenting with automated AI systems to find security weaknesses, but fewer are relying on the technology.

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

thehackernews.com · 27 days ago

A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.

Polymarket customers lose $3 million in supply-chain attack

www.bleepingcomputer.com · 27 days ago

Polymarket says it will fully reimburse customers who lost an estimated $3 million after hackers injected a malicious script into the platform's frontend following a breach at a third-party vendor.

Cybersecurity firms targeted by fraudulent OpenAI organization invites

www.bleepingcomputer.com · 27 days ago

Threat actors are creating OpenAI tenants that impersonate legitimate companies and inviting employees to join them, in what appears to be a ploy to trick targets into submitting sensitive company information in chats and projects.

Cisco Adds NHI to Security Stack With Astrix, WideField Acquisitions

www.darkreading.com · 27 days ago

Cisco joins a growing list of security platform providers who are betting that securing the agentic workforce means turning identity into the primary control plane.

Hackers Claim French Employment Leak Exposes Over 1M Records, Health Data

www.techrepublic.com · 27 days ago

Hackers claim 1M+ records tied to French employment apps were exposed, including HR files, health data, worker details, and plaintext passwords.

New License Plate Reader Tech Could Track Phones, AirPods, and Smartwatches

www.techrepublic.com · 27 days ago

Leonardo’s SignalTrace adds wireless device detection to ALPR systems, raising new questions about roadside surveillance, privacy, and security.

Meta Is Testing Facial Recognition for Police and Military

www.schneier.com · 27 days ago

We know that ICE wants to deploy eyeglasses with facial recognition that can identify people in real time. Turns out Meta is prototyping the feature with a Pentagon supplier. (Alternate news story.

New Initiative Tackles Security for End-of-Life Open Source Software

www.darkreading.com · 27 days ago

The Open Source Sustainability Initiative's goal is to help enterprises manage and secure aging open source projects while maintaining regulatory compliance.

Malware authors subvert AI detection systems

www.csoonline.com · 27 days ago

Enterprises that have turned to AI in order to boost their security defenses may have to reconsider their approach. Malware containing code that commands LLM-assisted products to abort their analysis or refuse to implement it is already circulating, according to a post from security company SentinelLabs. SentinelLabs thinks it knows who’s responsible for the malware, which attacks MacOS systems.

Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign

thehackernews.com · 27 days ago

A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as part of cyber attacks aimed at government entities and critical infrastructure in Southeast Asia.

AI Won't Wipe-Out Entry-Level Cybersecurity Jobs

www.darkreading.com · 27 days ago

Instead of eliminating jobs for early-career cyber pros, AI is creating new opportunities for candidates with strong human decision-making skills.

Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories

www.securityweek.com · 27 days ago

AWS has patched the vulnerability and published its own advisory to inform customers about the potential impact.

More Klue Breach Victims Identified as Hackers Get Hacked

www.securityweek.com · 27 days ago

Roughly two dozen companies have notified their customers of the Klue-Salesforce incident impact.

Cyberattacks pose a ‘threat to life’ in Australia

www.csoonline.com · 27 days ago

Australia’s Security Intelligence Organization (ASIO) has uncovered an attack on a critical infrastructure operator’s network. State-sponsored actors had compromised the network and were preparing to sabotage it, according to its director general, Mike Burgess. Other countries face similar cyber-threats to critical infrastructure.

In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs

www.securityweek.com · 27 days ago

Other noteworthy stories that might have slipped under the radar: Russia used Cellebrite to hack activist’s phone, Five Eyes issue urgent AI threat warning, macOS Gaslight backdoor, Scattered Spider guilty pleas.

In Europe, Tesla Sales Are Rising Despite Views on Elon Musk

www.nytimes.com · 27 days ago

Price cuts and low-interest-rate loans are luring buyers, including people offended by the company’s chief executive.

Your First GRC Agent: A Red Teamer's Walkthrough

www.bleepingcomputer.com · 27 days ago

AI won't replace GRC analysts, but it can eliminate much of the repetitive work they do. Anecdotes walks through building an agent that continuously monitors controls, identifies evidence gaps, and opens remediation tasks.

Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

thehackernews.com · 27 days ago

A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The path was short: a developer opens the repo, trusts the workspace, and Amazon Q does the rest. Amazon has patched it. Tracked as CVE-2026-12957 (CVSS 8.5), the bug sat in how Amazon's AI coding assistant handled Model Context Protocol (MCP) servers.

Microsoft Extends Windows 10 Security Updates to 2027

www.techrepublic.com · 27 days ago

Microsoft extended Windows 10 security updates for personal devices through Oct. 12, 2027, giving users more time to upgrade.

Meeting Trump's 2030 Quantum Deadline Will be Expensive, Complex

www.darkreading.com · 27 days ago

Getting accurate visibility into IT and OT systems will be compounded by multivendor environments, misaligned update life cycles, and interoperability gaps.

New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

thehackernews.com · 27 days ago

A flaw in the Linux kernel's traffic-control subsystem can let a local unprivileged user gain root on affected systems. CVE-2026-46331, nicknamed "pedit COW," is an out-of-bounds write in the packet-editing action (actpedit) that corrupts shared page-cache memory. A public, working exploit appeared within a day of the CVE assignment on June 16.

Thanks for Crushing the Submissions Inbox. We're Trying to Keep Up

www.darkreading.com · 27 days ago

It might be taking a bit longer than usual to respond to your submissions, here's why.

Water and Wastewater Systems Become Strategic Targets for Russia, China, and Iran

gbhackers.com · 27 days ago

Water and wastewater systems have become strategic gray‑zone targets for Russia, China, and Iran, driven by chronic underinvestment and weak operational‑technology (OT) defenses that make these utilities easy to probe and exploit.

Nebulock Raises $25 Million for AI-Native Contextual Security

www.securityweek.com · 27 days ago

The cybersecurity startup provides threat hunting, proactive detection, and behavioral security analytics.

CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue

thehackernews.com · 27 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical remote code execution vulnerability impacting PTC Windchill PDMlink and PTC FlexPLM enterprise Product Data Management (PDM) and Product Lifecycle Management (PLM) software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

Five Eyes Warns AI Could Speed Cyberattacks Within Months

www.techrepublic.com · 27 days ago

Five Eyes agencies warned that AI could speed cyberattacks within months, raising new risks around prompt injection, phishing, and enterprise AI tools.

New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets

thehackernews.com · 27 days ago

DirtyClone is a new Linux kernel privilege escalation in the DirtyFrag family. JFrog Security Research published a working exploit walkthrough for the flaw on June 25, the first public demonstration for this variant. Tracked as CVE-2026-43503 (CVSS 8.8), it lets a local user corrupt file-backed memory through a cloned network packet and gain root.

China-Linked Malware Found in Counterfeit USB Drives Used on Japan Defense Force Classified Networks

gbhackers.com · 27 days ago

Japan’s defense infrastructure has faced scrutiny following an investigation that revealed members of the Japan Self-Defense Forces (JSDF) used counterfeit USB drives embedded with malware linked to China on systems handling classified information. According to findings reported by Nikkei, these compromised USB devices were acquired at significantly lower costs through unofficial channels.

Guardian Agents: The Next Layer of Identity Governance

thehackernews.com · 27 days ago

AI agents are moving through enterprise environments, inheriting permissions, traversing systems, and executing decisions at machine speed with minimal oversight. The identity infrastructure built to govern human access wasn't designed for autonomous actors, and the gap between what enterprises are deploying and what their governance programs actually cover is widening fast.

Linux Foundation Unveils New Open Source Security Project Akrites

www.securityweek.com · 27 days ago

It will provide the tools and channels to report, patch, and disclose open source software vulnerabilities.

FOSSBilling Flaw Lets Admin Attackers Abuse DI Container for SQL Access and RCE

gbhackers.com · 27 days ago

A critical server-side template injection (SSTI) vulnerability in FOSSBilling, tracked as CVE-2026-28496, is exposing instances to potential full database compromise and remote code execution (RCE), with early signs of active exploitation appearing shortly after public disclosure. This flaw is documented under GitHub advisory GHSA-57mv-jm88-66jc and affects all versions up to 0.7.2.

Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack

thehackernews.com · 27 days ago

Cybersecurity researchers have flagged yet another evolution of the supply chain attack linked to the Mini Shai-Hulud, Miasma, and Hades malware family that has compromised a new set of npm packages, even as it has propagated to the Go ecosystem.

One Million Passports Leaked Online

www.schneier.com · 27 days ago

A database of almost a million passports from around the world was leaked online. Note what happened. A high-value credential, a passport, was used in an ancillary low-value authentication system: ID verification for cannabis dispensaries. And it’s the low-value system that got hacked, putting the high-value credential at risk.

‘The Daily’ and ‘The Opinions’: How A.I. Is Changing Loneliness and Taste

www.nytimes.com · 27 days ago

The story of a woman who let a robot into her home. Plus, a discussion about why Silicon Valley has taken such an interest in taste.

What CISOs need to tell the board about zero trust in OT: A 90-day communication and action plan

www.csoonline.com · 27 days ago

Zero Trust struggles in OT vs IT design. Following Colonial ransomware, operators face mandates like TSA Directive 2021-02C. CISA advises adopting zero trust via identity/device checks instead of full overhauls. Adaptations are key for affected entities.

Proposed US law would make AI risk reporting a legal obligation

www.csoonline.com · 27 days ago

US lawmakers proposed the AI Incident Reporting Act. It forces AI developers to report major safety/security incidents (e.g., evasion, unauthorized access) to the Commerce Department within seven days, establishing federal oversight. This bill holds high-risk AI systems legally accountable.

Hackers Exploit WinRAR CVE-2025-8088 to Plant Startup Shortcut and Run PowerShell Loader

gbhackers.com · 27 days ago

Hackers weaponized WinRAR's path-traversal flaw, tracked as CVE-2025-8088, by planting a Startup shortcut using NTFS Alternate Data Streams (ADS). This campaign employs a multi-stage PowerShell loader that maps a headerless PE image reflectively in memory. The payload utilizes custom reflective mapping APIs and exfiltrates 16-byte telemetry to hxxps://142.111.194[.]73:8640.

$3 Million Reportedly Stolen in Polymarket Hack

www.securityweek.com · 27 days ago

Polymarket disclosed that a third-party vendor compromised its platform by injecting malicious scripts into the frontend, affecting several users. PeckShield reported hackers stole roughly $3 million worth of pUSD through a phishing campaign targeting at least 11 victims. Attackers reportedly bridged these stolen funds from Polygon to Ethereum.

Scammers Abuse Shopify to Send Fake Invoices and Steal Credentials via Fake Support Calls

gbhackers.com · 27 days ago

Security researchers Luis Corrons and Jakub Vavra found scammers using Shopify’s Shop app for social engineering attacks. Attackers add fake receipts, pretending to be brands like Apple or Norton, to users' purchase histories to cause panic. These false invoices often include fake support numbers, tricking victims into voice phishing calls where they give up personal information.

Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant

thehackernews.com · 27 days ago

Microsoft alerted security users to an active phishing campaign targeting hospitality organizations across Europe and Asia since April 2026. Attackers utilize photo-themed ZIP files that drop a Node.js implant, compromising front-desk machines within these facilities. The group remains unattributed, and authorities do not yet know the ultimate goal of this attack.

Russian Authorities Used Cellebrite UFED to Break Into Human Rights Activist’s iPhone

gbhackers.com · 27 days ago

Russian authorities used Cellebrite's Universal Forensic Extraction Device on Andrey Pivovarov’s iPhone 12 during his 2021 detention. Non-consensual extraction bypassed protections, pulling data via tools like the Physical Analyzer for keyword searches on messaging platforms.

In AI race vs. U.S., China eyes victory in lower prices and broader appeal

www.washingtonpost.com · 27 days ago

Global AI competition shows Chinese leaders prioritize market adoption by offering widely accessible, lower-cost models. They pursue this strategy, differing from their U.S. counterparts who concentrate on developing high capabilities. This dynamic shifts the focus of global technological rivalry toward commercial proliferation.

Mythos is a signal, not a siren: What frontier AI should change for CISOs

www.csoonline.com · 27 days ago

AI models accelerate both cyber offense and defense; however, the biggest security issue remains execution rather than strategy. Attackers continue exploiting fundamental weaknesses, such as credential abuse and unpatched systems, according to breach reports. Organizations must prioritize strengthening core controls, asset visibility, and process discipline to manage these persistent risks.

Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets

www.securityweek.com · 27 days ago

Google Threat Intelligence Group reports Russia-linked APT Turla deploys the StockStay backdoor for cyber espionage against Ukraine's government and military targets. This multi-component.NET implant communicates via WebSocket, supporting commands like file exfiltration, registry modification, and system information harvesting. The group previously targeted European entities in Italy.

Russia Used Cellebrite on Jailed Activist's iPhone Months After Sales Cutoff

thehackernews.com · 27 days ago

The Citizen Lab reported that Russian authorities accessed opposition activist Andrey Pivovarov's iPhone in June 2021 using Cellebrite’s UFED forensic tools. This activity occurred three months after Cellebrite announced it would cease selling services and tools to Russia and Belarus. The finding, published June 25, derived evidence from physical phone traces and official Russian records.

We Scanned 50,000 Skills: The Threat Persists · Tencent Zhuque Lab

matrix.tencent.com · 27 days ago

AI agent ecosystems now create an expanded attack surface through "Skills," rendering traditional scanners insufficient for modern threats. Tencent scanned over 50,000 skills on ClawHub using AIG and discovered next-generation, covert malicious methods. The research highlights that attackers penetrate defenses by exploiting functionality itself rather than simply breaking existing safeguards.

First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild

www.securityweek.com · 27 days ago

Exploitation of a remote code execution flaw, CVE-2026-12569, in PTC Windchill has occurred in the wild. This improper input validation vulnerability affects critical PLM platforms used across industrial supply chains, leading CISA to add it to its catalog. Security authorities also previously warned about another weakness in vendor products tracked as CVE-2026-4681.

New Enterprise-Ready MCP Specification Brings New Security Challenges

www.securityweek.com · 27 days ago

MCP shifts security burdens from protocol to devs/operators. While stateless, developers must now protect tracking IDs from hijacking and prevent data leaks via HTTP headers carrying API keys or PII.

KuinaExtractor Stealer Targets Browser Data, Crypto Wallets, Roblox, Steam, and Discord

gbhackers.com · 27 days ago

KuinaExtractor evolved into k0to, a Rust infostealer targeting browser/crypto wallet data & Steam. It uses techniques like LSASS impersonation to grab master keys. The malware is continuously refined for better stealth.