Blahalla

Microsoft Warns Python Infostealers Target macOS via Fake Ads and Installers

thehackernews.com · 8 months ago

Microsoft warned that information-stealing campaigns are rapidly expanding beyond Windows to target macOS by leveraging cross-platform languages like Python and abusing trusted platforms for large-scale distribution. These campaigns have used malvertising and fake sites that employ ClickFix lures since late 2025 to deliver disk image installers that deploy stealer families such as Atomic macOS Stealer AMOS, MacSync, DigitStealer, and PXA Stealer, using fileless execution, native macOS utilities, and AppleScript automation to harvest browser credentials, session data, iCloud Keychain items, developer secrets, and financial information. Attack chains have involved phishing emails, persistence via registry Run keys or scheduled tasks, Telegram for command and control and exfiltration, and distribution through messaging apps like WhatsApp for malware such as Eternidade, and organizations are advised to educate users on malvertising and fake installers and to monitor Terminal activity, iCloud Keychain access, and network egress for suspicious POST requests.

Microsoft and Google Platforms Abused in New Enterprise Cyberattacks

gbhackers.com · 8 months ago

There is a dangerous shift in phishing tactics, with threat actors increasingly hosting malicious infrastructure on trusted cloud platforms including Microsoft Azure blob storage, Google Firebase, and AWS CloudFront to bypass traditional security defenses. Three adversary-in-the-middle kits, Tycoon2FA, Sneaky2FA, and EvilProxy, intercept credentials and session tokens in real time, defeat or bypass multi-factor authentication, and target enterprise accounts by filtering for corporate email addresses. Attackers exploit Cloudflare and cloud provider features such as valid HTTPS certificates, CAPTCHA challenges, geographic filtering, and user agent validation to hide malicious origins and evade automated scanners, and documented Tycoon2FA incidents on Microsoft Azure nearly doubled within one week. Effective defense requires moving beyond static indicators and implementing behavioral analysis and interactive malware analysis to trace full attack chains and reveal credential theft pages hidden behind multi-stage redirects and anti-analysis techniques.

Should I stay or should I go?

www.csoonline.com · 8 months ago

CISO turnover is high, with many leaders switching jobs every two to three years because senior leadership often provides insufficient budget, limited board access, and executive misalignment that block risk management and resilience. Clear red flags are leadership paying lip service, repeated resource denials, reporting lines that prevent escalation, cognitive disconnects between boards and security teams, and pressure to conceal compliance gaps or reportable breaches that force ethical compromises. Green flags include visible executive and board support, transparent incident response and regular tabletop exercises, which helped teams respond to the SolarWinds supply chain hack by prioritizing transparency. Many CISOs respond to poor support by moving to fractional roles, running business-focused stress tests to reframe security as a revenue issue, and carrying indemnity insurance and outside legal counsel when they report to the board.

Ingress-NGINX Flaw Enables Arbitrary Code Execution Attacks

gbhackers.com · 8 months ago

A high-severity vulnerability in the Kubernetes ingress-nginx controller allows attackers to execute arbitrary code and potentially compromise entire clusters. Tracked as CVE-2026-24512, the flaw enables malicious actors to inject configuration directives through the ingress controller and gain unauthorized access to cluster secrets.

Eclipse Foundation Mandates Pre-Publish Security Checks for Open VSX Extensions

thehackernews.com · 8 months ago

The Eclipse Foundation will enforce pre publish security checks for extensions submitted to the Open VSX Registry to proactively prevent supply chain threats and stop malicious extensions from being published. These checks will flag name or namespace impersonation, accidentally published credentials, and known malicious patterns, and will quarantine suspicious uploads for review instead of publishing them immediately. The verification program will be staged with February 2026 used for monitoring without blocking publication to reduce false positives, and enforcement will begin in March 2026.

My book is about a corporate IT analyst who gets caught up in an illegal debt collection scheme through an anonymized encrypted device. It’s currently free on Amazon for educational purposes

www.goodreads.com · 8 months ago

A book tells the story of a corporate analyst who uses physical violence as a psychological coping mechanism. The protagonist beats random strangers in the street to vent office frustration while keeping his employer unaware. The work is being offered free on Amazon for educational purposes.

Shadow DNS Operation Abuses Compromised Routers to Manipulate Internet Traffic

gbhackers.com · 8 months ago

A sophisticated shadow DNS network has been hijacking internet traffic since mid 2022 by compromising older home and business routers and forcing devices to use attacker controlled DNS resolvers hosted by Aeza International AS210644, a bulletproof hosting provider sanctioned by the U.S. Treasury in July 2025. The operation returns altered DNS answers with a twenty second time to live and uses an HTTP based two stage traffic distribution system that fingerprints browsers with JavaScript before redirecting victims to affiliate marketing platforms or malicious content. The threat evades researchers by only responding to DNS queries that omit EDNS0 and by serving legitimate responses for popular domains while manipulating lookups for targeted services, enabling redirections, adversary in the middle attacks, and secondary payloads such as cryptocurrency miners. Organizations and home users should verify router DNS settings match legitimate resolvers, update firmware, change default credentials, monitor unusual DNS query patterns, and adopt encrypted DNS to detect and mitigate compromise.

Critical Django Flaw Allows DoS and SQL Injection Attacks

gbhackers.com · 8 months ago

The Django Software Foundation has released emergency security updates to address six critical vulnerabilities impacting Django versions 6.0.2, 5.2.11, and 4.2.28. These flaws include SQL injection vulnerabilities affecting PostGIS and FilteredRelation queries, as well as denial-of-service conditions related to HTTP header processing. Several vulnerabilities have been assigned CVE identifiers, including CVE-2026-1207, CVE-2025-13473, CVE-2025-14550, CVE-2026-1285, CVE-2026-1287, and CVE-2026-1312. Users are strongly advised to upgrade immediately to mitigate potential exploitation and sanitize all user inputs before database operations.

CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog

thehackernews.com · 8 months ago

CISA added a critical SolarWinds Web Help Desk vulnerability to its Known Exploited Vulnerabilities catalog and flagged it as actively exploited. The flaw is tracked as CVE-2025-40551 with a CVSS score of 9.8 and is an untrusted data deserialization vulnerability that can allow unauthenticated remote code execution. SolarWinds released fixes in Web Help Desk version 2026.1 that also addressed CVE-2025-40536, CVE-2025-40537, CVE-2025-40552, CVE-2025-40553, and CVE-2025-40554, and CISA added three other KEV entries: CVE-2019-19006, CVE-2025-64328, and CVE-2021-39935. Federal Civilian Executive Branch agencies are required to remediate CVE-2025-40551 by February 6, 2026 and the remaining fixes by February 24, 2026 under Binding Operational Directive 22-01.

Chrome Add-On Caught Stealing Amazon Commissions

www.techrepublic.com · 8 months ago

A Chrome extension posing as an Amazon ad blocker hijacked affiliate links in the background, redirecting commissions without user consent. Users installed the extension believing it would block ads while it silently replaced legitimate affiliate codes to capture commissions. The behavior raises privacy and fraud concerns and underscores the need to vet browser extensions and review permissions before installing them.

Hackers Actively Exploit React Native Metro Server to Target Software Developers

gbhackers.com · 8 months ago

Hackers are actively exploiting a critical vulnerability in the React Native Metro development server, known as "Metro4Shell," to target software developers. This vulnerability, CVE-2025-11953, allows attackers to execute commands on developer machines and has a CVSS score of 9.8. Exploitation began in December 2025 and involves a multi-stage PowerShell loader designed to evade security controls and download malicious payloads from attacker-controlled infrastructure. Approximately 3,500 Metro servers remain exposed online, making developers' environments attractive targets.

Coinbase confirms insider breach linked to leaked support tool screenshots

www.bleepingcomputer.com · 8 months ago

Coinbase confirmed that a single contractor improperly accessed the personal information of approximately thirty customers in an insider breach that occurred in December. Impacted users were notified, offered identity theft protection and guidance, and the individual no longer performs services for Coinbase. Threat actors briefly posted screenshots of an internal support panel showing email addresses, names, date of birth, phone numbers, KYC information, cryptocurrency wallet balances and transactions before deleting the posts. The incident underscores ongoing targeting of outsourced support and BPO firms through bribed or compromised insiders and social engineering to gain access to customer data.

Why Smart People Fall For Phishing Attacks

unit42.paloaltonetworks.com · 8 months ago

Phishing attacks remain a significant threat despite advances in cybersecurity, with over 90% of successful cyberattacks linked to phishing emails. Attackers use psychological tactics in three stages: baiting with attractive information, hooking with urgency, and catching victims by initiating compromise through actions like clicking links. To exploit vulnerabilities, attackers utilize tactics such as creating urgency and fear, impersonating authority figures, and taking advantage of distractions. Experts advise adopting a zero-trust mindset, staying educated about phishing trends, recognizing psychological triggers, and pausing to verify information before taking action.

SVD-2026-0201: Third-Party Package Updates in Splunk SOAR - February 2026

advisory.splunk.com · 8 months ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk SOAR version 7.1.0.

Netflix Leader Pushes Warner Deal Before Skeptical Lawmakers

www.nytimes.com · 8 months ago

false

Russian Hackers Weaponize Microsoft Office Bug in Just 3 Days

www.darkreading.com · 8 months ago

A Russian-linked advanced persistent threat group, APT28, is actively exploiting a recently patched Microsoft Office vulnerability, CVE-2026-21509, in a campaign called Operation Neusploit. The group began exploiting the flaw just three days after a patch was released, targeting organizations in Central and Eastern Europe with phishing lures in multiple languages. APT28 is using specially crafted documents to deploy malware, including MiniDoor for email theft and PixyNetLoader to deliver a Covenant Grunt backdoor. Security experts recommend immediate patching and monitoring of related cloud services to mitigate the risk.

Step Finance says compromised execs' devices led to $40M crypto theft

www.bleepingcomputer.com · 8 months ago

Researchers have identified a new technique called "Synolocker" that allows attackers to lock victims out of their own devices and demand ransom payments. This method exploits vulnerabilities in publicly available open-source code used in various network devices, potentially impacting a wide range of users. Attackers leverage readily accessible tools and scripts, making the process relatively simple and inexpensive to execute. The vulnerabilities exploited include CVE-2021-22965, CVE-2021-23902, and CVE-2019-11049.

CISA official says CIRCIA cyber reporting update is 'weeks' away

therecord.media · 8 months ago

false

Spain Aims to Ban Social Media for Children Under 16

www.nytimes.com · 8 months ago

Spain will ban access to social media for children under 16, Prime Minister Pedro Sánchez announced at the World Government Summit in Dubai. Platforms will be required to implement robust age verification and the government plans a bill to hold platform executives criminally liable for illegal content and to make algorithmic amplification of illegal material an offense, citing harms including child sexual abuse material, nonconsensual deepfakes, addiction and disinformation. Spain said it will coordinate with other European countries and follows similar moves in France and Australia, while the measures will require parliamentary approval and face legal and enforcement challenges.

CISA orders federal agencies to patch exploited SolarWinds bug by Friday

therecord.media · 8 months ago

Hackers are actively exploiting a critical vulnerability in SolarWinds’ Web Help Desk software. The U.S. cyber defense agency is requiring federal agencies to patch CVE-2025-40551 by Friday, which has a severity score of 9.8 out of 10. This vulnerability stems from bypasses of a previous fix for CVE-2024-28986, and was discovered by researchers at Horizon3.ai. A software update, version 2026.1, addresses CVE-2025-40551 and other security issues.

GlassWorm Malware Returns to Shatter Developer Ecosystems

www.darkreading.com · 8 months ago

Cybercriminals have resurfaced with the GlassWorm malware, targeting software developers through a supply chain attack. The attackers compromised four legitimate components distributed via the Open VSX registry, resulting in over 22,000 downloads before malicious versions were removed. The malware harvests data including cryptocurrency wallet information, developer credentials, and more from macOS systems and likely gained access through a leaked token or unauthorized access. Security experts recommend rotating credentials, auditing GitHub activity, and removing affected extensions to mitigate the risk.

Wave of Citrix NetScaler scans use thousands of residential proxies

www.bleepingcomputer.com · 8 months ago

A coordinated scanning campaign targeted Citrix NetScaler infrastructure between January 28th and February 2nd, utilizing over 63,000 distinct IP addresses, many of which were residential proxies. The activity focused on discovering login panels and identifying software versions, suggesting preparation for potential exploitation. Researchers observed traffic aimed at authentication interfaces and the EPA setup file path, indicating interest in version-specific exploits. Recent critical vulnerabilities impacting Citrix products include CVE-2025-5777 and CVE-2025-5775.

Spain will ban social media for kids under 16

therecord.media · 8 months ago

false

CISA flags critical SolarWinds RCE flaw as exploited in attacks

www.bleepingcomputer.com · 8 months ago

CISA has identified a critical vulnerability in the SolarWinds Web Help Desk software as actively exploited in attacks. The flaw, CVE-2025-40551, allows unauthenticated attackers to gain remote command execution. SolarWinds has released a patch and also addressed a hardcoded credentials vulnerability, CVE-2025-40537, and two authentication bypass flaws, CVE-2025-40552 and CVE-2025-40554. Federal agencies are required to patch within three days, and all organizations are urged to do so quickly due to previous exploitation of Web Help Desk vulnerabilities.

Epstein invested alongside top Silicon Valley names in crypto firm Coinbase

www.washingtonpost.com · 8 months ago

false

AI May Supplant Pen Testers, But Oversight & Trust Are Not There Yet

www.darkreading.com · 8 months ago

AI agents are increasingly augmenting and in some cases supplanting human penetration testers by automating low hanging vulnerability discovery, expanding coverage, and lowering costs. Current LLMs and agentic tools still produce notable false positives and struggle with GUI tasks and novel, complex issues such as timing attacks, so human experts remain necessary to validate findings, enforce authorization and scope, and accept legal accountability. Research and industry data show AI can match top testers on many routine tasks at a fraction of the cost, and adoption is rising with expectations that routine standards scans will become automated while human testers shift to AI-augmented orchestration and validation roles.

Poland detains defense ministry employee on suspicion of spying for Russia

therecord.media · 8 months ago

Polish authorities have detained a 60-year-old defense ministry employee suspected of spying for a foreign intelligence agency, believed to be Russia and Belarus. The civilian employee, who held a position in the strategy and planning department since the 1990s, had access to sensitive defense documents. Counterintelligence officers executed searches of his office and home, seizing electronic devices as evidence of espionage. This incident highlights Poland’s increasing vulnerability to Russian hybrid warfare tactics, following prior arrests and cyberattacks.

California city turns off Flock cameras after company shared data without authorization

therecord.media · 8 months ago

Mountain View, California, has deactivated 30 Flock automated license plate reader cameras after it was discovered the company shared data with outside agencies without authorization. Police learned that out-of-state agencies and other California police departments had been searching the city’s database, and one camera had illegal access from August through November 2024. The city has a stricter policy limiting data access to California agencies with prior authorization, and California law prohibits sharing ALPR data with out-of-state entities or for immigration purposes. The cameras will remain off until the City Council discusses the matter on February 24.

New Microsoft Update Improves Windows Sign-In Experience

www.techrepublic.com · 8 months ago

Microsoft released an optional Windows 11 update KB5074105 on January 29, 2026 that fixes the missing password icon bug introduced by the August 29, 2025 KB5064081 update and delivers 32 stability improvements. The update also resolves issues including an iSCSI boot failure that could prevent system startup and an Explorer.exe hang, and reports indicate Microsoft had not received widespread problems from installing the update at the time of reporting. KB5074105 is a non-security optional preview intended to improve reliability ahead of the next mandatory Patch Tuesday and to address lingering issues caused by the earlier August 29, 2025 update.

Microsoft SDL: Evolving security practices for an AI-powered world

www.microsoft.com · 8 months ago

false

Iron Mountain: Data breach mostly limited to marketing materials

www.bleepingcomputer.com · 8 months ago

The Everest extortion gang claimed it had stolen 1.4 terabytes of internal documents including personal and client information. Iron Mountain says the incident was limited to a single folder of marketing materials on a public facing file sharing server that was accessed using a compromised credential, that no customer confidential or sensitive information was involved, and that no ransomware, malware, or other systems were breached and the credential has been deactivated. Everest is described as a data theft focused extortion group that also acts as an initial access broker for other threat actors.

Auditing Outline. Firsthand lessons from comparing manual testing and AI security platforms

blog.doyensec.com · 8 months ago

There was a July 2025 audit of Outline OSS v0.85.1 that reported seven unique vulnerabilities, all of which have since been fixed. The findings included a server side request forgery affecting self hosted instances, a Vite path traversal limited to development, cross site request forgery via sibling domains, a local file storage content security policy bypass that enabled cross site scripting in versions before v0.84.0, an insecure verification code comparison, a content type override leading to XSS, and an IDOR in the events.list API that allowed unauthorized access to audit events. Several issues were caused by outdated third party libraries and one vulnerability was discovered autonomously by an AI security platform, while the cloud offering included protections not present in the self hosted release. Use of three AI security platforms generated many convincing false positives that required about forty hours to validate, leading to the conclusion that human expertise remains essential for high quality security audits.

UK investigating first suspected breach of cyber sanctions

therecord.media · 8 months ago

British authorities have opened the first investigation into suspected breaches of the UK cyber sanctions regime since the measures took effect more than five years ago. HM Treasury said the Office of Financial Sanctions Implementation has recorded up to five potential cyber sanctions breaches, all involving firms in the financial services sector, but declined to identify firms or provide case details. OFSI has not completed any enforcement action in those cases and has been expanding monitoring capabilities, including increased headcount, advanced data analytics, specialist datasets and cryptocurrency investigation tools. Financial services firms face civil penalties up to one million pounds or 50 percent of the value of a breach, criminal fines that can be unlimited and potential prison sentences of up to seven years for senior managers, while the cyber sanctions regime currently designates dozens of individuals and entities.

Docker Fixes Critical Ask Gordon AI Flaw Allowing Code Execution via Image Metadata

thehackernews.com · 8 months ago

A critical prompt injection vulnerability in Ask Gordon, Docker's built-in AI assistant for Docker Desktop and the Docker CLI, lets a single malicious Docker image metadata label be treated as executable instructions, enabling remote code execution and sensitive data exfiltration. The issue, tracked as DockerDash by Noma Labs, exploits Ask Gordon's failure to validate LABEL metadata, causing the assistant to forward parsed instructions to the Model Context Protocol Gateway which invokes MCP tools that then run commands with the user's Docker privileges. Docker addressed the vulnerability in version 4.50.0 released in November 2025, and the update also patches a separate prompt injection involving Docker Hub repository metadata.

Paris police raid X offices as part of expanded criminal probe

www.washingtonpost.com · 8 months ago

Paris police raided X's Paris headquarters as part of an expanded criminal probe that lists seven alleged offenses, including spreading Holocaust denial content and involvement in distributing child pornography. French prosecutors say the investigation began more than a year ago focused on X's algorithm and data handling and was expanded after reports that Grok, X's AI tool, generated sexually explicit deepfakes and Holocaust denial material. Investigators, working with Europol and French cybercrime units, searched offices and summoned current and former X employees, including Elon Musk and former chief executive Linda Yaccarino, for voluntary interviews scheduled in April. No charges have been filed and prosecutors say the inquiry aims to ensure X complies with French law, where Holocaust denial is a criminal offense that can carry up to one year in prison and substantial fines.

8-Minute Access: AI Accelerates Breach of AWS Environment

www.darkreading.com · 8 months ago

Attackers breached an Amazon Web Services environment in less than ten minutes by exploiting exposed credentials in public Simple Storage Service buckets and leveraging artificial intelligence. Threat actors used large language models to automate reconnaissance, generate malicious code, escalate privileges, and hijack cloud resources like Amazon Bedrock and GPU instances. The attack involved lateral movement across 19 AWS principals and demonstrated AI-assisted code generation, including instances of what researchers described as AI hallucinations. Security experts emphasize that proper credential management, such as using IAM roles and rotating access keys, is crucial to prevent similar breaches.

Fighting AI anomaly false-positives with firejail and proxychains

tech.michaelaltfield.net · 8 months ago

A guide explains how to create a persistent, sandboxed single-site browser to maintain a consistent IP and browser state and reduce the chance of being locked out by machine learning anomaly detection on login pages. The method combines an SSH established local SOCKS5 proxy to present a static server IP, firejail to provide a kernel-level sandbox for the browser, and proxychains to force all browser traffic through the proxy. The approach requires SSH access to a server with a static IP and specific software versions including Debian 12, Firejail version 0.9.72, and Proxychains version 3.1, and it supplies a script to launch a dedicated persistent browser profile inside the sandbox. The information frames this as harm reduction, warns that persistent single-site browsers reduce privacy compared with ephemeral browsing, and advises weighing operational security risks before proceeding.

Dark Patterns Undermine Security, One Click at a Time

www.darkreading.com · 8 months ago

Dark patterns in websites and apps, such as cookie banners without a reject option, hard-to-cancel free trials, hidden refund options, and misleading permission requests, are widespread and condition users to make insecure choices. These practices have contributed to concrete security risks and incidents, including social engineering and vishing that exposed multifactor authentication codes, automatic syncing or cloud migration of credentials, and mass account creation and data access by third-party services. Regulators are beginning to act with advisories and laws to curb deceptive interfaces, but vendor defaults and tiered pricing continue to shift security burdens onto users and smaller organizations.

Russian state hackers exploit new Microsoft Office flaw in attacks on Ukraine, EU

therecord.media · 8 months ago

Russian state linked hackers exploited a newly patched Microsoft Office vulnerability tracked as CVE-2026-21509 to target government bodies in Ukraine and other European countries. Malicious Office documents disguised as correspondence from Ukraine’s hydrometeorological center delivered payloads that executed Covenant malware and, in other variants, installed MiniDoor and PixyNetLoader to harvest emails and deploy backdoors. CERT-UA and security firms observed the campaign soon after Microsoft disclosed the flaw in early January and warned attacks will likely increase while organizations delay installing patches. Microsoft released a high severity patch and the vulnerability was added to the Known Exploited Vulnerabilities catalog.

RADICL Raises $31 Million for vSOC

www.securityweek.com · 8 months ago

RADICL raised 31 million dollars in a Series A round, bringing its total funding to 42 million dollars. Founded in 2021 and based in Boulder, Colorado, the company provides an autonomous virtual security operations center for small and medium sized businesses in regulated or high risk sectors such as the defense industrial base and critical infrastructure, using agentic operators and artificial intelligence to identify, assess, and respond to attacks at machine speed. The round was led by Paladin Capital Group with participation from Access Venture Partners, Denver Ventures, and Cervin Ventures, and the company will use the funding to accelerate development of its AI native autonomous vSOC, launch new products, and support market adoption.

How LLMs Feed Your RE Habit: Following the Use-After-Free Trail in CLFS

clearbluejar.github.io · 8 months ago

LLMs combined with patch diffing and tools like pyghidra-mcp accelerate reverse engineering by tracing a use after free in the Windows Common Log File System. The vulnerability CVE-2025-29824 occurs when FsContext2 is freed during the cleanup path triggered by IRPMJCLEANUP and CClfsLogCcb Cleanup and Release while a concurrent IRP handling a DeviceIoControl can still access FsContext2, creating a race between cleanup and close. Reproducing and understanding the issue relies on patch diffs, importing the vulnerable clfs.sys into Ghidra, IRP timing analysis, and iterative prompts to local LLMs to map code paths and infer trigger conditions.

AI Agent Identity Management: A New Security Control Plane for CISOs

www.bleepingcomputer.com · 8 months ago

Autonomous AI agents are proliferating in production environments and operating outside traditional identity and access management controls, creating a new identity blind spot. This gap produces identity sprawl, unclear ownership, orphaned agent accounts, and widespread over-privilege that legacy IAM, PAM, and IGA systems cannot govern at machine speed. Continuous AI agent identity lifecycle management is required, emphasizing real-time discovery of shadow agents, enforced ownership, dynamic least privilege, traceability for forensics and compliance, and treating identity as the control plane for AI security.

Cyberrisiko Ruhestand

www.csoonline.com · 8 months ago

Es gibt drei kritische Risiken, wenn erfahrene OT Fachkräfte in den Ruhestand gehen: massiver Wissensverlust über undokumentierte Altsysteme, versteckte Netzwerkrouten und proprietäre Protokolle, die für Betrieb und Compliance erforderlich sind. Das erste Risiko sind Systemausfälle bei Modernisierungen, weil historische Windows NT oder Windows XP Systeme, nicht dokumentierte VLAN und Routing Konfigurationen sowie proprietäre Protokollparameter bei Änderungen übersehen werden; das zweite ist eine verlängerte Time to Value für neue Geräte und Prozesse durch aufwendige Netzwerkintegration, ineffiziente Fehlerbehebung und stärkere Abhängigkeit von externen Integratoren. Das dritte Risiko sind unbeabsichtigte Cybersicherheitslücken, zum Beispiel fehlerhafte Netzwerksegmentierung und Firewall Fehlkonfigurationen, die zuvor isolierte Komponenten offenlegen, wobei alle drei Risiken sich gegenseitig verstärken und Modernisierungsprojekte zusätzlich gefährden.

From credentials to cloud admin in 8 minutes: AI supercharges AWS attack chain

www.csoonline.com · 8 months ago

Threat actors moved from a single exposed credential in a public storage bucket to full administrative control of an Amazon Web Services environment in under eight minutes, chaining credential theft, privilege escalation, lateral movement, and GPU resource abuse with help from large language models. The intrusion began with valid AWS credentials left in a public bucket tied to an IAM user with Lambda and limited Bedrock permissions, enabling rapid enumeration and modification of an existing Lambda function to create new admin access keys via Lambda execution output. With admin access the attacker assumed multiple roles across nineteen principals, created users to spread activity, invoked multiple foundation models while model invocation logging was disabled, and attempted to launch high end GPU instances to run training workloads and expose a public JupyterLab interface. Mitigations include enforcing least privilege for IAM users and Lambda execution roles, restricting sensitive permissions such as UpdateFunctionCode and PassRole, preventing public exposure of sensitive buckets, enabling Lambda versioning and model invocation logging, and monitoring for large scale enumeration and unusual resource provisioning.

RapidFort Raises $42M to Automate Software Supply Chain Security

www.securityweek.com · 8 months ago

RapidFort raised 42 million in a Series A funding round led by Blue Cloud Ventures and Forgepoint Capital with participation from several other investors, bringing total funding to more than 50 million and earmarked to scale go to market efforts and expand the platform. The company provides a software attack surface management platform that continuously analyzes and hardens software artifacts to eliminate vulnerabilities before production by scanning and profiling containers in CI CD pipelines, generating software bills of materials and identifying unused packages for removal. The platform includes a catalog of thousands of curated near zero CVE container images built on major Linux distributions that are FIPS 140 3 validated and STIG and CIS benchmarked, and its runtime intelligence removes components never executed during operation with less than one percent compute overhead while supporting FedRAMP and CMMC compliance.

10 SSO providers and solutions compared for 2026

blog.scalefusion.com · 8 months ago

There are ten leading single sign-on solutions in 2026 addressing fragmented access, rising credential-based attacks, and poor user experience by supporting standards such as SAML, OpenID Connect, and SCIM while offering robust multifactor authentication, conditional access, and centralized policy control across endpoints. The providers highlighted include Scalefusion OneIdP, Okta, Duo, LastPass, PingOne, OneLogin, JumpCloud, RSA SecurID, CyberArk Workforce Identity, and ForgeRock, with offerings focused on federation, adaptive authentication, passwordless options, and enterprise provisioning and deprovisioning. Guidance for choosing an SSO emphasizes compatibility with existing directories and applications, prioritizing security, user experience, scalability, and flexibility, and recommends integrating SSO with unified endpoint management for stronger operational efficiency and security outcomes.

UK privacy watchdog probes Grok over AI-generated sexual images

www.bleepingcomputer.com · 8 months ago

The United Kingdom's data protection authority has opened a formal investigation into X and its Irish subsidiary after reports that the Grok AI assistant was used to generate nonconsensual sexual images. The ICO said it contacted X and xAI on January 7 seeking urgent information and will examine whether X Internet Unlimited Company and X.AI LLC processed personal data lawfully and whether adequate safeguards were in place to prevent Grok from creating harmful manipulated images. The regulator warned that losing control over personal data can cause immediate and significant harm, particularly for children, and it can impose fines of up to seventeen point five million pounds or four percent of worldwide annual turnover. X is also facing related probes from French prosecutors who raided its Paris offices, the European Commission, the California Attorney General, and the UK online safety regulator Ofcom.

Chaos in Minneapolis Exposes an Internet at War With Truth

www.nytimes.com · 8 months ago

There is growing evidence that advances in artificial intelligence are producing realistic fabricated text, images, audio, and video that spread rapidly online and are eroding public trust in traditional sources of information. In Minneapolis, AI generated images and manipulated media circulated after recent shootings and immigration enforcement actions, prompting widespread false identifications and confusion that hampered public understanding of events. Automated bot networks and coordinated activity amplified these synthetic narratives across platforms, making it harder for journalists and investigators to contain misinformation. Experts and local officials are relying on traditional verification and forensic techniques and partnering with platforms to debunk false claims while policymakers and institutions consider legal and technological countermeasures to limit harm.

[Webinar] The Smarter SOC Blueprint: Learn What to Build, Buy, and Automate

thehackernews.com · 8 months ago

There is a live session called The Smarter SOC Blueprint that explains what to build, what to buy, and what to automate to simplify modern security operations centers. Speakers Kumar Saurabh, CEO of AirMDR, and Francis Odum, CEO of SACR, present a customer case study, compare common SOC models, and provide a practical checklist to help teams reduce tool bloat and missed signals. The session aims to give security teams clear, actionable steps to simplify operations, cut clutter, and make better decisions with existing people, tools, and budgets.

Hackers exploit critical React Native Metro bug to breach dev systems

www.bleepingcomputer.com · 8 months ago

There is a critical vulnerability CVE-2025-11953 in the Metro development server used by React Native that allows unauthenticated attackers to execute arbitrary OS commands on Windows via a POST to the open-url endpoint and to launch arbitrary executables on Linux and macOS, and it affects @react-native-community/cli-server-api versions 4.8.0 through 20.0.0-alpha.2 and was fixed in version 20.0.0. Active exploitation was observed beginning December 21, 2025, with attackers delivering base64 encoded PowerShell payloads in POST bodies that disable Microsoft Defender exclusions, fetch a Rust UPX packed Windows binary and corresponding Linux binaries, write them to disk, and execute them to retrieve further payloads. There are approximately 3,500 Metro servers exposed online, and organizations are urged to update to version 20.0.0 or bind Metro to localhost and apply published indicators of compromise and mitigation guidance.