Blahalla

Interesting Paper Exploring Prompt Injection

www.schneier.com · 28 days ago

This is a fascinating explotation of how LLMs fall for prompt injection attacks. It turns out that they learn to recognize the style of text in different role/instruction blocks, and not just the tags. Their conclusion: Role tags were a formatting trick that became the security architecture and the cognitive scaffolding of modern LLMs.

Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning

www.securityweek.com · 28 days ago

The exploited flaw, CVE-2025-67038, is one of the vulnerabilities disclosed in April as part of the BRIDGE:BREAK research project.

Surviving the Mythos Era: Richard Bejtlich on the Case for NDR

thehackernews.com · 28 days ago

Despite the abundance of telemetry at analysts’ disposal, many security operations teams struggle to answer a few basic questions during incident investigation: What happened? What evidence do we have? How do we know we’re seeing it all, in context? Answering these questions requires teams to go beyond alerts, the most common basis for initial triage.

GitLab Patches Code Execution, Information Disclosure Vulnerabilities

www.securityweek.com · 28 days ago

The latest GitLab CE/EE updates address 13 vulnerabilities, including three high-severity defects.

Gemini 3.5 Flash Now Supports Agentic Computer Use for Enterprise Automation Tasks

gbhackers.com · 28 days ago

Google has announced a significant enhancement to its AI platform with the release of Gemini 3.5 Flash, which now includes native support for agentic computer use. This new feature enables advanced enterprise automation across web, desktop, and mobile environments. Introduced on June 24, 2026, this capability was previously limited to the standalone Gemini 2.

Shai-Hulud Hades Payload Hits 20 Leo/RStreams npm Packages in Fresh Supply Chain Attack

gbhackers.com · 28 days ago

A fresh supply-chain wave by the Shai-Hulud/Hades family that infected 20 npm packages in the Leo/RStreams ecosystem, an AWS-native event streaming SDK widely used for Kinesis, Firehose, Lambda and S3-based pipelines.

Langflow RCE Flaw Lets Attackers Execute Arbitrary Python Code Without Authentication

gbhackers.com · 28 days ago

A critical unauthenticated remote code execution (RCE) vulnerability in Langflow, tracked as CVE-2026-33017, is being actively exploited in the wild within hours of its disclosure. This vulnerability allows attackers to execute arbitrary Python code on exposed instances without any authentication.

Curl 8.21.0 Released With 18 Security Fixes

gbhackers.com · 28 days ago

The curl project has announced the release of version 8.21.0, marking its 275th release and including a significant security update. This version addresses 18 newly disclosed vulnerabilities, reflecting an unusually high volume of security reports. Project maintainer Daniel Stenberg announced on June 24, 2026.

Rethinking the balance between AI oversight and innovation

www.csoonline.com · 28 days ago

The new CIO mandate is clear: facilitate AI adoption across the enterprise at speed. According to CIO.com’s State of the CIO survey, CEOs’ to p priority for their IT executives is to capitalize on AI. From researching to evaluating AI products, CIOs are now the central figures in their organizations’ AI strategies. And company leaders are looking for real outcomes.

IBM Unveils New Method to Make Smaller Computer Chip Parts

www.nytimes.com · 28 days ago

Industry leaders had worried that innovations in chip miniaturization were no longer possible.

Europe Evolves Into Ransomware's Favorite Region

www.darkreading.com · 28 days ago

After a global lull, ransomware gangs are setting sights on a rich new arena: attacking EU organizations and their suppliers.

25-Year-Old Vulnerability Patched in Curl

www.securityweek.com · 28 days ago

The latest version of the open source data transfer tool resolves 18 medium and low-severity vulnerabilities.

New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis

thehackernews.com · 28 days ago

A previously undocumented Rust-based macOS implant and information stealer has been found to embed a prompt injection payload designed to trick a malware analyst's artificial intelligence (AI) tools and trick it into aborting or refusing an analysis of the artifact. The malware has been codenamed Gaslight owing to this deceptive behavior.

Hackers Abuse Cloudflare-Hosted AWS Phishing Domains to Steal Console Logins

gbhackers.com · 28 days ago

A concise but sophisticated phishing campaign that targeted AWS console users by abusing Cloudflare-hosted domains to deliver adversary-in-the-middle (AiTM) credential theft.

SecurityWeek ICS Cybersecurity Conference Heads to Nashville for Special 25-Year Anniversary Edition

www.securityweek.com · 28 days ago

The 2026 Industrial Control Systems (ICS) Cybersecurity Conference takes place October 6-8, 2026, at the W Nashville.

GRC is broken. FedRAMP 20x might fix it

www.csoonline.com · 28 days ago

We are auditing a curated version of history. I’ve worked in security long enough now to know something most of us don’t really say out loud. A lot of compliance is theatre. Not all of it, and not all auditors or frameworks, but enough of it that most experienced CISOs know exactly what I mean.

New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns

thehackernews.com · 28 days ago

A new, stealthy backdoor named Mistic has been deployed as part of suspected financially motivated attacks aimed at multiple organizations spanning insurance, education, IT, and professional services sectors since April 2026.

NIST Opens Updated IoT Security Guidance to Public Review

www.securityweek.com · 28 days ago

The guidance aims to establish product cybersecurity requirements for IoT devices integrated into federal agencies’ networks.

Chrome 149 Update Resolves 18 Severe Vulnerabilities

www.securityweek.com · 28 days ago

More than half of the bugs are use-after-free defects, which can potentially lead to remote code execution.

Google Chrome Update Patches 18 Security Flaws, Including Critical WebGL and Autofill Vulnerabilities

gbhackers.com · 28 days ago

Google has released Chrome version 149.0.7827.196/197 for Windows and macOS, and version 149.0.7827.196 for Linux. This update addresses 18 security vulnerabilities, including several critical memory safety flaws in the WebGL and Autofill components. The announcement was made on June 23, 2026, and the update is being rolled out gradually over the coming days and weeks.

DPRK-Linked macOS Implant Uses LaunchAgent Persistence and Python Stealer Module

gbhackers.com · 28 days ago

The binary tracked as macOS.Gaslight as a Rust-based macOS implant and infostealer whose most novel features are analyst-directed prompt injection and a hardened Telegram-based command-and-control (C2) channel. We assess with high confidence that macOS.Gaslight aligns with DPRK-linked macOS activity clustered around BONZAI and AIRPIPE signatures. macOS.

Technical Co-founder needed for CyberTech new venture

embryonic.studio · 28 days ago

Thought this might be relevant to some of the security people in the group. embryōnic is a venture studio that partners with problem-driven founders. We’re currently looking for founders for a cohort focused on Cybersecurity for the Agentic Web.

Windows Defender antivirus bypass in 2026

www.hackmosphere.fr · 28 days ago

We reviewed our blog and updated our code on how to bypass Windows Defender for endpoint in 2026

Microsoft WinRE Vulnerability Allows Hackers to Bypass UEFI/BIOS Password Enforcement

gbhackers.com · 28 days ago

A newly disclosed vulnerability in the Microsoft Windows Recovery Environment (WinRE) could allow attackers to bypass UEFI and BIOS password protections, exposing systems to unauthorized access even when firmware-level security controls are active.

Hackers Use Malicious Chrome Extension to Break Out of Browser Sandbox

gbhackers.com · 28 days ago

A sophisticated malware campaign that combined a phishing lure, an obfuscated Windows JavaScript dropper, a malicious Google Chrome extension and a Native Messaging Host to effectively break the browser sandbox and execute arbitrary PowerShell commands on infected Windows machines.

Alibaba Accused of Illicitly Accessing Claude AI Models Using 25,000 Fraudulent Accounts

gbhackers.com · 28 days ago

Anthropic has accused the Chinese technology conglomerate Alibaba of orchestrating a large-scale, coordinated operation to extract capabilities from its Claude AI models illegally. The company describes this incident as the largest adversarial distillation attack recorded to date. The allegations, outlined in a formal letter dated June 10, 2026, were addressed to U.S.

Cisco SD-WAN Zero-Day Exploited Months Before Patching

www.securityweek.com · 28 days ago

CVE-2026-20245, the 7th Cisco SD-WAN vulnerability exploited in 2026, was used for months prior to its disclosure and patching.

Cisco Catalyst SD-WAN Manager Zero-Day Exploited to Gain Root Access via Malicious CSV Upload

gbhackers.com · 28 days ago

Cisco Catalyst SD-WAN Manager instances are currently being targeted in a zero-day exploitation campaign that allows attackers to escalate their privileges to root through a malicious CSV upload mechanism. Mandiant reported this information on June 24, 2026.

Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access

thehackernews.com · 28 days ago

An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco Catalyst SD-WAN as a zero-day at least two months before it was publicly disclosed, according to new findings from Google-owned Mandiant. The vulnerability, tracked as CVE-2026-20245 (CVSS score: 7.

OpenClaw Supply Chain Risk Lets Attackers Abuse AI Agent Authority for Unauthorized Actions

gbhackers.com · 28 days ago

OpenClaw’s agentic marketplace, ClawHub, was designed to accelerate AI-driven workflows by letting third-party “skills” extend an AI agent’s capabilities. Those skills are markdown-driven packages with broad local access, and that design choice made ClawHub a critical and sensitive link in the emerging AI agent supply chain.

StrikeShark Campaign Uses New SharkLoader Malware to Deploy Cobalt Strike Beacon

gbhackers.com · 28 days ago

During a recent investigation into activity affecting a diplomatic mission in Indonesia, researchers uncovered a previously undocumented loader family they named SharkLoader.

Europol Disrupts Cybercrime-as-a-Service Networks Used for Ransomware and Financial Fraud

gbhackers.com · 28 days ago

Europol, in collaboration with global law enforcement agencies and private sector partners, has successfully disrupted a significant cybercrime-as-a-service (CaaS) infrastructure used for ransomware deployment and financial fraud. This effort, part of Operation Endgame, was announced on June 24, 2026, and marked a considerable milestone in the fight against cybercrime.

Agentic Red-Team Tools Flaws Let Hackers Steal API Keys, Escape Sandboxes, and Compromise Hosts

gbhackers.com · 28 days ago

Agentic red-team tools designed for autonomous offensive security operations are themselves vulnerable, allowing attackers to steal API keys, weaponize the agents, escape sandboxes, and fully compromise the hosts that run them.

Google releases new privacy controls for activity history, personalization

www.bleepingcomputer.com · 29 days ago

Google is rolling out new privacy controls for Search services and Google Play, giving you more control over saved history and personalized recommendations.

Smashing Security podcast #473: How a hacker could have Rickrolled the entire World Cup

grahamcluley.com · 29 days ago

A polite caller from your bank says there is a problem with your account. Don't worry - they'll send someone round to help. They'll even take your cards away to keep them safe. The scam has run rampant, until Dutch police plastered blurred photos of 100 suspects across billboards, supermarkets, and TikTok, with a two-week ultimatum to turn themselves in... or else.

Be on the lookout for Mistic, a new backdoor used by ransomware broker

www.csoonline.com · 29 days ago

Researchers have identified a new backdoor program that has been used in enterprise intrusions since April and appears to be linked to an initial access broker that sells network footholds to ransomware gangs.

DraftKings hacker 'Snoopy' sentenced to 18 months in prison

www.bleepingcomputer.com · 29 days ago

A 21-year-old using the alias "Snoopy" was sentenced to 18 months in prison for his role in hacking DraftKings accounts in the November 2022 cyberattack.

Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access

www.bleepingcomputer.com · 29 days ago

New details have been revealed on how hackers exploited a Cisco Catalyst SD-WAN vulnerability tracked as CVE-2026-20245 in zero-day attacks to create rogue root accounts on targeted devices.

Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure

www.darkreading.com · 29 days ago

Researchers believe rogue peering was used to connect to the victim's SD-WAN devices to gain admin privileges and root-level access.

Malicious Edge extension abuses Native Messaging as bridge to malware

www.bleepingcomputer.com · 29 days ago

A malicious Microsoft Edge extension dubbed 'Edgecution' has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor.

2026 FIFA World Cup Faces Surge in Cyber Threats

www.darkreading.com · 29 days ago

Persistent cybercrime, social engineering, and infrastructure threats continue to plague the FIFA 2026 World Cup across the US, Canada, and Mexico.

Do CISOs Need a Code of Ethics?

www.darkreading.com · 29 days ago

Kickbacks, no-show jobs, "dirty" VCs, and shelf ware, industry expert Robert "RSnake" Hansen explains why he thinks its time for a CISO code of ethics to ensure cybersecurity bosses aren't engaged in self-dealing that could risk enterprise, and even national, security.

OpenAI and Broadcom Unveil Custom A.I. Chip Design

www.nytimes.com · 29 days ago

The maker of ChatGPT plans to use enough chips to consume 10 gigawatts of electricity, an amount that could power millions of households.

Healthcare Vendor Xsolis Reports Breach Affecting 1.4M People

www.techrepublic.com · 29 days ago

Xsolis confirmed a healthcare data breach affecting nearly 1.4 million people after a phishing attack exposed health and identity data.

Apple’s £3B iCloud Lawsuit Could Affect 40M UK Users

www.techrepublic.com · 29 days ago

Apple lost a bid to narrow a UK iCloud lawsuit from Which?, keeping a £3 billion competition claim on track for an October 2028 trial.

CNAPP evolution: How Microsoft aligns with leading cloud risk management platforms

www.microsoft.com · 29 days ago

Learn how CNAPP platforms are helping organizations prioritize exploitable risks, reduce exposure, and operationalize security across the application lifecycle.

LastPass Confirms Vendor Breach Exposed Customer Contact, Support Data

www.techrepublic.com · 29 days ago

LastPass said customer contact and support data were exposed after attackers used stolen Klue OAuth tokens to access its Salesforce environment and CRM records.

When Information Becomes the Attack Surface – Understanding AI Agent Traps

www.securityweek.com · 29 days ago

From hidden content injections to cognitive state poisoning, attackers are turning trusted data sources into traps for autonomous AI.

Scattered Spider duo convicted over $38M Transport for London attack

www.csoonline.com · 29 days ago

Two members of the Scattered Spide r cybercrime collective have admitted launching a cyberattack against Transport for London (TfL) that caused millions in damages.

CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited

thehackernews.com · 29 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation of a critical security flaw impacting Lantronix EDS5000 Series devices, urging Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by June 26, 2026. The vulnerability in question is CVE-2025-67038 (CVSS score: 9.