Blahalla

DORA Year Two: Can Your SOC Actually See the Attack?

thehackernews.com · 27 days ago

When the Digital Operational Resilience Act (DORA) became enforceable across the European Union in January 2025, it triggered an administrative sprint. Financial entities spent the first year establishing risk governance, assessing third-party service providers, updating contract clauses, and documenting incident escalation workflows.

New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

thehackernews.com · 27 days ago

A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled. The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the researcher who found it says it can be used to escape the guest and run code on the host machine.

TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands

gbhackers.com · 27 days ago

A Windows-focused backdoor dubbed TASKSTOMP that uses VBScript, PowerShell, Scheduled Tasks, and runtime C compilation to establish resilient persistence and continuously steal business documents. The implant also captures screenshots, extracts saved Wi-Fi passwords, harvests clipboard data, and executes arbitrary commands received from its operators.

Malicious B-tree NPM Package Accumulates Millions of Downloads

www.securityweek.com · 27 days ago

Posing as the legitimate sorted-btree package, indexed-btree hides a malware trigger in its prototype method.

Hackers Exploit Veeam Agent Vulnerability to Gain SYSTEM-Level Access on Windows

gbhackers.com · 27 days ago

A newly discovered privilege escalation flaw in Veeam Agent for Microsoft Windows could allow attackers with local access to compromised endpoints to execute commands as NT AUTHORITY\SYSTEM. Public proof-of-concept (PoC) code for CVE-2026-32996 was released on September 14, increasing the urgency for organizations to patch affected Veeam deployments.

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

thehackernews.com · 27 days ago

A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution, according to full technical details published today by Viettel Cyber Security researcher Dinh Ho Anh Khoa. The flaw, CVE-2026-65660, affects SharePoint Server 2016, 2019, and Subscription Edition.

Red Hat OpenShift Flaw Lets Attackers Poison Disconnected Registries With Malicious Releases

gbhackers.com · 27 days ago

Red Hat disclosed an important OpenShift vulnerability that could let attackers bypass release-image signature checks and introduce malicious payloads into disconnected registries. This issue, tracked as CVE-2026-75939, affects the openshift/oc-mirror tool and has a preliminary CVSS v3.1 score of 7.4.

GPT-6 Astra Breaks an Old Enigma Message

www.schneier.com · 27 days ago

This is pretty amazing: However, the most astonishing thing about this break is that the GPT6 Astra did it entirely on its own. Carter Leffer only directed GPT6 Astra to see if it could break any of the unbroken Enigma messages published on the Crypto Cellar Research web page. After analysing the unbroken messages on the website, it decided that the most promising message was Nr.

Linux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration

gbhackers.com · 27 days ago

A Linux variant of the BambooToken backdoor uses MQTT as its command-and-control channel, enabling operators to profile compromised hosts, execute shell commands, and transfer files through broker-mediated topics. Analysis of a statically linked x86-64 ELF sample shows that its configuration, task routing, and network payloads are obfuscated with separate XOR routines.

Critical MaxKB AI Agent Flaw Lets Prompt Injection Execute System Commands

gbhackers.com · 27 days ago

A critical vulnerability in the MaxKB AI knowledge-base platform could let attackers exploit prompt injection and run operating system commands on vulnerable deployments, including directly on the underlying host in some configurations. This flaw, tracked as CVE-2026-77521 and GHSA-f36j-f34j-h3rx, affects MaxKB versions up to and including 2.10.3-lts. The issue has received a maximum CVSS v3.

WordPress Patches ‘Click2Shell’ Vulnerability

www.securityweek.com · 27 days ago

The bug lets attackers automatically install and preview themes and could lead to remote code execution.

What endlessly searching for a job can do to your mind

www.washingtonpost.com · 27 days ago

“Ghost job” postings, AI interviewers and a lack of in-person connection do little to help people's self-esteem.

You’ll do anything for your baby. Algorithms know how to exploit that.

www.washingtonpost.com · 27 days ago

In the mega-consumption era of parenthood, the internet tells new moms that products can solve the hardest parts of having a newborn. All they have to do is add to cart.

New Windows Defender zero-day blocks Microsoft antivirus updates

www.bleepingcomputer.com · 27 days ago

Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates.

Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal

thehackernews.com · 27 days ago

A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. "Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree/indexing utility," Checkmarx said. "

Hackers Abuse Stolen BigCommerce App Key to Steal Master of Malt Customer Data

gbhackers.com · 27 days ago

Master of Malt reported a customer data breach after attackers allegedly compromised an application key linked to Ribon, a third-party BigCommerce app managed by Be A Part Of that identifies itself as a Fastr brand.

What to Know About Recent A.I. Hacks

www.nytimes.com · 27 days ago

OpenAI, Google and others recently disclosed breaches by their artificial intelligence models that amplified concerns about the advancing capabilities of the technology.

The Big Threat Has Been Climate Change. Now Comes A.I.

www.nytimes.com · 27 days ago

Both are human-caused, both are frightening, and one of them has raced to the forefront of the global conversation.

How to Split Expenses on a Group Trip Without Fighting

www.nytimes.com · 27 days ago

From bachelorette trips to family vacations, group travel can cause relationship-ending fallouts. Here’s how to navigate difficult conversations about finances.

Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits

gbhackers.com · 27 days ago

A third Chinese threat actor has been linked to phishing campaigns that cloned trusted websites and chained Chrome and Windows zero-day exploits to deploy a previously undocumented backdoor. The activity occurred on September 3 and 4, 2026, while the targeted vulnerabilities remained unpatched in Google Chrome.

As Computers Take the Driver’s Seat, Experts Worry About Safety

www.nytimes.com · 27 days ago

Self-driving systems are getting so good that drivers may overestimate the technology and not be prepared to respond when something goes wrong.

The cyber AI parity window now has a deadline

www.csoonline.com · 27 days ago

In April, I wrote about what I called the Cyber AI Parity Window. This is the rare period in which defenders and adversaries gained access to the same transformative technology at roughly the same moment. For most of cybersecurity history, advanced offensive capability reached attackers years before defenders could respond with comparable technology. AI changed that pattern.

D-Link DIR-822A Router Vulnerability Scores CVSS 10.0 With Public PoC Available

gbhackers.com · 27 days ago

D-Link has announced a critical stack-based buffer overflow vulnerability affecting the non-US DIR-822A router, identified as CVE-2026-86296. This vulnerability has received a maximum CVSS v3.1 score of 10.0 and a CVSS v4.0 score of 10.0. Furthermore, a public proof-of-concept (PoC) exploit is reportedly available.

CISA orders feds to patch Zyxel flaw exploited for data theft

www.bleepingcomputer.com · 27 days ago

Attackers are now actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

CISA Flags Actively Exploited Flaw in Zyxel GS1900 Switches

gbhackers.com · 27 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a high-severity vulnerability affecting Zyxel GS1900 Series switches in its Known Exploited Vulnerabilities (KEV) Catalog. This warning highlights that the flaw, tracked as CVE-2026-7273, has been exploited in the wild. The vulnerability stems from a stack-based buffer overflow in the device’s CGI program.

Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme

www.securityweek.com · 27 days ago

The US, Japan, Germany and Australia have published a joint report detailing the scope of North Korea’s WaterPlum campaign.

Hackers Compromise 65 GitHub Repositories and Poison npm Package With Hidden Backdoor

gbhackers.com · 27 days ago

Threat actors have compromised at least 65 public GitHub repositories in a software supply-chain campaign that abused npm trusted publishing to distribute a stealthy backdoor through a legitimate package. The malicious package was identified as @dforge-core/dforge-mcp, an MCP-related npm package whose maintainer account was abused for roughly 105 minutes on September 9.

CISOs can no longer ignore the nation-state threat

www.csoonline.com · 27 days ago

Flare-ups between US intelligence agencies and private-sector defenders have long been a characteristic of the cybersecurity landscape, with the balance swinging between deep collaboration and friction.

vCenter pre-auth RCE: CVE-2026-59309/59310

mobeta.fr · 28 days ago

CVE-2026-59309 & CVE-2026-59310: patch-diffing VMware vCenter reveals two pre-auth 9.

SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing

thehackernews.com · 28 days ago

The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. "SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.

Leveraging undocumented CodeConnection APIs in a CodePipeline build job or SageMaker Studio Notebook to enumerate, clone, push and delete code repositories.

thomaspreece.com · 28 days ago

Continuing my spare time research around CodeConnections, I've moved on from CodeBuild and started looking at CodePipeline & SageMaker.

Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data

gbhackers.com · 28 days ago

A suspected Chinese-speaking threat actor has exploited the critical WordPress “wp2shell” vulnerability chain to compromise government and small-business targets across 29 countries, stealing at least 18,566 sensitive records from one Western government organization. GreyNoise linked the activity to a malicious cyber actor (MCA) it has tracked through its Global Observation Grid since early June.

Windows 11 26H1 Security Update Expands Secure Boot Certificate Protection

gbhackers.com · 28 days ago

Microsoft has released the cumulative security update for September 2026 for Windows 11 version 26H1. This update expands the range of systems that can automatically receive new Secure Boot certificates. KB5124012, released on September 8, brings devices to OS Build 28000.2954.

One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor

thehackernews.com · 28 days ago

Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21. It works by changing a hidden setting so that when the user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta.

Microsoft to Disable SMS as Primary Entra ID Sign-In Method in 2027

gbhackers.com · 28 days ago

Microsoft will turn off SMS as a primary sign-in method for Microsoft Entra ID workforce tenants on February 1, 2027, accelerating its transition to phishing-resistant authentication. This change affects workers who currently use a registered phone number and a one-time SMS code as their initial sign-in credential, a passwordless flow utilized by frontline organizations.

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

thehackernews.com · 28 days ago

A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed "Comment2Shell," on September 17 in version 7.1.1 and told site owners to update right away.

Vidar Uses Custom Bytecode Interpreter and ARX Stream Ciphers for Per-Build String Obfuscation

gbhackers.com · 28 days ago

Vidar information stealer has introduced a lightweight custom virtual machine and per-build stream-cipher variations to conceal its embedded strings, raising the cost of static detection and automated reverse engineering. First observed in 2018, Vidar remains a widely tracked credential-stealing malware family.

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

thehackernews.com · 28 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.

AWS Detects and Quarantines Exposed IAM Credentials in Public GitHub Repositories

gbhackers.com · 28 days ago

AWS can automatically quarantine exposed Identity and Access Management (IAM) access keys that appear in public GitHub repositories. This process involves applying a restrictive managed policy within seconds to reduce the risk of cloud abuse.

One Stolen Active Directory File Can Expose Credentials for an Entire Windows Domain

gbhackers.com · 28 days ago

A single stolen Active Directory database can turn a limited Windows intrusion into a domain-wide credential compromise. Threat actors that obtain the NTDS.dIT file from a domain controller, along with its corresponding SYSTEM registry hive, can extract password hashes, Kerberos keys, and password-history data for domain identities offline.

Google Fined €403 Million for GDPR Violations Over Location Data Processing

gbhackers.com · 28 days ago

Ireland’s Data Protection Commission (DPC) has imposed a €403 million administrative fine on Google Ireland Limited for breaching the EU General Data Protection Regulation (GDPR) by processing users’ location data. This decision follows an inquiry initiated in February 2020 after complaints from European consumer rights organizations, including BEUC.

Meta’s Muse AI 0-Day Lets Hackers Hijack Dictation Traffic and Inject Malicious Prompts

gbhackers.com · 28 days ago

A recent proof-of-concept (PoC) developed by security researcher Patrick Wardle reveals a local zero-day vulnerability in the Muse application. This vulnerability allows malware running under the logged-in user’s account to redirect dictation traffic to a server controlled by an attacker. Meta’s Muse AI 0-Day The issue is documented in Wardle’s “not-a-mused” research repository.

Inside BambooToken’s Linux implant: shell and file control over MQTT

app.reverser.space · 28 days ago

A small configuration blob is enough to explain how this Linux backdoor finds its controller. Decode it, follow the MQTT callbacks, and the program resolves into three useful pieces: a host inventory collector, a shell command worker, and a file manager. MQTT topics connect those pieces, while a repeating XOR key obscures their messages.

US Proposes AI Incident Alert System in Talks With China, Bessent Says

www.securityweek.com · 28 days ago

Trump has resisted calls to slow down AI development, saying that would help China catch up to U.S. companies.

Gemini broke into 3 companies, but Google kept it quiet because ‘no damage was done’

www.csoonline.com · 28 days ago

A Google Gemini AI agent broke into three companies in July, guessing the credentials for one and discovering the credentials for the second two in a public repository, Google confirmed on Monday.

How AI Agents Can Trigger Runaway Costs for Enterprises

www.darkreading.com · 28 days ago

Unbounded consumption is an issue that OWASP currently ranks sixth in its Top 10 for LLM Applications, and it could be an extremely costly one.

BigCommerce alerts merchants of data breach linked to Ribon apps

www.bleepingcomputer.com · 28 days ago

Ecommerce platform BigCommerce has alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores.

CISA alerts of active exploitation of three Linux kernel flaws

www.bleepingcomputer.com · 28 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical.

ShinyHunters Hacked Clop. Now What About Clop's Victims?

www.darkreading.com · 28 days ago

ShinyHunters defaced Clop's Dark Web site and claims to have stolen victim data, potentially exposing organizations that paid ransoms to renewed extortion attempts.

Cybercriminals Are Hiding New Malware in Torrents for Popular Films

www.darkreading.com · 28 days ago

Victims have been identified in Africa, including in Kenya and Uganda.