Blahalla

Ukraine Warns of CABINETRAT Backdoor + XLL Add-ins Spread via Signal ZIPs

thehackernews.com · 10 months ago

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of new targeted cyber attacks in the country using a backdoor called CABINETRAT. The activity, observed in September 2025, has been attributed to a threat cluster it tracks as UAC-0245. The agency said it spotted the attack following the discovery of software tools taking the form of XLL files, which refer to Microsoft Excel

Uber Not Responsible for Sex Assault, Jury Finds, as More Cases Follow

www.nytimes.com · 10 months ago

The company is facing similar lawsuits in federal and state courts from people who claim their drivers sexually assaulted or harassed them.

California’s Gavin Newsom Signs Major AI Safety Law

www.nytimes.com · 10 months ago

Gavin Newsom signed a major safety law on artificial intelligence, creating one of the strongest sets of rules about the technology in the nation.

China Imposes One-Hour Reporting Rule for Major Cyber Incidents

www.darkreading.com · 10 months ago

The sweeping new regulations show that China's serious about hardening its own networks after launching widespread attacks on global networks.

SVD-2025-1007: Third-Party Package Updates in Splunk Enterprise - October 2025

advisory.splunk.com · 10 months ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.0.1, 9.4.4, 9.3.6, 9.2.8, and higher.

SVD-2025-1006: Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise

advisory.splunk.com · 10 months ago

In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user.

SVD-2025-1005: Denial of Service (DoS) through Multiple LDAP Bind Requests in Splunk Enterprise

advisory.splunk.com · 10 months ago

In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a user who holds a role that contains the high-privilege capability changeauthentication, could send multiple LDAP bind requests to a specific internal endpoint, resulting in high server CPU usage, which could potentially lead to a denial of service (DoS) until the Splunk Enterprise instance is restarted. See https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.0/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities and https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.0/use-ldap-as-an-authentication-scheme/configure-ldap-with-splunk-webcfe47e31007f460d8b3d8505ffc3f0ddConfigureLDAPwithSplunkWeb for more information.

SVD-2025-1002: Reflected Cross-site Scripting (XSS) in '/app/search/table' endpoint through the 'dataset.command' parameter on Splunk Enterprise

advisory.splunk.com · 10 months ago

In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could craft a malicious payload through the dataset.command parameter of the /app/search/table endpoint, which could result in execution of unauthorized JavaScript code in the browser of a user.

SVD-2025-1003: Stored Cross-Site Scripting (XSS) through missing field warning messages in Saved Search and Job Inspector on Splunk Enterprise

advisory.splunk.com · 10 months ago

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through the error messages and job inspection details of a saved search. This could result in execution of unauthorized JavaScript code in the browser of a user.

SVD-2025-1001: Improper Access Control in Background Job Submission in Splunk Enterprise

advisory.splunk.com · 10 months ago

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privileged user that does not hold the admin or power Splunk roles could access sensitive search results if Splunk Enterprise runs an administrative search job in the background. If the low privileged user guesses the search job’s unique Search ID (SID), the user could retrieve the results of that job, potentially exposing sensitive search results. For more information see https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-jobs/about-jobs-and-job-management and https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-jobs/manage-search-jobs.

SVD-2025-1004: Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise

advisory.splunk.com · 10 months ago

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the “admin” or “power” Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.

Microsoft Extends Windows 10 Security Updates for EEA Customers

www.techrepublic.com · 10 months ago

Although Microsoft still plans to end support for Windows 10 in October, users in the European Economic Area will be able to enjoy free updates for a little while longer.

Cisco IOS XE Software for Catalyst 9000 Series Switches Denial of Service Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent attacker to cause an egress port to become blocked and drop all outbound traffic. This vulnerability is due to improper handling of crafted Ethernet frames. An attacker could exploit this vulnerability by sending crafted Ethernet frames through an affected switch. A successful exploit could allow the attacker to cause the egress port to which the crafted frame is forwarded to start dropping all frames, resulting in a denial of service (DoS) condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cat9k-PtmD7bgy This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: High <br/CVE: CVE-2025-20311

New China APT Strikes With Precision and Persistence

www.darkreading.com · 10 months ago

Phantom Taurus demonstrates a deep understanding of Windows environments, including advanced components like IIServerCore, a fileless backdoor that executes in memory to evade detection.

'Klopatra' Trojan Makes Bank Transfers While You Sleep

www.darkreading.com · 10 months ago

A sophisticated new banking malware is hard to detect, capable of stealing lots of money, and infecting thousands of people in Italy and Spain.

From fake lovers to sextortionists: 260 scammers arrested across Africa

www.bitdefender.com · 10 months ago

INTERPOL has announced the arrest of 260 alleged romance scammers, sextortionists, and online fraudsters as part of a multi-national operation across Africa. Read more in my article on the Hot for Security blog.

China Exploited New VMware Bug for Nearly a Year

www.darkreading.com · 10 months ago

A seemingly benign privilege-escalation process in VMware and other software has likely benefited attackers and other malware strains for years, researchers noted.

ZeroDay Cloud: The first open-source cloud hacking competition

www.reddit.com · 10 months ago

Details surrounding an investigation into open-source cloud platforms have emerged. Researchers examined potential security flaws, identifying vulnerabilities in cloud networking and storage mechanisms. The work highlights multiple attack vectors that could compromise data integrity and system availability. Implementing robust security practices is crucial for protecting open-source cloud infrastructure.

New $50 Battering RAM Attack Breaks Intel and AMD Cloud Security Protections

thehackernews.com · 10 months ago

A group of academics from KU Leuven and the University of Birmingham has demonstrated a new vulnerability called Battering RAM to bypass the latest defenses on Intel and AMD cloud processors. "We built a simple, $50 interposer that sits quietly in the memory path, behaving transparently during startup and passing all trust checks," researchers Jesse De Meulemeester, David Oswald, Ingrid

YouTube Settles Trump Lawsuit Over Account Suspension for $24.5 Million

www.nytimes.com · 10 months ago

Mr. Trump had sued Alphabet, the parent of YouTube and Google, and other social media companies after the platforms suspended his accounts following the Jan. 6, 2021, riot at the Capitol.

Top A.I. Researchers Leave OpenAI, Google and Meta for New Start-Up

www.nytimes.com · 10 months ago

Founded by a co-creator of ChatGPT, Periodic Labs aims to build artificial intelligence that can accelerate discoveries in physics, chemistry and other fields.

Phantom Taurus: New China-Linked Hacker Group Hits Governments With Stealth Malware

thehackernews.com · 10 months ago

Government and telecommunications organizations across Africa, the Middle East, and Asia have emerged as the target of a previously undocumented China-aligned nation-state actor dubbed Phantom Taurus over the past two-and-a-half years. "Phantom Taurus' main focus areas include ministries of foreign affairs, embassies, geopolitical events, and military operations," Palo Alto Networks Unit 42

The AI Fix #70: AI behaves… until it knows you’re watching

grahamcluley.com · 10 months ago

In episode 70 of The AI Fix, our hosts learn that AI makes people more dishonest, Waymo's robo-cars save lives but get outsmarted by a bathroom mirror, a "rescue" bot slurps up victims head-first, and China shows off a fusion robot arm that can lift ten elephants (or 200,000 pigeons, if you’re scientific about it). Meanwhile Graham reveals how AIs are tricked into solving CAPTCHAs with fake mouse wiggles, and Mark explains how OpenAI’s “deliberative alignment” works perfectly - until the AI realises it is being watched. So, nothing to worry about there then... All this and much more is discussed in the latest edition of "The AI Fix" podcast by Graham Cluley and Mark Stockley.

Can Shadow AI Risks Be Stopped?

www.darkreading.com · 10 months ago

Agentic AI has introduced abundant shadow artificial intelligence (AI) risks. Cybersecurity startup Entro Security extends its platform to help enterprises combat the growing issue.

Researchers Disclose Google Gemini AI Flaws Allowing Prompt Injection and Cloud Exploits

thehackernews.com · 10 months ago

Cybersecurity researchers have disclosed three now-patched security vulnerabilities impacting Google's Gemini artificial intelligence (AI) assistant that, if successfully exploited, could have exposed users to major privacy risks and data theft. "They made Gemini vulnerable to search-injection attacks on its Search Personalization Model; log-to-prompt injection attacks against Gemini Cloud

Microsoft Expands Sentinel Into Agentic Security Platform With Unified Data Lake

thehackernews.com · 10 months ago

Microsoft on Tuesday unveiled the expansion of its Sentinel Security Incidents and Event Management solution (SIEM) as a unified agentic platform with the general availability of the Sentinel data lake. In addition, the tech giant said it's also releasing a public preview of Sentinel Graph and Sentinel Model Context Protocol (MCP) server to turn telemetry into a security graph and allow AI

Empowering defenders in the era of agentic AI with Microsoft Sentinel

www.microsoft.com · 10 months ago

Microsoft Sentinel is expanding into an agentic platform with general availability of the Sentinel data lake, and the public preview of Sentinel graph and Sentinel Model Context Protocol (MCP) server.

Stop Alert Chaos: Context Is the Key to Effective Incident Response

thehackernews.com · 10 months ago

The Problem: Legacy SOCs and Endless Alert Noise Every SOC leader knows the feeling: hundreds of alerts pouring in, dashboards lighting up like a slot machine, analysts scrambling to keep pace. The harder they try to scale people or buy new tools, the faster the chaos multiplies. The problem is not just volume; it is the model itself. Traditional SOCs start with rules, wait for alerts to fire

What We Know About ChatGPT’s New Parental Controls

www.nytimes.com · 10 months ago

OpenAI said parents can set time and content limits on accounts and receive notifications if ChatGPT detects signs of potential self-harm.

Details of a Scam

www.schneier.com · 10 months ago

Longtime Crypto-Gram readers know that I collect personal experiences of people being scammed. Here’s an almost: Then he added, “Here at Chase, we’ll never ask for your personal information or passwords.” On the contrary, he gave me more information, two “cancellation codes” and a long case number with four letters and 10 digits. That’s when he offered to transfer me to his supervisor. That simple phrase, familiar from countless customer-service calls, draped a cloak of corporate competence over this unfolding drama. His supervisor. I mean, would a scammer have a supervisor?

Urgent: China-Linked Hackers Exploit New VMware Zero-Day Since October 2024

thehackernews.com · 10 months ago

A newly patched security flaw impacting Broadcom VMware Tools and VMware Aria Operations has been exploited in the wild as a zero-day since mid-October 2024 by a threat actor called UNC5174, according to NVISO Labs. The vulnerability in question is CVE-2025-41244 (CVSS score: 7.8), a local privilege escalation bug affecting the following versions - VMware Cloud Foundation 4.x and 5.x VMware

Dutch teens recruited on Telegram, accused of Russia-backed hacking plot

www.bitdefender.com · 10 months ago

Two 17-year-olds have been arrested by Dutch authorities on suspicion of spying for pro-Russian hackers. The teenagers, who are said to have been recruited as "disposable agents" via Telegram, were reportedly arrested last week "on suspicion that are linked to government-sponsored interference." Read more in my article on the Hot for Security blog.

'Trifecta' of Google Gemini Flaws Turn AI Into Attack Vehicle

www.darkreading.com · 10 months ago

Flaws in individual models of Google's AI suite created significant security and privacy risks for users, demonstrating the need for heightened defenses.

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

unit42.paloaltonetworks.com · 10 months ago

Phantom Taurus is a previously undocumented Chinese threat group. Explore how this group's distinctive toolset lead to uncovering their existence.

Report: Addressing cybersecurity burnout in 2025

news.sophos.com · 10 months ago

The consequences of this burnout are far-reaching, affecting productivity, incident response times, and employee retention.

New Android Trojan “Datzbro” Tricking Elderly with AI-Generated Facebook Travel Events

thehackernews.com · 10 months ago

Cybersecurity researchers have flagged a previously undocumented Android banking trojan called Datzbro that can conduct device takeover (DTO) attacks and perform fraudulent transactions by preying on the elderly. Dutch mobile security company ThreatFabric said it discovered the campaign in August 2025 after users in Australia reported scammers managing Facebook groups promoting "active senior

Klopatra: exposing a new Android banking trojan operation with roots in Turkey | Cleafy LABS

www.reddit.com · 10 months ago

A new Android banking trojan was exposed by security researchers Klopatra. This sophisticated malware targets mobile users to steal sensitive banking credentials and financial data. The threat operates by infiltrating legitimate applications to exfiltrate private user information. Users are advised to maintain rigorous security hygiene and keep their operating systems patched.

Evolving Enterprise Defense to Secure the Modern AI Supply Chain

thehackernews.com · 10 months ago

The world of enterprise technology is undergoing a dramatic shift. Gen-AI adoption is accelerating at an unprecedented pace, and SaaS vendors are embedding powerful LLMs directly into their platforms. Organizations are embracing AI-powered applications across every function, from marketing and development to finance and HR. This transformation unlocks innovation and efficiency, but it also

U.K. Police Just Seized £5.5 Billion in Bitcoin — The World’s Largest Crypto Bust

thehackernews.com · 10 months ago

A Chinese national has been convicted for her role in a fraudulent cryptocurrency scheme after law enforcement authorities in the U.K. confiscated £5.5 billion (about $7.39 billion) during a raid of her home in London. The cryptocurrency seizure, amounting to 61,000 Bitcoin, is believed to be the single largest such effort in the world, the Metropolitan Police said. Zhimin Qian (aka Yadi Zhang)

Is your SIEM still serving You? Why it might be time to rethink your security stack

news.sophos.com · 10 months ago

Security teams are under increasing pressure to detect and respond to threats in real time, especially as the median dwell time for ransomware attacks has dropped from weeks to a few days. Yet many organizations still rely on legacy Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) tools. These tools

AI-Powered Voice Cloning Raises Vishing Risks

www.darkreading.com · 10 months ago

A researcher-developed framework could enable attackers to conduct real-time conversations using simulated audio to compromise organizations and extract sensitive information.

CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems

thehackernews.com · 10 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting the Sudo command-line utility for Linux and Unix-like operating systems to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-32463 (CVSS score: 9.3), which affects Sudo versions prior to

Last Week in Security (LWiS) - 2025-09-29

blog.badsectorlabs.com · 10 months ago

OmniProx ( @ZephrFish ), Phantom Chrome Extensions ( Riadh Bouchahoua (@Synacktiv) ), FIDO phishing ( @denniskniep ), VMWare Tools LPE ( @0xThiebaut ), MSI lateral movement ( @werdhaihai ), and more!

IoT Security Flounders Amid Churning Risk

www.darkreading.com · 10 months ago

The Internet of Things (IoT) has made everything more interconnected, but an important US government security initiative is stuck in limbo while threat actors step up attacks on everything from medical gear to printers.

Security Breaches Found in AI-Powered Repair Tool Wondershare RepairIt

www.techrepublic.com · 10 months ago

Trend Micro reveals that RepairIt "contradicted its privacy policy by collecting, storing, and, due to weak Development, Security, and Operations practices, inadvertently leaking private user data."

Sneaky, Malicious MCP Server Exfiltrates Secrets via BCC

www.darkreading.com · 10 months ago

The first known malicious MCP server is an AI integration tool that automatically sends email such as those related to password resets, account confirmations, security alerts, invoices, and receipts to threat actors.

Akira Hits SonicWall VPNs in Broad Ransomware Campaign

www.darkreading.com · 10 months ago

Akira ransomware actors are currently targeting SonicWall firewall customers vulnerable to a bug discovered last year.

Sophos named a Leader in the IDC MarketScape™: Worldwide Extended Detection and Response (XDR) Software 2025

news.sophos.com · 10 months ago

A milestone that reflects our progress.

EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations

thehackernews.com · 10 months ago

Threat actors have been observed using seemingly legitimate artificial intelligence (AI) tools and software to sneakily slip malware for future attacks on organizations worldwide. According to Trend Micro, the campaign is using productivity or AI-enhanced tools to deliver malware targeting various regions, including Europe, the Americas, and the Asia, Middle East, and Africa (AMEA) region.

CodeQL zero to hero part 5: Debugging queries

github.blog · 10 months ago

Learn to debug and fix your CodeQL queries.