Blahalla

CISA alerts of active exploitation of three Linux kernel flaws

www.bleepingcomputer.com · 28 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical.

ShinyHunters Hacked Clop. Now What About Clop's Victims?

www.darkreading.com · 28 days ago

ShinyHunters defaced Clop's Dark Web site and claims to have stolen victim data, potentially exposing organizations that paid ransoms to renewed extortion attempts.

Cybercriminals Are Hiding New Malware in Torrents for Popular Films

www.darkreading.com · 28 days ago

Victims have been identified in Africa, including in Kenya and Uganda.

WordPress Click2Shell flaw lets hackers execute PHP on the server

www.bleepingcomputer.com · 28 days ago

Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component.

Microsoft to retire Microsoft 365 Companion apps in December

www.bleepingcomputer.com · 28 days ago

Microsoft will retire the Calendar, People, and Files Microsoft 365 companion apps on December 16 and has asked admins to remove them from managed devices.

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

thehackernews.com · 28 days ago

A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17.

Google Hit With $463 Million Fine for EU Location Data Rule Breach

www.securityweek.com · 28 days ago

Google has been fined 403 million euros ($463 million) for breaching the European Union’s strict privacy rules because it mishandled users’ location data.

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

thehackernews.com · 28 days ago

The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory.

Google Wants Android Apps to Look Beyond the Security Patch Date

www.techrepublic.com · 28 days ago

Google’s new Android security libraries let apps and administrators inspect patch status by component instead of relying on a single security patch date.

Google Fined €403 Million Over GDPR Violations Tied to Location Data

thehackernews.com · 28 days ago

Google has been fined €403 million for breaking the EU's data protection law, the GDPR, in the way three of its features handled people's location data from May 2018 to February 2020. Ireland's Data Protection Commission (DPC), Google's lead regulator in the EU, also ordered the company to make its processing comply with the law within 6 months.

How Potential 2028 Presidential Candidates Are Talking About A.I.

www.nytimes.com · 28 days ago

Democrats are jockeying to embrace new safeguards, while Republicans have aligned with President Trump’s warnings against slowing down the technology.

ZTE SmartHome Account Takeover: Password Reset Without Verification Code. 4 CVEs, 100K+ Android Downloads - CVE-2026-86553

minanagehsalalma.github.io · 28 days ago

Technical write-up for four vulnerabilities I reported in ZTE SmartLife. The main issue is CVE-2026-86553, a password reset flaw in the SmartLife account backend. The reset endpoint accepted the target accountId and a new password without requiring a reset code, old password, or validated reset transaction.

After spending billions, OpenAI still has gaps in its cybersecurity

www.csoonline.com · 28 days ago

Two separate reports of security flaws in OpenAI systems highlight how even a company spending billions on developing its own AI-powered cybersecurity testing tools remains vulnerable. In one incident, researchers breached OpenAI systems with the help of a rival AI developer’s tools, while another group of researchers tricked OpenAI’s Codex agent into bypassing its sandbox controls.

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer

www.securityweek.com · 28 days ago

The attackers impersonate at least 40 companies and disable 145 security products to deploy infostealer malware.

Google fined €403 million over location data privacy violations

www.bleepingcomputer.com · 28 days ago

Ireland's Data Protection Commission (DPC) has fined Google €403 million ($463M) for multiple GDPR violations related to processing users' location data.

Rogue Behavior: OpenAI Reveals More Model Misalignment Incidents

www.darkreading.com · 28 days ago

The AI giant disclosed six examples of concerning model activity and published a new framework for investigating and disclosing such incidents.

Microsoft fixes broken Excel copy and paste for all Office users

www.bleepingcomputer.com · 28 days ago

Microsoft has fixed a known issue that causes copy-and-paste failures for Excel users after installing the September 2026 security updates.

Reverse-Engineering Flock Cameras

www.schneier.com · 28 days ago

Hackers captured a Flock camera and got a look (alternate link ) at the software: While much of the automatic license plate reader’s (ALPR) most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles.

CISO Conversations: Noopur Davis – The Accidental Global CISO at Comcast

www.securityweek.com · 28 days ago

Noopur Davis never planned a career in cybersecurity. She was a developer at Intergraph, and for many years that was all she wanted to be.

New npm malware finds a way around install script defenses

www.csoonline.com · 28 days ago

Blocking suspicious install scripts may no longer be enough to mitigate threats from malicious JavaScript dependencies used in software supply-chain attacks. Security researchers at Checkmarx are warning of attackers using a malicious package called “indexed-btree” to impersonate the legitimate sorted-btree library, to spread malware hidden in the package’s normal runtime code.

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks

thehackernews.com · 28 days ago

A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week. The trouble keeps showing up inside things people already trust: code that takes a bad turn, old payloads coming back, exposed systems, weak checks, fake fixes, and attack paths that look almost too easy.

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

thehackernews.com · 28 days ago

Cybersecurity researchers have disclosed details of a new campaign dubbed TASKSTOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts.

FBI's CJIS v6.1: What Security Teams Need to Know.

www.bleepingcomputer.com · 28 days ago

The FBI's CJIS Security Policy v6.1 strengthens requirements around encryption and vulnerability scanning while continuing the shift toward more continuous security assessment. Specops explains what changed and how agencies can address password, MFA, and identity requirements as they prepare for upcoming audits.

Dragos Completes NetRise and runZero Acquisitions Following Accenture Deal

www.securityweek.com · 28 days ago

The transaction is part of the $4.1 billion deal in which Accenture acquired a majority stake in Dragos in an OT cybersecurity push.

Orchid Security Introduces AI Agent Readiness Controls Featuring Continuous Identity Monitoring and Kill-Switch Capabilities

www.csoonline.com · 28 days ago

Readiness tagging for AI, always-on observability, and coordinated kill switches at the application layer give enterprises a defensible route to scaling agents while keeping authority in human hands.

NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers

gbhackers.com · 28 days ago

NightEagle, an espionage-focused threat group also tracked as APT-Q-95, has expanded its operations from Asian targets to Russian organizations, using a layered intrusion chain that culminates in attempts to compromise Active Directory domain controllers.

Microsoft reminds admins to migrate Entra ID users to passkeys

www.bleepingcomputer.com · 28 days ago

Microsoft has reminded admins to migrate Entra ID users to phishing-resistant authentication methods to avoid sign-in disruptions after it retires SMS first-factor sign-in starting in February 2027.

RatHat Android Trojan Uses AI for Automation

www.securityweek.com · 28 days ago

The malware relies on AI for real-time device navigation and control, increasing adaptability and evasion.

10 Malicious npm Packages Linked to Runtime Malware Campaign With Millions of Downloads

gbhackers.com · 28 days ago

A sophisticated npm supply-chain campaign has been linked to 10 malicious JavaScript packages that collectively recorded millions of downloads while bypassing npm’s lifecycle-script protections. The operation centers on a counterfeit package named indexed-btree, which impersonates the legitimate sorted-btree library and executes its malware only when an application uses the package at runtime.

Rust Team Members and Popular Crate Owners Targeted via Video Calls

www.securityweek.com · 28 days ago

It’s unclear if the attacks are part of previous campaigns against Rust, but the techniques used by the attackers match those used by North Korea.

PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain

gbhackers.com · 28 days ago

A ransomware incident in which attackers used Active Directory Group Policy to disrupt operations without deploying a Windows encryptor or leaving malware running on endpoints. In April 2026, the attackers accessed a FortiGate SSL VPN using compromised domain credentials, then gained domain-admin-equivalent rights.

Microsoft: September updates break File History backup feature

www.bleepingcomputer.com · 28 days ago

Microsoft warned that the built-in File History backup feature in Windows may stop working on some systems after installing the September 2026 security updates.

New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools

gbhackers.com · 28 days ago

A newly identified information-stealing campaign, tracked as Rapuncel, is exploiting a Microsoft-attested kernel driver to terminate up to 145 antivirus (AV) and endpoint detection and response (EDR) processes. This allows attackers to steal browser credentials, cryptocurrency wallet data, chat tokens, and Windows credentials.

BigDiskBuster Windows Defender DoS Vulnerability Blocks Platform and Signature Updates

gbhackers.com · 28 days ago

A recently published proof-of-concept project named BigDiskBuster claims to prevent Microsoft Defender from completing its platform and security intelligence signature updates. This could create a potential denial-of-service condition, leaving Windows endpoints operating with outdated anti-malware protection.

CrowdSec Confirms Source Code Stolen in Supply Chain Attack

www.securityweek.com · 28 days ago

The cybersecurity firm believes the data breach was the result of the May 2026 TanStack supply chain attack.

Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems

www.securityweek.com · 28 days ago

The hackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles, officials said.

From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies

unit42.paloaltonetworks.com · 28 days ago

We explore how AWS neutralizes exposed IAM credentials using managed policies, detailing GitHub secret scanning and CloudTrail monitoring strategies.

North Korea’s Hangro VPN Certificate Exposes Internal Network and Russia-Linked Infrastructure

gbhackers.com · 28 days ago

North Korea’s Hangro VPN and mail platform has deployed a new certificate hierarchy that exposes an apparent cross-border management environment spanning systems in Pyongyang and Russia’s Far East.

Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities

www.securityweek.com · 28 days ago

Attackers could exploit the flaws to cause denial-of-service conditions, disclose memory, or modify memory.

Hackers Abuse Microsoft Teams to Pose as IT Support and Steal Employee Passwords

gbhackers.com · 29 days ago

Threat actors are increasingly abusing Microsoft Teams’ external chat capabilities to impersonate corporate IT help desks. They trick employees into installing malware, granting remote access, and stealing Windows credentials. These attacks exploit a simple vulnerability: employees tend to distrust suspicious emails but often do not apply the same caution to collaboration platforms like Teams.

Three memory-safety bugs in Godot's untrusted-file parsers

axeghost.offprint.app · 29 days ago

Author here. The post describes three memory-safety bugs which have been in Godot since v1.0 and v3.0. All three are still present in current releases. The bugs can affect exported games that load community-authored data files. Godot allows attackers using maliciously crafted files to trigger reads or writes past the end of a buffer, inside the process running the game.

This A.I. House Can Provide You With Connections. It Also Has a Dark Side.

www.nytimes.com · 29 days ago

Group tech houses have proliferated across the San Francisco Bay Area in the artificial intelligence boom. One of the most prominent has also racked up an extensive police record.

He spent 11 months inside DOGE. Now he wants to set the record straight.

www.washingtonpost.com · 29 days ago

In his first major interview about his tell-all memoir, Tyler Hassen describes the culture clash surrounding DOGE’s mission and the backlash that followed.

Is this how the world ends? Extinction scenarios are taking over the AI debate.

www.washingtonpost.com · 29 days ago

As nightmare thought experiments shape the fight over how to govern a multitrillion-dollar industry, some experts say the parables may lead decision-makers astray.

Revoking the token didn’t kill the backdoor

www.csoonline.com · 29 days ago

Every identity-compromise runbook I have written, read or inherited has the same step near the top: revoke the tokens. Reset the password, kill the sessions, invalidate the refresh tokens, then go hunting. It is the right instinct. Against adversary-in-the-middle phishing, where the whole prize is a stolen session cookie, revocation is the move that ends the incident.

New Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches

gbhackers.com · 29 days ago

Security researchers have unveiled a cache poisoning technique called cache key injection that lets attackers bypass access controls, expose cached sensitive pages, trigger denial-of-service conditions, and potentially execute stored cross-site scripting (XSS) attacks against vulnerable Nginx deployments.

Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors

gbhackers.com · 29 days ago

North Korea-linked threat actor TraderTraitor has expanded its developer-focused intrusion activity beyond cryptocurrency targets, using weaponized Terraform lock files in fake job-interview repositories to infect DevOps engineers with macOS backdoors.

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

thehackernews.com · 29 days ago

Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript.

5 ways AI is reshaping the cybersecurity job market

www.csoonline.com · 29 days ago

Mario Platt spent part of last year eliminating a team. As CISO for online password management service LastPass, he shut down the company’s dedicated vulnerability management function in late 2025, folding its responsibilities directly into IT and product security. AI and business intelligence tools now handle the triage and analysis that once required a standing group of specialists.

HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise

gbhackers.com · 29 days ago

“HEIF Heist,” a broad class of image-processing attack paths that could allow threat actors to turn malicious HEIF, HEIC, and AVIF uploads into remote code execution, sensitive-data exposure, and account compromise across major technology and enterprise platforms.