Blahalla

New Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches

gbhackers.com · 29 days ago

Security researchers have unveiled a cache poisoning technique called cache key injection that lets attackers bypass access controls, expose cached sensitive pages, trigger denial-of-service conditions, and potentially execute stored cross-site scripting (XSS) attacks against vulnerable Nginx deployments.

Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors

gbhackers.com · 29 days ago

North Korea-linked threat actor TraderTraitor has expanded its developer-focused intrusion activity beyond cryptocurrency targets, using weaponized Terraform lock files in fake job-interview repositories to infect DevOps engineers with macOS backdoors.

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

thehackernews.com · 29 days ago

Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript.

5 ways AI is reshaping the cybersecurity job market

www.csoonline.com · 29 days ago

Mario Platt spent part of last year eliminating a team. As CISO for online password management service LastPass, he shut down the company’s dedicated vulnerability management function in late 2025, folding its responsibilities directly into IT and product security. AI and business intelligence tools now handle the triage and analysis that once required a standing group of specialists.

HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise

gbhackers.com · 29 days ago

“HEIF Heist,” a broad class of image-processing attack paths that could allow threat actors to turn malicious HEIF, HEIC, and AVIF uploads into remote code execution, sensitive-data exposure, and account compromise across major technology and enterprise platforms.

Google Confirms Gemini AI Breached Three Firms

www.securityweek.com · 29 days ago

Google is the latest AI giant to confirm that its models escaped a testing environment and hacked real companies.

New Remus Infostealer Steals OpenAI and Anthropic API Tokens, Passwords and Crypto Wallets

gbhackers.com · 29 days ago

A newly tracked Windows infostealer dubbed Remus is expanding its credential-theft playbook by targeting API tokens and local usage data tied to AI platforms, including OpenAI and Anthropic.

Exim Mail Server Hit by 4 Security Flaws Enabling SMTP Smuggling and Heap Corruption

gbhackers.com · 29 days ago

Exim maintainers have released version 4.100.1 to address four security vulnerabilities affecting the widely used mail transfer agent. This update resolves issues that could potentially enable SMTP smuggling and heap-memory corruption under certain configurations.

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

thehackernews.com · 29 days ago

The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks.

EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials

gbhackers.com · 29 days ago

A newly uncovered EtherHiding campaign has turned the Polygon blockchain into a resilient command-and-control mechanism, allowing operators to rotate malware infrastructure without modifying the payload deployed on victim systems.

BragJack Attack Hijacks AI Assistants in 5 Popular Browsers With Zero Clicks

gbhackers.com · 29 days ago

Security researchers have revealed a zero-click attack technique known as BragJack, which could enable a malicious browser extension to hijack built-in AI assistants in popular browsers like Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome.

Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories

gbhackers.com · 29 days ago

Threat actors linked to the TanStack npm supply chain compromise allegedly used a stolen GitHub OAuth token to clone about 170 private CrowdSec repositories, exposing source code, limited contact information, and a restricted AWS notification credential.

Hackers Abuse Critical cPanel Authentication Bypass to Compromise Hosting Servers

gbhackers.com · 29 days ago

Threat actors rapidly exploited a critical authentication bypass in cPanel and WHM to compromise internet-facing hosting servers, with Japanese telemetry data linking the campaign to a sharp rise in Mirai-like scanning and attack traffic targeting Telnet services.

Click2Shell WordPress Flaw Lets Hackers Execute PHP Code and Take Over Websites

gbhackers.com · 29 days ago

A recently disclosed WordPress vulnerability, known as Click2Shell, could let attackers execute remote PHP code on vulnerable sites after convincing a logged-in administrator to click a specially crafted link. WordPress version 7.1.1, released on September 17, 2026, addresses this issue.

Silent packet loss in PcapSplitter: a file collision bug on TCP session reuse

robinhayer.dev · 29 days ago

I have been developing a tool wrapped around tshark. The first blog post was about hitting a wall on a 2.5 GB file. Later, I talked about parallelizing the PCAP processing in my second blog post where I ran into a file corruption bug. I was using PcapSplitter from PcapPlusPlus in connection mode and output started coming back corrupted.

Malicious npm packages evade install-script defenses at runtime

www.bleepingcomputer.com · 29 days ago

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts.

Researchers escape OpenAI Codex sandbox to run commands on host

www.bleepingcomputer.com · 29 days ago

Researchers escaped OpenAI's Codex sandbox two ways, one running commands on a developer's machine from its most locked-down mode. OpenAI has patched both.

In China, A.I. Is Moving Forward While the Economy Lags Behind

www.nytimes.com · 30 days ago

The upcoming state visit of Xi Jinping to the United States spotlights China's advancements in artificial intelligence. Meanwhile, the article notes that China's economy faces one of its most challenging periods in decades.

Hackers who broke into OpenAI warn the AI industry has a security problem

www.washingtonpost.com · 30 days ago

Security experts said companies developing powerful AI should step up protections against cyberattacks.

BragJack - $20K in bounty rewards from Anthropic, Perplexity, Google, Microsoft and Opera Using 1 Extension

forever.security · 30 days ago

Hi folks, my name is Gal Weizman, I do browser security research. Excited to finally share my recent work, where I managed to hack Chrome, Comet, Edge, Opera and Claude in Chrome using one single browser extension 2 CVEs & $20,000 in bounties 🙂 Hope you like it!

BragJack attacks hijack AI browser agents through malicious extensions

www.bleepingcomputer.com · 30 days ago

BragJack, a proof-of-concept attack from Forever Security's Gal Weizman, hijacks the AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome using one malicious extension. The Prompt Forcing technique earned over $20,000 in bounties and two CVEs.

TigerByte Cyber Emerges From Stealth With $3 Million in Funding

www.securityweek.com · 30 days ago

The company has secured over $7 million in contracts with US government agencies, including the US Space Force, the US Navy, and DARPA.

North Korean WaterPlum hackers infected 30,000 devices worldwide

www.bleepingcomputer.com · 30 days ago

A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea.

ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

www.bleepingcomputer.com · 30 days ago

The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation's data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service.

Identity Visibility in 2026: The Foundation of Identity Security

thehackernews.com · 30 days ago

Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among the most frequently reported initial access vectors in breach research, including Verizon's annual Data Breach Investigations Report.

Google Gemini AI Hacked 3 Real Companies After Cybersecurity Test Exposed It to Internet

gbhackers.com · 30 days ago

Google has confirmed that its Gemini artificial intelligence model accidentally accessed protected systems belonging to three real companies during a cybersecurity evaluation. The incident stemmed from a configuration error that exposed the AI agent to the public internet.

Viral AI actress' hotline face-scans every caller, watches their mood

www.bleepingcomputer.com · 30 days ago

AI actress Tilly Norwood went viral after glitching into Chinese on Piers Morgan Uncensored last night. Her "Talking Tilly" video call service face-scans every caller for an 18+ age check, senses callers' moods during calls, and shuts down permanently on September 27. We tried it and read the fine print.

Calling viral AI actress Tilly Norwood? Agree to a face scan first

www.bleepingcomputer.com · 30 days ago

AI actress Tilly Norwood went viral after glitching into Chinese on Piers Morgan Uncensored. Her "Talking Tilly" video-call service face-scans every caller for an 18+ age check, senses callers' moods during calls, and shuts down permanently on September 27. We tried it and read the fine print.

Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws

thehackernews.com · a month ago

Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository. The chain began with a bug in the software that runs OpenAI's public help forum and moved through a weakness in OpenAI's own login system.

SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE

thehackernews.com · a month ago

SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability. The vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10.0 on the CVSS scoring system. The issue affects all versions of Access Rights Manager 2026.2 and prior.

North Korean WaterPlum Hackers Target IT Professionals With Fake Job Interviews to Steal Crypto

gbhackers.com · a month ago

North Korean threat actors, known as WaterPlum (also referred to as Contagious Interview), have infected at least 30,000 devices in over 100 countries by luring software developers and IT professionals into malicious job interviews. This campaign specifically targets web developers, freelancers, blockchain specialists, and cryptocurrency professionals.

AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes

gbhackers.com · a month ago

Researchers have identified a new Android banking Trojan called RatHat that utilizes artificial intelligence to automate device compromise and steal financial credentials, PINs, and one-time passcodes. Zimperium’s zLabs researchers analyzed this malware, which represents a significant evolution in Android threats.

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

thehackernews.com · a month ago

A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 (CVSS v3.1 score: 9.8/CVSS v4 score: 9.3), which relates to a case of unauthenticated remote code execution. "Orkes Conductor 3.21.21 before 3.30.

Your LLM is prompt injecting you...

www.edenai.co · a month ago

It's crazy how security has gone from an important consideration to the main challenge with AI agents.

Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up

thehackernews.com · a month ago

Google's Gemini model has become the latest artificial intelligence (AI) system to access the internet and break into other companies during a cybersecurity evaluation. The development was first reported by The Wall Street Journal. The incidents occurred in May 2026 as part of a test run conducted by Israeli company Irregular.

CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

thehackernews.com · a month ago

An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open.

PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner

gbhackers.com · a month ago

A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, PNG images, and WAV audio files. The infection was detected after repeated security alerts indicated suspicious PowerShell activity.

CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

thehackernews.com · a month ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2025-39682 (CVSS score: 9.

Google’s Gemini AI hacked into other companies, adding to ‘rogue’ AI incidents

www.washingtonpost.com · a month ago

The incursions came during tests of its cybersecurity skills, similar to other incidents disclosed by OpenAI, Anthropic and Meta.

Gemini AI Hacked Three Companies in a Testing Breakout, Google Says

www.nytimes.com · a month ago

A third-party test company inadvertently gave internet access to Google’s Gemini and other artificial intelligence models during cybersecurity testing.

Hackers Are Using Passkey Updates as a New Microsoft Phishing Hook

www.techrepublic.com · a month ago

Microsoft warns attackers are using passkey and MFA update requests to phish employees, hijack sessions, and access Microsoft 365 data.

UAE Cyber Chief Says Country Faced 640,000 Cyberattacks in One Day

www.techrepublic.com · a month ago

The UAE faced 640,000 cyberattacks in one day, its cyber chief says, highlighting risks from unpatched software, ransomware, and deepfakes.

Anthropic picks consulting firm to monitor AI safety, pledges to spend $1 billion

www.washingtonpost.com · a month ago

The artificial intelligence company selected the firm to provide oversight for its products.

Hackers Crack Flock Camera, Expose 1.6M Images in 21 Days

www.techrepublic.com · a month ago

Hackers physically compromised a Flock camera and found an encryption key, 27,000 clips, and 1.6 million images generated in 21 days.

Friday Squid Blogging: On Squid Egg Sacs

www.schneier.com · a month ago

Short essay about squid egg sacs. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

Vectra AI Launches Ascent to Help Address New Era of AI-Driven Attacks

www.darkreading.com · a month ago

The new program expands Vectra AI's partner strategy as increasingly complex security environments and the growing use of AI create demand for broader AI expertise, services, and security outcomes.

Anthropic Pursues IPO Despite Its A.I. Safety Warnings

www.nytimes.com · a month ago

The company is expected to generate $100 billion in annualized revenue this year, even as chief executive Dario Amodei calls for slowing down development of some advanced A.I. models.

Cisco Zero-Day Highlights API Endpoint Authentication Issues

www.darkreading.com · a month ago

The authentication bypass flaw CVE-2026-76460 impacts Cisco's Identity Services Engine (ISE) and received a maximum 10 out of 10 CVSS score.

EY Survey Finds Autonomous AI Implementation Outpaces Oversight

www.darkreading.com · a month ago

A new survey of senior AI execs shows that while organizations are rapidly deploying AI and autonomous systems, their process and controls are not keeping pace.

Uber to Pay $40 Million to Parents of Woman Fatally Hit by Car

www.nytimes.com · a month ago

Emily Normandin-Parker, 23, was struck and killed on a California freeway after an Uber driver ordered her and a friend out of his car in August 2023.