Blahalla

‘Hard Fork’ Live, Part 3: Differing Visions of an A.I. Future

www.nytimes.com · a month ago

One final episode from our live event, featuring a debate, questions from listeners and the dramatic and unplanned collapse of a dancing robot.

FortiBleed: 86,000 Fortinet Device Credentials Compromised

www.securityweek.com · a month ago

The large-scale credential theft campaign hit roughly half of the internet-accessible Fortinet firewalls and VPNs.

UEFI DBX Update Guidance Targets Vulnerable Vendor-Signed Boot Applications

gbhackers.com · a month ago

A recently disclosed vulnerability inc, which affects UEFI applications signed by multiple vendors, has prompted urgent recommendations to update the UEFI Forbidden Signature Database (DBX). This issue, tracked as VU457458 and published by CERT/CC on June 18, 2026, reveals a significant weakness in trusted firmware components.

CISA: Splunk Enterprise flaw actively exploited, patch by Sunday

www.bleepingcomputer.com · a month ago

CISA has urged U.S. federal agencies to secure their systems by Sunday against a critical Splunk Enterprise vulnerability that is being exploited in attacks.

Forget Data Leakage: Shadow AI's Real Threat Is Access Control

thehackernews.com · a month ago

The first wave of enterprise AI concern was straightforward. It was simply employees pasting sensitive data into public AI tools. Security teams responded with usage policies, domain blocks, and data loss prevention rules. That response made sense at the time. It doesn't fit the problem anymore. Shadow AI has shifted from a data leakage concern to an access control problem.

Breaking the SOC triangle: How AI reshapes security operations trade-offs

www.csoonline.com · a month ago

A simple framework has always governed security operations that I call the SOC Triangle. It is a balance between quality, consistency and cost efficiency. Every SOC operates within it. Push for higher-quality investigations, deeper analysis, richer context, fewer missed signals and you pay for it in time and expertise.

Cybersecurity Firms Impacted by Klue Supply Chain Attack

www.securityweek.com · a month ago

The hackers exfiltrated data from Salesforce instances of Klue customers, such as Huntress and Recorded Future.

SmartApeSG Hackers Abuse Okendo Reviews Widget in E-Commerce Supply Chain Attack

gbhackers.com · a month ago

A supply-chain style compromise in the Okendo Reviews widget that enabled the SmartApeSG threat actor to deliver staged JavaScript loaders across a wide e-commerce surface.

Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data

thehackernews.com · a month ago

Salesforce has revealed that it disabled the Klue Battlecards app integration within its platform in response to a security incident impacting the competitive intelligence company on June 11, 2026. To that end, organizations will be unable to connect to Salesforce via the app until further notice, the American cloud-based software company noted in an alert published this week.

The Ageless and Undefeated Champs of Tulsa’s Wii Bowling League

www.nytimes.com · a month ago

The U.V. Okies have dominated a competition with other senior living facilities for six seasons, but they’re not just there to win.

Security considerations for adopting Claude Code and Cowork for SMBs

www.csoonline.com · a month ago

You are a security leader at a small or medium-sized business (SMB), and your organization has decided to adopt Claude. If you are like me, after the initial “surprise” wears off, you probably want to quickly get your arms around what adopting Claude means for the business, and for security specifically.

HazyBeacon Abuses AWS Lambda Function URLs for Stealthy Command-and-Control Operations

gbhackers.com · a month ago

HazyBeacon is a stealthy cloud-native malware campaign identified as CL-STA-1020. It is exploiting Amazon Web Services (AWS) Lambda Function URLs to create covert command-and-control (C2) channels, marking a significant evolution in attacker tactics.

NY man charged after harassing college student with AI-generated nudes

www.bleepingcomputer.com · a month ago

A New York man faces cyberstalking charges after allegedly sharing AI-generated nude images and fabricated racist messages using fake social media profiles to harass a Georgia college student.

Microsoft says web-enabled AI agents can trigger host-level RCE

www.csoonline.com · a month ago

Microsoft is warning of a novel remote code execution (RCE) path possible through web-enabled AI agents, demonstrating the technique against AutoGen Studio, its open-source interface for building and testing multi-agent applications.

CISA Issues Alert on Critical Splunk Enterprise Bug Under Active Exploitation

gbhackers.com · a month ago

CISA has issued an urgent alert regarding a critical vulnerability in Splunk Enterprise, tracked as CVE-2026-20253, which is now listed in the Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation.

Node.js Releases Security Updates for 12 Vulnerabilities, Two Rated High Severity

gbhackers.com · a month ago

Node.js has announced critical security updates that address 12 vulnerabilities across its supported release lines. Among these, two high-severity flaws could lead to denial-of-service (DoS) conditions and authentication bypass. These updates, released on June 18, 2026, affect Node.js versions 22.x, 24.x, and 26.x. The patched versions are now available as v22.23.0, v24.17.0, and v26.3.1. Node.

INC Ransomware Uses Double Extortion and Printer Ransom Notes to Pressure Victims

gbhackers.com · a month ago

INC has matured from an emerging RaaS operation into one of 2026’s most active ransomware families, claiming more than 800 victims since 2023 and capitalizing on disruption among competitors to expand its affiliate base.

Cisco to Acquire WideField Security to Boost Splunk’s Agentic SOC

www.securityweek.com · a month ago

WideField will accelerate Agentic SOC capabilities by expanding the lens on threat investigation to include identity, credentials, sessions, and blast radius.

Showboat Malware Uses Pastebin-Hosted C Code to Enable Linux Process Hiding

gbhackers.com · a month ago

A previously undocumented, modular Linux post‑exploitation framework that demonstrates sophisticated stealth techniques most notably fetching and compiling C code hosted on Pastebin to hide processes at runtime.

M365 Copilot SearchLeak: Your prompt injection attack surface just got bigger

www.csoonline.com · a month ago

A recent proof-of-concept attack against Microsoft’s M365 Copilot Enterprise highlights what could be a much broader prompt injection threat based on a common way many AI-enhanced web services operate. Dubbed SearchLeak, the attack hinged on a typical malicious objective: to leak sensitive corporate data by tricking employees to click on specially crafted links.

CISA warns Fortinet users to secure devices after FortiBleed leak

www.bleepingcomputer.com · a month ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged Fortinet customers to secure their devices after nearly 74,000 firewall and VPN credentials were exposed in a data leak dubbed "FortiBleed."

15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown

www.securityweek.com · a month ago

Law enforcement and private partners took down 106 SocGholish C&C servers and domains as part of Operation Endgame.

Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone

thehackernews.com · a month ago

Apple has updated its Beats Studio Buds wireless earbuds to patch a high-severity vulnerability that could be exploited by nearby hackers to eavesdrop on users. The vulnerability, tracked as CVE-2025-20701 (CVSS score: 8.8), refers to a case of incorrect authorization impacting the Airoha Bluetooth audio SDK that makes it possible to pair a Bluetooth audio device without user consent.

New Crypto Clipper Uses Windows Script Host and ActiveXObject for Remote Code Execution

gbhackers.com · a month ago

A novel Windows-based cryptocurrency clipper that has been active since February 2026 and leverages Windows Script Host (WScript) and ActiveXObject calls to achieve remote code execution and persistent, high-frequency data theft. The campaign stands out because it avoids traditional installers and exposed IP-based command-and-control (C2) infrastructure; instead, it bundles a portable Tor client.

Hackers Exploit Klue Integration to Steal Salesforce CRM Data Using OAuth Tokens

gbhackers.com · a month ago

Hackers are actively exploiting a compromised Klue Battlecards integration to extract sensitive Salesforce CRM data by abusing OAuth tokens, according to new research published by ReliaQuest on June 17, 2026.

iPhone BootROM Vulnerability Opens Door to Full Apple SoC Trust Chain Compromise

gbhackers.com · a month ago

A recently disclosed iPhone BootROM vulnerability, dubbed “usbliter8,” highlights a significant flaw in Apple’s SecureROM implementation. This vulnerability allows attackers to compromise the entire trust chain of the Application Processor (AP) on affected devices.

State Digital Surveillance Puts Foreign Travelers and Businesses at Risk Across 31 Countries

gbhackers.com · a month ago

A new state-surveillance assessment finds that foreign travelers and business staff face high or very high digital risk in 31 countries, where governments increasingly use telecom interception, spyware, AI-enabled monitoring, and data aggregation with little meaningful oversight.

Authorities Seize 106 Servers and 101 Domains in Major SocGholish Malware Takedown

gbhackers.com · a month ago

International law enforcement agencies have successfully seized 106 servers and 101 domains as part of a coordinated global effort against the SocGholish malware infrastructure, marking a major milestone in Operation Endgame.

Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure

www.securityweek.com · a month ago

CISA has given federal agencies only three days to patch CVE-2026-20253, which can be exploited for unauthenticated remote code execution.

Have You Bought a Tesla Recently? We Want to Hear From You.

www.nytimes.com · a month ago

Tesla sales are rebounding in Europe even though many people have negative feelings about Elon Musk, the company’s chief executive. We want to know why.

Oracle releases 245 new security patches, all rated ‘high-priority security’

www.csoonline.com · a month ago

The Oracle Critical Security Patch update (CSPU) released this week contains 245 newly-announced fixes for supported on-premises software, some of which impact multiple products. It is in reaction to an industry trend to announce and fix security holes much more quickly, and complements Oracle’s traditional quarterly patch schedule.

AutoJack: How a single page can RCE the host running your AI agent

www.microsoft.com · a month ago

AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers can trigger arbitrary process execution through AutoGen Studio’s MCP WebSocket.

Gentlemen ransomware uses multiple EDR killers to disable defenses

www.bleepingcomputer.com · a month ago

The Gentlemen ransomware-as-a-service (RaaS) is actively developing and maintaining a suite of endpoint detection and response (EDR) killers to help affiliates evade detection in attacks.

24B Records Exposed in Massive Leak of Emails, Passwords, and Login Data

www.techrepublic.com · a month ago

Cybernews researchers found an exposed database with 24 billion credential records, raising fresh risks from password reuse and credential stuffing.

124M Passwords Exposed as Infostealer Malware Hits Millions of Devices

www.techrepublic.com · a month ago

Have I Been Pwned has added 124 million passwords and 56 million email addresses from infostealer logs tied to infected devices.

Novo Nordisk Breach Exposes Software Development Pipeline Risk

www.darkreading.com · a month ago

A leaked GitHub token underscores what most organizations get wrong: Treating secrets management as a tooling problem rather than an identity problem.

Operation Escaneo Signals Shift in LatAm Threat Landscape

www.darkreading.com · a month ago

The threat group's curious business model may combine opportunistic monetization alongside intel collection, without much coordination between the two.

Nintendo confirms data stolen in WebMD subsidiary cyberattack

www.bleepingcomputer.com · a month ago

Nintendo of America has confirmed to BleepingComputer that threat actors stole survey data from the third-party TinyPulse service used internally, but its systems were not compromised.

FIFA Bug Exposed World Cup Streams to Remote Takeover

www.darkreading.com · a month ago

An ethical hacker found a critical access control vulnerability within FIFA's World Cup infrastructure in its Microsoft Entra environment. The flaw lacked server-side enforcement, letting attackers bypass client-side security checks using an easy account. This weakness could grant unauthorized users direct access to manage global broadcast streams and core tournament systems.

‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm

krebsonsecurity.com · a month ago

For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts.

F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution

thehackernews.com · a month ago

F5 released security updates addressing two critical flaws in NGINX Open Source that allow code execution on affected systems. These vulnerabilities include CVE-2026-42530, a use-after-free flaw residing in the ngxhttpv3module component. This vulnerability lets remote unauthenticated attackers compromise running NGINX Open Source instances.

Majority of Internet-Accessible REDCap Servers Outdated

www.securityweek.com · a month ago

These servers are regularly targeted by China-linked UNC6508 for initial access and backdoor deployment.

AI Crackdowns, Mega Mergers, and Security Chaos Define This Week in Tech

www.techrepublic.com · a month ago

See what you missed in Daily Tech Insider from June 15, 18.

Salesforce Data Thefts Continue via Klue App Compromise

www.darkreading.com · a month ago

Klue's Battlecards is now the third integrated application that has been compromised to steal customers' Salesforce data, and victims include Huntress, the cybersecurity vendor.

USB worm spreads crypto-stealing malware via Windows shortcut files

www.bleepingcomputer.com · a month ago

Threat actors targeting cryptocurrency wallets have been distributing clipboard-stealing malware with self-spreading capabilities and using the Tor network to conceal communication.

Amazon Retaliated Against Workers Who Supported Regulating Data Centers, Complaint Says

www.nytimes.com · a month ago

Amazon faces allegations from Employees for Climate Justice of retaliation after they testified about data center regulation to Seattle City Council. The group claims Amazon launched investigations and threatened job loss post-testimony regarding its tech infrastructure.

Alibaba Cloud Bets on France as Europe Seeks More Control Over AI

www.techrepublic.com · a month ago

Alibaba Cloud opened two Paris availability zones as European enterprises weigh data sovereignty, resilience, and AI infrastructure needs.

Trump Says Apple to Buy Computer Chips from Intel

www.nytimes.com · a month ago

Former President Trump claimed Apple agreed to work with Intel to design and build computer chips within the U.S. This initiative supports strengthening domestic semiconductor manufacturing, following the government's acquisition of a 10 percent stake in Intel last year. The policy aims to shift technology production away from overseas facilities like those in Taiwan.

ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories

thehackernews.com · a month ago

Bad groups attacked users this week using shady browser add-ons for search data theft and turning AI chat links into malware delivery paths. They also targeted edge gear via poisoned packages or exploiting cloud agents. Malicious in-memory campaigns hit macOS with little evidence remains.

[Virtual Event] Anatomy of a Data Breach: What to Do if it Happens to You

www.darkreading.com · a month ago

A virtual event on June 18, 2026 will examine how SecOps teams can prepare to respond when cyberattacks expose critical enterprise data. The program covers the primary vulnerabilities and exploits that lead to data breaches and outlines the latest tools and incident response best practices to help organizations get ahead of attackers and avoid becoming breach victims.