Blahalla

Friday Squid Blogging: Squid Washing Up on Cape Cod Beach

www.schneier.com · 3 days ago

Lots of articles about this. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

Abbott Laboratories probes two cyber incidents amid extortion claims

www.bleepingcomputer.com · 3 days ago

Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, while also investigating a separate claim that attackers breached its LabCentral portal and stole company data.

Microsoft’s ‘Project Perception’ Could Challenge Anthropic’s Mythos in AI Security

www.techrepublic.com · 3 days ago

Microsoft is reportedly developing Project Perception, a lower-cost AI security tool that would use multiple models to identify enterprise vulnerabilities.

OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

thehackernews.com · 3 days ago

Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc systems Okta tested, that memory is gone until the process restarts. OpenSSL shipped the HollowByte fix in June with no CVE, no advisory, and no changelog entry pointing at it.

China’s Moonshot AI Unveils Kimi Model, Threatening America’s Lead

www.nytimes.com · 3 days ago

China’s Moonshot AI unveiled a freely available artificial intelligence model that seemed to narrow the gap with cutting-edge offerings from U.S. tech companies.

Inc Ransomware Exploits SonicWall SMA Zero-Days

www.darkreading.com · 3 days ago

When chained together, the two vulnerabilities allow threat actors to gain root-level capabilities on SonicWall's mobile access appliances.

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

thehackernews.com · 3 days ago

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack.

Critical Zoom Flaw Could Let Attackers Take Over Windows Accounts

www.techrepublic.com · 3 days ago

Zoom patched a critical Windows flaw that could enable remote account takeover, along with three high-severity privilege-escalation vulnerabilities.

HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload

www.bleepingcomputer.com · 3 days ago

A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on OpenSSL servers with a malicious payload of just 11 bytes.

OnlyFans performers become unlikely allies of CISOs in securing websites

www.csoonline.com · 3 days ago

CISOs at government organizations and universities have an unexpected ally coming to their aid: OnlyFans models. For some time, hackers have exploited weaknesses in the websites of universities or government departments to host scams or malware, using content stolen from the OnlyFans website as bait to attract victims.

New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

thehackernews.com · 3 days ago

A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys. A Shodan harvester keeps the scan queue stocked with ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio: the image generators, local model runners, and workflow builders that teams stand up fast and firewall late.

The Real AI Threat Is Blind Trust

www.darkreading.com · 3 days ago

AI models left to both interpret and execute commands eliminate critical cybersecurity oversight.

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

thehackernews.com · 3 days ago

Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed CylindricalCanine.

Meta in Talks to Lease Computing Power to Anthropic in Potential $10 Billion Deal

www.nytimes.com · 3 days ago

A deal would underline how scarce computing power is for artificial intelligence development, and could create a new business for Meta.

Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks

www.microsoft.com · 3 days ago

Join Microsoft Security at Black Hat USA 2026 for supply chain research, hands-on security experiences, expert conversations, and our reception.

Xi Jinping of China Pitches ‘Openness’ in Push to Shape the Path of A.I.

www.nytimes.com · 3 days ago

Xi Jinping said that the development of artificial intelligence systems should be a “symphony of global collaboration.

Ernst & Young discloses data breach after support system hack

www.bleepingcomputer.com · 4 days ago

Ernst & Young is notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its IT personnel.

New FCC Proposal Pits Phone Privacy Against Fraud Prevention

www.techrepublic.com · 4 days ago

The FCC has proposed requiring identity verification for phone activation, a move supporters say will fight fraud while critics warn it threatens privacy.

Google must open Android to rival AI agents, EU orders

www.csoonline.com · 4 days ago

The European Union is stepping up its actions against US tech giants under the Digital Markets Act, which is intended to ensure fair competition between digital platforms. On Thursday, the European Commission issued two rulings to limit Google’s dominance.

In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint

www.securityweek.com · 4 days ago

Noteworthy stories that might have slipped under the radar: OpenClaw AI agents exploited via WhatsApp, ransomware hits naval defense firm TKMS, Lidl discloses data breach.

Apple Sued Over Hide My Email Privacy Claims

www.techrepublic.com · 4 days ago

Apple faces a proposed class action alleging a Hide My Email flaw could expose users’ real addresses despite the company’s privacy claims.

Roger Summit, Who Invented an Early Online Search Service, Dies at 95

www.nytimes.com · 4 days ago

A research scientist at Lockheed, he came up with the idea for a computer system that would search scientific and technical literature almost instantaneously.

AI Hardware, App Store Shifts, and Security Scares Define This Week in Tech

www.techrepublic.com · 4 days ago

Catch up on the week's biggest tech news, including Google's app store shakeup, Apple's AI expansion, OpenAI's hardware plans, and critical security threats.

1Password Lets Claude Sign In Without Revealing Passwords

www.techrepublic.com · 4 days ago

1Password's new Claude integration lets AI agents sign in to websites without exposing passwords, adding user approval and credential protection.

Inside the Search for "Clean" Residential Proxies for Carding

www.bleepingcomputer.com · 4 days ago

Residential proxies are no longer the silver bullet they once were for carding. Flare explains why cybercriminals increasingly seek "clean" residential proxies and combine them with browser fingerprints, device profiles, and other identity signals to evade modern fraud detection.

Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

thehackernews.com · 4 days ago

North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges.

New Starland RAT Steals Browser Credentials and Scans for Over 40 Crypto Wallets

gbhackers.com · 4 days ago

A financially motivated, Russian-speaking threat actor tracked as UAT-11795, orchestrating a large-scale campaign since at least June 2025. A sophisticated Python-based remote access trojan dubbed “Starland RAT,” alongside a stealthy in-memory PowerShell implant known as the “WLDR agent.

Hackers Hide Lua Loaders in Fake TTF Files to Deploy Remcos, XWorm, and Agent Tesla

gbhackers.com · 4 days ago

Hackers are increasingly abusing trusted file formats and lightweight scripting environments to evade detection, with a newly observed campaign leveraging Lua-based loaders. Disguised as TrueType (.ttf) font files to deploy commodity malware, including Remcos RAT, Agent Tesla, XWorm, and Snake Keylogger variants.

Hugging Face Says Autonomous AI System Executed Multi-Stage Cyberattack

www.techrepublic.com · 4 days ago

Hugging Face says an autonomous AI agent carried out a cyberattack against its production systems, highlighting the growing role of AI in offensive and defensive cybersecurity.

Gold Eagle Clearinghouse Targets Security Gap, But How Is Unclear

www.darkreading.com · 4 days ago

The White House launched Gold Eagle to coordinate vulnerability response in a new AI world, but multiple questions linger over how it's being implemented.

LegacyHive Windows Zero-Day Lets Attackers Hijack Administrator Registry Hives

gbhackers.com · 4 days ago

A newly disclosed Windows local privilege-escalation vulnerability, dubbed LegacyHive, could allow a standard user to load and modify the per-user registry classes hive of an administrator account. The proof-of-concept (PoC), published by researcher NightmareEclipse under the MSNightmare/LegacyHive GitHub repository, abuses Windows’ User Profile Service to mount a target user’s UsrClass.

ClickLock Mac Malware Traps Users in a Three-Day Password Loop

www.techrepublic.com · 4 days ago

ClickLock can shut down Mac apps for more than three days while pressuring users to enter a password and stealing sensitive account data in the background.

Hackers Breached an IIS Server and Deployed Ransomware Across the Network the Next Day

gbhackers.com · 4 days ago

Hackers leveraged a compromised Microsoft IIS server to gain initial access and deploy a previously unseen ransomware payload across an enterprise network within 24 hours, highlighting a highly coordinated and operationally mature intrusion chain observed in June 2026.

AWS Billing Bug Displays Trillion-Dollar Cost Estimates to Cloud Customers

gbhackers.com · 4 days ago

Amazon Web Services (AWS) is currently investigating a significant billing issue affecting its Cost Explorer tool. This problem caused some cloud customers to see alarmingly inflated cost estimates, with figures reportedly reaching into the trillions of dollars.

Podcast: Broken Governance, Agentic AI, and the MindStone Agent Exclusive

www.securityweek.com · 4 days ago

(Video) Artificial intelligence is transforming cybersecurity, but are governance, compliance, and security practices evolving fast enough to keep up?

Google Bets 'Agentic Defense' Strategy Can Outpace Attackers

www.darkreading.com · 4 days ago

Google Cloud incorporates key Wiz capabilities into an agentic defense platform to automate threat detection and remediation against AI attacks.

E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants

thehackernews.com · 4 days ago

The European Commission on Thursday ordered Google to give rival AI assistants the same reach into Android that Gemini already has: the camera, the microphone, whatever is on screen, a wake word that fires with the display off, and the ability to drive other apps in the background by imitating taps and typing.

Beacon Security Raises $13 Million for Security Data Platform

www.securityweek.com · 4 days ago

The startup helps organizations detect, hunt, and protect their assets across environments at machine speed.

The Race to Field Military Autonomy Is On, Can Trusted Information Infrastructure Keep Pace?

thehackernews.com · 4 days ago

Military forces are under increasing pressure to field autonomous capabilities faster than ever before. Across the U.S., UK, and NATO, new investment, evolving defense strategies, and accelerated acquisition pathways are transforming how capability is delivered, rewarding programs that can move from concept to operational deployment at commercial speed.

EU Orders Google to Open Android AI Features, Share Search Data With Rivals

www.techrepublic.com · 4 days ago

EU rules will make Google share anonymized search data and give rival AI assistants broader access to Android features across Europe.

Industry Reactions to Pentagon Suspending CMMC Phase 2: Feedback Friday

www.securityweek.com · 4 days ago

Industry professionals broadly agree that the suspension pauses third-party CMMC audits but not the underlying legal obligation to protect CUI.

New Windows LegacyHive zero-day gives hackers admin privileges

www.bleepingcomputer.com · 4 days ago

A security researcher using the "Nightmare Eclipse" handle has released a Windows zero-day exploit dubbed LegacyHive that allows attackers to escalate privileges on up-to-date Windows systems.

Details of Alan Turing’s Voice Encryption System

www.schneier.com · 4 days ago

Really interesting piece of cryptographic history: In November 2023, a large cache of his wartime papers, nicknamed the “Bayley papers”, was auctioned in London for almost half a million U.S. dollars. The previously unknown cache contains many sheets in Turing’s own handwriting, telling of his top-secret “Delilah” engineering project from 1943 to 1945.

The A.I. Trade Secrets War + Economists Say ‘We Must Act Now’ + HatGPT

www.nytimes.com · 4 days ago

“I don’t know if the public understands this, but these companies hate each other.

New NadMesh Botnet Uses 20+ RCE Vectors to Hijack AI and MCP Infrastructure

gbhackers.com · 4 days ago

NadMesh is a new, industrial‑grade Go‑based botnet that weaponizes more than 20 RCE vectors to hijack AI and MCP infrastructure at scale, combining autonomous scanning, exploit delivery, and credential harvesting in a single closed‑loop platform.

Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man

thehackernews.com · 4 days ago

Armenia has held a Russian tourist named Aleksandr Ermakov in a detention center since June 28, on a U.S. extradition request for a REvil ransomware suspect named Aleksandr Ermakov.

Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

unit42.paloaltonetworks.com · 4 days ago

A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access.

TP-Link Kasa Camera Flaws Let Attackers Steal Admin Credentials and Geolocation Data

gbhackers.com · 4 days ago

TP-Link has revealed several serious vulnerabilities affecting its Kasa EC70 and EC71 smart camera models, which could expose users to credential theft and geolocation data leakage. These vulnerabilities are CVE-2026-9770 and CVE-2026-13230 and specifically affect version 4 of both devices.

CISA Warns of Two Fortinet FortiSandbox Flaws Exploited to Execute Commands

gbhackers.com · 4 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities in Fortinet FortiSandbox to its Known Exploited Vulnerabilities (KEV) catalog. These flaws are actively being exploited in the wild to execute unauthorized commands on affected systems.

Windows Server 2022 reach end of mainstream support in 90 days

www.bleepingcomputer.com · 4 days ago

Microsoft announced that Windows Server 2022 will reach the mainstream end date in October 2026, but will switch to extended support and continue receiving security updates for five more years.