Blahalla

BLAHALLA

Fighting Your Dragons Through Tough Tech Times

www.darkreading.com · a month ago

Cybersecurity industry veteran Hal Pomeranz gives a pep talk on career anxiety and self-doubt and shares how to build meaningful connections during historical tech industry downturns.
Spain's data agency gets first report of AI-powered data breach

www.bleepingcomputer.com · a month ago

The Spanish Data Protection Agency (AEPD) was notified of an attack allegedly carried out with an AI agent powered by a known large language model (LLM).
SilkParasite Infrastructure Exposed: pivoting from one page hash and a single TLS cert to a 13-server SpiceRAT cluster

hunt.io · a month ago

Researchers found SpiceRAT C2 servers targeting Central Asia's energy/government sectors since late 2025. The cluster used TLC certificates to impersonate entities like Uzbekistan's state railway. This links SpiceRAT, NodeEdgeRAT, and NomadRAT for geopolitical targeting.
BragJack Attack Can Turn a Browser's Agentic AI Against It

www.darkreading.com · a month ago

Researcher Gal Weizman found BragJack, an attack exploiting a flaw in browser AI assistants. It allows malicious extensions to force actions, bypassing guardrails. Google and Microsoft issued CVE-2026-0628 and CVE-2026-55945 for the vulnerabilities.
First Agentic AI Data Breach Reported to Spanish Regulator

www.securityweek.com · a month ago

The Spanish Data Protection Agency (AEPD) reported the first known personal data breach executed by an AI agent. The attack successfully chained together a login, vulnerability discovery, and modification of personal data. AEPD stressed that defenses must adopt AI tools and incorporate detection mechanisms to respond quickly.
Big Tech’s AI safety rift signals disruption and disparity for enterprises

www.csoonline.com · a month ago

AI model security is challenging due to company disagreement. Zuckerberg favors neutral evaluators, differing from rivals' calls for coordination. Orgs must treat frontier AI as a variable supply, not assuming consistent access.
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SSL VPN Denial of Service Vulnerability

sec.cloudapps.cisco.com · a month ago

A Denial of Service vulnerability (CVE-2024-20260) impacts Cisco Secure Firewall ASA and FTD Software. Attackers exploit this flaw through the VPN and management web servers by sending a large volume of SSL/TLS connections. This action exhausts system memory or buffer blocks, causing severe service disruption.
Cisco Identity Services Engine Information Disclosure Vulnerability

sec.cloudapps.cisco.com · a month ago

A vulnerability (CVE-2026-20235) in the Cisco Identity Services Engine API allows an authenticated, remote attacker to view sensitive information, including hashed credentials. The flaw stems from insufficient validation of user-supplied parameters in API requests. Cisco strongly recommends customers upgrade to fixed software versions, as no current workarounds address this vulnerability.
Cisco Secure Firewall Management Center Software sftunnel Root Arbitrary Code Execution Vulnerability

sec.cloudapps.cisco.com · a month ago

CVE-2026-20324 affects Cisco Secure FMC via sftunnel, allowing remote, authenticated attackers to run root commands. Malicious file execution is possible due to incorrect peer permissions. Cisco has issued updates to fix this vulnerability.
Cisco Identity Services Engine SQL Injection Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Multiple vulnerabilities affect Cisco Identity Services Engine (ISE), allowing remote attackers to perform SQL injection attacks. Flaws detailed in CVE-2026-20247 and CVE-2026-20300 stem from improper validation of user-supplied input. Cisco released software updates to address these high-severity issues, stating that no temporary workarounds exist.
Cisco Identity Services Engine SQL and HQL Injection Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Four CVEs (CVE-2026-76448 to CVE-2026-76451) affect Cisco ISE/Passive Identity Connector. Authenticated, remote attackers can use SQL/HQL injection against flawed input validation. Exploitation allows viewing or modifying unauthorized database data.
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability

sec.cloudapps.cisco.com · a month ago

The vulnerability, CVE-2026-20249, affects Cisco Secure Firewall ASA and FTD Software when using IKEv2 certificate authentication. A logic error during the connection setup allows unauthenticated, remote attackers to craft a certificate, causing a denial of service (DoS) condition. Cisco released software updates to resolve this vulnerability, and no workarounds are available.
Cisco Identity Services Engine Authentication Bypass Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could let remote attackers manipulate data or execute code. Cisco detailed these issues across four CVEs: CVE-2026-76439, CVE-2026-76444, CVE-2026-76446, and CVE-2026-76447. Cisco released software updates to address these flaws, advising users that no workarounds exist.
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Logging Denial of Service Vulnerability

sec.cloudapps.cisco.com · a month ago

A vulnerability (CVE-2026-20154) impacts Cisco ASA and FTD Software due to improper rate limiting for syslog message 419002. Unauthenticated, remote attackers can exploit this flaw by sending a packet flood, causing high CPU utilization and a Denial of Service (DoS) condition. Cisco released software updates and workarounds to resolve this issue.
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software EIGRP Denial of Service Vulnerability

sec.cloudapps.cisco.com · a month ago

An adjacent attacker can exploit a flaw in the EIGRP implementation across Cisco ASA and FTD Software to cause a Denial of Service condition (CVE-2026-20222). The vulnerability results from improper resource management that allows sending crafted EIGRP updates at a high rate, triggering a memory leak. Cisco released updated software to address this EIGRP Denial of Service flaw.
Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability

sec.cloudapps.cisco.com · a month ago

A vulnerability in Cisco BroadWorks CommPilot Application Software, identified as CVE-2026-76438, results from missing authorization checks. This flaw allows authenticated, remote attackers with low privileges to alter configurations by sending crafted HTTP requests. Cisco strongly recommends upgrading to fixed software releases to eliminate the risk.
Cisco Nexus Dashboard Software Security Hardening Release: September 2026

sec.cloudapps.cisco.com · a month ago

Cisco Nexus Dashboard engineering conducted an internal review and released software updates addressing multiple newly discovered vulnerabilities. These hardening releases fix critical issues, including CVE-2026-20322 and CVE-2026-20325, which carry a CVSS score of 9.9. The advisory also patches vulnerabilities detailed by CVE-2026-20326, CVE-2026-20360, CVE-2026-20361, and CVE-2026-76409.
Cisco Secure Firewall Management Center Software Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Cisco found critical vulns in FMC: CVE-2026-76412, CVE-2026-76413, CVE-2026-76420. Remote attackers can gain root access and forge sessions. One allows unauthenticated impersonation. Users must update Cisco software immediately.
Cisco Identity Services Engine Authorization Bypass Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Auth remote attacker can modify Cisco ISE/ISE-PIC config via poor server-side validation. Updates are needed for multiple vulnerabilities. No workarounds exist. Customers must apply software updates.
Cisco Identity Services Engine Authentication Bypass Vulnerability

sec.cloudapps.cisco.com · a month ago

A critical vulnerability, designated CVE-2026-76460, impacts the API of Cisco Identity Services Engine (ISE). This flaw permits an unauthenticated, remote attacker to bypass authentication by exploiting insufficient authentication control on an API endpoint. Cisco released software updates that address this vulnerability, allowing users to secure the web-based management interface.
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Object Group Access Control List Bypass Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Multiple vulnerabilities (CVE-2026-20120, CVE-2026-20121) affect Cisco ASA and FTD Secure Firewall software's ACL Object Group Search (OGS) implementation. The logic error allows an unauthenticated, remote attacker to bypass configured access controls. Cisco released software updates to mitigate these security flaws.
Cisco Identity Services Engine Command Injection Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Flaws in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), including CVE-2026-20305 and CVE-2026-20306, allow an authenticated, remote attacker to execute arbitrary root commands via command injection due to improper input validation. Cisco released software updates addressing these vulnerabilities, noting no current workarounds are available.
Cisco Identity Services Engine Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · a month ago

An unauthenticated, remote attacker can exploit a vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) to conduct a reflected Cross-Site Scripting (XSS) attack. This flaw, CVE-2026-20309, results from the interface failing to properly validate user input. Cisco advises all customers to upgrade to fixed software releases immediately, as this resolves the risk.
Cisco Identity Services Engine Multiple Path Traversal Vulnerabilities

sec.cloudapps.cisco.com · a month ago

CVE-2026-76431 to CVE-2026-76434 affect Cisco ISE and ISE-PIC. Flaws permit remote path traversal/info disclosure. Cisco released updates; no workarounds exist.
Cisco Identity Services Engine Hardening Release: September 2026

sec.cloudapps.cisco.com · a month ago

Cisco engineers issued hardening releases for the Identity Services Engine (ISE) and ISE-PIC following an internal security review. These updates address multiple vulnerabilities, including critical CVE-2026-20130 (CVSS 10.0), some of which are actively exploited. Patches cover CVE-2026-20192, CVE-2026-20194, CVE-2026-20234, CVE-2026-20237, and CVE-2026-20287.
Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability

sec.cloudapps.cisco.com · a month ago

An unauthenticated, remote attacker can exploit a vulnerability in SSL/TLS certificate parsing within the Snort 2 Detection Engine. This flaw, identified as CVE-2026-20290, affects Cisco Secure FTD Software and other Snort 2 instances. Exploiting this vulnerability allows the attacker to trigger an unexpected Snort 2 Engine restart, causing a denial of service condition.
Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability

sec.cloudapps.cisco.com · a month ago

A vulnerability in the Cisco ThousandEyes Virtual Appliance's web management interface, CVE-2026-20350, allows command injection. Improper validation of user input enables an authenticated, remote attacker to execute arbitrary operating system commands with root privileges. Cisco released software updates addressing this flaw, advising customers to upgrade to fixed releases for remediation.
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software TCP DNS Denial of Service Vulnerability

sec.cloudapps.cisco.com · a month ago

CVE-2026-20248 in Cisco Secure Firewall ASA/FTD's DNS over TCP allows remote, unauthenticated DoS. A logic error in parsing DNS queries forces the TCP DNS response handler to restart, causing device reloads.
Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026

sec.cloudapps.cisco.com · a month ago

Cisco conducted an internal security review of its ASA, FTD, and FMC firewalls, releasing hardening updates to patch multiple vulnerabilities. These advisories address CVE-2026-20329 through CVE-2026-20336, covering various CWEs. Cisco warned that two vulnerabilities require immediate attention as they are already known to be actively exploited.
Cisco Secure Firewall Management Center Software Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Cisco FMC has multiple vulns (CVE-2026-20340 to CVE-2026-20344) allowing root access or SQL injection via low-privilege login. Update immediately.
Cisco Identity Services Engine 802.1X Session Hijack and Information Disclosure Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Multiple vulnerabilities in Cisco Identity Services Engine could allow an unauthenticated, local attacker to achieve authentication bypass or disclose sensitive information. Cisco detailed two separate flaws, CVE-2026-20071 and CVE-2026-20072, impacting the web-based management interface. Cisco released software updates to address these issues, noting that no workarounds currently exist.
Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability

sec.cloudapps.cisco.com · a month ago

Cisco Secure Firewall Threat Defense (FTD) Software suffers a vulnerability (CVE-2026-20135) within its TLS 1.3 implementation. Improper buffer management permits an unauthenticated, remote attacker to exploit the system via a crafted TLS 1.3 packet. Successfully sending this packet causes a denial of service (DoS) condition by forcing the affected device to reload.
Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Unauthenticated attackers can exploit CVE-2026-20295 and CVE-2026-20323 in Cisco Secure FMC/FTD via sftunnel. Attacks allow DoS or auth bypass. Updates are available.
Cisco Identity Services Engine RADIUS Denial of Service Vulnerability

sec.cloudapps.cisco.com · a month ago

Cisco issued an advisory detailing CVE-2026-20352, a vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE). This flaw allows unauthenticated, remote attackers to trigger a denial of service (DoS) by sending a crafted RADIUS request to an affected ISE node. Successful exploitation can render the ISE node unavailable, preventing endpoints from accessing the network.
Cisco Identity Services Engine Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Multiple vulnerabilities affect Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Exploiting CVE-2026-76423 through CVE-2026-76428 permits remote attackers to bypass REST API authentication, execute code, or perform SQL injection. Cisco released software updates to address these critical flaws, advising customers to patch immediately.
Cisco Identity Services Engine Authenticated Remote Code Execution and API Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Multiple vulnerabilities, including CVE-2026-20282, CVE-2026-20283, and CVE-2026-20284, impact Cisco Identity Services Engine. These flaws allow an authenticated, remote attacker to execute arbitrary commands or perform SQL injections. Cisco released advisory updates addressing these critical security weaknesses.
Cisco Identity Services Engine Remote Code Execution Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) allow authenticated, remote attackers to execute arbitrary commands on the underlying operating system. These critical flaws include CVE-2026-20176, CVE-2026-20211, and CVE-2026-20307. Cisco released software updates to address these issues, noting that no workarounds currently exist.
Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

sec.cloudapps.cisco.com · a month ago

Cisco’s Secure Firewall Management Center (FMC) features a vulnerability (CVE-2026-20242) that allows remote, unauthenticated attackers to execute arbitrary commands as root. The flaw results from insecure deserialization of a user-supplied Java byte stream via the External Database Access feature. Attackers can exploit this by sending a crafted, serialized Java byte stream to an affected device.
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Secure Firewall 3100 and 4200 Series DTLS Denial of Service Vulnerability

sec.cloudapps.cisco.com · a month ago

Cisco warns of CVE-2026-20250 in DTLS handling, affecting Cisco Secure Firewall ASA/FTD 3100/4200 series. Unauth remote attackers can cause DoS via improper resource management. Immediate updates are necessary.
Oracle’s September patches put Fusion Middleware back in the hot seat

www.csoonline.com · a month ago

Oracle released 673 patches for 17 product families in Sept 2026. E-Business Suite/Fusion Middleware got major fixes, addressing critical, remote flaws like CVE-2026-71133, CVE-2026-83099, CVE-2026-83059, and CVE-2026-87230, plus others. Patching is essential for security.
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

thehackernews.com · a month ago

A critical vulnerability, CVE-2026-89026, affects Issabel Framework, a web-based component for open-source PBX software. Active exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands. This flaw registers high CVSS scores of 9.8 (v3.1) and 9.3 (v4.0).
AI agent authorization risks remain a gap in new NIST-CISA token security guidance

www.csoonline.com · a month ago

NIST and CISA released guidance to secure digital tokens and assertions used for single sign-on and API access. Current guidance does not fully cover AI agents' actions, leaving authorization risks. Cybersecurity experts advise organizations to treat AI agents as low-trust identities and mandate human approval for all high-risk actions.
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

thehackernews.com · a month ago

Kaspersky tracked three activity clusters targeting Russian enterprises: NightEagle, Hacking Cat, and Toy Ghouls. The vendor identified attacks mounted by NightEagle, also known as APT-Q-95, active since at least 2023. NightEagle employs techniques for persistence and lateral movement against corporate targets.
Evading Machine Learning Based Detections · MSec Operations Blog

msecops.de · a month ago

Malware packers and loaders require polymorphism to defeat modern detection systems. Authors detail how tools insert random code snippets and use string obfuscation with multiple keys to prevent static signature creation. These techniques help malware bypass general detection and machine-learning-based security engines.
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude

thehackernews.com · a month ago

Security researchers at Forever Security showed that a single browser extension could hijack AI assistants built into five Chromium-based products. These vulnerable platforms include Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension. Installing the extension grants unauthorized access to each product's built-in AI with just one click.
EU Chief Warns of AI-Powered Hacking, Moves to Rein In Social Media

www.securityweek.com · a month ago

Ursula von der Leyen warned that AI models pose "massive risks," potentially allowing unprecedented levels of hacking. She stressed that the EU's forthcoming AI Act is crucial for establishing global guardrails against these threats. Von der Leyen advocates using AI to assist critical sectors, such as healthcare and energy grids, emphasizing that humans must always control the technology.
I Missed One TLB Shootdown and Somehow Ended Up Controlling a Page Table

blog.himanshuanand.com · a month ago

The author exploited a public Linux kernel bug to create a stale memory mapping, allowing an unprivileged process to write to the old physical page. Subsequently, the author persuaded the kernel to treat this page as a page table. This chain of actions successfully yielded one flag from Google's kernelCTF service.
The true cost of a ransomware attack, with and without BCDR

www.bleepingcomputer.com · a month ago

The average total cost of a ransomware incident reached $5.08 million, significantly surpassing the median ransom payment of $139,875. Attack costs stem primarily from downtime, remediation, and legal compliance, not the ransom itself. Businesses must implement mature BCDR strategies to mitigate risk and satisfy mandates like GDPR and SEC disclosure rules.
Bypassing Referer-Based CSRF with strict-origin-when-cross-origin

afine.com · a month ago

The article details vulnerabilities, including methods for bypassing Referer-based CSRF protections and chaining HTML injection flaws to steal credentials. Furthermore, it examines a Time of Check Time of Use (TOCTOU) race condition in GNU sed, identified as CVE-2026-5958. This vulnerability sat inside the program's --follow-symlinks path for two decades.
GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

gbhackers.com · a month ago

GhostCode, a phishing kit, exploits Microsoft Entra device enrollment via social engineering, impersonating staff (e.g., BJ’s Wholesale Club) using business emails. It abuses OAuth 2.0 device auth grant with AES-256-GCM attachments to bypass controls.