Blahalla

India's Telegram ban hit the UAE too. Here's how to get around it

www.bleepingcomputer.com · a month ago

India has banned Telegram until June 22 after the app was used to circulate leaked exam papers. CEO Pavel Durov accuses telecom Reliance of BGP hijacking that disrupted the app as far away as the UAE. Here's what happened, and how to get around the block with an MTProto proxy.

Modular Phishing Kit Uses GitHub Pages to Steal Payment Card Details and Passwords

gbhackers.com · a month ago

A sophisticated, long-running phishing operation has evolved into a serverless, modular campaign that weaponizes GitHub Pages to harvest payment card data, credentials, and customer identifiers from banking customers in Mexico. The campaign’s architecture centers on a phishing kit containing a selector panel that operators use to generate institution-specific landing pages.

1Password Acquires Apono in Reported $250M-$300M Deal

www.securityweek.com · a month ago

Apono specializes in just-in-time access governance technology for humans, machines, and AI agents.

Tenet Security Emerges from Stealth with $6 Million Seed Funding

www.securityweek.com · a month ago

Tenet aims to detect and stop dangerous AI agentic behavior in real time.

Adversarial Exposure Validation Turns Security Visibility into Confident Prioritization

thehackernews.com · a month ago

For security teams, the findings never stop, but confidence in knowing which ones matter is becoming harder to maintain. The problem is no longer visibility. It's validation. Security teams must decide which findings warrant action while operating under constant pressure and incomplete information. Increasingly, the challenge is not discovering potential risks.

Microsoft confirms Office apps launch issues after June updates

www.bleepingcomputer.com · a month ago

Microsoft is investigating a new issue preventing third-party applications from launching Microsoft Office applications or opening documents on up-to-date Windows systems.

Google’s Vertex AI SDK could allow RCE through bucket squatting

www.csoonline.com · a month ago

A design flaw in the Vertex AI software development kit (SDK) for Python, Google Cloud’s managed platform for building, training, and deploying AI agents, could allow hijacking and poisoning of models outside of a developer’s own Google Cloud project.

ClickFix Attack Deploys Potemkin Loader, RMMProject RAT, and EtherRAT Across 11 Hosts

gbhackers.com · a month ago

A sophisticated ClickFix social engineering campaign in May 2026 triggered a full hands-on-keyboard intrusion spanning 11 hosts, deploying a novel trio of malicious tools: Potemkin loader, RMMProject RAT, and EtherRAT. The attack chain began when the user visited a compromised website and pasted a base64-encoded PowerShell command into Win+R. This command abused pcalua.

Rockwell Automation Patches Vulnerabilities in ICS Controllers and Software

www.securityweek.com · a month ago

The industrial automation giant has fixed security holes in Logix, CompactLogix, Flex, RSLinx, and FactoryTalk products.

Google Cloud Vertex AI Vulnerability Lets Attackers Take Over and Poison AI Models

gbhackers.com · a month ago

A critical vulnerability in Google Cloud’s Vertex AI has been discovered, allowing attackers to hijack machine learning model uploads, poison artifacts, and achieve cross-tenant remote code execution (RCE) without any prior access to the victim’s environment.

Sweeping Credential-Harvesting Heist Compromises +30K Fortinet Devices

www.darkreading.com · a month ago

Attackers actively are targeting various sectors across nearly 200 countries and have already compiled a list of working credentials for tens of thousands of compromised devices

Hackers Target npm Ecosystem by Compromising 140+ Mastra Packages

gbhackers.com · a month ago

A large-scale software supply chain attack has compromised more than 140 npm packages under the widely used Mastra namespace, exposing developers, CI/CD pipelines, and enterprise environments to a stealthy cross-platform infostealer.

Sapphire Sleet macOS Malware Abuses curl-to-osascript Execution for Multi-Stage Payload Delivery

gbhackers.com · a month ago

Sapphire Sleet’s latest macOS campaign uses crafted.scpt AppleScript lures that pipe curl output directly to osascript, enabling a compact, multi-stage payload chain that executes entirely within Script Editor and evades many built‑in macOS protections. The infection begins with a socially engineered lure fake SDK or update AppleScript files such as Zoom SDK Update.

AI Use by the US Government

www.schneier.com · a month ago

On 14 April, the Trump administration quietly acknowledged the widespread use of AI to automate government processes. The office of management and budget (OMB) disclosed a staggering 3,611 active or planned use cases for AI across the federal government.

Attackers Exploit Cloud Logging Platforms to Hide Malicious Activity

gbhackers.com · a month ago

Attackers are increasingly targeting cloud logging platforms to evade detection and maintain persistent visibility into compromised environments.

‘Hard Fork’ Live Part 2: Dylan Field on Standing Out in the A.I. Era

www.nytimes.com · a month ago

“I think if you have a creative voice in writing or design, you put yourself out there and you take a risk, this is a good time to do that,” said the Figma chief executive Dylan Field.

Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack

www.securityweek.com · a month ago

The attackers deployed a new Go-based backdoor that uses Microsoft Teams servers for command-and-control.

The Top 10 Attack Surface Exposures in 2026

thehackernews.com · a month ago

Breaches don't always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop, like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication, anything internet-facing is immediately at risk.

CISA orders feds to patch max severity Joomla plugin flaw by Friday

www.bleepingcomputer.com · a month ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity flaw in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited in the wild.

Extortion group FulcrumSec leaks initial samples from 1.3TB Novo Nordisk data breach following failed $25M ransom demand

www.technadu.com · a month ago

Following a limited incident disclosure by Novo Nordisk on June 11, the cyber extortion group FulcrumSec has claimed responsibility for an extensive network intrusion resulting in the exfiltration of 1.3 TB of data (approximately 700,000 files). The group published initial samples on its dark web leak site after Novo Nordisk reportedly refused a $25 million extortion demand.

Microsoft Working on Patch for ‘RoguePlanet’ Zero-Day

www.securityweek.com · a month ago

The public PoC code exploits a race condition in Microsoft Defender to spawn a command prompt with System privileges.

Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats

thehackernews.com · a month ago

Cybersecurity researchers have flagged a "coordinated malware campaign" on the JetBrains Marketplace that has published no less than 15 malicious plugins capable of exfiltrating artificial intelligence (AI) provider keys. "Every plugin poses as an AI coding assistant built on DeepSeek and other large language models, offering chat, commit messages, code review, bug finding, and unit tests,"

Oracle’s Second Monthly Security Updates Deliver 245 Patches

www.securityweek.com · a month ago

Oracle has released its June 2026 Critical Security Patch Update to fix vulnerabilities in Communications, EBS, Enterprise Manager and other products.

SprySOCKS Windows Backdoor Uses Kernel Driver to Hide Processes, Files, and Network Traffic

gbhackers.com · a month ago

Windows variants of SprySOCKS, a backdoor long associated with FishMonger (aka Earth Lusca/TAG-22), expanding a toolset that was until now Linux-only.

5 AI risk management frameworks for shoring up key gaps

www.csoonline.com · a month ago

Organizations racing to embed AI into business operations are realizing that the risk management frameworks they’ve relied on for decades aren’t built for the behaviors, failure modes, and ethical complexities AI systems introduce.

The Cloud Has Sound: The Unrelenting and Unseen Cost of the A.I. Boom

www.nytimes.com · a month ago

As tech giants rush to build big data centers, some residents who live near them say a constant low-frequency vibration is ruining their health and homes.

What 22,000 breaches teach us about incident preparedness

www.csoonline.com · a month ago

The 2026 Verizon Data Breach Investigations Report analyzed more than 22,000 confirmed data breaches across 145 countries. Its findings point to a single uncomfortable truth: organizations cannot patch fast enough to prevent every incident.

Microsoft working on Defender patch for RoguePlanet zero-day

www.bleepingcomputer.com · a month ago

Microsoft confirmed that it's working on a security patch for a Defender zero-day vulnerability named "RoguePlanet," disclosed one week ago.

Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities

www.securityweek.com · a month ago

The browser updates address multiple memory safety bugs that could potentially lead to remote code execution.

UK Social Media Ban for Minors Has Privacy Experts Worried

www.darkreading.com · a month ago

The UK will ban adolescents under 16 years old from user-to-user social-media platforms, despite age-verification issues and privacy concerns.

7-Year-Old OpenBSD Security Flaw Exposes Systems to Full PAP Authentication Bypass

gbhackers.com · a month ago

A significant authentication flaw has been discovered in the PPP stack of OpenBSD, allowing attackers to bypass the Password Authentication Protocol (PAP) validation and gain unauthorized network access.

Steam Workshop Malware Campaign Uses Wallpaper Engine to Steal Accounts and Infect Gamers

gbhackers.com · a month ago

A sophisticated malware campaign has been abusing Steam Workshop’s sharing model to distribute backdoors, infostealers and crypto miners hidden inside Wallpaper Engine packages, primarily targeting gamers in China and Russia.

144 Mastra npm Packages Compromised via Hijacked Contributor Account

thehackernews.com · a month ago

As many as 144 npm packages associated with the Mastra namespace ("@mastra/"), a popular open-source JavaScript and TypeScript framework for building artificial intelligence (AI) applications, have been compromised as part of a software supply chain attack codenamed easy-day-js, per findings from JFrog, SafeDep, Socket, and StepSecurity.

Joomla, LiteSpeed Vulnerabilities Exploited in Attacks

www.securityweek.com · a month ago

The flaws allow attackers to execute arbitrary PHP code and gain root privileges on shared hosting servers.

CISA Issues Alert on Oracle PeopleSoft Vulnerability Exploited by Ransomware Groups

gbhackers.com · a month ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of a critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools, identified as CVE-2026-35273.

[ Removed by Reddit ]

www.reddit.com · a month ago

[ Removed by Reddit on account of violating the content policy.

Kodak confirms data breach claimed by ShinyHunters extortion gang

www.bleepingcomputer.com · a month ago

Kodak has confirmed that it's working with external cybersecurity experts to investigate a security breach after hackers gained access to some of the company's data.

3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs

www.securityweek.com · a month ago

SOCRadar has detected 30,000 compromised Fortinet firewalls that expose networks to hacking.

Hackers Inject Malicious JavaScript Into WordPress Sites to Deploy ErrTraffic ClickFix Lures

gbhackers.com · a month ago

Hackers are injecting malicious JavaScript into compromised WordPress sites to deploy ErrTraffic-powered ClickFix lures, a campaign that achieved nearly 60% victim conversion rates an unprecedented figure in malware ecosystems.

Rokarolla Malware Abuses Android Accessibility Services to Steal Banking Credentials

gbhackers.com · a month ago

Rokarolla, a new Android banking trojan named after its Command-and-Control (C2) infrastructure, that combines sophisticated social engineering, broad permissions abuse, and a flexible command set to harvest credentials from 217 targeted banking and cryptocurrency apps.

CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution

thehackernews.com · a month ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting Widget Factory Joomla Content Editor (JCE) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-48907 (CVSS score: 10.

JetBrains Plugin Security Alert: 70,000+ Installs Linked to AI Key Theft

gbhackers.com · a month ago

A coordinated supply chain attack targeting JetBrains IDE users has exposed over 70,000 developers to silent credential theft. The campaign involves at least 15 malicious plugins distributed via the JetBrains Marketplace, masquerading as AI-powered coding assistants built on models such as DeepSeek.

NVIDIA NeMo Security Flaw Exposes Systems to Command Injection Attacks

gbhackers.com · a month ago

NVIDIA has disclosed multiple high-severity vulnerabilities in its NeMo Framework, including a critical command injection flaw that could allow attackers to execute arbitrary code on affected systems. These issues, outlined in the June 2026 security bulletin, impact NeMo versions up to 2.7.2 across all platforms.

Fortra Access Manager Security Flaw Exposes Systems to Command Injection

gbhackers.com · a month ago

Fortra has reported a critical command injection vulnerability in its Core Privileged Access Manager (BoKS) platform, which could allow remote attackers to execute arbitrary commands with elevated privileges. This could potentially lead to a full system compromise. Tracked as CVE-2026-9862 and assigned a CVSS v3.1 score of 9.

Malware Uses Deno Permission Flags to Run Commands and Proxy Internal Network Traffic

gbhackers.com · a month ago

A recent intrusion demonstrates how threat actors are shifting toward scripting runtimes to evade traditional detection: attackers delivered a modular Remote Access Trojan (RAT) built on Deno, using social engineering to install a multi-process JavaScript implant that executes commands and proxies internal network traffic.

Critical Chrome Flaws Let Attackers Execute Arbitrary Code – Update Immediately

gbhackers.com · a month ago

Google has released an urgent Chrome security update addressing multiple critical vulnerabilities that could allow attackers to execute arbitrary code on affected systems. The update, now rolling out to users globally, upgrades Chrome to version 149.0.7827.155/.156 for Windows and macOS and 149.0.7827.155 for Linux.

Critical LiteLLM Flaw Allows Authentication Bypass via Host Header Injection

gbhackers.com · a month ago

A critical security vulnerability tracked as CVE-2026-49468 has been disclosed in the LiteLLM framework, exposing deployments to authentication bypass attacks via Host header injection. The issue, published in the GitHub Advisory Database and classified under GHSA-4xpc-pv4p-pm3w, affects all LiteLLM versions before 1.84.

Microsoft says you don’t need another email security tool; experts say, not so fast

www.csoonline.com · a month ago

Despite best efforts by defenders, malicious emails continue to slip through the cybersecurity cracks, leading some enterprises to implement a layered “defense in depth” strategy that incorporates multiple tools. Microsoft seems to be challenging this idea, revealing that there are only nominal returns from adding integrated pre- and post-send partners to Defender for Office 365’s protections.

PrizeBuzz phishing network analysis

phisheye.com · a month ago

I did a write-up on the PrizeBuzz phishing network, looking at how the campaign uses fake brand pages, rotating domains, and reused infrastructure. Sharing in case anyone is interested in phishing analysis and tracking malicious infrastructure.

SVD-2026-0613: Insecure Default Domain Allowlist in Splunk AI Toolkit

advisory.splunk.com · a month ago

In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the “admin” or “power” Splunk roles could cause the Splunk AI Toolkit to make outbound requests over HTTP to a server that an attacker controls, which could allow for data exfiltration.