Blahalla

Bypassing Referer-Based CSRF with strict-origin-when-cross-origin

afine.com · a month ago

The article details vulnerabilities, including methods for bypassing Referer-based CSRF protections and chaining HTML injection flaws to steal credentials. Furthermore, it examines a Time of Check Time of Use (TOCTOU) race condition in GNU sed, identified as CVE-2026-5958. This vulnerability sat inside the program's --follow-symlinks path for two decades.

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

gbhackers.com · a month ago

GhostCode, a phishing kit, exploits Microsoft Entra device enrollment via social engineering, impersonating staff (e.g., BJ’s Wholesale Club) using business emails. It abuses OAuth 2.0 device auth grant with AES-256-GCM attachments to bypass controls.

AIUC Raises $40 Million to Certify Enterprise AI Agents

www.securityweek.com · a month ago

AIUC secured $40 million in funding to expand its specialized focus on enterprise AI security. The company established the AIUC-1 standard, which rigorously tests AI agents against risks such as jailbreaks, prompt injections, and hallucinations. AIUC-1 already certifies major agents, including Cursor and ElevenLabs, and will use the investment to audit frontier models.

Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories

thehackernews.com · a month ago

Mandiant reported an attacker hijacked an AI coding-assistant session at an unnamed SaaS provider. The attacker then deployed the Shai-Hulud worm across about 100 internal code repositories. The worm stole repository secrets and source code, following a preliminary recommendation of poisoned software.

OpenAI’s Altman says world should ‘trust’ AI firms amid mounting fears

www.washingtonpost.com · a month ago

Altman (OpenAI) and Zuckerberg (Meta) advised trusting industry self-regulation of AI despite public fears. They argued developers naturally incentivize safe alignment.

Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix

thehackernews.com · a month ago

JFrog reported a flaw in Parallels Desktop for Mac that permits ordinary local accounts to execute code with root access, the system's highest level of privilege. The exploit requires running code on the machine and therefore does not function over the network. Developers addressed this vulnerability in Parallels Desktop 27, though this updated version cannot run on Intel Macs.

VectraRAT Malware-as-a-Service Lets Hackers Bypass UAC and Hijack Windows Systems

gbhackers.com · a month ago

VectraRAT, using a Go-based Linux C2 (VectraHub) and C++ implant over TCP 3308, steals credentials from Chromium, Firefox, and IE, and harvests API keys.

Pixel Modem Zero-Day Exploited in Targeted Attacks

www.securityweek.com · a month ago

Google patched zero-day vulnerability CVE-2026-58704, which affects the Pixel’s modem component. Researchers found the flaw allows remote privilege escalation through a logic error, enabling exploitation without user interaction. These patches resolve over 100 other vulnerabilities, including critical flaws in the VPU and multimedia subsystem.

TP-Link Tapo Camera Flaw Lets Attackers Gain Admin Access Without Password

gbhackers.com · a month ago

OPSWAT researchers Khoi Tran and Thai Do discovered two vulnerabilities in the TP-Link Tapo C200 camera. CVE-2026-15315 enables nearby network attackers to bypass administrator authentication using a replayed value, granting full control. Furthermore, CVE-2026-15316 allows denial-of-service by exploiting oversized Wi-Fi credentials during the onboarding process.

Chinese-Speaking Hackers Use Noodle RAT Backdoor to Spy on Windows and Linux Systems

gbhackers.com · a month ago

Chinese groups use Noodle RAT, a cross-platform backdoor targeting Windows/Linux. Active since mid-2016, it impacts APAC organizations for espionage/crime. Win.NOODLERAT allows file transfer and proxy ops. The malware is a distinct family.

Microsoft says Copilot buttons still missing in classic Outlook

www.bleepingcomputer.com · a month ago

Microsoft investigates Copilot/Chat vanishing from Classic Outlook on Windows builds 20026.20182+. The bug links to missing MAPI property PRPROFILEUSERSMTPEMAILADDRESSW. Users should enable "Show Apps in Outlook" in File Advanced settings for a fix.

Webinar: What happens in the first hours of a Google Workspace breach

www.bleepingcomputer.com · a month ago

Security teams must act swiftly after discovering a Google Workspace breach, as early decisions determine the total impact of the incident. Experts will analyze real-world breaches where attackers leveraged social engineering and malicious OAuth applications to gain access. The upcoming webinar will review critical response decisions that limit damage versus actions that worsen the breach's scope.

US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

www.securityweek.com · a month ago

US, UK, and Dutch agencies warn Iranian actors deployed Chosen Brick malware. It targets dissidents via Telegram, exploiting messaging platforms to harvest contacts/emails. The malware records audio and steals data.

Axoflow Launches AxoDetect, Bringing Detection Into the Pipeline and Making the SIEM Optional

gbhackers.com · a month ago

Axoflow launched AxoDetect, a tool that runs Sigma rules directly in the data pipeline before logs reach the SIEM. This mechanism processes clean, normalized security data, shifting detection earlier in the flow. The platform supports low-cost storage in AxoLake, significantly reducing reliance on SIEM ingest rates and costs.

N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security

thehackernews.com · a month ago

Nova targets North American and European organizations with phishing campaigns that impersonate trusted services. These attacks abuse legitimate authentication flows, granting access to valid accounts. A single compromised identity then opens the door to sensitive data, business systems, and additional cloud access.

Smishing Triad Hackers Use JWR Phishing Kit to Steal Cards, OTPs and Bank Credentials

gbhackers.com · a month ago

Smishing Triad used the JWR kit in large campaigns, harvesting payment data, OTPs, and banking credentials via SMS. Group-IB linked this to Outsider, noting the platform collects up to 70 PII fields.

CenterPoint Energy Confirms Data Breach Exposing Customers’ Personal Information

gbhackers.com · a month ago

CenterPoint Energy confirmed an unauthorized third party accessed personal customer data after compromising an external utility system. The Houston-based company disclosed the breach via a Form 8-K filing. Although operations remain active, CenterPoint expects additional costs for ongoing investigation, remediation, and customer notification efforts.

Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover

www.securityweek.com · a month ago

Defiant found 2 critical RCEs in The Events Calendar plugin, risking 200k+ sites. Flaws are CVE-2026-78159 (unauth code injection) and CVE-2026-78006 (unauth PHP object injection via comments). StellarWP patched both vulnerabilities.

Parallels Desktop Flaw Lets Unprivileged Mac Users Gain Root Access

gbhackers.com · a month ago

CVE-2026-90894 (ParaShells) lets unprivileged macOS users gain root access on Parallels Desktop. Attackers use argument injection in a crafted package exploiting the prldispservice daemon. This grants root privileges on affected systems.

Fake CAPTCHA Scams

www.schneier.com · a month ago

A new scam variant exploits the trusted nature of CAPTCHA challenges. Scammers frame these tests to deceive users into downloading and executing malicious programs. This is a social engineering attack.

Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation

thehackernews.com · a month ago

Google disclosed that a high-severity privilege escalation flaw affects the Pixel Cellular Modem, tracking to CVE-2026-58704 (CVSS score: 8.0). The vulnerability permits attackers to bypass permissions due to a logic error in the modem's code. Users must update the device immediately to patch this high-risk security flaw currently exploited in the wild.

Threat Intelligence Alone Won't Close the Exploitation Gap

thehackernews.com · a month ago

Attackers combine leaked credentials or disclosed vulnerabilities with AI-assisted exploitation. This combination significantly accelerates the path from initial exposure to a full breach. Security programs must adapt quickly because they often cannot react to this pace.

Critical ScreenConnect flaw now actively exploited in attacks

www.bleepingcomputer.com · a month ago

CISA warned that attackers actively exploit a critical missing-authorization flaw in ConnectWise ScreenConnect, tracked as CVE-2026-84869. This vulnerability allows basic-privilege actors to execute files and transfer data through active remote sessions. Attackers have historically exploited other flaws, including CVE-2024-1709, CVE-2025-3935, and CVE-2026-3564.

Hackuity Raises $19 Million for AI-Powered Vulnerability Management

www.securityweek.com · a month ago

Hackuity raised $19M, totaling $38M. Funds will accelerate its AI vulnerability platform, integrating data from 130+ security products to score vulnerabilities by exploitability and business impact.

Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks

thehackernews.com · a month ago

Acronis disclosed a high-severity vulnerability in its Backup plugin for cPanel and WHM. Attackers can exploit CVE-2026-87886, a local privilege escalation flaw stemming from insecure file permissions. This vulnerability has been actively exploited in the wild, requiring immediate patching.

280,000 Impacted by Premier Medical Group Data Breach

www.securityweek.com · a month ago

Premier Medical Group notified the Department of Health and Human Services about a data breach affecting 282,075 patients. The incident, which occurred in June 2026, compromised sensitive personal and medical records. Stolen data includes names, dates of birth, diagnosis details, and health insurance information.

Chrome, Firefox Updates Patch 115 Vulnerabilities

www.securityweek.com · a month ago

Google released Chrome 153, patching 42 security defects, including critical flaws like CVE-2026-91726, CVE-2026-91721, and CVE-2026-91749. Mozilla released Firefox 156, fixing 73 vulnerabilities, many addressing use-after-free and privilege escalation issues. These combined updates resolved a total of 115 vulnerabilities, urging users to update their browsers immediately.

Apple Adds New Parental Controls to iPhone, iPad and Mac: Here’s What Changes

www.techrepublic.com · a month ago

Apple rolling out new parental controls with iOS 27, iPadOS 27, and macOS 27. The Ask to Browse feature routes website visits to a parent for approval, adding web protection to existing app purchase controls. Additionally, the system expands Communication Safety to detect gore in live FaceTime calls and uses Time Allowances for flexible Screen Time management.

Atomic macOS (AMOS) Stealer Activity

unit42.paloaltonetworks.com · a month ago

The Atomic macOS (AMOS) stealer targets macOS users, stealing credentials and sensitive data from web browsers and cryptocurrency wallets. Groups deploy AMOS via deceptive setup guides claiming to offer "macOS toolkit" software. Analysis shows these attacks execute malicious Zsh scripts in the Terminal, retrieving Base64-encoded GZIP payloads.

Acronis Backup Plugin Vulnerability Exploited in the Wild to Gain Elevated Linux Privileges

gbhackers.com · a month ago

Acronis issued an urgent update addressing a high-severity local privilege escalation vulnerability (CVE-2026-87886). The flaw impacts the Acronis Backup plugin for cPanel & WHM on Linux, allowing low-privileged attackers to exploit insecure file permissions. Security teams must immediately upgrade to version 1.9.3 HF3 to mitigate active attacks gaining elevated server control.

12 Best Kubernetes Security Tools Compared (2026): Features & Pricing

gbhackers.com · a month ago

Quick Answer: Kubernetes security quotes hinge on the node-vs-cluster-vs-developer unit choice, and the OSS floor (Kubescape, Falco, Calico, NeuVector, Cilium/Tetragon) resets every negotiation. Sysdig and Aqua lead paid runtime/lifecycle; Cisco (Isovalent) now owns the eBPF network layer; Fairwinds sells governance-as-guardrails; Microsoft Defender publishes the anchor rates.

Acronis Patches Exploited Vulnerability in cPanel Backup Plugin

www.securityweek.com · a month ago

Acronis rolled out urgent patches addressing CVE-2026-87886, a high-severity insecure file permissions vulnerability. Attackers could exploit this flaw, leading to local privilege escalation on the Backup plugin for cPanel & WHM and Plesk extension. Acronis advises users immediately update deployments affected by versions prior to 1.9.3.1021 and 1.8.11.638, respectively.

12 Best Container Security Tools Compared (2026): Features & Pricing

gbhackers.com · a month ago

Open-source tools like Trivy, Falco, and SUSE NeuVector offer free, comprehensive container security coverage across the full lifecycle. Vendors like Sysdig, Aqua, and Prisma employ complex pricing models, billing per workload, developer, node, or vCore. Buyers must critically evaluate these diverse commercial units to justify cost increases above capable free alternatives.

PAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users

gbhackers.com · a month ago

Phishing operation PAPERMILL abuses a legitimate, signed Notepad++ executable to deliver VenomRAT to Windows systems. The campaign uses tax-audit lures, showing a pattern of China-nexus malware targeting Indian recipients. Operators deploy DLL sideloading through a companion libcurl.dll, executing loader logic in memory to bypass security checks.

Apache Superset SQL Injection Flaw Gets Public PoC Exploit

gbhackers.com · a month ago

A public proof-of-concept exploit targets CVE-2026-23980, a SQL injection flaw in Apache Superset versions prior to 6.0.0. This vulnerability allows authenticated users with read access to execute error-based SQL injection. Organizations must upgrade to Apache Superset 6.0.0 immediately to patch the flaw.

Windows Server 2022 reaches end of mainstream support next month

www.bleepingcomputer.com · a month ago

Microsoft has reminded customers that Windows Server 2022 will reach the end of mainstream support next month and enter extended support until October 2031.

China-Aligned Hackers Hide PeckBirdy Malware C2 Inside Casino and Adult Websites

gbhackers.com · a month ago

China-aligned groups camouflage the PeckBirdy C2 framework within low-quality Chinese casino and adult websites. They exploit this ignored internet infrastructure to blend malware traffic into apparent gambling activity. These attacks use JScript and WebSockets, complicating detection and associating with backdoors like MKDOOR and HOLODONUT.

Cat Frazier, Whose Retro GIFs Celebrated a Weirder Internet, Dies at 35

www.nytimes.com · a month ago

She found a future in the internet’s past with a Tumblr blog of animated texts, a revolt against the clean minimalism of contemporary design aesthetics.

How to Use AI to Plan a Trip: Better Prompts for Travel Recommendations

www.nytimes.com · a month ago

Generic questions get generic answers, experts say, so to avoid mediocre recommendations, you’ll need to write smarter prompts. Follow these tips.

A top Democratic donor says time is running out to stop Americans from hating AI

www.washingtonpost.com · a month ago

LinkedIn co-founder and influential Democratic donor Reid Hoffman says industry and government must show Americans how they can benefit from artificial intelligence.

Inside the campaign to convince Washington that AI could end human life

www.washingtonpost.com · a month ago

Senator Bernie Sanders visited the Bay Area to question artificial intelligence's impact. There, Sanders met tech executives to discuss the threat of AI ending human life. Lawmakers from both major parties now openly debate this potential extinction-level risk.

You don’t have to join the hack-back program to inherit its risk

www.csoonline.com · a month ago

NSPM allows private vendors offensive cyber ops (covert access, manipulation). DOJ and DHS jointly run it. Legal basis on untested CFAA reading creates liability gaps.

Enterprises Warned of Attacks Exploiting WSO2 Vulnerability

www.securityweek.com · a month ago

The vulnerability, tracked as CVE-2026-5430, can be exploited to gain access to valuable enterprise data.

AI made software development unrecognizable. Is cybersecurity next?

www.csoonline.com · a month ago

The rapid emergence of AI has radically changed a host of professions, with software engineering and development perhaps the most transformed of all pursuits. The usual “ solitary ritual ” of a developer writing code for hours is giving way to collaboration with an army of chatbots.

Age Limits for Social Media Outlined by European Union

www.nytimes.com · a month ago

A proposed law would bar children under 13 from using social media across the 27-nation bloc.

Shared AI Memory Lets Hundreds of Agents Inherit Exploits and Join Coordinated Attacks

gbhackers.com · a month ago

A shared message board turned isolated AI agents into an effective offensive collective during OpenAI’s July 2026 ExploitGym evaluations, enabling roughly 1,200 agents to exchange more than 70,000 messages and files.

Oracle Patches 800+ Vulnerabilities in September 2026 Security Update

www.securityweek.com · a month ago

The security updates resolve over 800 vulnerabilities across 17 product families, including over 100 critical-severity flaws.

NIST Issues New Guidance to Protect SSO and API Tokens From Theft and Forgery

gbhackers.com · a month ago

The National Institute of Standards and Technology (NIST) has published new implementation guidance to safeguard identity tokens, access tokens, and assertions used in single sign-on, cloud federation, and application programming interface (API) environments.

12 Best CIEM Tools Compared (2026): Features & Pricing

gbhackers.com · a month ago

Quick Answer: CIEM bills per identity or per cloud resource, and the count that matters is non-human identities machines outnumber people many-fold and inflate quotes fast. Tenable (Ermetic) and Wiz lead platform CIEM; Britive prices standalone JIT; CyberArk monetizes enforcement. Retirement alert: Microsoft Entra Permissions Management has been discontinued plan migrations, not renewals.

12 Best CASB Solutions Compared (2026): Features & Pricing

gbhackers.com · a month ago

Quick Answer: Nobody buys standalone CASB anymore you buy an SSE seat and CASB rides along. That flips the cost question: Defender for Cloud Apps is already inside M365 E5, Netskope/Zscaler/Skyhigh price CASB into per-user SSE bundles, and specialist attach (Proofpoint-style people-risk, Lookout mobile) is where incremental spend needs justifying.