Blahalla

Critical LiteLLM Flaw Allows Authentication Bypass via Host Header Injection

gbhackers.com · a month ago

A critical security vulnerability tracked as CVE-2026-49468 has been disclosed in the LiteLLM framework, exposing deployments to authentication bypass attacks via Host header injection. The issue, published in the GitHub Advisory Database and classified under GHSA-4xpc-pv4p-pm3w, affects all LiteLLM versions before 1.84.

Microsoft says you don’t need another email security tool; experts say, not so fast

www.csoonline.com · a month ago

Despite best efforts by defenders, malicious emails continue to slip through the cybersecurity cracks, leading some enterprises to implement a layered “defense in depth” strategy that incorporates multiple tools. Microsoft seems to be challenging this idea, revealing that there are only nominal returns from adding integrated pre- and post-send partners to Defender for Office 365’s protections.

PrizeBuzz phishing network analysis

phisheye.com · a month ago

I did a write-up on the PrizeBuzz phishing network, looking at how the campaign uses fake brand pages, rotating domains, and reused infrastructure. Sharing in case anyone is interested in phishing analysis and tracking malicious infrastructure.

SVD-2026-0613: Insecure Default Domain Allowlist in Splunk AI Toolkit

advisory.splunk.com · a month ago

In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the “admin” or “power” Splunk roles could cause the Splunk AI Toolkit to make outbound requests over HTTP to a server that an attacker controls, which could allow for data exfiltration.

SVD-2026-0614: OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit

advisory.splunk.com · a month ago

In Splunk AI Toolkit versions below 5.7.4, a user who holds the “admin” Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.

Fileless Phantom Stealer Targets Browser Credentials

www.darkreading.com · a month ago

In addition to executing entirely in memory, the malware's infection chain incorporates other anti-analysis techniques designed to frustrate detection.

Security Community Slams US Ban on Exporting Mythos, Fable

www.darkreading.com · a month ago

An open letter signed by dozens of security experts asked the government to reverse export restrictions on Anthropic's Claude Fable 5 and Mythos 5 models.

Malicious JetBrains Marketplace plugins steal AI API keys from developers

www.bleepingcomputer.com · a month ago

At least 15 malicious plugins found on the JetBrains Marketplace were designed to steal AI API keys from developers.

Infinite Campus: Salesforce Breach Exposed 137,000 Staff Records

www.techrepublic.com · a month ago

Infinite Campus says a Salesforce breach exposed data tied to 137,000 school staff accounts, raising phishing and SaaS security concerns.

27 Years in the Dark: OpenBSD Fixes Ancient Remote Kernel Auth Bypass

blog.argus-systems.ai · a month ago

Absolutely wild find by Argus-Systems. A remote authentication bypass hiding in OpenBSD's kernel PPP stack since it was imported from FreeBSD in July 1999. An attacker could essentially bypass authentication via a null-auth flaw and intercept/read PPPoE traffic without credentials. It survived every single release for nearly three decades until the patch. OpenBSD already released a patch.

New Rokarolla Android malware targets 217 banking, crypto apps

www.bleepingcomputer.com · a month ago

A new Android banking trojan named Rokarolla is targeting 217 banking and cryptocurrency applications using an extensive set of 137 commands.

Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting

thehackernews.com · a month ago

A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with no access to a victim's project hijack the victim's machine learning model upload and run code inside Google's serving infrastructure. Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty program, calls the technique "Pickle in the Middle" and said it saw no exploitation in the wild.

Steam Workshop abused to spread malware via Wallpaper Engine app

www.bleepingcomputer.com · a month ago

Threat actors are abusing Steam Workshop, Valve's community hub for downloading game-related content, to push various malware hidden in wallpaper packages.

SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection

www.darkreading.com · a month ago

FishMonger, a China-nexus threat group, has deployed an undocumented version of the Linux backdoor against government targets in Honduras, Taiwan, Thailand, and Pakistan.

ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

thehackernews.com · a month ago

Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, per independent reports from Morphisec, BlueVoyant, and Huntress, respectively. Attacks involving BabaDeda Loader, observed in April 2026, have targeted education and financial organizations.

Rokarolla Android Trojan Levels Up to Full Device Control, Persistence

www.darkreading.com · a month ago

The emerging malware, spread via fake TikTok and Chrome downloads, demonstrates an evolution by combining banking fraud with extensive device surveillance and remote control.

D.O.J. Seeks to Halt Pollution Lawsuit Against Elon Musk’s Data Center

www.nytimes.com · a month ago

The department cited national security concerns, saying Elon Musk’s company had played a crucial role in the Iran war. It also argued it has the authority to stop environmental lawsuits brought by citizens.

Aembit Extends IAM for Agentic AI to Microsoft Copilot Studio

gbhackers.com · a month ago

Las Vegas, USA / Nevada, June 16th, 2026, CyberNewswire Aembit on Tuesday announced support for Copilot Studio, extending its identity and access management capabilities to Microsoft’s enterprise AI agent platform.

'Lorem Ipsum' Malware Pivots to ClickFix Delivery

www.darkreading.com · a month ago

New analysis shows the campaign, which uses compromised WordPress sites, may be linked to the ransomware and data extortion group Vice Society.

iRhythm Confirms Data Stolen in Hack

www.securityweek.com · a month ago

The digital health company said it learned of the breach on June 8 and the attackers demanded a ransom.

Best Prime Day Tech Deals: Apple, Bose, Garmin, and More

www.techrepublic.com · a month ago

Shop early Amazon Prime Day tech deals on earbuds, mice, routers, doorbells, headphones, smartwatches, Android phones, and fitness watches.

UK to require ID or face scan before you can make social media accounts

www.bleepingcomputer.com · a month ago

Opening a new social media account in the UK will soon mean proving you're over 16 with an ID upload or a facial age scan, under a government ban on under-16s taking effect in spring 2027. Security experts warn the age checks are easy to circumvent and create new data-breach risks.

Hackers for Granny: A Call to Arms Against Industrialized Fraud

professorsigmund.com · a month ago

Fraud syndicates operating from fortified compounds in Myanmar, Cambodia, and Laos run vertically integrated criminal enterprises targeting the elderly. Images from the research in the original source. " There's a horrid truth swept under the rug: loneliness kills! And it enables fraud.

Hacker Conversations: Isira Adithya, the Evolution of an Ethical Hacker

www.securityweek.com · a month ago

From building LED bulbs to graduating college and buying a house with money earned from bug bounties.

ShinyHunters Claims Council of Europe HR Data, Threatens Leak

www.techrepublic.com · a month ago

ShinyHunters claims it stole 297GB of data from the Council of Europe, including payroll and medical records, but the organization has not confirmed a breach.

GhostTree Attack Abused Recursive Windows Junctions to Hide Malware

www.bleepingcomputer.com · a month ago

GhostTree uses recursive NTFS junctions to generate vast numbers of valid Windows file paths. Varonis explains how the technique could cause Microsoft Defender folder scans to never complete, leaving malware undetected.

AppViewX Launches Agent Identity Security to Govern Agents for the AI and Quantum Era

gbhackers.com · a month ago

New York, United States of America, June 16th, 2026, CyberNewswire Agent Identity Security combines AI agent governance with a native PKI foundation, directly targeting ungoverned AI agents, enterprise security’s fastest-growing blind spot AppViewX today announced Agent Identity Security, a new product within the AppViewX platform that discovers, governs, secures, and monitors AI agents across the

Developer laptops are the credential store attackers are picking through in 2026, GitGuardian announces Endpoint Protection

gbhackers.com · a month ago

New York, New York, June 16th, 2026, CyberNewswire GitGuardian is introducing Developer Endpoint Protection, extending its secrets and non-human identity (NHI) security platform coverage to developer workstations.

FTC warns of record $3.5 billion losses to imposter scams in 2025

www.bleepingcomputer.com · a month ago

The U.S. Federal Trade Commission (FTC) warned that Americans lost $3.5 billion to imposter scams in 2025, with reported losses nearly tripling since 2020.

Magnitude Emerges From Stealth Mode With $10 Million in Funding

www.securityweek.com · a month ago

The company is enhancing third-party risk management (TPRM) through autonomous AI agents.

Silent Ransom Group Targets US Legal Firms With Voice Phishing and Data Theft Extortion

gbhackers.com · a month ago

A concentrated data theft extortion campaign by UNC3753 also reported as Luna Moth, Chatty Spider, and Silent Ransom Group targeting dozens of U.S. professional, legal, and financial services firms.

AI and Cybersecurity – Everything You Wanted to Know, But Were Afraid to Ask

www.securityweek.com · a month ago

From defending networks to enabling attacks, artificial intelligence is changing every aspect of cybersecurity. Here's what dozens of experts say security leaders need to understand now.

New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds

thehackernews.com · a month ago

Security researchers at Zimperium's zLabs have documented a new Android banking trojan, Rokarolla, that targets 217 banking and cryptocurrency apps and packs 137 remote commands.

Endpoint Security Startup Ent Emerges From Stealth With $100 Million Seed Round

www.securityweek.com · a month ago

Ent has developed an intent-aware platform designed to interpret user and agent behavior before risky actions are carried out.

Riding High After I.P.O., SpaceX to Buy A.I. Start-Up for $60 Billion

www.nytimes.com · a month ago

SpaceX exercised its option to acquire Cursor in an all-stock deal, bolstering Elon Musk’s ambitions in artificial intelligence.

Hackers Exploit Critical Fortinet FortiSandbox Flaws in Active Attacks

gbhackers.com · a month ago

Security researchers have reported active exploitation attempts targeting multiple critical vulnerabilities in Fortinet FortiSandbox appliances, raising concerns about potential compromises in enterprise security infrastructure.

Cybercrime Group Claims Novo Nordisk Hack

www.securityweek.com · a month ago

The hack-and-leak group FulcrumSec claims to have stolen 1.3TB of data from the pharmaceutical giant.

Microsoft Teams Relay Abused by Hackers to Hide Malicious Traffic

gbhackers.com · a month ago

Microsoft Teams’ trusted infrastructure has been exploited by threat actors to secretly route malicious traffic, leading to a highly stealthy ransomware campaign attributed to the DragonForce group.

Can CISOs Trust Their Applications? TrustCloud Wants to Replace the Questionnaire

www.securityweek.com · a month ago

By continuously analyzing security, infrastructure, and governance data, TrustCloud aims to give CISOs a real-time view of application risk and board-ready assurance.

Hackers Use OnionDrop Loader With DLL Sideloading to Deploy Multiple Infostealers

gbhackers.com · a month ago

A professionally engineered loader called OnionDrop is being used in high-tempo campaigns to deliver multiple infostealers at scale. Between February 28 and May 20, 2026, YARA retro-hunting uncovered more than 645 unique OnionDrop DLL samples, and deliveries remained active at the time of publication.

Novo Nordisk Confirms Cyberattack Exposing Patient Medical Data and Internal AI Assets

gbhackers.com · a month ago

Novo Nordisk, the Danish pharmaceutical giant behind blockbuster weight-loss drugs Ozempic and Wegovy, has confirmed a cybersecurity breach involving unauthorized access to sensitive clinical data and internal artificial intelligence (AI) assets.

Cal Water Investigating Iranian Hackers’ Claims

www.securityweek.com · a month ago

California Water Service says there is no indication of operational disruptions to its water and wastewater systems.

China-linked hackers target US, Canada research using legacy REDCap exploits

www.csoonline.com · a month ago

Google is warning of a cyber espionage campaign linked to a China-nexus threat actor, UNC6508, that kept close tabs on valuable US and Canadian research environments for over a year. The campaign abused REDCap, a widely adopted platform for collecting and managing research data. Attackers, now disrupted, intercepted REDCap’s upgrade process to inject persistence malware.

White House Issues Memo to Bolster NSS Cybersecurity

www.securityweek.com · a month ago

NSPM-12 establishes a clear structure for NSS cybersecurity governance and accountability and reestablishes CNSS.

Survey: 94% of Incidents Involve Anonymized Infrastructure. Teams Are Still Reactive

thehackernews.com · a month ago

Security teams have never had more IP data at their disposal. Every day, analysts ingest enrichment feeds, geolocation data, reputation scores, telemetry, and threat intelligence from a growing ecosystem of vendors and platforms.

Infinite Campus Breach Leaks Personal Information of 137,000 Users

gbhackers.com · a month ago

A data breach affecting the widely used K, 12 student information system, Infinite Campus, has exposed the personal information of approximately 137,000 users. This incident is linked to an extortion campaign that occurred in March 2026 and has been attributed to the ShinyHunters threat group. It was officially recorded on Have I Been Pwned (HIBP).

Flock Cameras Are Being Used for Stalking

www.schneier.com · a month ago

There are over a dozen cases around the country where police officers are using the Flock surveillance camera system to obsessively and illegally stalk people. Alternate link.

Hackers Abuse Compromised WordPress Sites to Deliver GULoader Through EtherHiding Chain

gbhackers.com · a month ago

In April 2026, incident responders traced a sophisticated intrusion that abused compromised WordPress sites to deliver GULoader via an EtherHiding → ClickFix → UNC-chain. The real-world ClickFix incident produced convergent evidence from an ANY.RUN sandbox detonation and live EDR telemetry, revealing a complete, user-initiated attack path from a WordPress mu-plugin backdoor to a blocked rundll32.

Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages

www.securityweek.com · a month ago

Arch Linux suspended account registrations in response to the wave of malicious packages being uploaded to AUR.

CISA warns of another cPanel plugin flaw exploited in attacks

www.bleepingcomputer.com · a month ago

CISA warns U.S. agencies must patch LiteSpeed cPanel plugin for actively exploited CVE-2026-54420 and CVE-2026-48172. These flaws allow root privilege escalation via UNIX symlink, mandating action in three days.