Blahalla

White House Issues Memo to Bolster NSS Cybersecurity

www.securityweek.com · a month ago

NSPM-12 establishes a clear structure for NSS cybersecurity governance and accountability and reestablishes CNSS.

Survey: 94% of Incidents Involve Anonymized Infrastructure. Teams Are Still Reactive

thehackernews.com · a month ago

Security teams have never had more IP data at their disposal. Every day, analysts ingest enrichment feeds, geolocation data, reputation scores, telemetry, and threat intelligence from a growing ecosystem of vendors and platforms.

Infinite Campus Breach Leaks Personal Information of 137,000 Users

gbhackers.com · a month ago

A data breach affecting the widely used K, 12 student information system, Infinite Campus, has exposed the personal information of approximately 137,000 users. This incident is linked to an extortion campaign that occurred in March 2026 and has been attributed to the ShinyHunters threat group. It was officially recorded on Have I Been Pwned (HIBP).

Flock Cameras Are Being Used for Stalking

www.schneier.com · a month ago

There are over a dozen cases around the country where police officers are using the Flock surveillance camera system to obsessively and illegally stalk people. Alternate link.

Hackers Abuse Compromised WordPress Sites to Deliver GULoader Through EtherHiding Chain

gbhackers.com · a month ago

In April 2026, incident responders traced a sophisticated intrusion that abused compromised WordPress sites to deliver GULoader via an EtherHiding → ClickFix → UNC-chain. The real-world ClickFix incident produced convergent evidence from an ANY.RUN sandbox detonation and live EDR telemetry, revealing a complete, user-initiated attack path from a WordPress mu-plugin backdoor to a blocked rundll32.

Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages

www.securityweek.com · a month ago

Arch Linux suspended account registrations in response to the wave of malicious packages being uploaded to AUR.

CISA warns of another cPanel plugin flaw exploited in attacks

www.bleepingcomputer.com · a month ago

CISA warns U.S. agencies must patch LiteSpeed cPanel plugin for actively exploited CVE-2026-54420 and CVE-2026-48172. These flaws allow root privilege escalation via UNIX symlink, mandating action in three days.

Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week

thehackernews.com · a month ago

Threat intelligence firm Defused Cyber warned that bad actors exploited multiple vulnerabilities in Fortinet FortiSandbox over 24 hours. The company observed the exploitation of CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089. Notably, CVE-2026-39813 involves a path traversal vulnerability within the FortiSandbox JRPC API, carrying a CVSS score of 9.1.

Cybersecurity Executives Urge the Trump Administration to Ease Restrictions on Anthropic AI Models

www.securityweek.com · a month ago

Experts urged lifting Trump's export controls on Anthropic's Mythos 5 and Fable 5 AI models. Restrictions forced Anthropic offline due to compliance fears, weakening US cyber defense vs. China.

Ransomware gang abuses Microsoft Teams relays to hide malicious traffic

www.bleepingcomputer.com · a month ago

DragonForce used 'Backdoor.Turn' RAT via Teams/TURN to hide C2 traffic after exploiting SQL/MSSQL flaws. They gained kernel privileges using BYOVD, leveraging CVE-2023-52271, CVE-2025-61155, and CVE-2025-1055 in a December 2025 campaign.

Ghostwriter APT Uses Fake Gmail Login Panels to Steal Passwords and 2FA Codes

gbhackers.com · a month ago

CERT Polska warns Ghostwriter (UNC1151) escalated phishing using fake Gmail logins to harvest passwords/MFA codes. Since March 2026, they targeted Gmail users with professional Polish messages leading to counterfeit sites capturing one-time codes.

Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE

unit42.paloaltonetworks.com · a month ago

Unit 42 discovered a critical flaw in the Google Cloud Vertex AI Python SDK allowing Remote Code Execution (RCE) via bucket squatting. Exploiting this weakness, an attacker can predict and hijack model uploads by precreating necessary buckets linked to a victim's project ID. Developers must upgrade from vulnerable versions 1.139.0 and 1.140.0 to the fixed version v1.148.0.

Cisco patches SD-WAN flaw amid evidence of active exploitation

www.csoonline.com · a month ago

Cisco patched CVE-2026-20262 in Catalyst SD-WAN Manager. An authenticated attacker with write access can exploit file validation issues to gain root and overwrite system files, risking network control.

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

thehackernews.com · a month ago

ESET reported finding two undocumented Windows variants of the backdoor SprySOCKS, which was previously thought to target Linux systems. Cybersecurity researchers identified these new versions, named WINDRV and WINPLUS. Both variants support communication using TCP and UDP protocols and include a hard-coded command-and-control configuration.

Tech Coalition ‘Athena’ Targets OSS Vulnerabilities Ahead of Disclosure

www.securityweek.com · a month ago

A coalition named Athena formed over two dozen technology organizations, including Cloudflare and BNY, to proactively secure open-source software (OSS). Members use a shared platform to triage and fix vulnerabilities before security patches can be publicly disclosed. By pooling findings and deploying virtual patches across multiple layers, Athena mitigates risks accelerated by AI exploitation.

Hackers Abuse Microsoft OAuth Device Code Flow to Take Over Microsoft 365 Accounts

gbhackers.com · a month ago

Exploit targeting Microsoft's OAuth 2.0 Device Authorization Grant flow seizes control of Microsoft 365 accounts. Instead of stealing credentials, attackers guide victims through a legitimate Microsoft login process, authorizing an attacker-controlled device. The campaign uses deceptive email lures and specialized landing pages to harvest the necessary device code for account takeover.

Critical Fortinet FortiSandbox flaws now exploited in attacks

www.bleepingcomputer.com · a month ago

Defused warned of unauthenticated RCE in FortiSandbox via CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089. Risks include CVE-2025-61624, CVE-2026-21643, and CVE-2026-26083. Users must update immediately.

A.I. Boom Ignites Asian Chip Companies

www.nytimes.com · a month ago

AI demand drives massive spending on essential data center hardware, creating a global semiconductor boom. Memory chips are supplied overwhelmingly by South Korea and Taiwan, making these nations crucial to high-end AI supercomputers. This concentration of manufacturing ability shifts technological power, establishing Asian firms as central pillars in the global infrastructure map.

Zero trust isn’t broken. Most companies just do it wrong.

www.csoonline.com · a month ago

Zero Trust replaced perimeter security with a "never trust, always verify" approach, originally defined by Forrester analyst John Kindervag. Implementing the concept proves difficult, as Accenture reported 88% of organizations struggle with its adoption. Experts caution that Zero Trust is a necessary mindset and strategy, not a product that vendors can simply sell.

Windows version of SprySOCKS Linux malware used to attack govt orgs

www.bleepingcomputer.com · a month ago

ESET researchers traced SprySOCKS malware variants used by the Earth Lusca group against government organizations in at least four countries since 2023. The Windows variant, WINDRV, offers kernel-level stealth and can intercept traffic without exposing the backdoor's true listening port. Additionally, telemetry data suggests potential exploitation of CVE-2023-24932, a Secure Boot flaw.

OptinMonster Plugin Vulnerability Exposes 1.2 Million WordPress Sites to Cyberattacks

gbhackers.com · a month ago

Supply chain attack on OptinMonster, TrustPulse, PushEngage plugins exposed 1.2M WordPress sites. Attackers injected JS to create admin accounts and a backdoor for RCE via unauthenticated access. Active exploitation was confirmed.

Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware

thehackernews.com · a month ago

North Korean group ScarCruft, also known as APT37, utilized spear-phishing messages in a recent attack. These emails impersonated Microsoft Account security notifications to deploy NarwhalRAT malware. Genians Security Center observed this tactic aimed at generating concern among victims regarding their accounts.

Rhysida and Interlock Ransomware Groups Linked to Initial Access Brokers and Crypter Ecosystem

gbhackers.com · a month ago

IBM X-Force analyzed Rhysida and Interlock ransomware groups, finding their link extends beyond simple code reuse. The research ties both operations into a supply chain involving initial access brokers and downloaders. Together, these actors utilize private crypters and backdoors to stage intrusion chains before encrypting victim data.

iRhythm discloses data breach, says hackers stole patient info

www.bleepingcomputer.com · a month ago

iRhythm disclosed a data breach: hackers stole patient personal/health info from third-party apps via social engineering. Ransom demands followed exfiltration of sensitive records. The breach avoided clinical devices or financial accounts.

Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks

www.securityweek.com · a month ago

Cisco alerts on CVE-2026-20262 (arbitrary file write) in Catalyst SD-WAN Manager. Attackers use crafted HTTP requests for root privilege escalation. CISA added this and 7 other CVEs, including CVE-2026-20182, to its KEV catalog.

Russian and Chinese Actors Use AI Translation and Visual Content in Malign Influence Operations

gbhackers.com · a month ago

Analysis of inauthentic accounts on X shows foreign actors use AI to improve content quality and believability rather than generating sheer volume. Researchers found that posting frequency dropped between 2024 and 2026, indicating a focus on subtle refinement. Pro-Russia accounts quadrupled original image posts using AI generation, while linguistic reach expanded from two languages to six by 2026.

Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw

thehackernews.com · a month ago

Cisco released security updates for a medium-severity flaw in its Catalyst SD-WAN Manager web UI, formerly known as SD-WAN vManage. The vulnerability, designated CVE-2026-20262 with a CVSS score of 6.5/10.0, allows authenticated remote attackers to create files. Cisco urges users to apply patches immediately due to active exploitation in the wild.

CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation

thehackernews.com · a month ago

CISA added a security flaw impacting LiteSpeed cPanel Plugin to its Known Exploited Vulnerabilities catalog. The vulnerability, identified as CVE-2026-54420 and scoring 8.5 on CVSS, allows privilege escalation. Federal Civilian Executive Branch agencies must apply the necessary fixes by June 18, 2026.

The Gentlemen RaaS Scales to 166 Victims as Ransomware Groups Compete for Affiliates

gbhackers.com · a month ago

Two new Ransomware-as-a-Service entrants signaled the ransomware market's rapid reconsolidation. The actor hyflock123 launched Hyflock, claiming experience with LockBit and Qilin to draw affiliates. Meanwhile, founder hastalamuerte rapidly scaled The Gentlemen RaaS group, offering affiliates a 90% revenue share and jumping from 40 to 166 victims in one quarter.

PRC-Nexus Hackers Abuse REDCap Servers to Monitor US Medical Research Organizations

gbhackers.com · a month ago

PRC-nexus UNC6508 hit NA academic/medical sites from Sept 2023 via REDCap downgrade attacks. They used INFINITERED, an implant, to steal credentials and keep persistent access.

Hackers Use The Quarry PhaaS Ecosystem to Target U.S. Victims With IRS Phishing

gbhackers.com · a month ago

RockyBelling's Quarry PhaaS/MaaS lets global affiliates run IRS/SSA phishing against US victims using Adspect cloaking and telemetry. Payloads evade detection via legitimate RMM tools like ScreenConnect MSI or EXE for persistent access.

Microsoft Website Displays Security Warning After Certificate Expiry

gbhackers.com · a month ago

Microsoft’s connectivity testing domain, connectivity.office.com, triggered widespread browser security warnings after its TLS certificate expired. The failure involved the Azure RSA TLS Issuing CA 07, highlighting a lapse in vendor certificate lifecycle management practices. This expiry poses a risk of disrupting automated enterprise health checks that validate access to Microsoft 365 services.

Microsoft 365 Copilot Vulnerability Exposes Sensitive Data Through One-Click Attack

gbhackers.com · a month ago

Varonis found SearchLeak in M365 Copilot, a critical one-click vulnerability. It uses Parameter-to-Prompt injection, HTML race conditions, and SSRF to steal data like MFA codes from SharePoint/OneDrive with low privileges. The flaw allows unauthorized data exfiltration.

How Anthropic lost the White House’s trust — and then its flagship product

www.washingtonpost.com · a month ago

Trump admin weighed sanctions on Anthropic due to Mythos AI's suspected ties to China. Officials ordered the model offline citing tech safeguard failures and a security vulnerability alert. The government is using national security controls on US AI dev.

Inside the Modern SOC: The 72-Minute Race

unit42.paloaltonetworks.com · a month ago

Attackers can move from access to exfiltration in 72 minutes. Learn how modern SOC teams close the speed gap with Unit 42's AI-driven automation, threat hunting, MDR and Managed XSIAM.

DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act

www.bleepingcomputer.com · a month ago

The U.S. Department of Justice announced Friday that it has seized the CFAKE.com and SOCFAKE.com websites, which allegedly hosted nonconsensual AI-generated nude images and videos of women, in what appears to be the first publicly announced domain seizure under the TAKE IT DOWN Act.

Nintendo Alleged Data Breach: Threat Actor Demands $2M Ransom

www.techrepublic.com · a month ago

ShadowByte claims stealing 10 years of Nintendo's data, including HR/employee info. They demand $2M ransom to prevent release. This shows vendor risk in handling sensitive corporate data.

SimpleHelp bug lets hackers create rogue remote support accounts

www.bleepingcomputer.com · a month ago

A flaw in SimpleHelp's OpenID Connect authentication protocol, tracked as CVE-2026-48558, permits unauthenticated attackers to create privileged technician accounts. Attackers exploit the vulnerability to log in as new technicians without bypassing multi-factor authentication. Organizations must update to versions 5.5.16 or 6.0RC2 and consider restricting login sources using IP allowlists.

What we found instrumenting AI coding agents in production for two weeks (post-mortem)

atensecurity.com · a month ago

AI agents create governance gaps due to logging gaps in tool calls. Aten Security's 14-day pilot used Thoth for telemetry fingerprinting. It achieved full context capture and simulated policy triggers, showing high dev overhead with mutable agent schemas.

Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails

thehackernews.com · a month ago

A China-linked espionage group hid inside North American medical, academic, and military research networks for more than a year, quietly stealing sensitive research and defense email. The way in was a backdoor on their REDCap research servers that stole login credentials.

North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels

thehackernews.com · a month ago

Cybersecurity researchers flagged two malicious cyber campaigns linked to a North Korean cluster named Contagious Interview, also known as Famous Chollima. Proofpoint reported that this operation orchestrates phishing emails themed around developer recruitment or code reviews. These campaign activities mimic previous operations within the persistent threat group.

HTTP/2 Bomb Attacks Put Telcos, Healthcare Orgs at Risk

www.darkreading.com · a month ago

The denial-of-service (DoS) exploit takes advantage of two features in HTTP/2 that were designed to save Internet bandwith, not power massive amplification attacks.

Copilot 'SearchLeak' Attack Allows 1-Click Data Theft

www.darkreading.com · a month ago

The critical, three-stage attack is now patched, but it's part of a new group of AI prompt-injection issues that use hidden URLs and other variables.

OptinMonster WordPress plugin hacked in CDN supply-chain attack

www.bleepingcomputer.com · a month ago

WordPress plugins OptinMonster, TrustPulse, and PushEngage have been compromised in a supply-chain attack impacting Awesome Motive-s content distribution network (CDN).

Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks

www.bleepingcomputer.com · a month ago

Cisco has released security updates to address a vulnerability in the Catalyst SD-WAN Manager, tracked as CVE-2026-20262, that was exploited in attacks to escalate to root privileges.

China-Nexus Actor Spied on US Researchers Undetected for a Year

www.darkreading.com · a month ago

Google discovered and disrupted the sprawling campaign, which stole RedCAP credentials to target numerous institutions and exfiltrate sensitive data.

Most CISOs Report Pressure to Bury Bad Security News

www.darkreading.com · a month ago

Checkmarx surveyed 2,350 pros; 95% of CISOs delay reporting security findings due to pressure from product/boards balancing transparency with business goals.

LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers

thehackernews.com · a month ago

A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, researchers at Obsidian Security disclosed LiteLLM is a widely deployed open-source AI gateway that brokers calls to more than 100 model providers behind one OpenAI-compatible interface.

Council of Europe investigates ShinyHunters data breach claims

www.bleepingcomputer.com · a month ago

The Council of Europe, the continent's oldest intergovernmental body, is probing claims of a data breach made by the ShinyHunters extortion group over the weekend.

Microsoft Defender email security benchmarking: Key insights from one year of data

www.microsoft.com · a month ago

See how Microsoft Defender performed in one year of real-world email security benchmarking against SEG and ICES vendors.