Blahalla

CISA: Critical VMware RCE flaw now exploited by ransomware gangs

www.bleepingcomputer.com · a month ago

CISA warned that ransomware gangs exploit the critical VMware vCenter vulnerability, CVE-2026-59310, which was patched in July. Groups continue targeting other flaws, including CVE-2024-37079 and CVE-2026-22719, due to the risk they pose to network access. The agency previously flagged multiple high-risk flaws, including CVE-2025-22225, CVE-2025-60710, and CVE-2026-22719.

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

gbhackers.com · a month ago

Bad groups actively exploit CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin, enabling unauthenticated upload of malicious PHP files and full site control. The vulnerability affects plugin versions 2.0.3.1 and earlier, granting remote code execution via a flawed AJAX upload handler. Users must update immediately to version 2.0.3.2, which patches this critical flaw.

Getting into EMFI for 30€ thanks to globalization

www.errno.fr · a month ago

Low-budget EMFI hardware attacks are rising. Users should upgrade tools like FaultyCat and PicoEMP. Effective EM injection demands designers optimize coil geometry, core material, and turns.

Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

thehackernews.com · a month ago

New findings from Sysdig show that skilled human operators remain swift threats, even as AI accelerates the vulnerability-to-exploitation window. The cloud security company documented an instance where an individual pivoted from a vulnerable Marimo notebook to gain access via SSH. This research highlights that the human element poses a risk following initial system access.

240,000 Hit by Data Breach at Japan’s Digital Agency

www.securityweek.com · a month ago

Hackers exploited a vulnerability in a VPN product to breach Japan's Digital Agency network through a maintenance employee's account. The incident compromised data for roughly 240,000 individuals, exposing names, email addresses, and phone numbers. The agency blocked external access and suspended the account but did not name the vulnerable VPN product.

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week

gbhackers.com · a month ago

Microsoft patched a record 973 CVEs, including two exploited zero-days. Malicious groups used Claude AI agents to automate attacks, compromising 440 PaperCut servers. Additionally, China-linked hackers chained a Chrome zero-day with a Windows kernel flaw, while critical Cisco FMC flaws saw active exploitation.

Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point

thehackernews.com · a month ago

Security teams validate controls like EDR agents and SIEM rules against specific payloads. Attackers increasingly utilize continuous, multi-stage attack chains, moving beyond simple attack surfaces. Organizations must continuously test defenses to counter these complex, evolving threats.

WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites

gbhackers.com · a month ago

Wordfence disclosed two critical, unauthenticated flaws in The Events Calendar (v<=6.17.4): CVE-2026-78006 (RCE via PHP Object Injection) and CVE-2026-78159 (RCE via block markup). These flaws allow full website compromise.

Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit

gbhackers.com · a month ago

Red Heron exploited CVE-2026-60004, a critical RCE vulnerability in Gitea versions 1.17 through 1.27.0. Exploiting the flaw in Gitea's diffpatch workflow, Red Heron stole source code, harvested credentials, and established persistent access. Researchers linked this operation to a Linux implant called JITTERLY, documenting attacks across multiple countries in sectors like defense and energy.

Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers

thehackernews.com · a month ago

Cybersecurity researchers disclosed a mass-scanning campaign targeting internet-exposed Vite development servers. This automated effort aims to steal sensitive cloud credentials, configurations, and infrastructure state files. F5 Labs reports the campaign targets Amazon Web Services and Microsoft Azure instances.

Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases

www.securityweek.com · a month ago

Apple patched over 200 flaws in iOS 27/macOS Golden Gate 27. Fixes address kernel flaws, including CVE-2026-64752 (CoreMedia memory corruption) and CVE-2022-3437 (Samba buffer overflow), securing 90+ components. Updates protect Apple's mobile and desktop systems.

25 Years of Mass Surveillance Is Enough

www.schneier.com · a month ago

Post-9/11, surveillance expanded from targeted taps to mass collection of internet/phone metadata. Agencies combine private data broker purchases with tools like facial recognition for law enforcement, expanding monitoring beyond national security.

On the NSA’s Supercomputer from the 1960s

www.schneier.com · a month ago

Harvest, a specialized code-breaking computer, represents a piece of intelligence history. IBM built this complex machine for the NSA during the 1960s. Researchers examine this unique hardware to understand early cryptanalysis methods.

Telegram Desktop XSS Vulnerability Lets Attackers Steal Entire Chat Histories

gbhackers.com · a month ago

Stored XSS vulnerability found in Telegram Desktop's HTML chat export. Attackers could embed malicious code via inline buttons, stealing chat history when a victim opened the file in a browser. Affected builds pre-Beta 6.9.4 and Stable 7.0.1. Telegram patched the issue.

Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds

gbhackers.com · a month ago

The Sysdig Threat Research Team identified CVE-2026-39987, a pre-authentication RCE flaw in marimo versions up to 0.20.4. This vulnerability allows attackers to harvest AWS credentials and retrieve private keys from AWS Secrets Manager. Researchers observed exploitation of this flaw to authenticate to a bastion host, demonstrating severe system compromise.

DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory

gbhackers.com · a month ago

DDRop is a hardware attack exploiting DDR5 memory traffic to undermine Intel TDX. Physical access and an interposer force "write dropping," allowing attackers to expose private memory plaintext by tricking the processor with stale, encrypted data.

Suspected Black Axe gang leaders face cybercrime charges in the US

www.bleepingcomputer.com · a month ago

Five leaders of the Black Axe syndicate, including Perry and Franklyn Osagiede, were extradited to the US on wire fraud/money laundering charges. They allegedly ran romance/advance fee scams from Cape Town (2011-2021) targeting US victims with aliases, VoIP, and photo threats.

Former AT&T store worker jailed after moonlighting as a SIM-swap gang’s inside man

www.bitdefender.com · a month ago

Kenneth Carter, a former AT&T employee, faced a 16-month sentence for participating in a SIM swap gang. He used his retail access to hijack victims' phone numbers between 2018 and 2019. Co-conspirators successfully drained accounts totaling $593,963.77, despite bank fraud checks thwarting multiple transfer attempts.

Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints

www.securityweek.com · a month ago

Microsoft AI published a "Humanist AI Code of Conduct" for MAI Models, establishing absolute constraints on offensive cyber capabilities. The rules forbid models from generating working exploit code, attack tooling, or operational guidance that could improve a cyberattack. Nevertheless, models can assist with authorized defensive work, including vulnerability discovery and malware analysis.

AI companies buoyed the U.S. economy. What happens if they slow down?

www.washingtonpost.com · a month ago

Tech executives calling for slower AI development risk hobbling U.S. economic growth, according to the president. These warnings force investors to grapple with a question: Should they slow the technology to avoid catastrophe? The debate centers on balancing perceived dangers against potential economic benefits.

Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack

www.securityweek.com · a month ago

Hackers compromised HBO Max's Reddit account for malvertising (PasteSwitch). The attack tricked macOS/Windows users into clicking links to a fake HBO Max site, running commands to deploy MacSync and Amatera Stealer, stealing credentials and crypto.

Alex Bores Wants Democrats to Make AI Safety a 2028 Election Issue

www.nytimes.com · a month ago

Former candidate Alex Bores lost a congressional primary contest focused on AI regulation. He now aims to position himself at the core of the national conversation by emphasizing AI policy ahead of the next presidential election.

AI is exposing a security structure built for yesterday’s threats

www.csoonline.com · a month ago

AI-powered deepfakes and social engineering threats are rendering traditional, siloed security models obsolete. These attacks now integrate risks across digital, physical, and operational environments. To counter transnational adversaries, organizations must build unified, cross-functional verification pipelines bridging HR, physical security, and IT provisioning.

Microsoft confirms KB5002914 Excel update breaks copy and paste

www.bleepingcomputer.com · a month ago

Microsoft's KB5002914 (Sept 2026) breaks Excel copy/paste, autofill, etc., in Excel 2016, 2019, 2021, 2024. Users must uninstall the update via command prompt to fix it.

Passwd Enterprise Review: Features, Pricing & Security

www.techrepublic.com · a month ago

Review Passwd Enterprise pricing, security, Google Workspace integration, and private Google Cloud deployment to see if it fits your organization.

Threat actors are coming for your AI assets to operationalize their use of AI

www.csoonline.com · a month ago

State/cybercrime groups target proprietary AI assets via model distillation. US NSA, FBI, CISA condemned China-based labs for industrial-scale distillation attacks against U.S. models.

Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges

gbhackers.com · a month ago

NebuSec disclosed CVE-2026-43502, a local privilege escalation in Linux kernel RDS. Unprivileged local attackers can achieve root via this flaw, affecting kernels since 4.17. Other CVEs include CVE-2026-23274, CVE-2026-31659, CVE-2026-31678, CVE-2026-43042, CVE-2026-43074, and CVE-2026-43501.

Microsoft Offers $60,000 Bounty for Critical Cross-Tenant Vulnerabilities

gbhackers.com · a month ago

Microsoft expanded its security research incentives for Dynamics 365 and Power Platform, offering bounties up to $60,000 for qualifying vulnerabilities. The program prioritizes critical cross-tenant flaws, which risk compromising isolation between customer environments. High multipliers also reward findings involving Dataverse or critical AI inference manipulation.

Hackers Deploy Agentic AI to Automate Exploitation and Mass Credential Harvesting

gbhackers.com · a month ago

GTIG documented a financially motivated actor that used a multi-agent framework to execute mass credential harvesting in under six hours. The system automated tasks like vulnerability scanning, credential harvesting, and IP-address rotation after gaining access to a cloud environment. GTIG warns that this model accelerates breaches by leveraging weak cloud identities and exposed secrets.

Cisco patches Secure Email Gateway zero-day exploited in attacks

www.bleepingcomputer.com · a month ago

Cisco warned about CVE-2026-76461, a flaw in Secure Email Gateway allowing remote attackers to execute root commands via crafted SQL. CISA added this critical vulnerability to its KEV Catalog, urging federal agencies to patch systems by September 17. Cisco also fixed several other issues, including CVE-2025-20393, CVE-2026-76440, CVE-2026-76441, CVE-2026-76443, CVE-2026-353, and CVE-2026-20079.

LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server

thehackernews.com · a month ago

cPanel warned on September 14 about a critical vulnerability in LiteSpeed Web Server Enterprise. This flaw allows a low-privilege website user to gain root access on a shared-hosting server. Attackers could exploit this vulnerability to access or alter data belonging to other sites and the server itself.

UANIA OS: Authenticated Remote Code Execution

rainpwn.blog · a month ago

Researchers documented an authenticated Remote Code Execution (RCE) vulnerability in UaniaOS versions 2.1 through 3.0.0. The flaw exists within the Packet Capture feature, which executes tcpdump using user-supplied input. Exploiting this vulnerability could allow an attacker to gain root access; the vendor fixed the issue in UaniaOS 3.0.1.

12 Best CNAPP Platforms Compared (2026): Features & Pricing

gbhackers.com · a month ago

CNAPP platform quotes vary widely, causing price swings (2-3x) because vendors use different calculation methods. Microsoft Defender for Cloud offers transparent per-resource rates, while competitors like Wiz and Orca charge based on defined workloads. This guide compares 12 vendors, detailing these unique pricing models and offering a buyer's negotiation playbook.

12 Best CWPP Solutions Compared (2026): Features & Pricing

gbhackers.com · a month ago

The comparison analyzes top CWPP solutions, noting that Sysdig excels in container and Kubernetes runtime depth using Falco. Prisma Cloud provides the broadest workload coverage, expanding into serverless environments. Additionally, Wiz and CrowdStrike facilitate superior platform correlation, while Illumio specializes in microsegmentation.

12 Best CWPP Solutions Compared (2026): Features & Pricing

gbhackers.com · a month ago

The guide compares 12 Cloud Workload Protection Platform (CWPP) solutions, highlighting vendor strengths for 2026. Sysdig leads container and Kubernetes runtime depth, while Prisma Cloud provides the broadest workload coverage, including serverless environments. Buyers must balance agentless scanning for comprehensive coverage against runtime agents for real-time prevention and defense.

11 Best CSPM Tools Compared (2026): Features & Pricing

gbhackers.com · a month ago

CSPM detects cloud misconfigs, top breach cause. CNAPPs unify workloads/identities for attack paths. Wiz leads agentless attack-path CSPM, while Orca pioneers agentless SideScanning.

12 Best Enterprise Browsers Compared (2026): Features & Pricing

gbhackers.com · a month ago

Browser security is key for unmanaged endpoints and DLP. Models include secure browsers (Palo Alto Talon), security layers for Chrome/Edge, or extensions. These secure BYOD/contractor access via presentation layer policies.

12 Best Browser Isolation Solutions Compared (2026): Features & Pricing

gbhackers.com · a month ago

RBI neutralizes zero-days via disposable rendering. Solutions use pixel streaming/DOM reconstruction. Zscaler integrates RBI in its SWG; Cloudflare and Menlo Security offer specialized isolation.

Nintendo Switch QR Code Vulnerability Lets Nearby Attackers Execute Unauthorized Code

gbhackers.com · a month ago

Nintendo released system version 23.0.0 to address CVE-2026-82079, a vulnerability in the Switch’s local wireless networking. This flaw stems from a stack-based buffer overflow, potentially allowing nearby attackers to execute unauthorized code or access locally stored data. Owners must patch their consoles promptly and avoid QR-based sharing until the update is complete.

EchelonGraph

echelongraph.io · a month ago

EchelonGraph tracks 373,518 active CVEs, utilizing a proprietary EG score that synthesizes data from multiple sources including NVD, CISA KEV, and FIRST EPSS. This scoring model provides enhanced risk ranking beyond standard CVSS. Researchers monitor specific vulnerabilities, such as CVE-2026-91004, CVE-2026-16592, and CVE-2026-18232, offering real-time threat intelligence.

Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution

thehackernews.com · a month ago

Cisco warns that a critical vulnerability, CVE-2026-76461, affects AsyncOS Software for Cisco Secure Email Gateway. This flaw, carrying a CVSS score of 9.8, allows unauthenticated, remote attackers to exploit insufficient validation in the email parsing logic.

Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

gbhackers.com · a month ago

Attackers use VSS via vssadmin.exe to delete shadow copies (T1490) and extract NT hashes from SAM databases. This facilitates ransomware deployment and credential theft.

UK Government Enables Passkey Login for 23 Million Users to Fight Phishing Attacks

gbhackers.com · a month ago

The UK government implemented passkey authentication for GOV.UK One Login, securing access for over 23 million users. This initiative replaces vulnerable passwords and SMS codes, providing a faster, more secure login mechanism for public services like tax and pension checks. Passkeys use device-bound biometrics, offering cryptographic resistance that directly combats phishing and credential theft.

Mass Scanning Targets Exposed Vite Servers to Steal AWS Keys and Azure Tokens

gbhackers.com · a month ago

Aug 2026 attackers hit Vite servers, using CVE-2026-39364 (unauthenticated file-read) to steal cloud creds. They also exploited CVE-2024-45811, CVE-2025-30208, and CVE-2025-31125. Several victims faced credential theft.

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

thehackernews.com · a month ago

A Chinese group executed a spear-phishing campaign, exploiting patched flaws in Google Chrome and Microsoft Windows. The attack delivered a malicious JavaScript backdoor called GRIMWEDGE. Volexity tracks the group under the moniker UTA0560, noting the activity targeted multiple non-governmental organizations on September 1, 2026.

HBO Max Reddit Account Hijacked to Spread PasteSwitch ClickFix Malware

gbhackers.com · a month ago

Hackers hijacked HBO Max Reddit (u/hbomax) for 48 hrs, running PasteSwitch. They distributed 108 malicious ads infecting macOS/Windows with info stealers/crypto clippers, often via simulated Terminal overlays.

Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor

gbhackers.com · a month ago

CVE-2024-21762, an out-of-bounds write in FortiOS SSL-VPN, breached 3BB. Attackers used it for unauthenticated RCE, deploying MeshCentral agents. Researchers found evidence of the breach.

Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation

www.securityweek.com · a month ago

Cisco reported unauthenticated root exploits for CVE-2026-76461 in Secure Email Gateway due to email parsing flaws. CISA added this to KEV. CVE-2025-20393 and CVE-2026-20079, CVE-2026-20316 are also actively exploited. Users must apply patches immediately.

Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as Root

gbhackers.com · a month ago

Cisco released updates addressing CVE-2026-76461, a critical SQL injection vulnerability in the Secure Email Gateway. Exploiting this flaw grants remote, unauthenticated attackers root-level command execution by sending specially crafted emails. Administrators must upgrade affected AsyncOS instances immediately, with Cisco recommending versions like 16.5.0-780.

A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove

www.csoonline.com · a month ago

Yet another security vulnerability has been discovered in GitLab infrastructure, this one a perfect 10 in severity. CVE-2026-85706, the second flaw GitLab has disclosed in just a month, is a maximum-severity vulnerability that allows attackers to read arbitrary files in a single HTTP request.