Blahalla

Russia-Aligned Hackers Exploit Old WinRAR Vulnerability to Target Ukrainian Organizations

gbhackers.com · a month ago

CVE-2025-8088 persists as an initial access vector against Ukraine, despite a July 2025 patch. Attackers use RAR5 headers exploiting NTFS Alternate Data Streams for payload deployment without user interaction. Groups SHADOW-EARTH-066 and Earth Dahu steal credentials via compiled-stealer chains.

Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw

thehackernews.com · a month ago

Palo Alto Networks reported observing active exploitation of a PAN-OS vulnerability targeting GlobalProtect portals. The flaw, identified as CVE-2026-0257 and scoring 7.8 on CVSS, allows an authentication bypass. Attackers exploit this weakness affecting the portal and gateway components to gain unauthorized access.

APT37 Hackers Use NarwhalRAT Malware With MS-Themed Phishing and Dead-Drop C2

gbhackers.com · a month ago

APT37 uses NarwhalRAT in an intrusion chain starting with Microsoft-themed spear-phishing and malicious LNK files. The attackers exploit PowerShell abuse and legitimate Windows tooling like curl/tar, blending activity into normal system behavior for stealth. They leverage dead-drop C2 via pCloud and employ persistence methods to increase dwell time while reducing detection visibility.

Critical Wazuh Flaw Enables Threat Actors to Alter Alerts and Remove Logs

gbhackers.com · a month ago

Wazuh Manager v5.0.0-beta1 has an input validation flaw via inventory sync. Exploiting DataValue.index in OpenSearch bulk API lets attackers compromise high-privilege systems, deleting alerts or tampering with forensics.

Threat Actor Malware Platform Exposed Through Unlocked PHP Installer Page

gbhackers.com · a month ago

Malware researchers exploited misconfigured PHP code on an unlocked install page. Gaining admin rights via unprotected installer endpoints, attackers redirected the DB connection. Weak session management allowed ongoing control over the platform. These vulnerabilities relate to CVE-2023-XXXX (assuming one) affecting multiple victim systems.

Maine Shuts Down Breach Reporting Portal Following Fake VRChat and Discord Submissions

gbhackers.com · a month ago

Maine AG closed data breach portal after fake reports citing VRChat/Discord incidents. Malicious actors misused official database to spread disinformation. Office is enhancing verification before reopening.

Criminal IP at Infosecurity Europe 2026: Introducing AITEM, the Next Chapter of Attack Surface Management

gbhackers.com · a month ago

Criminal IP showcased its AITEM framework at Infosecurity Europe 2026, defining the next generation of threat exposure management. This concept advances Continuous Threat Exposure Management beyond basic asset surface discovery. By integrating AI agents, AITEM guides remediation and prioritizes risks, helping security teams bridge the critical gap between mere detection and effective action.

Upcoming Speaking Engagements

www.schneier.com · a month ago

This is a current list of where and when I am scheduled to speak: I’m giving a keynote at Cybernation 2026 in Berlin, Germany, on June 24, 2026. I’m speaking at the Potsdam Conference on National Cybersecurity at the Hasso Plattner Institut in Potsdam, Germany. The event runs June 24, 25, 2026, and my talk will be the evening of June 24.

FBI disrupts massive AI-powered phishing service using a million URLs

www.bleepingcomputer.com · a month ago

FBI, Google, Black Lotus Labs busted Outsider Enterprise, a Chinese phishing service using AI for fake websites/text blasts via AT&T, T-Mobile, Verizon. The network stole data from 3.8M+ credit cards, causing over $1.9B loss.

Readers reply: Experts say we should use passkeys, but can a smartphone pin really be safer than a password?

www.theguardian.com · a month ago

The long-running series in which readers answer other readers’ questions on subjects ranging from trivial flights of fancy to profound scientific and philosophical concepts This week’s question: Is ‘ripen at home’ fruit the supermarkets’ idea of a joke? I’ve been struggling to get my head around the idea that a passkey, which can be a pin on your phone, or facial recognition, can be safer than usi

Merger Cleared, David Ellison to Join Trump at U.F.C. Bout

www.nytimes.com · a month ago

A U.F.C. fight on President Trump’s birthday will now double as a capstone for Paramount’s successful effort to secure Justice Department approval for a mega media merger.

Researcher accidentally gained access to a threat actor-controlled phishing website

potato.id · a month ago

An interesting write-up from https://x.com/unrequitedlyfe describing how an accidental login led to access to a threat actor-controlled phishing website. The blog provides a behind-the-scenes look at phishing infrastructure, operational mistakes made by the actor, backend panels, and infrastructure pivoting opportunities that can assist threat intelligence investigations.

Trump Administration Reignites Its Feud With Anthropic Over Latest A.I. Models

www.nytimes.com · a month ago

The administration imposed surprise restrictions Friday, cutting off foreign nations' access to Anthropic’s latest AI models. The move sparked immediate political debate regarding technological restrictions and international policy.

State Attorneys General Are Investigating OpenAI

www.nytimes.com · a month ago

OpenAI said that a coalition of states had opened an investigation over a wide range of its practices, including its handing of user data, safety of minors and advertising activities.

PromptSnatcher: AdBlocker stealing Ai Chats - 90k installs

malext.io · a month ago

Full write-up: MalExt Sentry - Malicious Browser Extension Tracker Two Chrome extensions presenting as adblockers also intercept every prompt and response on ChatGPT, Claude, Gemini, Copilot, Grok, Perplexity, DeepSeek, and Meta AI, exfiltrating them to operator-controlled servers. They also check whether you're a paid user on 5 of the 8 platforms (ChatGPT, Claude, Perplexity, Copilot, Gemini).

Ex-school district employee jailed for hacks on former employer

www.bleepingcomputer.com · a month ago

Former IT employee Ezekiel Dean Potter conducted cyberattacks against the Saydel Community School District after leaving his position. Prosecutors reported that Potter deleted key accounts across various platforms, including Apple School Manager, disrupting MacBooks and iPads for district employees. These actions impaired classroom operations and led to his sentencing to 21 months in prison.

MeshCentral: From XSS to RCE

www.techanarchy.net · a month ago

The research demonstrated how to utilize a Cross-Site Scripting (XSS) vulnerability within MeshCentral. Researchers combined this flaw with a rogue client setup. This sequence successfully escalates the exploit, culminating in Remote Code Execution (RCE).

NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks

www.securityweek.com · a month ago

By default, npm install will no longer execute scripts from dependencies, unless explicitly allowed.

Chinese hackers hijack auth flow, spy on isolated network for a decade

www.bleepingcomputer.com · a month ago

Chinese hackers took control of a target organization's authentication stack and maintained persistence for 10 years, with full visibility into the administrative activity.

Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication

thehackernews.com · a month ago

Splunk has released security updates to address a critical security flaw in Splunk Enterprise that could be exploited to conduct unauthenticated file operations and even remote code execution. The vulnerability, tracked as CVE-2026-20253, is rated 9.8 on the CVSS scoring system. "In Splunk Enterprise versions below 10.2.4 and 10.0.

US Gov asks Anthropic to ban 'foreign national' access to Fable, Mythos

www.bleepingcomputer.com · a month ago

The US government has ordered Anthropic to block all foreign nationals from accessing Fable 5 and Mythos 5, forcing the company to suspend both models worldwide. Anthropic is complying but disputes the basis, calling the cited jailbreak narrow and the capability widely available elsewhere.

New Agentjacking Attack Hijacks AI Coding Agents to Execute Malicious Code

gbhackers.com · a month ago

A newly disclosed Agentjacking attack class can silently weaponize AI coding agents against the very developers who rely on them, requiring no phishing, no server compromise, and no user interaction beyond a developer’s normal workflow of asking their AI assistant to investigate errors.

Getting the PID from random numbers in PHP

blog.ikaes.de · a month ago

In my blog article I analyze how random numbers in older PHP versions were generated. It turns out you can, under certain circumstances, derive the id of the process which generated a random number! While it has exactly 0 practical application, it was super fun to dig into the php's source code.

Critical Splunk Enterprise Pre-Auth RCE Chain Exposes Databases

gbhackers.com · a month ago

A critical pre-authentication remote code execution (RCE) vulnerability in Splunk Enterprise has been disclosed, carrying a near-perfect CVSS score of 9.8. Tracked as CVE-2026-20253, the flaw was published by Splunk on June 10, 2026, and affects the PostgreSQL Sidecar Service introduced in Splunk version 10.

Anthropic Blocks Fable 5 and Mythos 5 Following U.S. National Security Directive

gbhackers.com · a month ago

Anthropic has disabled all access to its Fable 5 and Mythos 5 artificial intelligence models following a sudden export-control directive from the United States government. Issued at 5:21 PM ET on June 13, 2026, the directive cited pressing national security concerns and strictly prohibited any foreign national from accessing the models.

Malicious 152 Chrome Extensions Caught Spoofing Google Organic Search Traffic

gbhackers.com · a month ago

A massive, coordinated network of 152 malicious Google Chrome browser extensions has been dismantled after researchers caught the operation generating fake organic Google search traffic. Socket’s Threat Research Team discovered the operation spanning 38 separate Chrome Web Store publisher accounts and tracing back to three primary brand backends: tabplugins[.]com, yowgames[.

Malicious 152 Chrome Extensions Caught Spoofing Google Organic Search Traffic

gbhackers.com · a month ago

A massive, coordinated network of 152 malicious Google Chrome browser extensions has been dismantled after researchers caught the operation generating fake organic Google search traffic. Socket’s Threat Research Team discovered the operation spanning 38 separate Chrome Web Store publisher accounts and tracing back to three primary brand backends: tabplugins[.]com, yowgames[.

Anthropic Says It Has Taken Its Latest AI Models Offline to Comply With New Export Controls

www.securityweek.com · a month ago

Anthropic takes Fable 5 and Mythos 5 offline to comply with a directive from the Trump administration to prevent use by foreign nationals.

U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals

thehackernews.com · a month ago

Anthropic said on Friday it will "abruptly disable" its most advanced artificial intelligence (AI) models, Claude Fable 5 and Mythos 5, for all users after the U.S. government ordered it to suspend access to the models for foreign nationals, whether inside or outside the U.S., citing national security concerns. The AI company said it received an order at 5:21 p.m.

Anthropic Blocks Foreign Nationals from Using Its Mythos and Fable A.I.

www.nytimes.com · a month ago

The San Francisco company said on Friday night that the federal government ordered the suspension of the two A.I. systems, citing national security concerns.

Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered

unit42.paloaltonetworks.com · a month ago

Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn more here.

GreatXML zero-day BitLocker bypass doesn’t seem to work, yet

www.csoonline.com · a month ago

A disgruntled researcher who has been publishing zero-day Microsoft Windows vulnerabilities for the past several months released a new exploit Thursday that promises to bypass BitLocker encryption on locked devices. A well respected security expert reported that the exploit doesn’t work as initially described, but the researcher is looking for ways to fix it.

Friday Squid Blogging: Squid-Inspired Fluid Pump

www.schneier.com · a month ago

This fluid pump was inspired by the way squids propel themselves through the water. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

SpaceX’s Unlikely Journey From Far-Out Idea to $2 Trillion Juggernaut

www.nytimes.com · a month ago

Elon Musk said he had initially given SpaceX less than a 10 percent chance of succeeding. His rocket company has come a long way.

ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed

www.darkreading.com · a month ago

A major bug in Oracle's ERP software disproportionately affected American universities, and hackers have capitalized by stealing gobs of data.

New Windows Zero-Day Claims BitLocker Bypass Amid Microsoft Disclosure Fight

www.techrepublic.com · a month ago

A new Windows zero-day reportedly bypasses BitLocker, adding pressure on Microsoft as researchers debate the exploit’s real-world impact.

Maine disables data breach notification portal after fake disclosures

www.bleepingcomputer.com · a month ago

Maine has taken its public data breach reporting portal offline after fraudulent breach disclosures were published on the state's website, prompting a review of procedures to prevent abuse in the future.

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

thehackernews.com · a month ago

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself.

400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer

thehackernews.com · a month ago

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself.

Google Sues Chinese Smishing Network Accused of Using Gemini AI in Phishing

thehackernews.com · a month ago

Google on Friday said it's pursuing legal action against a Chinese cybercrime network, accusing it of using its Gemini artificial intelligence (AI) agent to send phishing text messages targeting Americans. The network is said to be behind the development and management of a phishing-as-a-service (PhaaS) software kit called Outsider, per the tech giant.

What the SpaceX I.P.O. Means for OpenAI and Anthropic

www.nytimes.com · a month ago

Strong investor interest in SpaceX could be good news for the A.I. rivals, which have signaled that they, too, intend to go public this year.

Privacy own-goal: World Cup blunder leaks Lionel Messi’s passport details

www.bitdefender.com · a month ago

Argentina's World Cup squad had their passport numbers leaked before a ball was kicked - not by hackers, but by someone who failed to redact a document properly. document. It's a mistake that has been made many times in the past... Read more in my article on the Hot for Security blog.

phpBB forum fixes auth bypass bug lurking for a decade

www.bleepingcomputer.com · a month ago

A 10-year-old authentication bypass vulnerability discovered in the phpBB forum software allows an attacker to log in as any user, including administrators.

China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade

thehackernews.com · a month ago

Instead of hiding on the laptops and servers defenders watch most closely, a China-nexus group spent close to a decade hidden inside the Linux login system itself. Sygnia, which tracks the group as Velvet Ant, says it backdoored the PAM and OpenSSH components that decide who is allowed to sign in, planting its access where ordinary cleanup could not reach it.

Ukrainian national pleads guilty to role in Conti ransomware operation

www.bleepingcomputer.com · a month ago

A Ukrainian national extradited from Ireland to the United States last year has pleaded guilty to conspiracy charges tied to the Conti ransomware operation.

How Much SpaceX Are You About to Own?

www.nytimes.com · a month ago

If you have index funds, such as in a 401(k), they may soon include shares of the mega company. Here’s a rough calculation.

Over 400 Arch Linux packages compromised to push rootkit, infostealer

www.bleepingcomputer.com · a month ago

More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens.

In Other News: Google Security Layoffs, AudiA6 Takedown, $400 Million Coupang Fine

www.securityweek.com · a month ago

Other noteworthy stories that might have slipped under the radar: ICS device exposure remains flat as attack surface widens, Microsoft issues incident response playbook for AI, IBM and AT&T accused of hack cover-ups.

SpaceX Stock Rises 11% in Largest I.P.O. Ever

www.nytimes.com · a month ago

The stock market debut of Elon Musk’s rocket company paves the way for a wave of mega offerings that are coming from OpenAI and Anthropic.

Warrantless wiretaps cut off for a week following US Congress vote

www.csoonline.com · a month ago

Lawmakers have failed to extend a surveillance law that allows US intelligence agencies to monitor targets abroad without a warrant. Congress rejected a vote to extend Section 702 of the Foreign Intelligence Surveillance Act to July 2, which means, for a few days at least, some surveillance will be put on hold, for the first time since the Act was passed in 2008.