Blahalla

SpaceX Stock Rises 11% in Largest I.P.O. Ever

www.nytimes.com · a month ago

The stock market debut of Elon Musk’s rocket company paves the way for a wave of mega offerings that are coming from OpenAI and Anthropic.

Warrantless wiretaps cut off for a week following US Congress vote

www.csoonline.com · a month ago

Lawmakers have failed to extend a surveillance law that allows US intelligence agencies to monitor targets abroad without a warrant. Congress rejected a vote to extend Section 702 of the Foreign Intelligence Surveillance Act to July 2, which means, for a few days at least, some surveillance will be put on hold, for the first time since the Act was passed in 2008.

Elon Musk Becomes the World’s First Trillionaire

www.nytimes.com · a month ago

With SpaceX shares soaring on their first day of trading, the world’s richest person crossed another milestone, one with 13 digits.

French government’s secure messaging system breached

www.csoonline.com · a month ago

An intruder has breached the French government’s encrypted messaging service, Tchap, showing once again that human error is a weak spot in any security system. Tchap was developed in France as an example of national sovereignty and was designed to be a more secure option than WhatsApp for communication between government employees.

Major AI Clients Shipping With Broken OAuth Implementations (JUNE 2026 UPDATE)

www.redcaller.com · a month ago

The MCP authorization specification (November 2025) mandates OAuth 2.1 with PKCE for remote MCP servers. In practice, this security model is only achievable if MCP clients implement the OAuth refreshtoken grant.

How Security Debt Can Accumulate Faster Than Technical Debt

gbhackers.com · a month ago

Security debt sounds like a tidy metaphor until the first breach turns it into a billing department with teeth. Technical debt behaves like clutter. Code gets ugly, builds slow down, developers complain, and deadlines wobble. Security debt behaves like contagion.

Early Warning Signs of Supply-Chain Attacks Live in the Dark Web

www.bleepingcomputer.com · a month ago

GitHub access sales, leaked repositories, and stolen API keys can all become supply-chain attack footholds. Flare explores how underground forums expose early signals tied to software supply-chain risk.

Claude Fable 5 Doesn't Change the Mythos Security Story

www.darkreading.com · a month ago

Stay cool: Mythos 5 is an upgrade over Mythos Preview while Fable 5 is Mythos "made safe for general use," Anthropic explained.

GRU-Linked APT28 Uses MooBot Botnet and Compromised EdgeRouters for Cyber Operations

gbhackers.com · a month ago

A notable operational pivot by the GRU-linked intrusion set APT28 (aka Fancy Bear, Sofacy, Forest Blizzard, Pawn Storm) that combines the MooBot botnet and compromised EdgeRouters to enable resilient cyber operations.

Industry Reactions to Claude Fable 5: Feedback Friday

www.securityweek.com · a month ago

Industry professionals comment on various aspects of Fable 5, including dual-use capabilities, safeguards, and tiered access.

Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code

thehackernews.com · a month ago

Cybersecurity researchers have described what they say is a new class of attack that can trick artificial intelligence (AI) coding agents into running arbitrary code on developer machines. Called Agentjacking by Tenet Security, the attack can be triggered by means of a fake error report crafted using Sentry, an open-source error-tracking and performance-monitoring platform.

Microsoft fixes Windows update failures linked to WUSA installer

www.bleepingcomputer.com · a month ago

Microsoft has fixed a known issue that caused Windows updates released since May 2025 to fail when installed via the Windows Update Standalone Installer (WUSA) from a network share.

Iranian Cyber Group Handala Claims Cal Water Hack

www.securityweek.com · a month ago

The hackers published 5GB of data, including customer personal information and credentials for the RTKBase platform.

Hackers Abuse NinjaOne RMM Agent to Gain Remote Access to Brazilian Organizations

gbhackers.com · a month ago

An active phishing campaign that weaponizes a legitimate NinjaOne Remote Monitoring and Management (RMM) agent to gain persistent remote access to Brazilian organizations.

Bernie Sanders’ AI Sovereign Wealth Fund Plan

www.schneier.com · a month ago

Let no one accuse Bernie Sanders of ducking the big questions.

‘Hard Fork’ Live, Part 1: Satya Nadella and Cindy Cohn

www.nytimes.com · a month ago

A tech titan, a digital rights defender and two menacing-looking robot dogs took the stage at our second-ever live show.

Rethinking MDR as Attackers and Defenders Embrace AI

thehackernews.com · a month ago

For most of the past decade, managed detection and response was the answer to a real problem. Security teams couldn't staff around the clock, couldn't hire enough analysts, and needed someone else to handle the alert queue. MDR stepped in. It worked well enough. Until now. The threat landscape has changed faster than the MDR model can adapt.

Hackers Use Typosquatted npm Packages to Target Web3 Projects and Crypto Wallet Operators

gbhackers.com · a month ago

Hackers have been using typosquatting npm packages to weaponize the trust Web3 teams place in open-source dependencies, turning routine installs into a path for wallet theft, secret harvesting, and staged malware delivery.

Attackers Can Exploit Microsoft Outlook and Word Flaws to Run Malicious Code

gbhackers.com · a month ago

Microsoft has disclosed a set of critical remote code execution (RCE) vulnerabilities affecting Outlook and Word that could allow attackers to execute arbitrary code on targeted systems. The flaws, tracked as CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635, were released on June 9, 2026, and carry high severity ratings with CVSS scores of 8.4.

Palo Alto PAN-OS Flaw Lets Attackers Run Arbitrary Commands With Root Privileges

gbhackers.com · a month ago

Palo Alto Networks has released patches for three new PAN-OS vulnerabilities that could allow authenticated administrators or users to execute arbitrary commands with root privileges or force firewalls into repeated reboots, raising operational and security concerns for enterprises relying on PA-Series and VM-Series appliances.

Pharma giant Novo Nordisk discloses breach of clinical trials data

www.bleepingcomputer.com · a month ago

Danish pharmaceutical giant Novo Nordisk, the world's largest producer of insulin, disclosed a data breach affecting patient information from some clinical trials.

Prompt injection breaks today’s AI agents, study warns

www.csoonline.com · a month ago

Today’s AI web agents have no dependable defenses against prompt injection, according to new research showing that not a single attack scenario was consistently blocked across leading systems powered by GPT‑5 and Gemini.

LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution

thehackernews.com · a month ago

Cybersecurity researchers have disclosed details of three now-patched security flaws impacting LangGraph, including a critical vulnerability chain that could result in remote code execution. LangGraph is an open-source framework created by LangChain to build complex, stateful, and multi-agent artificial intelligence (AI) agentic applications.

Ivanti Sentry Exploitation Attempts Hitting Honeypots

www.securityweek.com · a month ago

The critical-severity OS command injection vulnerability allows attackers to execute arbitrary code with root privileges.

Chrome 149 Update Patches 28 Vulnerabilities

www.securityweek.com · a month ago

The browser refresh resolved critical and high-severity security defects, including a dozen use-after-free bugs.

Google Sues to Stop Chinese Cybercrime Group from Using Its A.I.

www.nytimes.com · a month ago

In a lawsuit, the tech giant accused the group of using Google’s Gemini system to create hundreds of fake corporate and government websites.

Oracle PeopleSoft zero‑day fuels ShinyHunters extortion spree

www.csoonline.com · a month ago

A newly disclosed Oracle PeopleSoft zero-day became the weapon of choice in a recent ShinyHunters extortion campaign that primarily targeted universities and other educational institutes. Attackers exploited the critical remote code execution (RCE) flaw in PeopleSoft’s Environment Management component that Oracle started warning customers about on June 10, 2026.

OnyxC2 Stealer Uses Cloudflare-Fronted C2 to Exfiltrate Browser Data and Credentials

gbhackers.com · a month ago

A new commercial-grade information stealer, marketed as OnyxC2, surfaced on cybercrime forums in early 2026 and demonstrates how commodity malware is increasingly packaged as a full-service product.

AI is exposing the biggest weakness in cybersecurity: We never built a health model. Until now!

www.csoonline.com · a month ago

For 30 years, cybersecurity has operated like an emergency room. Reactive. Crisis-driven. Always triaging. We are extraordinarily good at it, our detection is faster, our response playbooks are sharper, our incident teams are more capable than they have ever been. When something goes wrong, the modern security organization runs toward the fire with real skill.

INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator

thehackernews.com · a month ago

An INTERPOL-led operation last month resulted in the disruption of Sniper Dz, a decade-long phishing-as-a-service (PhaaS) platform, Group-IB said Thursday. The effort, codenamed Operation Ramz, took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests.

Anthropic Disputes Fable 5 AI Jailbreak

www.securityweek.com · a month ago

An AI hacker claims to have achieved a prompt-based jailbreak shortly after Fable 5’s launch, but Anthropic says it’s not a real jailbreak.

Tchap Messenger Hack Exposes Data of Over 73,000 French Government Employees

gbhackers.com · a month ago

A suspected cyberattack targeting Tchap, the secure messaging platform used by French government agencies, has reportedly exposed sensitive data belonging to more than 73,000 government employees. According to threat intelligence reports shared by the ThreatMon monitoring account, a threat actor claims to have exfiltrated approximately 13.

Hackers Use UAE-India Diplomatic Lure to Deliver SHEETCREEP RAT via Google Sheets

gbhackers.com · a month ago

An active espionage campaign tracked as SHEETCREEP that leverages a UAE‑India diplomatic-themed ISO lure to deliver a compact C remote access trojan (RAT) and uses Google Sheets as its command-and-control (C2) channel. The ISO, named UAE-IndiaStrategicPartnershipWeek.iso, contains a deceptively iconized LNK file that launches a C dropper.

CISA orders feds to patch actively exploited Ivanti flaw by Sunday

www.bleepingcomputer.com · a month ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch an actively exploited Ivanti Sentry flaw within three days, as mandated by the newly issued Binding Operational Directive (BOD) 26-04.

Authorities Seize AudiA6 Crypto Laundering Service Used by Cybercriminal Gangs

gbhackers.com · a month ago

Authorities have dismantled a major cryptocurrency laundering infrastructure known as “AudiA6,” disrupting a critical financial backbone used by ransomware gangs and cybercriminal networks to legitimize illicit proceeds.

‘Harvest now, decipher later’: The quantum threat few are preparing for

www.csoonline.com · a month ago

Quantum technology may feel far off but certain risks are already with us in the form of “harvest now, decrypt later”, an attack vector in which malicious actors steal data now for a future in which they have access to quantum computational tools capable of breaking encryption deployed by most companies today to protect their data.

Microsoft Teams Android Flaw Could Let Attackers Disclose Sensitive Information

gbhackers.com · a month ago

Microsoft has disclosed a high-severity information disclosure vulnerability affecting its Teams application for Android, tracked as CVE-2026-42835. The flaw, publicly released on June 9, 2026, has been assigned a CVSS v3.1 base score of 8.1, categorizing it as an “Important” severity issue.

Over 73,000 French govt employees affected in Tchap messenger breach

www.bleepingcomputer.com · a month ago

The French government revealed that a recent breach of its Tchap encrypted messaging platform affects the accounts of over 73,000 employees in the French public sector.

Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters

www.securityweek.com · a month ago

Oracle has mitigated CVE-2026-35273, but it has not publicly confirmed the vulnerability’s in-the-wild exploitation.

Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs

thehackernews.com · a month ago

Authorities in Europe have disrupted AudiA6, a cryptocurrency laundering service used by ransomware gangs and cybercriminal networks. Europol, in a statement issued Thursday, said the dismantling of AudiA6 cut off a "key financial pipeline used to wash hundreds of millions in illicit profits.

Researcher Uses AI to Hack Google, Earns $500,000 Bug Bounty

gbhackers.com · a month ago

Researcher Arvin Shivram has earned $500,000 in bug bounties from Google’s Vulnerability Reward Program (VRP) by deploying an AI-powered fuzzing framework against Google’s internal API infrastructure, uncovering critical access-control flaws across multiple high-impact services in under 3 months.

Fake Windows and Office Activation Videos Spread Infostealers on TikTok and Instagram

gbhackers.com · a month ago

Short-form video platforms such as TikTok and Instagram Reels have become an increasingly effective vector for distributing infostealers, as threat actors leverage polished tutorial-style clips to trick Windows users into running malicious code.

CISA Orders Federal Agencies to Patch Critical Vulnerabilities Within 3 Days

gbhackers.com · a month ago

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a new Binding Operational Directive, BOD 26-04, mandating that federal civilian agencies remediate critical vulnerabilities within as little as 3 days, significantly tightening patching timelines in response to escalating cyber threats and rapid exploitation cycles.

Solana FakeFix Campaign Plants Malicious npm, PyPI Packages to Steal Dev Secrets

gbhackers.com · a month ago

Recent disclosure of the “Solana FakeFix” campaign exposes a coordinated supply-chain attack that abused package registries to steal developer secrets.

Oracle PeopleSoft Zero-Day RCE Vulnerability Exploited by ShinyHunters

gbhackers.com · a month ago

A newly disclosed zero-day vulnerability in Oracle PeopleSoft is being actively exploited by the ShinyHunters threat group, according to a joint investigation by Mandiant and Google Threat Intelligence Group (GTIG). Tracked as CVE-2026-35273 with a critical CVSS score of 9.8, the flaw affects the Environment Management component and enables unauthenticated remote code execution.

Phishing Attack Volume Down 20%, but Risk Still Rising

www.darkreading.com · a month ago

Hackers are valuing quality over quantity, using AI to upgrade their phishing attacks rather than multiplying them.

Japanese energy firm loses drive with data of 10.9 million clients

www.bleepingcomputer.com · a month ago

Kyushu Electric Power Co., Inc. has disclosed a physical security incident that affects private data of more than 10 million customers.

Maine breach portal abused to publish fake data breach disclosures

www.bleepingcomputer.com · a month ago

In an unusual misinformation campaign, fraudulent data breach disclosures were submitted to Maine's official breach portal and publicly posted before their legitimacy could be verified, prompting companies to deny the claims.

SpaceX IPO: How Our Reporters Assess the Sky-High Valuation and Potential Economic Impact

www.nytimes.com · a month ago

Two Times tech reporters and their editor talk about assessing the sky-high valuation of the rocket and satellite maker, the potential economic impact of its public debut and the role of the world’s richest man in it all.

SpaceX Finalizes IPO Price at $135 a Share in World’s Largest Public Offering

www.nytimes.com · a month ago

Elon Musk’s rocket company said it would sell more than 555 million shares at $135 each in its blockbuster initial public offering, which is set to begin trading on Friday.