Blahalla

ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities

thehackernews.com · a month ago

The ShinyHunters extortion crew exploited an unpatched flaw in Oracle PeopleSoft to break into enterprise systems, steal data, and demand payment to keep it private. The campaign hit universities hardest. Google's Mandiant attributes it to the group it tracks as UNC6240, and dates the activity between May 27 and June 9.

Oracle mitigates PeopleSoft zero-day exploited in data theft attacks

www.bleepingcomputer.com · a month ago

Oracle is warning about a critical PeopleSoft Suite zero-day vulnerability tracked as CVE-2026-35273 that allows unauthenticated remote code execution, with the flaw actively exploited in ShinyHunter data theft attacks.

Max-Severity Ivanti Flaw Exploited 24 Hours After Disclosure

www.darkreading.com · a month ago

Initial methods suggest attackers had likely mapped out Ivanti's asset landscape upfront and acted quickly once the exploit became public.

New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets

thehackernews.com · a month ago

Security teams found OpenClaw, a self-hosted AI agent, can execute attacker code or leak sensitive data using seemingly harmless inputs. Imperva demonstrated this attack by embedding instructions within shared contacts, vCards, and location pins that the agent executed without user knowledge. Varonis also built an agent to prove these potential vulnerabilities in common AI workflows.

New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files

thehackernews.com · a month ago

Security researcher Chaotic Eclipse released GreatXML, a new exploit bypassing Windows BitLocker encryption. The discovery follows their recent publication of a vulnerability affecting Microsoft Defender. The researcher stated this finding occurred accidentally during testing and took four hours to confirm.

Skeptics Question Whether SpaceX Is Worth $1.77 Trillion

www.nytimes.com · a month ago

Critics like Jim Chanos and Michael Burry question SpaceX's $1.77 trillion IPO valuation given its financial spending. They noted a $4.3 billion loss in the first three months, contrasting it with Meta’s reported $56.3 billion revenue. These investors expressed doubt regarding the company's claim of an unprecedented $28.5 trillion addressable market.

The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm

thehackernews.com · a month ago

A new analysis reveals The Gentlemen, a financially motivated threat group, operated as an affiliate conducting double extortion attacks. The group leveraged resources from several major ransomware-as-a-service schemes. These utilized include LockBit (Tenacious Mantis), Qilin (Pestilent Mantis), and Medusa (Venomous Mantis).

Claude Fable 5: mid-tier results on coding tasks

www.endorlabs.com · a month ago

Testing assessed that Claude Fable 5 achieved mid-tier results on coding tasks within a 200-task benchmark. The model successfully solved functional problems in 59.8% of attempts. However, its performance dropped significantly in security solving, with only 19.0% passing the real-world tasks.

Making secret scanning more trustworthy: Reducing false positives at scale

github.blog · a month ago

The article details improving secret scanning by reducing noisy alerts. The enhancement incorporates context-aware Large Language Model (LLM) reasoning during verification to boost accuracy. This advancement ensures that security teams receive more trustworthy and actionable detections.

Authorities dismantle 'AudiA6' ransomware crypto-laundering service

www.bleepingcomputer.com · a month ago

Law enforcement dismantled "AudiA6," a cryptocurrency service allegedly used by cybercriminals to launder over $380 million. Europol confirmed the platform linked to 15 international investigations of ransomware activity between 2022 and 2025. Authorities arrested two nationals in Georgia, who are accused of running AudiA6 and an illicit forum called "Dark2Web."

Silent Ransom Group: what you need to know

www.fortra.com · a month ago

Most extortion gangs hide behind a keyboard. Silent Ransom Group will phone your staff pretending to be IT support - and if that fails, send someone to your office in person to plug in a USB stick. Read more in my article on the Fortra blog.

South Korea Drops a $409M Fine on Coupang in Historic Data Breach Ruling

www.techrepublic.com · a month ago

South Korea fined Coupang $409 million after regulators said weak security controls led to a massive breach affecting 37.5 million accounts.

Microsoft Restricts Claude Fable 5 Access Amid AI Safety Review

www.techrepublic.com · a month ago

Microsoft reportedly limited internal use of Claude Fable 5 while legal teams review Anthropic’s 30-day data-retention policy.

CISA Warning: LiteLLM Flaw Could Expose Enterprise AI Gateways

www.techrepublic.com · a month ago

CISA’s LiteLLM warning shows why AI gateways and agents need service account governance, scoped access, credential rotation, and audit trails.

Segmentation Works for OT If Operators Are Paying Attention

www.darkreading.com · a month ago

Traditional network segmentation struggles to secure Operational Technology (OT) environments because critical systems increasingly converge with IT infrastructure. Experts caution that physical firewalls fail when unmanaged devices, such as Wi-Fi laptops, bypass the security perimeter. Consequently, attackers exploit these gaps, making detection difficult even in supposedly segmented networks.

France’s Tchap Breach: 650,000 Messages, 73,000 Accounts Exposed

www.techrepublic.com · a month ago

Meta description: French officials are investigating a Tchap breach after an attacker claimed that 650,000 messages and 73,000 accounts were exposed via a hijacked account.

Why AI-driven threats are exposing the limits of MSP security stacks

www.bleepingcomputer.com · a month ago

Gartner says AI agents will cut exploit times by 50% by 2027. Verizon's report found generative AI deployed across all attack stages. MSPs must unify security stacks for cohesive detection and response.

Jeff Bezos Wants to Build an ‘Artificial General Engineer’

www.nytimes.com · a month ago

Amazon founder Jeff Bezos established the start-up Prometheus to develop an "artificial general engineer" AI platform. This venture plans to utilize tools that improve the design and manufacture of diverse physical devices, including computers and jet engines. The goal is to dramatically accelerate traditional engineering cycles, creating opportunities for companies like Blue Origin.

Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks

www.securityweek.com · a month ago

Oracle issued an advisory regarding CVE-2026-35273, a critical PeopleSoft vulnerability that permits unauthenticated remote code execution in versions 8.61 and 8.62. Oracle provided mitigations but did not confirm whether the flaw was exploited as a zero-day vulnerability. Meanwhile, hackers affiliated with ShinyHunters reported targeting over 100 organizations using PeopleSoft environments.

Alert Fatigue Is Becoming a Security Threat of Its Own

www.securityweek.com · a month ago

SOC analysts struggle with alert fatigue because security tools generate massive volumes of alerts lacking necessary business context. Attackers increasingly weaponize AI, escalating attack sophistication while defensive systems introduce new risks. Organizations must adopt deeper automation and contextual analysis to separate real threats from noise, preventing analyst burnout.

OceanLotus Targets Stock Investors in FireAnt MetaKit Supply-Chain Hack

gbhackers.com · a month ago

OceanLotus APT32 implanted its SPECTRALVIPER backdoor into FireAnt MetaKit via a supply-chain operation targeting stock investors. The attack began in October 2025, exploiting malicious updates that lacked integrity checks using the C2 domain financemachinelearning. Separately, the group maintained an espionage intrusion against a Vietnamese infrastructure company from mid-2024 to February 2026.

ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Action Patch + 28 New Stories

thehackernews.com · a month ago

Intelligence revealed several alarming modern issues, including a public supply chain attack kit. Malicious software was deployed, such as a $5,000-a-month RAT that clones browsers. Research also showed that attackers can deceive AI agents into leaking real credentials.

ServiceNow fixes API issue after reports of suspicious tenant activity

www.csoonline.com · a month ago

ServiceNow disclosed a vulnerability allowing unauthorized data exposure via an unauthenticated, internet-facing API endpoint. The company issued remediation guidance, including KB3067321 for hosted customers, after the flaw came from its bug bounty program. Experts cautioned that knowing the specific endpoint could enable access to sensitive tenant information without authentication.

CISA Directs Federal Agencies to Prioritize Security Patches Based on Risk

www.securityweek.com · a month ago

CISA Directive 26-04 mandates federal agencies update vulnerability policies using the KEV catalog. Agencies must inventory assets and report status. Publicly exposed flaws allowing total control require patching within three days.

Coupang hit with record $409 million data breach fine in Korea

www.bleepingcomputer.com · a month ago

The Personal Information Protection Commission (PIPC) fined Coupang a record 624.6 billion won ($409 million) over massive data security failures. The regulator cited inadequate practices, including negligence in authentication key management and access controls. This breach exposed personal information belonging to over 37 million customers.

GoFlateLoader Hides Infostealers in Massive PE Overlay

gbhackers.com · a month ago

GoFlateLoader serves as a Golang loader distributing infostealers like Lumma, Vidar, and StealC through straightforward in-memory PE loading. The loader utilizes massive PE overlays to inflate its size up to 950 MB. This technique evades detection by exceeding practical size limits imposed on automated static analysis platforms, such as VirusTotal’s 650 MB cap.

CISA tells govt agencies to patch critical exploited flaws in 3 days

www.bleepingcomputer.com · a month ago

CISA's Directive 26-04 mandates FEB agencies prioritize security updates, requiring rapid fixes for known exploited vulnerabilities within three days. The rule covers on-premise/cloud federal systems but excludes DoD and private contractors.

GreatXML Zero-Day Enables BitLocker Bypass Through Windows Defender Offline Scan

gbhackers.com · a month ago

A newly disclosed zero-day vulnerability named "GreatXML" enables a practical BitLocker bypass on Windows systems. The flaw abuses the Windows Recovery Environment (WinRE) during Defender Offline Scans, exploiting how the system processes crafted unattended XML files. Attackers with physical access can thus gain unrestricted entry to encrypted volumes without needing authentication.

Fable 5 and the analyst-AI threat model: what a Mythos-class model changes for security work

blog.flipflow.app · a month ago

Anthropic's Claude Fable 5 has a 1M token window; high SWE-Bench Pro scores boost defense by cross-referencing large data like full HAR captures. Adopting AI agent mode requires developers to mitigate risks from prompt injection and poisoned context.

Attackers Exploit Critical Langflow Flaw for Remote Code Execution

gbhackers.com · a month ago

Path traversal in Langflow's file uploads exploits CVE-2026-5027 (CVSS 8.8), enabling RCE via unauthenticated session token theft and arbitrary file writes. This affects users already facing CVE-2025-34291, CVE-2026-0770, CVE-2026-21445, and CVE-2026-33017.

Hackers Exploit Langflow Vulnerability for Remote Code Execution

www.securityweek.com · a month ago

Exploiting CVE-2026-5027, a high-severity path traversal vulnerability in Langflow allows unauthenticated attackers to achieve remote code execution (RCE) by targeting the POST /api/v2/files endpoint. The system fails to sanitize filename parameters, enabling arbitrary file writing and subsequent exploitation.

Hackers Exploit SniperDz PhaaS for Brand Spoofing and Browser Hijacking

gbhackers.com · a month ago

Phishing hits SniperDz PNaaS/PhaaS platform in MENA. Attackers clone global brands (PayPal, Netflix, etc) for massive credential theft using browser notifications and VAPID keys. Scammers profit by this attack method.

GitHub Introduces Automatic Controls to Prevent Malicious npm Install Scripts

gbhackers.com · a month ago

GitHub's npm v12 blocks install-time scripts (preinstall/postinstall) by default using allowScripts, curbing supply chain attacks. It also limits Git deps and remote tarballs. This enhances package security for users.

Siemens Says Desigo CC Files Flagged as Malware by Security Engines

www.securityweek.com · a month ago

Siemens Desigo CC patch files trigger false malware detections via a PowerShell script in 'patchHelper'. No malicious changes exist; vendors must fix the misclassification.

AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS.

thehackernews.com · a month ago

AI eliminated the "buffer" that historically protected vulnerability management processes. Previously, weaponizing a found bug required months, allowing security teams time to triage and schedule fixes. Now, AI drastically reduces this window, fundamentally altering the modern cybersecurity challenge for organizations.

FBI Seizes 13 Websites That Officials Say Were Used by China to Target and Recruit US Workers

www.securityweek.com · a month ago

FBI seized dozen Chinese intelligence sites targeting US workers with classified access. Fake sites posted bogus consulting jobs for gov't employees using fake identities and AI photos. Operators allegedly paid recruits in crypto for sensitive data. Multiple western agencies issued warnings.

Enhanced License Plate Tracking

www.schneier.com · a month ago

Leonardo plans SignalTrace integration for ALPRs to collect Bluetooth IDs. This expands data collection beyond license plates, enabling person tracking via mobile phones and wearables. The system could allow law enforcement personal surveillance.

Weaponized DMG Files Deliver macOS Infostealer Malware

gbhackers.com · a month ago

Attackers deploy weaponized DMG files via social engineering to steal macOS user credentials, cookies, and tokens. These infostealers avoid Gatekeeper bypasses using compromised sites. Monitor /Volumes for unexpected mounts via the Endpoint Security API.

Splunk, Palo Alto Networks Patch Severe Vulnerabilities

www.securityweek.com · a month ago

PAN fixed CVE-2026-0274 (Cortex XSOAR). Splunk patched critical CVE-2026-20253 allowing unauthenticated file creation and addressed multiple RCE risks across its platforms. Patches are available for all impacted entities.

Hacking Google with A.I. for $500,000

brutecat.com · a month ago

AI fuzzing targets Google's APIs via scraped data from 60k+ Android APKs and key capture across thousands of Google domains, enabling vulnerability research.

BLUERABBIT Backdoor Encrypts Files, Wipes Windows Systems

gbhackers.com · a month ago

Golang backdoor BLUERABBIT performs data theft, file encryption, and destructive disk wiping on Windows hosts. The malware utilizes RabbitMQ for command-and-control tasks and MinIO for bulk exfiltration of staged files. Threat intelligence links the tool, first observed in 2026, to an Iran-nexus threat cluster potentially targeting Israeli entities.

Trust No Skill: Integrity Verification for AI Agent Supply Chains

unit42.paloaltonetworks.com · a month ago

AI agent risks grow via third-party skills with privileged access. Researchers developed BIV to audit skill functions. BIV found skills can execute complex attacks enabling credential theft, RCE, or data exfiltration.

What SRE teams need before they trust AI agents

www.csoonline.com · a month ago

SRE teams must earn trust when using AI agents for incident response by demonstrating operational reliability under stress. True implementation depends on foundational observability, requiring correlated metrics, logs, and traces rather than mere theoretical capability. These systems also need clear service ownership and dependency mapping to ground recommendations in actual system truth.

China-linked recon botnet outpaces enterprise defenses

www.csoonline.com · a month ago

JDY botnet (1,500+ SOHO/IoT devices) linked to Chinese actors like Volt Typhoon uses industrialized recon against public vulnerabilities. It evades geofencing via fake residential traffic.

‘GreatXML’ Zero-Day Exploit Bypasses BitLocker

www.securityweek.com · a month ago

Security researcher Nightmare Eclipse released GreatXML, a Proof-of-Concept exploit that bypasses BitLocker protection. This zero-day targets Microsoft Defender’s offline scan functionality, granting users SYSTEM privileges in Recovery Mode. The PoC requires the system to have previously initiated an offline scan and involves placing specific XML files on the recovery partition.

OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack

thehackernews.com · a month ago

OceanLotus executed two campaigns utilizing the SPECTRALVIPER backdoor. These operations targeted domestic Vietnamese entities and stock investors with espionage efforts. The intrusions involved both a supply chain attack and prolonged cyber espionage against an infrastructure construction corporation.

Hackers Use Residential Proxies Networks to Evade Detection

gbhackers.com · a month ago

Infoblox data shows widespread residential proxy use complicating defense. Proxy queries rose in 2025/2026 for AI training and scraping. Groups used these proxies to deploy botnets, like Kimwolf, inside enterprises.

How Tesla’s Stock Listing in 2010 Enabled SpaceX’s I.P.O.

www.nytimes.com · a month ago

Investors who bought the automaker’s shares in its initial public offering became rich. As a result, many have a deep faith in Elon Musk, the chief executive of Tesla and SpaceX.

Frontier AI models offer sneak peak of seismic cyber shifts ahead

www.csoonline.com · a month ago

AI models (Claude Mythos, GPT-5.5) enable large-scale vulnerability discovery. CISOs should assume initial compromise and focus on identity controls/segmentation over patching. Attackers can gain this via local tuning of open-weight models.

Aged-domain acquisition: The tradecraft phishing operators are using to bypass your mail filter’s reputation score

www.csoonline.com · a month ago

Phishing groups bypass email filters by buying old domains with clean histories. Attackers target US government/healthcare via Sneaky2FA using these reputable domains.