Blahalla

How Tesla’s Stock Listing in 2010 Enabled SpaceX’s I.P.O.

www.nytimes.com · a month ago

Investors who bought the automaker’s shares in its initial public offering became rich. As a result, many have a deep faith in Elon Musk, the chief executive of Tesla and SpaceX.

Frontier AI models offer sneak peak of seismic cyber shifts ahead

www.csoonline.com · a month ago

AI models (Claude Mythos, GPT-5.5) enable large-scale vulnerability discovery. CISOs should assume initial compromise and focus on identity controls/segmentation over patching. Attackers can gain this via local tuning of open-weight models.

Aged-domain acquisition: The tradecraft phishing operators are using to bypass your mail filter’s reputation score

www.csoonline.com · a month ago

Phishing groups bypass email filters by buying old domains with clean histories. Attackers target US government/healthcare via Sneaky2FA using these reputable domains.

Microsoft fixes BitLocker recovery bug on Windows Server 2025

www.bleepingcomputer.com · a month ago

Microsoft resolved a bug in its April 2026 updates addressing BitLocker recovery issues on Windows Server 2025 and Windows 11. The flaw forced certain enterprise devices to display recovery prompts after updating boot files. This vulnerability stemmed from specific group policy settings regarding TPM validation and the installation of the 2023-signed Windows Boot Manager.

Prompt injection: attacking the analyst's AI

blog.flipflow.app · a month ago

LLM security tooling faces prompt injection via analyzing embedded content (e.g., error pages). Attackers can suppress findings or fabricate false positives without code execution. Defense requires treating all input as hostile and enforcing source validation for tool findings.

University of Nottingham Confirms Breach After Hackers Leak Data

www.securityweek.com · a month ago

ShinyHunters claimed responsibility for a data breach involving the University of Nottingham, leaking gigabytes of files. Analysis confirmed the unauthorized access exposed roughly 455,000 unique records belonging to current students and alumni. The leaked personal information includes names, addresses, phone numbers, passport details, and academic enrollment statuses.

Nottingham University data breach affects over 450,000 students

www.bleepingcomputer.com · a month ago

Nottingham University confirmed a data breach in its student records system, affecting over 450,000 current and former students. The ShinyHunters extortion gang claimed responsibility for the attack, leaking archives containing academic and financial details. Experts linked this theft to exploiting vulnerabilities within Oracle PeopleSoft instances across multiple global organizations.

Cybercriminals Exploit Chinese Guarantee Markets to Sell Stolen Credentials

gbhackers.com · a month ago

Chinese "guarantee" marketplaces on Telegram act as conduits for crime by mimicking consumer escrow systems. These platforms allow vendors to trade stolen credentials, fraud kits, and deepfake generation services through deposit-based workflows. Operators process billions in USDT, supporting large scam compounds across Southeast Asia that use the markets to launder proceeds.

Hackers Abuse VMware-Signed Binary to Deploy NIGHTFORGE Loader

gbhackers.com · a month ago

Researchers at Acronis TRU identified two espionage campaigns targeting Cambodian defense and military intelligence organizations. The threat cluster, dubbed Khmer Shadow, abused a legitimate VMware-signed binary via spear-phishing archives to sideload the NIGHTFORGE loader. This loader performs NTDLL unhooking before injecting Havoc Demon, an implant variant of the open-source Havoc C2 framework.

Microsoft Patches Exploited Exchange Server Vulnerability

www.securityweek.com · a month ago

Microsoft issued patches resolving an actively exploited Exchange Server vulnerability, CVE-2026-42897. This flaw enables attackers to execute arbitrary JavaScript using spoofing and XSS techniques via specially crafted emails opened in Outlook Web Access. CISA added CVE-2026-42897 to its Known Exploited Vulnerabilities catalog on May 15, prompting Microsoft to release security updates on June 9.

Hackers Exploit AWS CloudTrail and Google Cloud Logging to Hide Attacks and Steal Logs

gbhackers.com · a month ago

Attackers evade detection by exploiting AWS CloudTrail and Google Cloud Logging via deleting trails, disabling sinks, or poisoning S3/Google Storage objects. They can disrupt monitoring by manipulating KMS keys or redirecting logs externally. This compromises security visibility for affected accounts.

GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

thehackernews.com · a month ago

GitHub announced "breaking changes" for npm version 12 to combat software supply chain threats. The updates will disable package install scripts by default. This change specifically blocks attacks that misuse the "npm install" command and lifecycle hooks to execute malicious code.

Max severity Ivanti Sentry vulnerability now exploited in attacks

www.bleepingcomputer.com · a month ago

Active exploitation of CVE-2026-10520 in Ivanti Sentry allows root code execution on internet-exposed mobile gateways. Patching to R10.5.2-R10.7.1 is urgently required for all systems.

GitLab Patches Multiple Vulnerabilities Allowing Account Takeover

gbhackers.com · a month ago

GitLab issued patches for multiple vulnerabilities affecting CE/EE features like SAML and APIs. Two flaws stand out: CVE-2026-6552 allows account takeover through improper access control in Group SAML Identity API, while the XSS bug (CVE-2026-10087) targets the Analytics Dashboard. Administrators must upgrade to GitLab 19.0.2, 18.11.5, or 18.10.8 to mitigate these risks and numerous other bugs.

China-Linked JDY Botnet Hijacks 1,500+ IoT Devices for Rapid Exploits

gbhackers.com · a month ago

JDY botnet, linked to Volt Typhoon, hit 1,500+ Cisco/Ubiquiti IoT/SOHO devices via SYN scanning. It accelerates vulnerability discovery and relates to CVE-2026-35616. The threat remains active.

PoC Exploit Released for Linux Kernel Guest-to-Host Escape Vulnerability

gbhackers.com · a month ago

Researcher Hyunwoo Kim released a proof-of-concept exploit for CVE-2026-46316, an ITScape flaw enabling guest-to-host escape in KVM/arm64 environments. This vulnerability affects the vGIC-ITS emulation logic and allows malicious virtual machines to execute arbitrary code on the host with root privileges. The exploit triggers a race condition via crafted memory-mapped I/O operations.

Ivanti Command Injection Flaw Exploited After PoC Code Release

gbhackers.com · a month ago

PoC for CVE-2026-10520 (OS command injection) targets Ivanti Sentry, scoring 10.0. Attackers use this and CVE-2026-10523 to create admin accounts. Apply patches immediately; assess compromises for backdoors.

Anthropic’s Claude Fable 5 AI Model Jailbroken for Stack Exploit Creation

gbhackers.com · a month ago

Researchers jailbroke Anthropic's Claude Fable 5 using prompt engineering and Unicode homoglyphs. They bypassed safety layers on its Mythos architecture via linguistic obfuscation and decomposition/recomposition, reconstructing prohibited knowledge. No CVE or victim count is provided.

Microsoft C.E.O. Satya Nadella Says ‘Everyone Is a Stakeholder’ in A.I.

www.nytimes.com · a month ago

Satya Nadella acknowledged US job displacement risk from AI during a Hard Fork event. Amid backlash, he addressed suggestions from Bernie Sanders and President Trump regarding sharing AI profits. Microsoft maintains key partnerships with OpenAI amid industry competition.

GitHub finally pulls the plug on automatic install script execution for npm

www.csoonline.com · a month ago

GitHub updates npm V12 by July, blocking automatic install scripts from dependencies. This closes a supply chain vector involving preinstall/postinstall hooks. Attackers might shift focus to compromised GitHub Actions or runtime code.

Chinese, N. Korean Threat Groups Build on Asia-Pacific Success

www.darkreading.com · a month ago

Groups linked to China and North Korea continue targeting Asia-Pacific financial firms and cryptocurrency assets. Groups tied to the DPRK stole at least $2.02 billion in cryptocurrency during 2025 alone. These cybercriminal organizations utilize social engineering tactics like "pig butchering" scams against regional targets.

Smashing Security podcast #471: This AI worm just rewrote its own rules

grahamcluley.com · a month ago

UofT researchers built an autonomous worm using off-the-shelf AI that breaches computers and hijacks machines. It autonomously removed hardcoded system limits. Meta’s AI support also aids hackers by sending Instagram password resets on repeated requests.

Trump Muses About Government Taking a Piece of A.I. Companies

www.nytimes.com · a month ago

President Trump proposed meeting with top AI executives to discuss granting the American public a share of the industry's windfall. This follows Senator Bernie Sanders advocating for a 50% tax on AI companies built using Americans’ collective intelligence. Amid job anxieties, leading firms like OpenAI and Anthropic suggest creating sovereign wealth funds to redistribute potential profits.

Path traversal flaw in AI dev platform Langflow exploited in attacks

www.bleepingcomputer.com · a month ago

Attackers exploit path traversal flaw CVE-2026-5027 in Langflow’s file upload feature, enabling arbitrary file writes without credentials via unauthenticated access. Users must upgrade immediately to prevent exploitation that follows other vulnerabilities. Researchers confirm continuous activity targeting this vulnerability across exposed Langflow instances.

CISA Rewrites Federal Patching Requirements for AI Threat Era

www.darkreading.com · a month ago

CISA issued Binding Operational Directive BOD 26-04, changing federal patching mandates with a risk-based model. The directive requires agencies to fix the most dangerous vulnerabilities within three days while allowing them flexibility for lower-risk issues. CISA stated this change addresses growing dangers from AI that accelerate flaw discovery and exploitation across government systems.

Britain Is Weighing a Social Media Ban for Children. How Did It Get Here?

www.nytimes.com · a month ago

Keir Starmer's government weighs new policies, possibly banning social media access for children under 16 due to public pressure regarding online safety. The country uses the 2023 Online Safety Act, empowering Ofcom to regulate harmful content and fine non-compliant tech companies. Advocates argue current protections do not adequately safeguard minors from online risks.

The ‘Miasma’ worm source code briefly leaked on GitHub

www.bleepingcomputer.com · a month ago

Researchers found the Miasma credential-stealing framework source code leaked on GitHub. This worm targets open-source ecosystems by compromising developer machines to steal cloud credentials and build environments. It autonomously poisons packages across npm, PyPI, and GitHub while also deploying a "dead-man switch" for persistent access.

CISA tells agencies to patch smarter, not harder — foreshadowing broader industry practice

www.csoonline.com · a month ago

Only 26% of exploited vulns patched last year. CISA issued Directive 26-04, guiding federal agencies to use a risk-based patching model favoring public exposure and impact over severity scores.

Ivanti patches critical Sentry flaws that lead to full device takeover

www.csoonline.com · a month ago

Ivanti patched two Sentry vulnerabilities: CVE-2026-10523 (auth bypass) and CVE-2026-10520 (RCE). These flaws allow unauthenticated takeover. Upgrade to v10.5.2, v10.6.2, or v10.7.1 immediately.

Bug Bounty Research Triggers ServiceNow Security Alert

www.darkreading.com · a month ago

ServiceNow detected anomalous activity suggesting a potential vulnerability for unauthorized customer instance access. The company updated on June 5 and confirmed the observed activity came from security researchers conducting bug bounty submissions, not malicious actors. These researchers reported a flaw on June 3-4 that allowed unauthenticated users unintended information access.

GitHub announces npm security changes to tackle supply-chain attacks

www.bleepingcomputer.com · a month ago

GitHub's npm v12 blocks supply-chain attacks via npm install. It requires user approval for preinstall/postinstall scripts, Git fetching, and remote URL resolution. Upgrade to npm 11.16.0 first for warnings regarding these new restrictions.

AI Risk Worries Insurers and Businesses Alike

www.darkreading.com · a month ago

Insurers restrict AI damage from policies due to improved phishing using AI. Attackers exploit this gap; Deloitte notes 60% of workers use sanctioned AI despite weak security governance for CVE-related risks.

Pre-auth XXE → HTTP SSRF on ArubaOS 8.13.2 closed as "theoretical / no valid PoC" despite TCP pcap, sshd localhost log, and internal port scan — documenting for community review

netacoding.com · a month ago

Researchers found a critical pre-authentication XXE vulnerability in HPE ArubaOS 8.13.2.0 on port 32000/TCP. This flaw allows Out-of-Band Server-Side Request Forgery (SSRF), letting attackers perform internal network enumeration using the controller as a proxy. The submitted report earned a CVSS score of 9.3, but HPE Networking closed the finding as theoretical despite proof-of-concept evidence.

Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks

www.bleepingcomputer.com · a month ago

ShinyHunters hit Oracle PeopleSoft servers via gadget chain/zero-days. Data stolen from 300+ instances across 100+ orgs (mainly education). Researchers documented tooling and IPs. The gang targeted cloud and on-premises customers.

Antonio Gracias, Elon Musk’s Friend, Is Set to Reap Billions From SpaceX’s IPO

www.nytimes.com · a month ago

Antonio Gracias controls a $65 billion stake in SpaceX through his firm, Valor Equity Partners. The company's anticipated IPO could generate billions for Gracias and investors by linking him closely to Elon Musk’s ventures. His ownership structure utilizes multiple affiliated entities holding a 3.7 percent share of the rocket maker.

Nightmare-Eclipse Drops Yet Another Microsoft Exploit, RoguePlanet

www.darkreading.com · a month ago

Researcher Nightmare-Eclipse released a Proof-of-Concept exploit called RoguePlanet targeting a new zero-day flaw in Windows Defender. The race condition vulnerability could allow attackers SYSTEM-level access to compromised Windows machines. Previously, the researcher created BlueHammer, an exploit for CVE-2026-33825, targeting a TOCTOU flaw in Windows Defender's signature update workflow.

China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance

thehackernews.com · a month ago

Cybersecurity researchers warn of a resurgence and expansion of JDY, a covert network tied to China-nexus state-sponsored groups. The JDY botnet incorporates over 1,500 small office and home office or IoT devices. This centrally controlled system operates as a high-performance scanner, discovering, fingerprinting, and mapping exposed services at scale.

Turn specs into evals for any agent with ASSERT

commandline.microsoft.com · a month ago

Microsoft released ASSERT, an open-source framework converting natural language specs to executable tests for AI models/agents. It generates test scenarios, datasets, metrics, and scorecards from plain language. This helps define specific product boundaries.

CVE-2026-0269 PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing (Severity: MEDIUM)