Blahalla

We post-trained a model for offensive security instead of teaching it to refuse

www.argusred.com · a month ago

ArgusRed offers a specialized CLI tool that audits codebases for vulnerabilities using AI models trained on capture-the-flag contests. The utility features two modes, providing both a read-only Security Scan and an active adversarial Pen Test. A sample audit of Bank of Anthos found critical risks, including forgeable tokens across ledger services and hardcoded RSA private keys.

They Tried To Catch a Child Predator on a Livestream. They Trapped Themselves Instead.

www.nytimes.com · a month ago

Vigilantes used the Kick livestreaming service to ambush Akash Singhania in a park, falsely accusing him of predatory behavior. Led by Vitaly, the group cornered Akash while he met a woman, prompting thousands of viewers to participate in harassment via live chat comments. Police arrived at the scene and took custody of Akash following the confrontation.

Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities

thehackernews.com · a month ago

Fortinet, Ivanti, and SAP released updates addressing critical vulnerabilities that allow arbitrary code execution and information disclosure. Fortinet patched a command injection vulnerability affecting FortiSandbox, FortiSandbox Cloud, and PaaS WEB UI through the fix for CVE-2026-25089. These patches protect users against multiple high-impact security flaws.

Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE

thehackernews.com · a month ago

VulnCheck found that a high-severity path traversal vulnerability (CVE-2026-5027, CVSS score: 8.8) affects Langflow, an open-source low-code platform for building AI applications. The flaw permits attackers to write files to arbitrary locations on the system. Security researchers note this unpatched vulnerability is under active exploitation in the wild.

China-linked JDY botnet expands targeting of U.S. military networks

www.bleepingcomputer.com · a month ago

Black Lotus Labs reported that the China-linked JDY botnet expanded its reconnaissance efforts targeting U.S. military networks and associated infrastructure. The malware now utilizes over 1,500 compromised devices to perform service discovery and fingerprinting. These persistent threat actors rapidly exploit newly disclosed flaws, such as CVE-2026-35616.

SpaceX’s IPO Will Turn 4,400 Employees Into Millionaires

www.nytimes.com · a month ago

SpaceX plans a massive Initial Public Offering with an expected valuation of $1.77 trillion. The debut will generate considerable wealth for Elon Musk and private investors, but also for the company's workforce. Analysts estimate over 4,400 current and former SpaceX employees are likely to become millionaires through their stock compensation during the IPO.

June Patch Tuesday marks a ‘new normal’ with over 200 CVEs, 32 rated ‘critical’

www.csoonline.com · a month ago

June's updates included 200+ CVE fixes plus four SAP critical patches. AI speeds discovery; monitor flaws like CVE-2026-49160 (HTTP), CVE-2026-42897, CVE-2026-45607, and CVE-2026-50507. Prepare for constant zero-day alerts.

CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation

thehackernews.com · a month ago

CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog after reports of active exploitation across multiple vendors. The new entries include CVE-2026-20245, an improper encoding or escaping vulnerability found in Cisco Catalyst SD-WAN Manager (CVSS score 7.8). CISA advises organizations acting quickly to mitigate these newly listed security flaws.

The 5 Best Practices for Secure Identity Verification

www.bleepingcomputer.com · a month ago

Phishing and MFA fatigue exploit weak auth to bypass security. Harden identity with hardware tokens/passkeys, not SMS. Secure service desks from social engineering for best defense.

Who Runs the Ransomware Group ‘The Gentlemen?’

krebsonsecurity.com · a month ago

The Gentlemen operates as a highly active Ransomware-as-a-Service group, promising affiliates 90 percent of ransom payments. Security researchers analyzed how the group targets internet-facing devices like VPNs before quickly encrypting entire networks. Investigators traced the administrator through pseudonyms Hastalamuerte and Zeta88 to multiple cybercrime forums originating in Izhevsk, Russia.

Infostealers Turn Millions of Devices Into Credential Theft Machines

www.securityweek.com · a month ago

Infostealers provide attackers preferred access by stealing credentials rather than utilizing exploits. Flashpoint reported that over 11.1 million devices became infected with stealers in 2025, leading to 3.3 billion stolen credentials circulating online. Malware strains like Vidar evade detection by operating only in memory while harvesting site and corporate logins.

Cyera Raises $600 Million at $12 Billion Valuation

www.securityweek.com · a month ago

Cyera secured $600M funding, hitting $12B valuation. The firm's AI platform manages data security posture for data at rest, in motion, or in use. This supports large-scale AI transformation.

Microsoft Reportedly Cuts Hundreds of Azure Jobs in China

www.techrepublic.com · a month ago

Microsoft reportedly cut between 200 and 400 Azure jobs in China, affecting staff across its Beijing and Shanghai teams. These layoffs occur as cross-border data scrutiny increases due to tightening US and Chinese regulations. Washington implemented the Data Security Program, while Beijing enforces laws like the Data Security Law and PIPL, challenging cloud operations.

Cloud Security Report Finds Fragmented Tools Widening the Cloud Complexity Gap

gbhackers.com · a month ago

The 2026 Cloud Security Report found that tool sprawl and visibility gaps limit cloud effectiveness for 69% of surveyed organizations. Additionally, 66% report low confidence in detecting or responding to real-time cloud threats. To address these vulnerabilities, security leaders now suggest consolidating into single-vendor platforms rather than using disparate point tools.

Microsoft’s Record-Breaking Patch Tuesday Fixes Over 200 Security Flaws

www.techrepublic.com · a month ago

Microsoft issued its record-breaking June Patch Tuesday, addressing over 200 CVEs, including public zero-days and the critical flaw CVE-2026-45586. Industry experts believe AI tooling supercharges vulnerability discovery, fundamentally challenging traditional monthly patching schedules. This massive release signals an industry shift toward rapidly escalating software defect finding.

Microsoft patches Exchange Server zero-day exploited in attacks

www.bleepingcomputer.com · a month ago

Microsoft patched CVE-2026-42897 affecting Exchange Server 2016, 2019, and Subscription Edition via XSS code execution from emails. CISA noted the critical flaw exploited in the wild; US agencies must patch by May 29.

Why schools remain one of cybercriminals’ favourite targets

www.bitdefender.com · a month ago

Ransomware gangs continue targeting educational institutions globally. Evanston Township High School suffered an attack, forcing a closure because it disabled critical systems like door access controls and public address announcements. Separately, Powys County Council in Wales disclosed that 13 schools faced hacker attacks, compromising student and staff personal data.

73 Microsoft Packages Weaponized in Password Stealer Attack

gbhackers.com · a month ago

GitHub disabled 73 repositories across four Microsoft organizations in a sudden 105-second window, impacting core Azure components like azure-functions-host. The scale points to automated abuse detection, indicating credential exposure within the code bases. This takedown relates to supply-chain weaponization waves where groups utilized malicious packages and tools for stealing credentials.

Aryon Security Raises $29 Million in Series A Funding

www.securityweek.com · a month ago

Cybersecurity startup Aryon Security raised $29 million in Series A funding, led by Brightmind Partners. The company provides proactive cloud protection and enforces security controls to prevent misconfigurations across complex environments. Aryon aims to help organizations maintain secure-by-design infrastructure during rapid cloud migration.

Critical HVAC and UPS Vulnerabilities Could Let Hackers Disrupt Data Centers

www.securityweek.com · a month ago

Claroty found vulnerabilities in Vertiv UPS network cards (auth bypass, RCE) and Trane Tracer SC+ HVAC controllers (unauthenticated control). Attackers could disrupt operations on these critical building systems.

New Windows CTF 0-Day Vulnerability Lets Attackers Gain Elevated Privileges

gbhackers.com · a month ago

Microsoft found CVE-2026-45586 in Windows CTFMON. This zero-day allows attackers elevated privileges via improper symbolic link handling with local access, bypassing user interaction for high-level code execution.

Microsoft feud escalates as researcher drops new Windows zero-day

www.csoonline.com · a month ago

Researcher Nightmare Eclipse published exploit code for RoguePlanet, a zero-day flaw targeting Microsoft Defender. The exploit uses a race condition vulnerability to potentially gain SYSTEM-level privilege and execute arbitrary code on Windows 10/11 with recent patches installed. This disclosure continues Eclipse's dispute with Microsoft over proper vulnerability disclosure timing.

How Fraudsters Bypass Facial Recognition and Stay Hidden in 2026

sumsub.com · a month ago

Fraudsters use deepfake technology and synthetic media to bypass facial recognition, with deepfake fraud surging by 1,100%. Attackers leverage AI-generated identities in virtual interviews, targeting financial institutions. To counter this, strong biometric systems must implement liveness detection; these measures verify physical presence and detect image manipulation beyond face matching.

New Windows Zero-Day Exploit ‘RoguePlanet’ Released

www.securityweek.com · a month ago

Nightmare Eclipse's RoguePlanet zero-day PoC exploits a Defender race condition for LPE (SYSTEM) on patched Win 10/11, building on CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45586, and CVE-2026-50507.

Microsoft: Some Windows PCs fail to install latest monthly updates

www.bleepingcomputer.com · a month ago

Microsoft warned customers that certain Windows PCs upgraded to versions 24H2 or 25H2 may fail installing monthly updates. Affected devices report specific errors, including 0x80073712 or 0x800f0993, when attempting the June 2026 cumulative update. Microsoft advises users to restart their PCs, noting a fix for unmanaged and Home edition systems will roll out following rebooting.

NSO Group Hacking WhatsApp Despite Court Order

www.schneier.com · a month ago

WhatsApp reportedly detected that the NSO Group was phishing its users while violating a court order. The company took action against the surveillance technology firm.

Hackers Use Fake Utility Downloads to Deploy ScreenConnect and Cryptominers

gbhackers.com · a month ago

A cryptojacking campaign was launched impersonating utilities like CrystalDiskInfo and HWMonitor. The attack poisons search results and leverages AI chatbots to direct users toward malicious download sites. The payload uses DLL sideloading techniques to silently install ScreenConnect, granting persistent remote access for cryptocurrency mining.

After AI Reaches Production: 12 Ways Security Teams Can Take Control

www.securityweek.com · a month ago

Security teams require a repeatable framework to monitor and defend AI applications moving into production. They must first achieve continuous visibility to detect data exposures, vulnerabilities, and fraud. Proper security demands generating telemetry from the AI, API, and application layers while building stakeholder trust early in the SDLC.

Autonomous AI agents duped into leaking sensitive data in phishing test

www.csoonline.com · a month ago

OpenClaw AI's Pinchy failed against social engineering, leaking AWS IAM keys & customer data despite resisting OAuth attacks. Human trust is the key vulnerability for autonomous agents.

CISA Issues Alert on Actively Exploited Google Chromium Zero-Day Flaw

gbhackers.com · a month ago

CISA warns of an actively exploited zero-day vulnerability, CVE-2026-11645, affecting Google Chromium's V8 JavaScript engine. This flaw involves out-of-bounds read and write issues, potentially allowing arbitrary code execution through malicious web content. Because this critical issue impacts browsers like Chrome and Edge, CISA urges organizations to apply vendor mitigations immediately.

Microsoft patches YellowKey, GreenPlasma, MiniPlasma zero-days

www.bleepingcomputer.com · a month ago

MS patched three flaws: GreenPlasma (CVE-2026-45586), MiniPlasma (CVE-2020-17103), grant local SYSTEM access on patched Windows. YellowKey (CVE-2026-45585) bypasses BitLocker with physical access. BlueHammer (CVE-2026-33825) and RoguePlanet details were leaked.

Tax Phishing Emails Deliver In-Memory Malware to Windows Systems

gbhackers.com · a month ago

Phishing emails mimicking HMRC/Intuit QuickBooks target India's sector via in-memory malware on Windows. It uses PowerShell/mshta.exe execution for evasion. Silver Fox deploys a modular RAT with C2 and LLVM Control Flow Flattening.

ServiceNow Patches Vulnerability Exploited Against Some Customers

www.securityweek.com · a month ago

ServiceNow patched a cloud platform vulnerability after reports indicated attackers exploited the flaw. The security update limits endpoint access and concerns potential unauthorized user access to instance data. ServiceNow detected anomalous activity for some customers, observing successful queries of specific instance tables via affected endpoints.

Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs

thehackernews.com · a month ago

Microsoft released fixes for a record 206 vulnerabilities impacting its software portfolio on Tuesday, including three flaws publicly disclosed at the time of patching. The patches address severity issues: 39 are rated Critical and 167 are Important. These comprehensive updates cover numerous flaw types, notably including 56 remote code execution and 63 privilege escalation issues.

AI red teaming comes of age

www.csoonline.com · a month ago

GPT-4 forces security teams to adapt past 2019's Microsoft AI red team due to probabilistic nature. Analyzing complex software dependencies is faster than traditional methods. Security risk determination now relies on frequency/conditions, not just existence.

Critical Vulnerabilities Patched in Fortinet, Ivanti Products

www.securityweek.com · a month ago

Fortinet patched CVE-2026-25089 (RCE/OS command injection) in FortiSandbox. Ivanti fixed OS command injection (CVE-2026-10520) and auth bypasses (CVE-2026-10523) for Sentry/EPMM, plus CVE-2026-6973 & CVE-2026-10727. Updates are now available.

certSIGN: Inconsistent revocation status (CRL "revoked" vs OCSP "good") for intermediate CA "certSIGN Web CA"

bugzilla.mozilla.org · a month ago

A Mozilla bug report identifies that certSIGN's intermediate CA, "certSIGN Web CA," exhibits inconsistent revocation status. The reporter demonstrated that checking the Certificate Revocation List (CRL) indicates the certificate is REVOKED, while performing an Online Certificate Status Protocol (OCSP) check reports its status as GOOD.

Malicious npm Package ‘dbmux’ Targets Developers

gbhackers.com · a month ago

npm package dbmux has a supply chain vulnerability allowing arbitrary code execution. Attackers can gain remote control by harvesting environment variables/credentials on affected systems. Isolate hosts and rotate all secrets now.

Windows BitLocker 0-Day Flaw Enables Security Feature Bypass Attacks

gbhackers.com · a month ago

Microsoft disclosed zero-day vulnerability CVE-2026-50507 in Windows BitLocker. This flaw compromises core disk encryption by exploiting a "Missing Authentication for Critical Function" weakness. Attackers could bypass protections using physical access without requiring user credentials.

Windows Defender Zero-Day “RoguePlanet” Lets Attackers Gain SYSTEM Privileges

gbhackers.com · a month ago

A zero-day vulnerability named "RoguePlanet" impacts Microsoft Defender on Windows 10 and 11, allowing attackers to escalate privileges to SYSTEM-level access. Security researcher "MSNightmare" published a proof-of-concept exploit demonstrating this flaw on GitHub. The attack leverages a race condition within Defender's file handling mechanisms by abusing ISO mounting behavior.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact

www.securityweek.com · a month ago

Siemens patched OpenSSL (CVE-2025-15467) for authenticated command execution. Schneider released updates for PowerLogic P7 DoS and EasyLogic T150 credential issues. Phoenix Contact warned of an unauthenticated log download flaw in CHARX SEC-3xxx. These advisories cover multiple critical ICS flaws.

Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards

thehackernews.com · a month ago

On June 9, Anthropic released Claude Fable 5, the most capable model it has developed to date. The company structured the release by splitting its core underlying model into two products using safety classifiers. Public access goes through Fable 5; simultaneously, a safeguarded twin, Claude Mythos 5, remains locked for vetted cybersecurity groups.

OpenClaw AI Agent Leaks Credentials in Phishing Simulation

gbhackers.com · a month ago

Phishing hit autonomous email agents; OpenClaw simulation showed agent "Pinchy" leaked AWS IAM keys and DB passwords when tricked by an attacker posing as "Dan," even with a Strict profile enforced.

GhostTrace – a Windows forensic scanner that finds what "Uninstall" leaves behind (22 modules, read-only, offline)

www.virustotal.com · a month ago

Researchers built GhostTrace, a Windows CLI tool investigating software remnants using 22 forensic modules in one pass. The utility detects artifacts like leftover registry keys, prefetch entries, and scheduled tasks remaining after uninstallation. GhostTrace covers persistence mechanisms including Run/RunOnce keys, services, AppInitDLLs, and WMI bindings associated with MITRE ATT&CK TA0003.

ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances

thehackernews.com · a month ago

Unknown groups exploited a flaw in ServiceNow instances to gain deep unauthorized access. The company issued an advisory and applied a security update on June 5, 2026. This patch addressed a vulnerability that could let unauthenticated users compromise susceptible hosted customer instances.

No Patch Planned for Exploited Arista EOS Vulnerability

www.securityweek.com · a month ago

Hackers exploit a zero-day vulnerability in Arista EOS (CVE-2026-7473) that processes non-verified tunnel traffic. Arista confirmed no patch exists, advising organizations to implement vendor mitigations for the flaw. CISA added CVE-2026-7473, alongside CVE-2026-11645 and CVE-2026-20245, to its Known Exploited Vulnerabilities list.

Jupyter Enterprise Gateway - From Notebook to Kubernetes Cluster Admin - elttam

www.elttam.com · a month ago

Jupyter Enterprise Gateway has three flaws: CVE-2026-44180, CVE-2026-44181 (RCE), and CVE-2026-44182. These let users compromise Kubernetes clusters via data science workloads. Updates are available in v3.3.0.

Ivanti: Max severity Sentry flaw allows code execution as root

www.bleepingcomputer.com · a month ago

Ivanti patched Sentry for two critical flaws: CVE-2026-10520 (root OS command injection) and CVE-2026-10523 (auth bypass). These affect its mobile gateway solution. Patches are now available to secure the product.

Microsoft Patch Tuesday June 2026 Fixes 198 Vulnerabilities, Including 3 Zero-Days

gbhackers.com · a month ago

MS June 2026 patch addressed 198 vulns incl. 3 zero-days. Flaws let BitLocker bypass (CVE-2026-50507) and HTTP.sys disruption (CVE-2026-49160). Fast deployment for AD, RDP, Hyper-V is required to mitigate risk.

Hackers Use ClickFix Chain to Deploy MLTBackdoor Malware

gbhackers.com · a month ago

Operators deploy MLTBackdoor, a new backdoor family, using a multi-stage ClickFix infection chain to establish ransomware footholds. The campaign leverages an automotive-themed lure; victims executing commands fetch a compressed archive from a DGA domain, dropping two artifacts that initiate the attack.