Blahalla

New NadMesh Botnet Uses 20+ RCE Vectors to Hijack AI and MCP Infrastructure

gbhackers.com · 4 days ago

NadMesh is a new, industrial‑grade Go‑based botnet that weaponizes more than 20 RCE vectors to hijack AI and MCP infrastructure at scale, combining autonomous scanning, exploit delivery, and credential harvesting in a single closed‑loop platform.

Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man

thehackernews.com · 4 days ago

Armenia has held a Russian tourist named Aleksandr Ermakov in a detention center since June 28, on a U.S. extradition request for a REvil ransomware suspect named Aleksandr Ermakov.

Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

unit42.paloaltonetworks.com · 4 days ago

A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access.

TP-Link Kasa Camera Flaws Let Attackers Steal Admin Credentials and Geolocation Data

gbhackers.com · 4 days ago

TP-Link has revealed several serious vulnerabilities affecting its Kasa EC70 and EC71 smart camera models, which could expose users to credential theft and geolocation data leakage. These vulnerabilities are CVE-2026-9770 and CVE-2026-13230 and specifically affect version 4 of both devices.

CISA Warns of Two Fortinet FortiSandbox Flaws Exploited to Execute Commands

gbhackers.com · 4 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities in Fortinet FortiSandbox to its Known Exploited Vulnerabilities (KEV) catalog. These flaws are actively being exploited in the wild to execute unauthorized commands on affected systems.

Windows Server 2022 reach end of mainstream support in 90 days

www.bleepingcomputer.com · 4 days ago

Microsoft announced that Windows Server 2022 will reach the mainstream end date in October 2026, but will switch to extended support and continue receiving security updates for five more years.

Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei

www.securityweek.com · 4 days ago

The company disconnected its systems on July 13 and is starting to gradually restore operations.

Hackers Use Paste-and-Run Commands to Deploy ClickLock Stealer Against Mac Users

gbhackers.com · 4 days ago

Hackers are actively targeting macOS users with a newly identified infostealer dubbed “ClickLock Stealer,” leveraging paste-and-run social engineering techniques to bypass Apple’s native security protections without requiring exploits or elevated privileges.

The SaaS blind spot: Why security teams can’t get inside their own apps

www.csoonline.com · 4 days ago

Most organizations I work with have invested heavily in cloud security. They have endpoint detection tools, SIEM platforms, cloud security posture management, and skilled security teams running on a 24/7 shift. And yet, when I ask them a simple question, who has admin access in your Salesforce tenant right now?, The room goes quiet. Nobody knows. Not because they are negligent.

ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

thehackernews.com · 4 days ago

ACR Stealer, an infostealer in circulation since 2024, is walking out of enterprise networks with saved browser passwords, live session tokens, PDFs, Microsoft 365 documents, and files from synced OneDrive and SharePoint folders. It gets in because someone pasted a command into a Run box and pressed Enter. Microsoft laid out two of the delivery chains on Thursday.

New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage

thehackernews.com · 4 days ago

Cybersecurity researchers have discovered a previously undocumented malware called GoSerpent that has been put to use in cyber attacks targeting entities in Southeast Asia since late 2025 with a focus on long-term access and intelligence gathering.

Fake TTF files deliver stealthy malware in global phishing campaign

www.csoonline.com · 4 days ago

Threat actors are now abusing an ordinary font file to deliver low-detection malware capable of stealing credentials and establishing persistence on compromised Windows systems.

Risk Ledger Raises $32 Million in Series B Funding

www.securityweek.com · 4 days ago

The British firm has built a collaborative platform to help organizations address supply chain security risks.

US charges two over laundering $43 million from investment fraud

www.bleepingcomputer.com · 4 days ago

U.S. prosecutors on Thursday charged a New York man and woman for their roles in a large-scale crime ring that laundered money stolen in cyber investment fraud scams.

GPT-5.6 Codex Reportedly Wipes Files From Home Directories

gbhackers.com · 4 days ago

Recent reports indicate that GPT-5.6 Codex has unintentionally deleted files in users’ home directories under certain configurations, raising concerns about the risks of running advanced AI coding agents with unrestricted access to the system.

Fresh SharePoint Vulnerability Exploited Soon After Disclosure

www.securityweek.com · 4 days ago

The critical-severity security defect allows remote, authenticated attackers to execute arbitrary code on the server.

CISA urges immediate action on actively exploited Fortinet flaws

www.bleepingcomputer.com · 4 days ago

CISA on Thursday ordered government agencies to prioritize patching two actively exploited vulnerabilities in the Fortinet FortiSandbox threat detection platform.

Senior executives are killing your shadow AI strategy

www.csoonline.com · 4 days ago

Shadow IT has long been a major problem for CISOs, but the biggest problem may be coming from the executive suite’s hunger for unsanctioned AI. Nearly two-thirds of senior decision-makers admit to using unapproved AI tools, compared to just 31% of lower-level employees, according to a survey by Microsoft solutions partner TrustedTech.

GoSerpent Silently Steals Government Files for Weeks Before Sending Them to Hackers

gbhackers.com · 4 days ago

A sophisticated cyber espionage campaign targeting government and diplomatic organizations across Southeast Asia has used a Go-based remote access Trojan, dubbed GoSerpent, to collect sensitive documents for weeks before exfiltrating them via network shares. Researchers first identified the activity in February 2026, although evidence indicates the operation began in late 2025.

CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV

thehackernews.com · 4 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly patched security flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by July 19, 2026. The vulnerability in question is CVE-2026-58644 (CVSS score: 9.

Two Scattered Spider Hackers Jailed in UK’s Largest Cybercrime Prosecution

gbhackers.com · 4 days ago

Two alleged leading members of the Scattered Spider cybercrime collective have been sentenced to five years and six months in prison each for their involvement in the 2024 cyberattack on Transport for London (TfL). The National Crime Agency (NCA) described this case as the largest cybercrime prosecution in the UK.

Coca-Cola Suspends US Fairlife Production Due to Ransomware Attack

www.securityweek.com · 4 days ago

The company says the incident has not affected product quality and safety, nor Fairlife’s Canada production.

7-Zip Vulnerability Lets Attackers Trigger Heap Buffer Overflow Using Malicious Files

gbhackers.com · 4 days ago

A newly disclosed vulnerability in 7-Zip could allow attackers to execute arbitrary code by tricking users into opening a specially crafted XZ-compressed file. Tracked as CVE-2026-14266 and identified by Trend Micro’s Zero Day Initiative as ZDI-26-444 (ZDI-CAN-30169), the flaw is a heap-based buffer overflow in the archive utility’s handling of XZ chunked data.

Linux Creator Linus Torvalds Rejects Anti-AI Push and Defends LLM Tools

gbhackers.com · 4 days ago

Linux creator and top-level kernel maintainer Linus Torvalds has made it clear that the Linux kernel project will not adopt an anti-AI stance. He believes that large language models and related tools should be assessed based on their technical value rather than dismissed outright.

ACR Stealer Uses ClickFix, WebDAV, and Steganography to Steal Browser Credentials and Tokens

gbhackers.com · 4 days ago

A surge in ACR Stealer activity from late April through mid-June 2026, with operators combining ClickFix social engineering, WebDAV-hosted payloads, PowerShell obfuscation, and steganography to compromise enterprise users.

Five-Layer Fileless Malware Uses JScript and PowerShell to Evade AMSI and Load .NET Payload

gbhackers.com · 4 days ago

An active phishing campaign using a five-layer, fileless malware loader to evade Microsoft’s Antimalware Scan Interface (AMSI), static detection controls, and disk-based forensic analysis. The campaign delivers a Windows Script Host JScript payload inside a TAR archive disguised as a purchase order, ultimately loading a.NET assembly directly into memory.

AnyDesk Zero-Day Flaw Allows Local Attackers to Trigger System-Wide Denial-of-Service

gbhackers.com · 4 days ago

A newly disclosed zero-day vulnerability in AnyDesk has the potential to allow a local attacker to trigger a denial-of-service condition by exploiting the remote-access software’s “Send Support Information” feature. The advisory, tracked as ZDI-26-401 and ZDI-CAN-26645, was published by Trend Micro’s Zero Day Initiative (ZDI) on July 8, 2026.

ACR Stealer: Two observed intrusion chains amid increased threat activity

www.microsoft.com · 4 days ago

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments.

AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report

unit42.paloaltonetworks.com · 4 days ago

Explore Unit 42's perspectives on AI's impact on cybersecurity, including key updates since the 2026 Incident Response Report.

New ClickLock macOS malware traps users into revealing login password

www.bleepingcomputer.com · 4 days ago

A new macOS information-stealing malware dubbed ClickLock terminates all visible processes to force users into entering their system login password.

Coca-Cola says Fairlife ransomware attack halts US dairy production

www.bleepingcomputer.com · 4 days ago

The Coca-Cola Company disclosed today that a ransomware attack impacting its Fairlife dairy subsidiary has disrupted operations, temporarily suspending production of Fairlife products across the United States.

Anubis ransomware: what you need to know

www.fortra.com · 4 days ago

The Anubis ransomware-as-a-service (RaaS) operation has hit some healthcare organisations hard - but they are not the only ones at risk. Read more in my article on the Fortra blog.

Agentic AI Is Untamable: Ask the Right Security Questions

www.darkreading.com · 4 days ago

Forget about attackers. Agentic artificial intelligence is creating enough risks for organizations and demands a security reframe.

1M+ Emails Use Hidden Text to Dupe AI Security Filters

www.darkreading.com · 4 days ago

Artificial intelligence and LLMs can be surprisingly ineffective against text salting, allowing phishing emails to slide right into your inbox.

Claude Chrome extension flaw lets malicious extensions trigger AI actions

www.bleepingcomputer.com · 4 days ago

A flaw in Anthropic's Claude for Chrome browser extension could allow a malicious extension to trigger predefined AI actions by simulating user clicks, potentially allowing it to abuse Claude's access to connected services such as Gmail, Google Docs, Google Calendar, and Salesforce.

White House Teleprompter Operator Bet on Trump Speeches, Kalshi Says

www.nytimes.com · 4 days ago

A technical assistant to President Trump won around $100,000, according to the prediction market, which flagged the activity to the federal government.

New OkoBot framework deploys 20 payloads to steal data, crypto

www.bleepingcomputer.com · 4 days ago

A new malicious framework called OkoBot is delivering more than 20 payloads in attacks focused on stealing cryptocurrency wallet seed phrases, credentials, and other sensitive data.

The Biggest Data Breaches of 2026 So Far, Ranked by Impact

www.techrepublic.com · 5 days ago

The biggest data breaches of 2026 so far, ranked by impact, with details on exposed data, affected users, and what readers should do next.

Zoom patches account takeover hole

www.csoonline.com · 5 days ago

Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.” The issue is especially significant given Zoom’s extensive reach; it reportedly has more than 300 million daily active users, including 470,000 paying business customers.

New Exploitable BOLA Found in Immich (self-hosted media platform)

escape.tech · 5 days ago

Full disclosure I'm at Escape but wanted to share something we found that would be interesting to those here! Escape's security research team found a Broken Access Control flaw in Immich which let any user read photos in a locked folder without the required PIN. Immich is a self-hosted media platform with 100k+ stars on GitHub.

Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack

thehackernews.com · 5 days ago

Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on Thursday, 16 July 2026, for the 2024 hack of Transport for London. The attack left 148 TfL systems inoperable and forced all 27,000 of the transport authority's employees into an office to get their passwords reset in person.

SpaceXAI Open-Sources Grok Build After Privacy Backlash

www.techrepublic.com · 5 days ago

SpaceXAI open-sourced Grok Build under Apache 2.0 after privacy backlash over broad directory uploads from its terminal AI coding agent.

Claude for Chrome Flaw Puts Gmail at Risk From Rogue Extensions

www.techrepublic.com · 5 days ago

Researchers say a Claude for Chrome flaw lets rogue extensions trigger Gmail, Docs, and Calendar tasks, with greater risk in unattended mode.

Mary-Dell Chilton Dies at 87; Helped Create First Genetically Modified Plant

www.nytimes.com · 5 days ago

In 1982, she led the research team that figured out how to genetically alter plants, a discovery that would eventually transform global agriculture.

Least privilege for AI agents: Identity, access, and tool binding

www.microsoft.com · 5 days ago

As AI agents become more autonomous, strong identity, access, and auditing controls are critical to keeping them secure.

Top 10 Firewall Solutions Setting New Cybersecurity Standards in 2026

gbhackers.com · 5 days ago

The firewall category is reinventing itself faster than at any point since NGFW arrived and 2026’s leaders aren’t just shipping better boxes, they’re redefining what “firewall” means.

ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories

thehackernews.com · 5 days ago

A lot of this week’s trouble starts with something that looks close enough. A familiar repo. A useful installer. A harmless sync setting. Then the handoff goes bad, the box starts talking to someone else, and the damage moves faster than the explanation. Old bugs are back, weak defaults are earning their keep, and some attack paths are so plain they barely feel like research. Here’s the mess.

Legacy Systems, Real-World Impacts: The Reality of OT Security

www.securityweek.com · 5 days ago

Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts.

Someone Used A.I. to Write an Unauthorized Biography of Me. I Don’t Recommend Reading It.

www.nytimes.com · 5 days ago

Someone used A.I. to write my biography. Thousands more of those books are polluting Amazon. Who is behind all this drivel?

Europe tells Google it must open Android phones to rivals’ AI bots

www.washingtonpost.com · 5 days ago

European officials ordered Google to make it easier for Android users to summon AI assistants from competing companies. Officials stated this regulatory move aims to promote competition against Google's dominant position in the European smartphone market.