Blahalla

GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks

gbhackers.com · a month ago

GoldFactory has expanded the evasion capabilities of its Gigabud Android banking trojan by deploying Vwork, a weaponized fork of the open-source Shelter application.

ICS Patch Tuesday: Schneider Electric, Siemens Fix Critical Flaws

www.securityweek.com · a month ago

AVEVA and Rockwell Automation also released patches for vulnerabilities affecting industrial control system products.

Fortinet Privileged Access Agent: Any Site Could Control Your Proxy and Watch Your Tab

amibeingpwned.com · a month ago

TL;DR. The FortiPAM Chrome extension (1M+ users), used for Privileged Access Management, allowed any site to set the browser's proxy for the session, alongside allowing any site to create a new tab and send screen recordings of it to an attacker's server. That makes for trivial phishing attacks which only require the user to view something sensitive in the attacker-opened tab. CVSS 9.

Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets

thehackernews.com · a month ago

Bitcoin wallet company Alby has warned of a critical flaw in Alby Hub that could have let an attacker take over a wallet and send its funds, but only where the owner had made the Hub reachable from the internet. Alby Hub is a self-hosted Lightning wallet, meaning the owner runs it on their own computer or server, and it holds their bitcoin. The flaw affects versions v1.7.

Windows BitLocker Flaw Lets Attackers Execute Code on Vulnerable Systems

gbhackers.com · a month ago

Microsoft disclosed CVE-2026-69449, an Important-severity vulnerability in Windows BitLocker. This issue is classified as a heap-based buffer overflow (CWE-122) and may allow remote code execution (RCE). Microsoft released details about this vulnerability on September 8, 2026. The CVSS 3.1 base score is 6.7, with a temporal score of 5.8.

Ivanti Patches Critical Flaws Across Enterprise Security Products

www.securityweek.com · a month ago

Six critical vulnerabilities in Neurons for ITSM could enable remote code execution, while Sentry and EPMM received patches for authentication bypass flaws.

ChatGPT Flaw Could Let Attackers Steal Gmail Data Across User Accounts

gbhackers.com · a month ago

Security researchers have revealed a recently patched flaw in ChatGPT’s isolation system that could have allowed attackers to access data from a victim’s connected Gmail account and send it to a separate ChatGPT account through a hidden cross-account channel.

Over 36,000 exposed Plex servers vulnerable to recent flaws

www.bleepingcomputer.com · a month ago

Over 36,000 Plex Media servers exposed online remain unpatched against multiple security vulnerabilities and are vulnerable to attacks.

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

unit42.paloaltonetworks.com · a month ago

An investigation into how cybercriminals used YouTube gaming lures and SEO poisoning to deliver multi-payload malware to enterprise networks.

When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications

www.csoonline.com · a month ago

Generative AI has moved well beyond the stand-alone chatbot. It now drafts code, searches internal knowledge, reviews contracts, opens support cases and, in some deployments, takes action through connected tools. That broader role changes the security question. A tester is no longer looking only for a model that will say something it should not.

New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser

www.securityweek.com · a month ago

Attackers are using trusted Microsoft services and blob URLs to generate stealthy phishing pages that leave defenders with no static website to detect or block.

This Key Will Self-Destruct: An Open Standard for Revocable API Keys

www.securityweek.com · a month ago

Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default.

Chrome 153 Patches Seventh Zero-Day of 2026

www.securityweek.com · a month ago

The Chrome update includes 230 security fixes, and users are advised to update their browsers as soon as possible.

U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok

thehackernews.com · a month ago

U.S. cybersecurity and intelligence agencies have accused China-based artificial intelligence (AI) companies of conducting "systematic extraction" of proprietary functionalities and capabilities of American frontier models through distillation attacks.

Hackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation

gbhackers.com · a month ago

Threat actors are increasingly operationalizing agentic artificial intelligence to compress cyberattack timelines, automating reconnaissance, vulnerability research, exploit development and credential theft with far less hands-on-keyboard activity. However, current evidence points to semi-autonomous, human-supervised attack chains rather than fully independent AI-driven intrusions in the wild.

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

thehackernews.com · a month ago

Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome's JavaScript and WebAssembly engine.

California, an Environmental Bastion, Warms to Nuclear Energy

www.nytimes.com · a month ago

The state is considering extending the life of its last nuclear power plant, Diablo Canyon, and allowing construction of new reactors to help meet its clean energy goals.

How Amazon’s Zoox Is Taking On Waymo in San Francisco

www.nytimes.com · a month ago

The Amazon-owned driverless car company is a distant second to Waymo. Its pitch to riders? Wine pop-ups, festival sponsorships and a car built to be filmed.

Post-quantum cryptography adoption and the national security implications

www.csoonline.com · a month ago

Quantum computers have advanced significantly in capability and compute power in the last several years and are turning theoretical vulnerabilities in modern cryptography into real-world threats. The shift to post-quantum cryptography (PQC) needs to start now, but several challenges need to be overcome.

Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT

gbhackers.com · a month ago

Threat actors are actively exploiting a critical vulnerability in FortiGate to deploy PivotC2, a Node. js-based remote access trojan (RAT) designed for persistent post-exploitation of FortiOS appliances.

Man gets 15 years for extorting women with AI-generated porn videos

www.bleepingcomputer.com · a month ago

An Ohio man was sentenced to 15 years in prison for multiple cybercrimes, including sextortion and cyberstalking of numerous victims using AI-generated sexually explicit content.

CRPx0 ransomware: what you need to know

www.fortra.com · a month ago

CRPx0 is a cybercrime operation that started off operating a scam before pivoting into a fully-blown ransomware and cryptocurrency business. Read more in my article on the Fortra blog.

Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM

gbhackers.com · a month ago

A newly published proof-of-concept (PoC) called ShieldCrash reveals an unpatched vulnerability in Microsoft Defender that allows a local attacker to gain arbitrary file-read access in the SYSTEM context.

DeepSeek, Alibaba and Chinese AI Firms Extract Billions of Tokens From U.S. AI Models

gbhackers.com · a month ago

U.S. intelligence and cybersecurity agencies have accused six China-based AI companies including DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun and Z.AI of extracting billions of tokens from leading American AI systems through industrial-scale knowledge-distillation campaigns.

50% of CISOs see Mythos as a sign to exit the profession

www.csoonline.com · a month ago

CISOs already have it tough, but the straw that breaks the back of many IT security executives may be the rapidly advancing capabilities of frontier AI models, enterprise insistence on rapid and widespread AI experimentation, and the compounding risk responsibilities and personal liabilities surrounding all that.

New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root

thehackernews.com · a month ago

cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user. cPanel published the advisory on September 8 and says every supported version of cPanel and WHM is affected.

The 12 Best Managed XDR Services, Compared and Priced

gbhackers.com · a month ago

Best value overall: Bitdefender, competent managed XDR at pricing that mid-market organizations can approve, which most of this list cannot claim. Best detection research: Secureworks Taegis. Best telemetry breadth: Palo Alto Unit 42. Best for keeping your existing tools: Stellar Cyber and ReliaQuest. Best Microsoft-native: Ontinue.

The 12 Best Managed Detection & Response (MDR) Services, Compared and Priced

gbhackers.com · a month ago

Best value overall: Huntress, published pricing, purpose-built for small business, and genuinely good at the threats that segment faces. Best response authority: CrowdStrike Falcon Complete. Best transparency: Expel. Best bring-your-own-tools: Red Canary and Expel. Best Microsoft-native: Ontinue. The contract clause that determines whether MDR actually protects you is buried on page nine.

The 12 Best Extended Detection & Response (XDR) Platforms, Compared and Priced

gbhackers.com · a month ago

Best value overall: Microsoft Defender XDR, included in Microsoft 365 E5 and genuinely strong across Microsoft’s own surface, which for most organizations is most of their surface. Best open XDR: Stellar Cyber, built to ingest whatever you already own. Best native correlation: Palo Alto Cortex XDR. Best detection: CrowdStrike.

The 12 Best Endpoint Detection & Response (EDR) Solutions, Compared and Priced

gbhackers.com · a month ago

Best value overall: Microsoft Defender for Endpoint P2, included in Microsoft 365 E5 and genuinely competitive, which makes its marginal cost zero for a large share of the market. Best for lean teams: Cynet, which bundles the whole stack plus a 24/7 SOC into one price. Best detection: CrowdStrike, leading among top EDR companies.

The 12 Best Antivirus Software for Mac, Compared and Priced

gbhackers.com · a month ago

Best value overall: Bitdefender, leading detection at mid-range pricing with a light footprint. Best free option: Malwarebytes’ scanner, which cleans an infected Mac without costing anything. Best macOS specialist: Intego. Best bundle: Norton, if you’ll actually use the VPN, backup, and identity monitoring.

F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

thehackernews.com · a month ago

Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy held in memory, so a check of the file on disk can come back clean.

New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access

www.bleepingcomputer.com · a month ago

An anonymous security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldCrash" right after Microsoft rolled out its September 2026 Patch Tuesday security updates.

cPanel EmailTrack SQL Injection Flaw Lets Attackers Execute Code as Root

gbhackers.com · a month ago

cPanel has disclosed CVE-2026-67401, a SQL injection vulnerability in its EmailTrack functionality. This flaw allows an authenticated account holder to create arbitrary files on a server, which can ultimately enable them to execute code with root privileges. The issue, published on September 8, 2026, affects all supported cPanel/WHM release versions before their respective fixes.

Fortinet FortiSandbox Vulnerability Allows Unauthenticated Attackers to Access Sensitive Information

gbhackers.com · a month ago

Fortinet has disclosed a critical vulnerability involving improper access control in the FortiSandbox web interfaces. This issue could allow an unauthenticated remote attacker to access sensitive information by sending specially crafted HTTP requests. The vulnerability is tracked as CVE-2026-26084 and documented in advisory FG-IR-26-166.

Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data

gbhackers.com · a month ago

Information-stealing malware is expanding its collection logic to target locally stored data from AI coding agents, including Claude, Cursor, Codex, Cline, Continue, and OpenCode.

Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed

thehackernews.com · a month ago

The security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender. The vulnerability, codenamed ShieldCrash, is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7.8), also called ShieldBreak, which the researcher reported last month.

Ivanti Patches 10 EPMM, Neurons for ITSM and Sentry Flaws Enabling RCE and Admin Access

gbhackers.com · a month ago

Ivanti has released security updates addressing 10 vulnerabilities in Endpoint Manager Mobile (EPMM), Neurons for ITSM, and Sentry. The vulnerabilities include several critical remote code execution (RCE) issues in Neurons for ITSM, an authentication bypass in Sentry that could grant administrative access, and a privilege escalation flaw in EPMM.

Google warns of new Chrome zero-day bug exploited in attacks

www.bleepingcomputer.com · a month ago

Google has patched 230 vulnerabilities on Tuesday, including another actively exploited Chrome zero-day bug, the seventh such vulnerability patched since the start of the year.

SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution

thehackernews.com · a month ago

SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport (EPP) Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 (CVSS score: 10.0), has been described as a case of memory corruption.

Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency

gbhackers.com · a month ago

A cryptocurrency-stealing campaign that abuses Google Sheets and the Google Visualization API as a covert command-and-control channel, delivering obfuscated JavaScript directly into victims’ browser sessions.

Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild

gbhackers.com · a month ago

Google released Chrome version 153 to the Stable channel for Windows, macOS, and Linux, including 230 security fixes and addressing CVE-2026-87491, a zero-day vulnerability currently being exploited in the wild. Because of the unusually large number of fixes, consumers and enterprise defenders should update their browsers promptly. The desktop releases are version 153.0.8010.

Massive Redis Cryptojacking Campaign Hijacks Thousands of Linux Servers

gbhackers.com · a month ago

A large-scale Redis cryptojacking operation targets thousands of exposed Linux servers by abusing unauthenticated Redis deployments to install XMRig cryptocurrency miners and establish durable, cron-based persistence.

Microsoft September 2026 Patch Tuesday Fixes 973 Vulnerabilities and 2 Exploited Zero-Days

gbhackers.com · a month ago

Microsoft’s September 2026 Patch Tuesday security update addresses 973 vulnerabilities across various products, including Windows, Microsoft Office, Azure components, Exchange Server, developer tools, and others. Among these vulnerabilities are two zero-day flaws reported as actively exploited.

Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

thehackernews.com · a month ago

Microsoft on Tuesday broke Patch Tuesday records by addressing an earth-shattering 974 vulnerabilities spanning its software portfolio, including two flaws that it said have been actively exploited in the wild. These include 723 flaws in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools. Of these, over 110 shortcomings have been assigned a critical severity rating.

N-able N-central Pre-Auth RCE Flaw Exploited in the Wild

thehackernews.com · a month ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 11, 2026. The vulnerability in question is CVE-2026-86218 (CVSS score: 10.

September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows

www.csoonline.com · a month ago

Possibly wormable bugs and two zero-day holes highlight the almost 1,000 fixes issued today by Microsoft in its September Patch Tuesday release. The 964 vulnerabilities, another record since Microsoft began using AI in the middle of the year to find holes, require customer action.

Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch

www.csoonline.com · a month ago

Cisco is looking to get ahead of attackers with a new set of more than a half-dozen fixes, some of them critical, for its IOS XR Linux-based network operating system (OS). As part of its regular testing, Cisco’s software engineering team flagged “multiple internally-discovered vulnerabilities,” the company said.

Microsoft adds age-awareness APIs that can tell if users are children, teens, or adults

www.bleepingcomputer.com · a month ago

Microsoft is adding new age-awareness APIs to Windows 11 that will allow apps to determine whether someone is a child, teenager, or adult without exposing their exact date of birth.

SVD-2026-0901: Advance Notice of Publication of Splunk Security Advisories - September 2026

advisory.splunk.com · a month ago

On September 16, 2026, Splunk PSIRT will publish advisories to disclose security vulnerability advisories for Splunk Enterprise, Universal Forwarder, and Splunk Apps and Add-ons.