Blahalla

Meta to Use Off-Site Business Data for Feed and AI Personalization

thehackernews.com · a month ago

Meta announced plans to use off-site information shared by other businesses to personalize user feeds and responses from its AI chatbot. This greatly expands Meta's data usage, moving beyond limited ad targeting. The company stated it already collects data detailing people's activity on various websites.

Anthropic Launches Claude Fable 5: Mythos-Class AI With Cybersecurity Guardrails

www.securityweek.com · a month ago

The AI giant also announced that Project Glasswing partners are being given access to the upgraded Mythos 5.

OpenSSL Patches High-Severity Vulnerability Found With AI

www.securityweek.com · a month ago

A total of 18 vulnerabilities have been patched in the latest OpenSSL releases, including many that were potentially discovered by AI.

Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code

thehackernews.com · a month ago

Veeam released security patches addressing a critical flaw in its Backup & Replication software. Tracked as CVE-2026-44963, this vulnerability allows remote code execution (RCE) on the Backup Server using only an authenticated domain user account. The advisory highlights the flaw carries a high CVSS score of 9.4 out of 10.

Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues

thehackernews.com · a month ago

Microsoft on Monday confirmed that it temporarily removed some GitHub repositories in response to a recent security incident that led to 73 of its open-source projects being compromised to inject an information stealer into the code. "Our priority is to protect customers and the broader ecosystem," a Microsoft spokesperson told The Hacker News via email.

Spyware firm targeted WhatsApp users in defiance of US court order, Meta says

www.theguardian.com · a month ago

Tech company says it ‘caught and disrupted’ NSO Group’s attempts to access accounts in Jordan and Lebanon A spyware firm has been targeting WhatsApp users with malicious links in contravention of a US court order forbidding it from doing so, Meta has said.

XBOW tests Anthropic's Mythos Preview for offensive security

www.bleepingcomputer.com · a month ago

Anthropic's Mythos Preview was highly effective at finding vulnerability candidates, especially when analyzing source code. XBOW explores how the model performed across exploit discovery, reverse engineering, and live-site validation.

GitHub disables Microsoft repos pushing password-stealing malware

www.bleepingcomputer.com · a month ago

Microsoft removed 73 repositories across its Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations on GitHub, disrupting continuous integration pipelines.

Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs

www.darkreading.com · a month ago

Two separate campaigns target CVE-2025-8088, fixed last July, to conduct data theft and cyberespionage against military and government targets in Ukraine.

GPS As a Key Distribution Platform

www.schneier.com · a month ago

This is interesting: The U.S. military has likely been quietly broadcasting codes for its global encryption network using public GPS for nearly 20 years, turning each satellite into a hidden “numbers station,” according to Steven Murdoch… That means every device that uses GPS has been receiving hidden government information for years, and nobody outside the military knew it until now.

Claude Mythos Turns N-Days Into N-Hours With Rapid Exploit Creation

www.securityweek.com · a month ago

Public LLM models with safeguards turned off can also build working exploits, increasing patch gap risks.

Dutch Authorities Block $115 Million Deal by a U.S. Tech Company

www.nytimes.com · a month ago

The Netherlands blocked a U.S. company from buying a Dutch firm that handles its national ID system, saying it would create a “threat to the public interest.

Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability

sec.cloudapps.cisco.com · a month ago

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

New Veeam vulnerability exposes backup servers to RCE attacks

www.bleepingcomputer.com · a month ago

Veeam has released security updates to patch a critical Backup & Replication security flaw that can be exploited to gain remote code execution (RCE) on domain-joined backup servers.

Why Apple’s A.I. Upgrade for Siri Won’t Be Available in Europe

www.nytimes.com · a month ago

A regulatory dispute has indefinitely delayed the release of Siri AI.

X.com silently injects session-bound tracking tokens into your clipboard on every copy — security tools correctly flag this as malicious injection

gitlab.com · a month ago

Did some digging into why pasting from X.com triggers "malicious injection" warnings in security tools (CrowdStrike, Defender, SentinelOne). Turns out it's not a false positive. Every time you copy text or a link from X.com, their JavaScript intercepts the copy event and rewrites your clipboard before it lands. Three injection vectors: URL tracking, clean tweet links get?s=12&t=

MagicAd Android Malware Bypasses Restrictions to Flood Devices With Ads

gbhackers.com · a month ago

Android.MagicAd, a stealthy Android trojan family that circumvents operating-system safeguards to push intrusive ads from the background. The apps were short-lived in the catalogs appearing for weeks then removed yet any installed copies remained active on user devices, allowing attackers to sustain ad-fraud and persistence while reducing exposure in app stores. Technically sophisticated, Android.

New Platform Uses Cryptographic Invisibility to Protect AI-Built Applications

www.securityweek.com · a month ago

Atsign’s AI Architect applies cryptographic protections to agentic software development, aiming to prevent attackers from exploiting vulnerabilities by making application identities effectively invisible.

Meta Instagram Recovery Flaw Exposed More Than 20,000 Accounts

www.techrepublic.com · a month ago

Meta reported a bug in its AI-assisted account recovery workflow, compromising user security on Instagram. Attackers likely exploited this vulnerability to reset passwords for more than 20,000 Instagram accounts. The flaw existed within the company's specialized recovery process.

Microsoft Defender Adds Monitoring for RPC Protocol Abuse in Cyberattacks

gbhackers.com · a month ago

Microsoft has introduced enhanced monitoring capabilities in Microsoft Defender for Endpoint to detect and disrupt cyberattacks that abuse the Remote Procedure Call (RPC) protocol, a core Windows communication mechanism that threat actors frequently exploit for lateral movement and credential access. Announced on June 8, 2026, the update provides granular visibility into inbound remote RPC activit

WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine

thehackernews.com · a month ago

Two Russia-aligned cyber attack campaigns have continued to exploit a security flaw in WinRAR to target Ukrainian organisations, almost a year after patches for the vulnerability were released. The activity has been attributed by Trend Micro to Earth Dahu (aka Gamaredon) and SHADOW-EARTH-066 (aka UAC-0226). It involves the exploitation of CVE-2025-8088, a path traversal flaw that allows an

SAP Patches Critical NetWeaver, Commerce Vulnerabilities

www.securityweek.com · a month ago

The flaws could lead to the disclosure of sensitive information, memory corruption, and disruption of normal system usage.

LiteLLM Vulnerability Allows Attackers to Execute Arbitrary Commands on Servers

gbhackers.com · a month ago

A critical vulnerability chain affecting LiteLLM has been identified, enabling unauthenticated remote code execution (RCE) on exposed servers. Tracked as CVE-2026-42271 and chained to CVE-2026-48710, the issue allows attackers to bypass authentication controls and execute arbitrary system commands, posing a severe risk to AI infrastructure that relies on LiteLLM deployments. LiteLLM Vulnerability

New BitB Phishing Attack Targets Microsoft 365 Logins

gbhackers.com · a month ago

A new Browser-in-the-Browser (BitB) phishing campaign is abusing fake OAuth login windows to steal Microsoft 365 credentials, and its design is polished enough to bypass casual visual checks. The attack uses a draggable popup that mimics a real browser dialog. However, it is embedded in the page itself and paired with a spoofed Microsoft OAuth

Check Point warns of ransomware-linked attacks exploiting outdated VPN protocol

www.csoonline.com · a month ago

Check Point has issued emergency hotfixes for a pair of vulnerabilities affecting VPN deployments that still use the deprecated Internet Key Exchange version 1 (IKEv1) protocol, warning that one of the flaws is already being exploited in the wild. The more serious issue allows attackers to establish VPN sessions without a valid password, potentially giving them a foothold inside corporate networks

Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models

thehackernews.com · a month ago

University of Toronto researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight large language model to reason its way through a network, generate tailored attack strategies for each target it encounters, and replicate itself, all without human intervention and without touching a commercial AI service. The preprint, posted to arXiv on

Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now

thehackernews.com · a month ago

Google has released security updates to address 74 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-11645 (CVSS score: 8.8), has been described as an out-of-bounds memory access in V8, Chrome's JavaScript and WebAssembly engine. "Out-of-bounds read and write in V8 in Google Chrome prior to 149.0.7827.103

Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks

www.securityweek.com · a month ago

The most recent variants of the self-propagating attacks are named Miasma and Hades.

North Korea Hackers Weaponize GitHub to Target Developers

gbhackers.com · a month ago

A sustained phishing campaign that leverages developer recruitment and code-review lures to deliver cross‑platform malware via attacker-controlled GitHub repositories. Tracked as UNKDeadDrop and attributed with high confidence to a North Korea‑aligned actor, the operation targeted nearly 100 organizations across finance, cryptocurrency, education and technology by sending more than 250 tailored em

The Hidden Security Risk in Modern Networks: The Work Between Tools

thehackernews.com · a month ago

Organizations have more visibility than ever. Growing tech stacks provide greater coverage, and network security teams are increasingly adopting AI and automation to help with routine tasks and reduce manual effort. But the same challenges persist. Outages still last hours, causing significant financial losses, operational disruption, and reputational impact. Threat response and mean time to

Security shifts to the human layer as AI scams surge

www.csoonline.com · a month ago

Cybercriminals are increasingly reshaping familiar social-engineering campaigns around the way employees use AI, with separate advisories from Microsoft and Google documenting how attackers are adapting scams to AI-powered tools, trusted digital services, and changing workplace behavior. Microsoft Threat Intelligence, in its advisory, said threat actors are “leveraging the wider global interest ar

Ghost-Sender Flaw Exposes Exchange Online Users to Sender Spoofing Attacks

gbhackers.com · a month ago

Ghost-Sender exposes Exchange Online to spoofing via misconfigurations bypassing SPF/DKIM/DMARC. Attackers forge emails impersonating trusted entities, affecting over 20% of tested domains.

Microsoft Entra Agent ID Logs Expose Suspicious Assistive Agent Activity

gbhackers.com · a month ago

Microsoft Entra Agent ID exposed OAuth OBO flow vulnerability. Attackers used assistive agents for actions with delegated user rights (e.g., email). Forensics cross-referenced Purview Exchange, Graph API telemetry, and Azure AD logs to find an agent emailing on behalf of a user from an external IP.

I found 23 Chrome extensions hijacking 758,000 users' searches for affiliate revenue

malext.io · a month ago

SearchJack used 23 deceptive Chrome extensions to hijack searches via the chromesettingsoverrides manifest key. This affected ~758,000 users by routing queries for undisclosed affiliate revenue across eight brokers.

Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks

www.securityweek.com · a month ago

Check Point warned of two zero-day flaws: CVE-2026-50751 (auth bypass via IKEv1) and CVE-2026-50752 (MITM on site-to-site). Qilin ransomware used CVE-2026-50751; CISA added it to KEV. Hotfixes are available for both vulnerabilities.

In the Hybrid A.I.-Human Work Force, Who Will Actually Thrive?

www.nytimes.com · a month ago

Experts Daron Acemoglu, Ethan Mollick, and Clara Shih analyzed how job seekers must navigate the complex disruptions caused by artificial intelligence. The panel addressed widespread concerns about automation and industry layoffs while detailing what a hybrid human-AI workforce will entail. They provided expert advice on preparing workers for fundamental shifts within modern labor markets.

AI worm prototype shows attackers don’t need Mythos to take over your network

www.csoonline.com · a month ago

U of T researchers built an AI worm prototype using local LLMs. It self-replicated in simulations, exploiting misc. configs and various CVEs. The test showed basic AI suffices to hit corporate hardware and steal data.

CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day

www.bleepingcomputer.com · a month ago

CISA urged patching for Check Point VPN flaw CVE-2026-50751 (IKEv1 bypass) used by Qilin Ransomware affiliates against U.S. agencies. Remember to patch CVE-2024-24919 too. Action is required now.

Linux Kernel Flaw Allows Local Attackers to Gain Root Privileges

gbhackers.com · a month ago

Local attackers can achieve root via CVE-2026-23111. This use-after-free bug in Linux netfilter's nftables subsystem allows bypassing KASLR and hijacking control flow by corrupting kernel structures. Exploitation is possible locally.

WhatsApp Blocks Pegasus Spyware Campaign Linked to NSO Group

gbhackers.com · a month ago

WhatsApp disrupted spyware linked to NSO Group (Pegasus). The campaign used spear-phishing for one-click exploitation, violating a U.S. injunction. WhatsApp seeks contempt over targeting journalists/officials.

Weedhack MaaS Targets Minecraft Players to Steal Credentials and Hijack Accounts

gbhackers.com · a month ago

Weedhack sold Malware-as-a-Service against Minecraft players. The malware steals credentials/crypto via trojanized JAR files using JNIC obfuscation for remote access. It queries Ethereum contracts. Over 3,800 malicious samples were linked to this group.

Google patches new Chrome zero-day flaw exploited in the wild

www.bleepingcomputer.com · a month ago

Google patched Chrome's V8 out-of-bounds read/write flaw (CVE-2026-11645) via crafted HTML. This is the fifth major fix this year; prior fixes included CVE-2026-3909, CVE-2026-5281, CVE-2026-2441, and CVE-2026-3910. Google also noted CVE-2024-0519.

LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE

thehackernews.com · a month ago

CISA added a high-severity command injection flaw in BerriAI LiteLLM to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The vulnerability is tracked as CVE-2026-42271, scoring 8.7 on the CVSS scale. This weakness allows any authenticated user to run arbitrary commands on affected systems.

AI Agents May Always Fall for Prompt Injections

arxiv.org · a month ago

Prompt injection is a critical vulnerability in AI agents. Research shows data-instruction separation defenses fail by manipulating contexts. The study uses Contextual Integrity (CI) as a design framework for safer, context-aware AI.

NFCShare Android Malware Spreads via Weaponized Banking Apps

gbhackers.com · a month ago

A renewed and operationally refined wave of the NFCShare Android banking trojan that delivers NFC card-data theft by masquerading as legitimate banking applications. First documented in January 2026, NFCShare continues to rely on a social‑engineering phishing flow that coerces victims into sideloading malicious APKs; since 14 May 2026 the campaign has pivoted to Italian and

Google Patches 5th Chrome Zero-Day Exploited in 2026

www.securityweek.com · a month ago

Google released Chrome 149, patching 74 vulnerabilities including a zero-day flaw tracked as CVE-2026-11645. This high-severity V8 out-of-bounds read/write issue allows remote code execution and was disclosed by an anonymous researcher in late April. This represents the fifth exploited Chrome zero-day of 2026, alongside CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.

Check Point VPN Zero-Day Under Active Exploitation by Ransomware Operators

gbhackers.com · a month ago

Check Point discloses active exploitation of CVE-2026-50751, an auth bypass in Remote Access VPNs via deprecated IKEv1 (CVSS 9.3). Unauth attackers exploit cert validation flaws. CVE-2026-50752 also affects site-to-site connections with legacy IKEv1 protocols (CVSS 7.4).

Shai-Hulud Malware Campaign Abuses 23 PyPI Packages in Developer-Focused Attack

gbhackers.com · a month ago

Shai-Hulud is a rapidly evolving supply chain campaign weaponizing malicious Python packages on PyPI to target developers. Researchers identified 23 new artifacts, expanding the scope of Mini Shai-Hulud, Miasma, and Hades malware operations. Attackers combine delivery techniques, utilizing native extensions and split-loader tactics, often aiming to steal cloud credentials from CI/CD pipelines.

Meet Hades: The malware that lies to AI security agents

www.csoonline.com · a month ago

Hades Campaign: Supply chain attack via infected Python packages (e.g., ensmallen). Attackers use Bun toolkit for multi-layer payloads scraping data from Linux, macOS, and Windows memory. Malware evades LLM security analysis.

Hackers Exploit ChatGPT, Claude, DeepSeek Brands in Credential Phishing Attacks

gbhackers.com · a month ago

Attackers use social engineering via impersonation (ChatGPT, Claude) instead of breaches. They deploy multi-stage redirect chains and compromised CDNs to trick users into revealing credentials or malware installation. Phishing kits steal credit card data; attackers distribute bad "AI plugins" through malvertising. No CVE numbers are mentioned.