Blahalla

Internet Explorer WebBrowser Control Abuse Lets Attackers Convert Clicks Into RCE

gbhackers.com · a month ago

Internet Explorer’s legacy WebBrowser control can be abused to turn seemingly harmless user clicks into full remote code execution (RCE), even on systems that no longer use Internet Explorer as a standalone browser. Although Microsoft officially ended support for IE, the Trident engine and WebBrowser ActiveX control remain embedded in numerous Windows applications built with

Silent Ransom Group Uses DNS Fast Flux in Attacks

www.securityweek.com · a month ago

Focusing on hacking law firms in the US, the ransomware group relies on fast flux to hide its C&C infrastructure.

VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances

thehackernews.com · a month ago

A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM, as well as two other malware families codenamed PLENET (aka GRIMBOLT) and AGENTPSD to target Linux systems. The activity has been attributed by Volexity to a threat cluster it tracks as VerdantBamboo, which it said overlaps with hacking groups known as Clay Typhoon (Microsoft)

China-Linked OP-512 Targets IIS Servers With Unique Web Shell Framework

gbhackers.com · a month ago

A suspected China-linked espionage cluster dubbed OP-512 after rapidly correlating many low-fidelity events into a single high-priority incident that human analysts then validated. OP-512 compromised an Internet Information Services (IIS) server and deployed a custom web shell framework built to evade signature-based detection. Each web shell instance is cryptographically unique, restricts access

Lucid Stealer Hits 18 Browsers, Crypto Wallets, and Discord Tokens

gbhackers.com · a month ago

A new, fully featured Lucid Stealer build that combines large-scale credential theft with hidden remote access. The sample, distributed through Telegram-linked underground channels, is not a simple packed executable but a Lucid-branded information stealer and RAT wrapped inside a legitimate Node.js Single Executable Application (SEA). Static analysis recovered an embedded JavaScript loader and dec

ExpressVPN Is on Sale for $40: A Great Deal for Remote Teams

www.techrepublic.com · a month ago

For remote workers and IT professionals juggling multiple devices, this VPN deal is worth a serious look.

Apple Expected to Detail Its A.I. Plans at Conference

www.nytimes.com · a month ago

For the second time, the company is expected to explain its artificial intelligence plans. Unlike some rivals, it is not reorganizing around the technology.

Two New Studies Ask: Did the iPhone Cause Birthrates to Decline?

www.nytimes.com · a month ago

Modern smartphones rolled out in 2007, the year that fertility rates began falling. Two studies say that is not a coincidence.

B.F.I. Preserves ‘Charlie Bit My Finger’ and More Videos in Archive of Viral Moments

www.nytimes.com · a month ago

The British Film Institute assembled more than 400 videos in an archive of culturally significant internet moments. See what made the cut.

15 tough cybersecurity questions every CISO must answer

www.csoonline.com · a month ago

As CISOs know, an effective security program cannot be static. Rather, it must adapt to the evolving threat landscape and an ever-changing business environment. To adapt and improve, CISOs must continuously evaluate their existing program. That starts with asking tough questions about their performance, investments, and strategies. Here, security leaders share 15 questions every CISO should ask to

Why most enterprise security teams would fail a military readiness test

www.csoonline.com · a month ago

Have you ever watched a military cyber ops team go to work responding to a cyberattack simulation? It’s like that scene from Die Hard 4.0 when all the screens start flashing red and systems start shutting down; however, unlike the movies, where bumbling government IT workers are caught out and panicking, our military actually moves with practiced precision to understand, contain, and mitigate the

OpenAI Rolling Out ChatGPT Account Security Controls

www.securityweek.com · a month ago

The Active Sessions and Lockdown Mode features are being made more broadly available by the AI giant.

Critical Redis Vulnerability Could Let Attackers Execute Code and Hijack Servers

gbhackers.com · a month ago

A critical vulnerability in Redis, tracked as CVE-2026-23631 and dubbed “DarkReplica,” exposes authenticated deployments to remote code execution (RCE) through a complex use-after-free (UAF) condition in the replication subsystem. Discovered by security researcher Yoni Sherez during the ZeroDay. In the Cloud 2025 competition, the flaw demonstrates how Redis’s internal Lua execution model and repli

Instagram Patches Account Recovery Flaw Leaking User Contact Information

gbhackers.com · a month ago

A critical logic flaw in Instagram’s web-based account recovery workflow exposed unredacted user contact information, including full email addresses and phone numbers, before Meta rapidly patched it on June 6, 2026. The vulnerability, which affected the platform’s password reset interface, allowed any unauthenticated user to initiate a standard recovery request for a target username and

Anthropic Urges Industry Coordination to Allow for a ‘Pause’ in AI Development if Risks Grow

www.securityweek.com · a month ago

The proposed coordination would let advanced AI labs verify that global rivals have actually stopped or slowed their work.

SolarWinds Serv-U Vulnerability Exploited in the Wild

www.securityweek.com · a month ago

CISA added the SolarWinds Serv-U vulnerability, CVE-2026-28318, to its Known Exploited Vulnerabilities catalog following reports of unauthenticated attacks. These flaws exploit a Denial-of-Service issue using crafted POST requests, crashing the core service. Organizations must install the vendor hotfix immediately, especially those running End-of-Life versions like 15.4.2.

UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign

thehackernews.com · a month ago

Cybersecurity researchers have disclosed details of a financially motivated data theft extortion campaign that has targeted dozens of organizations across professional, legal, and financial services in the U.S. between January and May 2026. The activity has been attributed by Google Mandiant and Google Threat Intelligence Group (GTIG) to a threat actor dubbed UNC3753, which is also known as

Ukraine’s foreign minister offer recipe for improved resilience

www.csoonline.com · a month ago

Dmytro Kuleba, former Ukrainian Foreign Minister, taught that resilience hinges on pre-planning following the Russian invasion. He cited KyivStar restoring its network after a cyberattack in December 2023 due to preparedness. Kuleba advised global technologists, stressing that proactive contingency planning remains vital even when facing unexpected crises.

Critical UniFi OS RCE Chain Grants Root Access Without Credentials

gbhackers.com · a month ago

A critical vulnerability chain in UniFi OS Server allows unauthenticated remote code execution leading to full root takeover. This exploit combines an authentication-gateway bypass and a path-traversal mismatch, along with command injection issues within the package-update service. Attackers can send one crafted HTTP request to gain root access via the admin interface without needing credentials.

Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse

www.securityweek.com · a month ago

Meta reported that hackers compromised about 20,000 Instagram accounts by exploiting a vulnerability in its account recovery support tool. This flaw allowed attackers to reset passwords using an unassociated email address without proper verification. The social media giant disabled the tool and informed authorities about the breach impacting high-profile targets like the Obama White House.

VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks

thehackernews.com · a month ago

Microsoft added a two-hour delay when updating VS Code extensions automatically. This measure aims to strengthen protection against software supply chain threats. The feature adds an extra layer of defense upon publishing newer versions.

Over 20,000 Instagram accounts stolen in Meta AI support hack

www.bleepingcomputer.com · a month ago

Hackers gained access to 20k+ Instagram accounts via a flaw in Meta's High Touch Support AI. Attackers reset passwords without MFA or email verification. Meta disabled HTS; users beware of stolen DMs/data.

EDRChoker Tool Abuses Windows QoS Policies to Disrupt Endpoint Security Tools

gbhackers.com · a month ago

A newly disclosed red-team tool dubbed “EDRChoker” is drawing attention across the cybersecurity community for its novel approach to disrupting Endpoint Detection and Response (EDR) visibility by abusing Windows Policy-based Quality of Service (quality of service). Unlike traditional EDR evasion techniques that rely on firewall manipulation or Windows Filtering Platform (WFP) rule injection, EDRCh

Microsoft Warns Claude Code GitHub Action May Expose CI/CD Secrets

gbhackers.com · a month ago

Anthropic’s Claude Code GitHub Action could unintentionally expose CI/CD workflow secrets when AI agents process untrusted GitHub content. The risk arises because certain tools the agent uses to read files were not sandboxed like subprocess execution paths such as Bash. In particular, the Read tool was able to access /proc/self/environ and returned environment variables, including

Hackers Exploit Claude Code MCP Traffic to Hijack OAuth Authentication Tokens

gbhackers.com · a month ago

Threat researchers have uncovered a novel man-in-the-middle (MitM) attack chain targeting Anthropic’s Claude Code ecosystem, where adversaries hijack Model Context Protocol (MCP) traffic to steal OAuth authentication tokens and persist access to enterprise SaaS platforms. The technique, detailed by Mitiga, abuses weak protections around the local Claude Code configuration file (~/.claude.json), ef

Free Samsung and LG Smart TV Apps Reportedly Exploit Devices for AI Proxy Traffic

gbhackers.com · a month ago

Free apps available on Samsung, LG, Roku, and other connected TV (CTV) platforms are quietly enrolling users’ smart televisions into a commercial residential proxy network operated by Bright Data, according to a technical investigation published June 5, 2026, by Include Security researcher Buchodi. The embedded SDK, embedded inside partner apps under the guise of a

Hackers Exploit 2026 FIFA World Cup With Phishing and Ticket Scams

gbhackers.com · a month ago

Cybercriminals are already turning the 2026 FIFA World Cup into a fraud opportunity, using phishing pages, fake online stores, and ticket scams to steal money and personal data. The risk is rising because the tournament will attract huge global demand, fast purchases, and buyers who may act quickly before checking whether a site is real.

New ChatGPT Lockdown Mode Aims to Block Prompt Injection and Data Exfiltration Attacks

gbhackers.com · a month ago

OpenAI this week introduced Lockdown Mode, a security-focused setting for ChatGPT designed to reduce the risk of data exfiltration from prompt-injection attacks. The feature is rolling out to eligible personal accounts (Free, Go, Plus, Pro) and self-serve ChatGPT Business workspaces, and managed-workspace administrators can assign a Lockdown Mode role to members. Prompt injection is a

Hands on with Intelligent Terminal, an AI-powered Windows Terminal

www.bleepingcomputer.com · a month ago

Microsoft has created an open-source fork of Windows Terminal called "Intelligent Terminal," and it allows you to use AI directly inside Terminal without interfering with the regular session.

Top 10 Best Software Composition Analysis (SCA) Tools for Security Teams in 2026

gbhackers.com · a month ago

The complexity of modern software development requires security to be deeply embedded within the engineering pipeline rather than treated as an afterthought. With modern applications consisting of over 80% open-source components, the attack surface has shifted drastically. Whether you are managing extensive codebases or integrating third-party APIs, catching flaws before code is compiled is crucia

C0XMO botnet spreads via DD-WRT router flaw, kills rival malware

www.bleepingcomputer.com · a month ago

A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures.

Silent Ransom Group targets law firms with fake IT support calls

www.bleepingcomputer.com · a month ago

The Silent Ransom Group extortion gang is actively targeting U.S. law firms and professional services organizations in social engineering attacks that often lead to data theft within hours of initial contact, according to a new report by cybersecurity firm Mandiant.

Emphere Raises $2.1 Million for AI-Powered Vulnerability Remediation

www.securityweek.com · a month ago

Emphere’s solution delivers AI-driven remediation to software companies to speed up releases.

EDRChoker: Choking The Telemetry Stream to Bypass Defenses

www.zerosalarium.com · a month ago

EDRChoker uses Policy-based Quality of Service (QoS) to set hard bandwidth caps (throttling) on Endpoint Detection and Response (EDR) agents, causing them to always time out - effectively blocking them.

PSA: Attack Shark R85 HE (FREEWOLF US / Amazon) — BadUSB credential harvester, confirmed malware

www.amazon.com · a month ago

TL;DR: Bought an Attack Shark R85 HE from FREEWOLF US on Amazon. Plugged it in. It immediately ran a BadUSB credential-harvesting attack, opened login pages, ran PowerShell recon, targeted my password manager, and downloaded confirmed malware. Windows Defender detected two threats, both requiring manual removal. Two days of incident response. Amazon called it a defective return. It wasn't defectiv

CVE-2026-46640: Developing payloads for Twig sandbox bypass

gist.github.com · a month ago

I recently learned about multiple sandbox bypasses discovered in Twig by project Glasswing. From the descriptions, only CVE-2026-46640 and CVE-2026-46633 seemed universally exploitable, so I decoded to research them. This writeup documents my development of payloads for the CVE-2026-46640 and the corresponding SSTImap module.

Critical Everest Forms Pro flaw exploited to take over WordPress sites

www.bleepingcomputer.com · a month ago

Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro plugin, which lets them take complete control of a WordPress website.

New ChatGPT Lockdown Mode Limits Tools That Could Enable Data Exfiltration

thehackernews.com · a month ago

OpenAI has begun rolling out a new Lockdown Mode to ChatGPT for eligible personal accounts to reduce the risk of data exfiltration arising from prompt injection attacks. The feature is primarily designed for people and organizations that handle sensitive data and require stricter protection guarantees. Lockdown Mode is available to logged-in users across Free, Go, Plus, and Pro, and

China-Linked Espionage Cluster Deploys Custom ASPX/ASHX Shells on IIS

gbhackers.com · a month ago

OP-512, a China-linked espionage cluster, targets end-of-life Windows Server 2016/NET Framework 4.0 via custom web shells on IIS. They use specialized handlers with variable randomization for persistence and evade detection using Base64 decoding, RC4 decryption, and RSA signature verification.

Critical UniFi OS Auth Bypass Flaws Lead to Unauthenticated Root RCE

gbhackers.com · a month ago

UniFi OS Server faces RCE via three flaws: CVE-2026-34908/34909 (Nginx auth bypass) and CVE-2026-34910 (package update command injection). The chain allows unauthenticated root code execution.

Opal Security Raises $23 Million for AI-Native Identity Governance

www.securityweek.com · a month ago

Identity governance startup Opal Security announced raising $23 million in new funding, bringing its total investment to $59 million. The company developed an AI-native platform providing real-time policy enforcement for human, service, and AI agents. Additionally, Opal appointed five senior leaders across product and engineering divisions to support expansion.

CISA Alerts on Actively Exploited SolarWinds Serv-U Denial-of-Service Flaw

gbhackers.com · a month ago

CISA added SolarWinds Serv-U vulnerability CVE-2026-28318 due to active exploitation. Unauthenticated attackers can use malicious POST requests to crash the file transfer service (DoS). Apply SolarWinds 15.5.4 Hotfix 1 immediately and restrict network access.

Malspam Campaign Abuses DoubleClick to Deploy Stealthy .NET Loader

gbhackers.com · a month ago

Huntress found malspam bypassing gateways via DoubleClick infrastructure. The attack uses personalized lures in HTML attachments, executing JScript, PowerShell, and a.NET loader to patch AMSI and silence ETW.

UNC3753 Targets US Law Firms with Vishing, RMM Tools, and Physical Break-Ins

gbhackers.com · a month ago

UNC3753 (Silent Ransom Group) hit U.S. professional services using voice phishing, RMM abuse, and physical intrusions to steal client data from iManage. They issue extortion demands within three days of harvesting sensitive info.

People Love to Hate This Fake Private Equity Guy

www.nytimes.com · a month ago

Johnny Hilbrant Partridge has found social media fame as PE Guy, a character who embodies obnoxious entitlement.

Americans hate rising prices. AI is making it worse.

www.washingtonpost.com · a month ago

Massive investments in artificial intelligence compel tech companies to spend hundreds of billions developing technology and building compute hubs. Some Federal Reserve officials and Wall Street assessors suggest that this tremendous spending pushes up inflation across the United States. This industry activity likely raises costs for consumers on various goods and services.

Free Apps Are Quietly Turning Smart TVs Into Web-Scraping Proxies for AI

thehackernews.com · a month ago

A researcher reverse-engineered Bright Data's embedded iOS SDK, documenting how it repurposes consumer devices into exit nodes. The mechanism allows the company to relay web-scraping traffic using smart TVs and similar always-on hardware. These assets support a data business that Bright Data heavily markets to the AI industry.

CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog

thehackernews.com · a month ago

CISA added a high-severity vulnerability in SolarWinds Serv-U multi-protocol file server software to its Known Exploited Vulnerabilities catalog. The agency cited evidence of active exploitation for the flaw. This issue, tracked as CVE-2026-28318 with a CVSS score of 7.5, functions as a denial-of-service bug that causes the service to crash.

AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs

thehackernews.com · a month ago

A security startup reported 21 previously unknown vulnerabilities in FFmpeg, leveraging an autonomous AI agent to find the zero-days. Concurrently, Google shipped Chrome 149 with patches for 429 security bugs, setting a record for fixes in one release. This pair of events underscores new methods and volumes of vulnerability discovery across critical media libraries and web browsers.

Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack

thehackernews.com · a month ago

The Miasma self-replicating supply chain attack impacted Microsoft's GitHub repositories. The threat compromised 73 repositories spread across four organizational groups, including Azure and MicrosoftDocs. Following the incident, GitHub initiated measures to disable access to the vulnerable codebases.