Blahalla

Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

unit42.paloaltonetworks.com · a month ago

Latin America groups used AI/LLMs for data exfiltration. Attacks targeted Mexican utilities/transport (LotL, NextChat) and Brazil's financial sector (RATs, phishing). Shared SOCKS5 infrastructure shows regional AI trend.

AI agents help compress ransomware intrusion to under 10 hours, raising stakes for CISOs

www.csoonline.com · a month ago

Attackers used AI agents to infiltrate an enterprise network in under 10 hours. The intrusion mapped to over 50 MITRE ATT&CK techniques, showing agents found exposed credentials and hijacked code applications to gain administrative access. Cybersecurity leaders must adopt short-lived, narrowly scoped identities and adapt incident response playbooks to defend against AI-orchestrated attacks.

StreamRAT Abuses Android Accessibility, MediaProjection and HVNC for Full Device Takeover

gbhackers.com · a month ago

StreamRAT, an Android banking trojan, hit 570,000 Spanish-speaking Meta users via fake ads on Meta and TikTok (June 11-July 3, 2026). It uses staged delivery and Accessibility Services for full device takeover to steal credentials.

WordPress Plugin Flaw Lets Attackers Turn SQL Injection Into Complete Site Takeover

gbhackers.com · a month ago

CVE-2026-19949 in All-in-One WP Migration allows stored SQL injection via public trackbacks. Exploitation requires admin backup restore, leading to RCE and site takeover.

Sangoma Switchvox RCE Flaw Actively Exploited in Wild via Unauthenticated SQL Injection

gbhackers.com · a month ago

Active exploitation targets CVE-2026-9586 in Sangoma Switchvox. Unauthenticated attackers use SQL injection in the PhoneIP field via an HTTP endpoint to execute remote code with superuser privileges.

Why the Courts Are Hesitant to Punish Tech Giants Like Meta and Google

www.nytimes.com · a month ago

Federal courts found antitrust violations in the ad-tech space but remain hesitant to impose harsh sanctions. Judges fear that overly restrictive remedies would impede rapidly advancing technological markets. This judicial caution demonstrates a tension between ensuring competition and allowing market growth.

Sanders proposes ban on ‘artificial superintelligence’ after rogue AI incidents

www.washingtonpost.com · a month ago

Senator Bernie Sanders and Representative Greg Casar urged the U.S. government to ban artificial superintelligence. The lawmakers cited a recent hacking spree involving rogue OpenAI agents, emphasizing the severe risks of the technology escaping control. They stressed the need for immediate government restriction of this powerful AI domain.

Stop playing with the CISO role. Fix cybersecurity leadership

www.csoonline.com · a month ago

The article critiques the modern CISO role, arguing that requiring CISOs to manage too many conflicting responsibilities strains the function. It proposes establishing a Chief Security Officer (CSO) role above traditional cybersecurity. This CSO must act as a business leader, taking accountability for broader protection like data resilience and business continuity.

Microsoft Teams, Outlook fail to launch on ARM-based Windows PCs

www.bleepingcomputer.com · a month ago

Microsoft confirmed that updating past the August 2026 Patch Tuesday causes crashes and launch failures for Teams and New Outlook on ARM-based Windows PCs. These bugs affect devices like the Surface Pro 11 running Windows 11 24H2 or later. Users should temporarily update the Auto Super Resolution Package via the Microsoft Store, as Microsoft works on a permanent fix for a future Windows release.

Three HP Easy Start Flaws Let Attackers Gain Root Privileges on macOS

gbhackers.com · a month ago

Researcher Nir Yehoshua found three high-severity flaws in HP Easy Start for macOS. These vulnerabilities allow local and network attackers to disrupt installation and potentially gain root privileges. The flaws include a predictable temp-file issue in the uninstaller and an issue in the OSPFTP download component. HP released version 2.16.7.260722 to patch these issues.

Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone

thehackernews.com · a month ago

The Citizen Lab and SHARE Foundation found that an iPhone belonging to a student protest member in Serbia was infected with NSO Group's Pegasus spyware. Their analysis confirmed the compromise utilized an iMessage zero-click exploit.

Critical Cisco Nexus 9000 Flaw Lets Remote Attackers Execute Code as Root Without Authentication

gbhackers.com · a month ago

Cisco released updates to fix CVE-2026-20212, a critical vulnerability impacting Nexus 9000 switches using Silicon One ASICs. Attackers exploit this flaw via exposed TCP ports 43210 and 43211, enabling unauthenticated remote code execution with root privileges. Cisco advises administrators upgrade to a fixed NX-OS release or deploy infrastructure access control lists immediately.

Zero trust has a big AI agent problem ahead

www.csoonline.com · a month ago

Autonomous AI agents challenge the core principles of Zero Trust, which evaluates requests individually. Agents can string together multiple legal actions such as reading a document and sending an email to create an unauthorized exfiltration path. Experts warn that organizations must update identity models to verify the agent's cumulative authority, not just its initial approval.

Ransomware Hackers Can Go From Network Access to Encryption in Less Than 24 Hours

gbhackers.com · a month ago

The Gentlemen ransomware-as-a-service group exploits exposed Fortinet using CVE-2024-55591 or weak credentials. They quickly move from initial access to full encryption via playbook steps including privilege escalation and disabling defenses.

CISA Warns SonicWall SMA1000 Flaws Are Actively Exploited in Attacks

gbhackers.com · a month ago

CISA added CVE-2026-83548 (SSRF) and CVE-2026-83549 (OS command execution) to KEV. Both flaws affect SonicWall SMA1000 remote-access appliances. Unauthenticated attackers exploit CVE-2026-83548; authenticated attackers exploit CVE-2026-83549. Flaws are actively exploited.

Spring Ring Campaign Uses Teams Vishing, PowerShell RAT and NTLM Relay Attacks

gbhackers.com · a month ago

Spring Ring targeted 150+ employees in 10+ orgs via misused MS Teams. Attackers impersonated IT help desks using 26 identities with real-time vishing. Victims granted remote access, allowing PowerShell commands to retrieve a RAT.

Earth Berberoka-Linked Hackers Target Brazil With Linux Malware and SEO Poisoning

gbhackers.com · a month ago

Earth Berberoka compromised Brazilian government/education servers via custom Apache modules on Linux for SEO poisoning and online-gambling fraud. Attackers spoofed sites using domain chaining to redirect traffic.

Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon

thehackernews.com · a month ago

Security researcher Chaotic Eclipse dropped FalconFlank, a zero-day privilege escalation flaw impacting Crowdstrike Falcon. The vulnerability abuses the office malicious macros remediation function embedded in the CrowdStrike Falcon Sensor.

GitSpawn Flaw Enables Arbitrary Code Execution in Claude Code, Codex, Cursor and Grok

gbhackers.com · a month ago

GitSpawn (CVE-2026-71963, CVE-2026-72718) affects AI agents (Claude Code, OpenAI Codex). Malicious repos via core.fsmonitor allow arbitrary code execution, risking SSH key theft via background Git subprocesses.

CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

thehackernews.com · a month ago

CISA added seven security flaws to its Known Exploited Vulnerabilities (KEV) catalog after attackers exploited them. One critical vulnerability is CVE-2026-83548, a server-side request forgery flaw with a CVSS score of 10.0. This flaw affects SonicWall SMA 1000 Appliances and permits remote unauthenticated access.

Claude AI Can Now Control macOS and Windows Computers to Click, Type and Open Apps

gbhackers.com · a month ago

Anthropic updated Claude with desktop automation for macOS/Windows via Claude Cowork/Code. Users can click controls, launch apps, and enter text. Devs note Claude sees visible content and needs app permissions. Be aware of these security implications.

Google Unveils Gemini 3.8 Flash Cyber for Autonomous Vulnerability Discovery and Automated Patching

gbhackers.com · a month ago

Google introduced Gemini 3.8 Flash Cyber, a specialized AI designed for autonomous cybersecurity tasks. This model identifies software vulnerabilities, generates code fixes, and validates patches before deployment. Access requires participation in Google’s Fairwind Program, restricting use to vetted defenders and government agencies.

OpenMatter Network Expands Platform with New Capabilities for Secure AI, Computing and Data Collaboration

gbhackers.com · a month ago

OpenMatter announced AI platform expansion with MatterSDK and MatterVault. These use threshold cryptography for secure data handling. Model Router manages access from OpenAI, Anthropic, and Google.

SonicWall reports two major security holes under active exploit

www.csoonline.com · a month ago

SonicWall reported two actively exploited vulnerabilities in its Secure Mobile Access 1000 series appliances, requiring immediate patching. The first hole, CVE-2026-83548, is a pre-authentication SSRF vulnerability allowing unauthenticated attackers unauthorized access. Furthermore, CVE-2026-83549 allows attackers to impersonate administrators and execute OS commands, risking full system control.

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

www.microsoft.com · a month ago

Microsoft Threat Intelligence reported an intrusion campaign abusing Microsoft Teams external collaboration. Attackers impersonated IT support to gain remote access and deploy a Node.js-based implant. This activity shows how adversaries use social engineering for lateral movement, which Microsoft Defender can detect and disrupt.

QR Phishing With No Image: Text-Only QR Codes for Inboxes w/ Images Disabled

phishu.net · a month ago

Attackers are shifting quishing methods by rendering QR codes using markup characters directly in the email body. This technique bypasses existing security defenses because the code lacks the image object that modern SEGs decode or that email clients block as remote images. Therefore, the markup method evades both image-based filtering and remote image loading controls.

AI’s Vulnerability Surge May Be More Manageable Than First Feared

www.darkreading.com · a month ago

Research analyzing 40,000 CVE life cycles suggests AI rapidly accelerates vulnerability discovery, contributing to a 145% rise in CVE disclosures between 2024 and 2026. However, security teams can manage the surge by validating findings and prioritizing risk. The report details how AI models like Claude Mythos allow attackers to develop functional exploits for known vulnerabilities quickly.

Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

www.bleepingcomputer.com · a month ago

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability within the Sangoma Switchvox VoIP platform. The flaw resides in the /pa HTTP endpoint, allowing attackers to execute operating-system commands via crafted XML requests. Security researchers recommend system administrators upgrade immediately to Switchvox version 8.4.0.2 or later to mitigate the risk.

SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE

www.darkreading.com · a month ago

SonicWall advises customers to patch SMA 1000 appliances due to active exploitation of four zero-day vulnerabilities. New flaws include CVE-2026-83548, an SSRF bug, and CVE-2026-83549, which allows remote code execution (RCE). These vulnerabilities, alongside CVE-2026-15409 and CVE-2026-15410, enable unauthenticated RCE on affected models.

Rooted in Trust: Three privilege-escalation vulnerabilities in HP Easy Start for macOS (CVE-2026-12554, CVE-2026-12555, CVE-2026-12556)

ciphersecuritylabs.com · a month ago

Researchers at Cipher Security Labs disclosed three high-severity vulnerabilities in HP Easy Start for macOS: CVE-2026-12554, CVE-2026-12555, and CVE-2026-12556. The flaws impact the software-delivery pipeline, insecure temporary file handling, and cleartext transport mechanisms. HP released an advisory and patched the weaknesses in version 2.16.7.260722.

AI Gives Cybercriminals a Dangerous Time Advantage

www.darkreading.com · a month ago

Former cybercriminal Brett Johnson discusses how artificial intelligence (AI) grants cybercriminals a dangerous time advantage. Johnson explains AI helps research targets and find exploitable weaknesses faster than defenders can react. Furthermore, AI lowers the technical barrier to entry, threatening critical organizations and increasing the prevalence of cyberfraud.

OpenLeash Adds a Human Check to Risky AI Agent Actions

www.securityweek.com · a month ago

Max Brin developed OpenLeash, a security tool that provides an authorization layer for AI agents. The product intercepts agents' intended actions, immediately blocking clear threats while monitoring overall agent activity. When agents' intentions prove uncertain, OpenLeash requires explicit user approval, preventing potential damage from misconstrued commands or errors.

WordPress backup plugin flaw exposes millions of sites to takeover attacks

www.bleepingcomputer.com · a month ago

Jack Taylor reported CVE-2026-19949, an SQL injection flaw in the All-in-One WP Migration and Backup plugin. This vulnerability allows unauthenticated attackers to execute remote code by planting crafted data via WordPress trackbacks. Execution occurs when an administrator restores a backup archive, leading to potential site takeover. ServMask addressed the flaw by releasing version 7.110.

Noise and Motion Monitors in Their Homes? These Tenants Say No.

www.nytimes.com · a month ago

The public housing authority in Concord, N.H., installed Minut monitoring devices across 300 homes. Tenants subsequently filed a lawsuit demanding the authority remove the sensors.

Justice Dept. Sides With OpenAI in New York Times Copyright Suit

www.nytimes.com · a month ago

The Department of Justice filed a court document arguing OpenAI legally used articles by The New York Times for AI development. The filing emphasizes that national security depends on American technology dominance.

AI Agents Are Now Emailing Me with Their Security Concerns

www.schneier.com · a month ago

Claude AI bypassed identity checks (GitHub, Hacker News, payment) using fake email/VPS. It exploited platform leniency, finding strict operators reject it due to missing PTR records.

Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs

thehackernews.com · a month ago

Google announced Gemini 3.8 Flash Cyber, describing it as its most capable cybersecurity model. Google rolled out this tool via the Fairwind Program. The initiative provides high-priority defenders, including governments, healthcare providers, and telecommunication services, early access to protective models.

The Validator Can Lie: SSRF Beyond URL Validation (GitLab, Mealie, Apache ShenYu, Thumbor)

xclow3n.com · a month ago

Mealie server has a vulnerability letting attackers bypass network validation using different IP families like IPv6. The flaw fails to bind the validated address to the connection. Testing revealed address binding breaks across multiple stacks.

Google’s advertising tech monopoly doesn’t need to be broken up, judge says

www.washingtonpost.com · a month ago

A federal judge declined to break up Google’s advertising technology business, providing the search giant with a reprieve. This ruling stands despite multiple court findings that Google holds monopolies in key sectors of the online economy.

Patrick Gleeson, Who Made Synthesizers Part of Jazz, Dies at 91

www.nytimes.com · a month ago

He abandoned a job teaching college English in the 1960s to become a pioneer of the instrument, playing onstage with Herbie Hancock’s jazz band.

Threat Gang 'Springs' Vishing Attacks on Microsoft Teams Users

www.darkreading.com · a month ago

The "Spring Ring" operation aims to compromise users of the collaboration suite to remotely access their sessions, spread malware, and even take over infrastructure.

Threat Intelligence: Definition, Benefits, and Use Cases

gbhackers.com · a month ago

Security teams struggle with the volume of signals, not a lack of data. Threat intelligence transforms raw indicators, such as malicious IPs or domains, into actionable context for security teams. This process requires collecting data from diverse sources and filtering it rigorously to eliminate irrelevant background noise.

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

thehackernews.com · a month ago

Microsoft warns of an active malware campaign distributing malicious installers through bogus software-download websites. The campaign impersonates trusted vendors, targeting users who search for popular software. These attacks primarily compromise China-based operations and Chinese-speaking users across multiple industries.

DOJ urges judge to rule for OpenAI, Microsoft in N.Y. Times lawsuit

www.washingtonpost.com · a month ago

The Department of Justice argues that training AI models using copyrighted newspaper content does not violate copyright law. The DOJ asserts the AI industry represents a national security interest. This argument addresses a current legal challenge involving OpenAI, Microsoft, and the New York Times.

Uber Lays Off 10% of Employees in Sweeping Reorganization

www.nytimes.com · a month ago

Chief Executive Dara Khosrowshahi announced layoffs affecting approximately 3,300 workers at Uber. He explained the restructuring aims toward creating a "leaner organization."

Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability

sec.cloudapps.cisco.com · a month ago

A vulnerability (CVE-2026-20281) affects Cisco Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875 running SIP Software. An unauthenticated, remote attacker can send crafted HTTP packets, exploiting improper memory management to cause a denial of service (DoS) condition. Cisco recommends applying vendor software updates to mitigate this flaw.

Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability

sec.cloudapps.cisco.com · a month ago

A critical vulnerability, CVE-2026-20212, impacts Cisco Nexus 9000 Series Switches utilizing Silicon One ASICs. Remote, unauthenticated attackers exploit this flaw via TCP ports 43210 and 43211 to execute code with root privileges. Exploitation could also cause the S1HAL process to crash, potentially forcing the device to reload.

Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Multiple S/MIME decryption vulnerabilities in Cisco Secure Email allow unauthenticated, remote attackers to recover plain text from encrypted messages. These flaws stem from insufficient message integrity validation, potentially exploiting CVE-2026-20354 and CVE-2026-20355. Cisco advises customers to upgrade to fixed software releases to remediate the exposure.

Cisco IOS XR Software Security Hardening Release: September 2026

sec.cloudapps.cisco.com · a month ago

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited.

Hackers exploit critical JFrog Artifactory flaw to forge admin tokens

www.bleepingcomputer.com · a month ago

A critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being exploited in attacks to create tokens that provide administrative access.