Blahalla

Microsoft Tries to Calm Legal Threat Fears After Zero-Day Disclosure Backlash

www.securityweek.com · a month ago

A researcher publicly disclosed PoC exploits for multiple unpatched vulnerabilities in Microsoft products, including CVE-2026-33825 and CVE-2026-45498. This action drew legal threats from Microsoft regarding proper vulnerability disclosure procedures.

HazyBeacon Campaign Abuses AWS for Stealthy C2 Communications

gbhackers.com · a month ago

Cyber espionage group HazyBeacon, tracked as CL-STA-1020, targets government networks in Southeast Asia by abusing AWS for stealthy command-and-control channels. The operation utilizes stolen IAM credentials to deploy lightweight Lambda functions with unauthenticated public endpoints.

Google adds Android protection against AI deepfake scam calls

www.bleepingcomputer.com · a month ago

Google released "fake call detection," an Android security feature rolling out globally to combat AI deepfake impersonation scams. When using Phone by Google, the system verifies calls by sending encrypted confirmation signals; if spoofed, the recipient's device pings the contact's actual phone for instant verification.

Lessons from the Canvas cyberattack

www.csoonline.com · a month ago

The ShinyHunters criminal group targeted Canvas LMS users on May 6 and 7, 2026, defacing login pages and warning of an Instructure compromise. The attackers reportedly stole 3.65 terabytes of sensitive data from nearly 9,000 educational institutions globally, affecting 275 million students and staff.

Windows Search URI Handler Vulnerability Exposes NTLMv2 Hashes to Remote Attackers

gbhackers.com · a month ago

Windows systems are once again exposed to NTLM credential leakage through a newly observed abuse of the search, URI handler, a vulnerability class closely mirroring the previously patched CVE-2026-33829 in the Snipping Tool. Windows Search URI Handler Vulnerability Security researchers from Huntress have identified that the Windows search URI handler improperly processes user-supplied parameters, allowing attackers to coerce

HTTP/2 Bomb Remote DoS Exploit Impacts nginx, Apache, IIS, Envoy, and Cloudflare Pingora

gbhackers.com · a month ago

Security researcher Quang Luong disclosed an "HTTP/2 Bomb" attack allowing remote Denial-of-Service against major servers including nginx, Apache httpd, and Microsoft IIS. The exploit combines HPACK header compression abuse with flow-control stalling, creating a memory exhaustion vector that consumes massive server resources using low bandwidth.

New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare

thehackernews.com · a month ago

Researchers discovered a remote denial-of-service exploit, dubbed "HTTP/2 Bomb," affecting major web servers. This vulnerability resides in the default HTTP/2 configurations of systems including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The flaw enables attackers to execute a Denial-of-Service attack against these critical services.

Abusing iDEAL (Wero): how criminals weaponise legitimate payment links in phishing

zolder.io · a month ago

Criminals exploit the iDEAL payment system in the Netherlands by capturing valid transaction URLs for phishing attacks. They initiate purchases on favored merchants, such as crypto exchanges or gift card resellers, to acquire these functional links.

CISA Warns of Cyberattacks Targeting U.S. Tank Gauge Systems

gbhackers.com · a month ago

CISA and federal partners warned of ongoing cyberattacks targeting Automatic Tank Gauge (ATG) systems across critical sectors like energy and transport. Attackers exploit weak security controls, utilizing techniques such as default credentials or SQL injection flaws to gain unauthorized access.

Laravel CRLF Injection Flaw Could Disrupt Outbound Email Handling

gbhackers.com · a month ago

A high-severity CRLF Injection flaw, tracked as CVE-2026-48019, affects Laravel's email validation logic by improperly neutralizing carriage return sequences. This vulnerability allows attackers to manipulate outgoing messages using user input, potentially bypassing authentication and redirecting emails without detection.

Fake Purchase Orders Spread JS.MonoGlyphRAT in U.S. Enterprise Attacks

gbhackers.com · a month ago

Malware uses fake purchase orders containing JS attachments to infiltrate US enterprises with the JS.MonoGlyphRAT backdoor. This malware executes via Windows Script Host and establishes persistence by adding an autorun entry while using distinctive "monoglyph" obfuscation. The RAT communicates with a C2 server over HTTP, collecting detailed host telemetry using WMI for remote control.

VS Code zero-day lets hackers steal GitHub tokens in one click

www.bleepingcomputer.com · a month ago

Security researcher Ammar Askar disclosed a VS Code zero-day vulnerability exploiting the sandboxed webview system. This flaw lets attackers install malicious extensions that steal GitHub OAuth tokens when users interact with github.dev. The exploit allows actors to query the GitHub API, enumerating all private repositories accessible via the victim's token.

Golang code review notes II - elttam

www.elttam.com · a month ago

The article offers notes for auditing Golang code, focusing on subtle behaviors beyond obvious bugs. It details how Go 1.24 introduced os.Root APIs to mitigate path traversal by establishing secured root directories. Authors also release new Semgrep rules to help secure coding practices against tricky, persistent vulnerabilities.

1-Click GitHub Vulnerability Enables OAuth Token Theft

gbhackers.com · a month ago

A newly disclosed vulnerability in GitHub’s browser-based editor, GitHub.dev, allows attackers to steal powerful OAuth tokens with just a single click, giving them read and write access to private repositories. The flaw exploits how Visual Studio Code (VSCode) webviews handle keyboard events and message passing, enabling a malicious repository to execute attacker-controlled actions inside the

50+ Malicious Chrome Extensions Hit 30K Users

gbhackers.com · a month ago

50+ malicious Chrome extensions posing as “live wallpaper” utilities have been caught running an adware operation that hijacks browser behavior and quietly pushes remote HTML content to around 30,000 users. These extensions were distributed through at least three publisher accounts and made available via the Chrome Web Store and third‑party download portals that advertised animated

Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content

thehackernews.com · a month ago

Cybersecurity researchers flagged Weedhack, a Malware-as-a-Service campaign targeting Minecraft players. The threat utilizes YouTube as a vector, spreading malware by impersonating official game clients and mods. This malicious activity aims to gain control of victims' systems through compromised platforms.

CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities (Severity: HIGH)

security.paloaltonetworks.com · a month ago

There are authentication bypass vulnerabilities identified as CVE-2026-0257 in the GlobalProtect portal and gateway of PAN-OS that can allow an attacker to bypass security restrictions and establish an unauthorized VPN connection. Palo Alto Networks rates the issue as medium severity with suggested urgency moderate and reports CVSS metrics of 4.7 and 7.8. Affected releases include multiple PAN-OS 12.1, 11.2, 11.1 and 10.2 builds and the vendor recommends upgrading to specified fixed versions. Mitigations include generating and using a dedicated certificate for authentication override cookies or disabling authentication override until systems are patched.

Hackers Spread WeedHack Malware via YouTube and SEO Poisoning

gbhackers.com · a month ago

Hackers are increasingly abusing trusted platforms like YouTube and search engines to distribute malware, and a newly uncovered campaign targeting Minecraft players highlights how effective this tactic has become. Minecraft, originally released in 2011 by Mojang Studios, remains the best-selling video game globally with more than 350 million copies sold. Its open ecosystem, which supports

Microsoft MSRC Allegedly Declines Action on Dependency Confusion Vulnerability

gbhackers.com · a month ago

Microsoft is facing scrutiny after reportedly declining to treat a critical dependency confusion vulnerability affecting Azure Portal assets as a security issue, despite a proof-of-concept exploit demonstrating remote code execution (RCE). Security researcher Wahid Fayad identified the issue while analyzing JavaScript assets served via portal.azure.com. The investigation revealed an internal Node.js dependency, FxInternal/NetDiagnostics, that was not

Project Glasswing Grows as Anthropic Extends Claude Mythos Preview Program

gbhackers.com · a month ago

Anthropic has expanded its Project Glasswing initiative, significantly scaling access to its Claude Mythos Preview model as part of a broader effort to strengthen global software security. The program, first launched in April 2026 with around 50 organizations, has now grown to include approximately 200 partners worldwide, marking a major shift in how artificial intelligence

North Korean APT Targets macOS to Steal Crypto Wallets and SSH Keys

gbhackers.com · a month ago

A newly uncovered macOS intrusion campaign attributed to the North Korean state-sponsored threat group Sapphire Sleet, also known as BlueNoroff or UNC1069, is targeting high-value organizations in the financial and cryptocurrency sectors. The operation focuses on venture capital firms, Web3 developers, and crypto platforms, highlighting a continued shift in North Korean cyber operations toward financially

Red Hat Confirms Supply Chain Breach Impacting @redhat-cloud-services npm Packages

gbhackers.com · a month ago

Red Hat has confirmed a supply chain security breach impacting multiple npm packages under the @redhat-cloud-services namespace, as detailed in security bulletin RHSB-2026-006 released on June 2, 2026. The incident was publicly disclosed a day earlier and stems from a compromised GitHub account that introduced malicious code into trusted repositories maintained within Red Hat’s infrastructure.

Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign

www.microsoft.com · a month ago

A large-scale npm supply chain attack compromised over 90 versions of @redhat-cloud-services packages, silently infecting CI/CD environments and developer systems. The malicious code steals credentials from GitHub, cloud platforms, and local machines, then spreads like a worm by republishing trusted packages. Discover how the attack works, what data is at risk, and the steps you can take to protect your organization.

Trump Signs Executive Order Seeking Oversight of A.I. Models

www.nytimes.com · a month ago

The order, which signaled a shift from the hands-off approach the White House had previously taken toward A.I., followed debates over how to gain control of A.I. models without disrupting innovation.

Anthropic grants Project Glasswing access to 150 more companies, with a focus on critical infrastructure

www.csoonline.com · a month ago

Anthropic added 150 companies, focusing on critical infrastructure like power, water, and healthcare, to its Project Glasswing vulnerability hunting initiative. While this expansion increases bug identification rates using AI, analysts warn the sector faces a major "patch bottleneck.

Scientists Find Way to Supercharge Dangerous Computer ‘Worms’ With A.I.

www.nytimes.com · a month ago

Researchers at the University of Toronto showed how hackers could use artificial intelligence to create a program that could target any known flaw in the world’s computers.

Two-year old Oracle WebLogic Server vulnerability is being exploited

www.csoonline.com · a month ago

US federal government departments have been given until Thursday to patch a two-year old high severity vulnerability in Oracle WebLogic Server that could allow an unauthenticated attacker to access critical data. The vulnerability, CVE-2024-21182, was added Monday to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog, giving federal Oracle admins a mere four days to plug the hole. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. While the KEV is aimed at US federal departments, inclusion of a vulnerability on the list should be taken as a warning to the private sector as well. At the time it was discovered, this vulnerability was rated 7.3 on the CVSS scale, nowhere near the 9+ rating that many infosec pros would see as signaling a need for immediate attention. However, Robert Enderle, a consultant who heads the Enderle Group, said the inclusion of this vulnerability in the KEV now means that CISA has recently confirmed that threat actors are actively weaponizing it. “To make the CISA KEV means that we’re seeing active exploitations,” agreed Tyler Reguly, Fortra’s associate director of security R&D. “Given that this CVE was patched by Oracle in the July 2024 Critical Patch Update (CPU), I would expect most admins to have patched this by now, particularly since it is a WebLogic vulnerability and, prior to the addition of this CVE, there were already a dozen WebLogic vulnerabilities listed in the KEV catalog.” Older vulns under exploit Reguly also had an observation about how fast vulnerabilities are added to the KEV. Based on a cursory review, he figured only about 41% of CVEs in the list were added during the same year they were released. Looking at release year + 1, that goes up to about 58%. That still means that, surprisingly, more than 40% of the CVEs added to the CISA KEV catalog are added two or more years after they are released. “I suppose it makes sense that it [the two-year-old Oracle hole] is just popping up now, if you consider that an organization that hasn’t patched their systems in multiple years is likely an easier target than an organization that patches regularly. After all, regular patching probably implies a more security-conscious environment.” Asked for comment on why this vulnerability is being added two years after its discovery, a CISA spokesperson referred to the department’s webpage explaining criteria for including bugs in the catalog, which says the list is of vulnerabilities that have been exploited in the wild. The spokesperson didn’t answer a question about how many federal servers were still unpatched after so long. Oracle WebLogic Server is a unified and extensible platform for developing, deploying, and running enterprise applications in Java, on-premises and in the cloud. It’s fully supported on Kubernetes, and enables users to migrate and efficiently build modern container apps with comprehensive Java services. It short, it’s a vital piece of middleware that can host sensitive corporate data. Not surprisingly, threat actors are eager to exploit any vulnerabilities of this type. In 2019 it was reported that threat actors were scanning for WebLogic servers vulnerable to a new method of bypassing protections that Oracle had fixed the year before. Earlier this year, security firm CloudSek set up a honeypot to study threat actor response to a newly discovered and extremely serious WebLogic Server remote code execution vulnerability, CVE-2026-21962, with a CVSS score of 10, as well examining their interest in older holes. Over a 12 day period, attack attempts targeting the new zero day-like flaw were observed immediately following the public release of its exploit code, “demonstrating the rapid weaponization of critical Oracle WebLogic vulnerabilities.” Attackers also tried to exploit a flaw reported in 2017 and two 2020 vulnerabilities in the unpatched honeypot server that CloudSek created. Slow patching a ‘clear risk’ Given the importance of Oracle products to large enterprises, the company recently switched to a monthly security patch release cycle from quarterly. The first of these patches was released Monday. The recent addition of the WebLogic vulnerability to the KEV illustrates a common problem in how many organizations handle security, said Gene Moody, field CTO at Action1. “The issue is not just the vulnerability itself. The bigger problem is the delay between when a fix is released and when it is actually applied to real systems. That delay gives attackers a chance to act, while also signaling that the security practices of the target org may be under-enforced.” It takes on average around 60 days for organizations to apply patches, he pointed out. Meanwhile, attackers are building and using exploits in just hours or days. This gap creates a convenient window where unpatched systems become simple targets, he pointed out. In addition, systems suffering from vulnerabilities greater than a year in age are likely not silos in an otherwise well-managed vulnerability management plan. “Attackers pay close attention to how quickly patches are applied,” he said. “When a well-known fix is not widely used, it demonstrates more than just exposure. It can point to poor system tracking, weak patch processes, or other priorities taking focus away from security. These issues often mean there are more weaknesses beyond the one vulnerability.” Organizations should treat slow patching as a clear risk, Moody warned, not just a yet another task waiting to be done. To improve the situation, there needs to be better tracking of systems, clear patch timelines, and making sure that fixes are actually applied, not just planned.

Microsoft's Coreutils project brings Linux commands to Windows

www.bleepingcomputer.com · a month ago

Microsoft announced today at its Build 2026 developer conference the release of Coreutils for Windows, bringing many commonly used Linux command-line utilities to Windows as native applications.

OpenAI upgrades GPT-5.5, as it plans to retire legacy ChatGPT models

www.bleepingcomputer.com · a month ago

OpenAI says it's rolling out a new update that improves the existing GPT-5.5 Instant model, and this move comes ahead of the scheduled retirement of multiple legacy models, including o3.

Critical Kirki flaw exploited to hijack WordPress admin accounts

www.bleepingcomputer.com · a month ago

Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators.

Over 116,000 Minecraft systems infected in WeedHack malware campaign

www.bleepingcomputer.com · a month ago

A large-scale malware campaign dubbed WeedHack is targeting Minecraft players and has infected more than 116,000 systems since January.

Over 116,000 Mincraft systems infected in WeedHack malware campaign

www.bleepingcomputer.com · a month ago

A large-scale malware campaign dubbed WeedHack is targeting Minecraft players and has infected more than 116,000 systems since January.

Zoom CISO: AI as a Security Enabler, Not Role-Replacer

www.darkreading.com · a month ago

As Zoom's CISO, Sandra McLeod, discusses the challenges of securing a global communication platform, the promise of AI-driven security workflows, and advice for aspiring cybersecurity leaders.

FBI-Flagged Phishing Kit Kali365 Expands Its Reach

www.darkreading.com · a month ago

Once targeting just Microsoft 365, the phishing-as-a-service platform now aims at AWS, Okta, and Russian platforms, while relying on device code phishing.

HP Poly VoIP vulnerability sets the stage for executive voice deepfakes

www.csoonline.com · a month ago

Researchers from Rapid7 discovered CVE-2026-0826, a critical buffer overflow vulnerability in HP Poly VoIP phones when ICE enables peer connections. This flaw allows unauthenticated attackers to obtain root privileges using specially crafted SIP INVITE requests, enabling eavesdropping and collecting audio data for deepfakes.

DriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks

www.darkreading.com · a month ago

A sneaky, wide-scale IAB operation uses a malicious traffic distribution system (TDS) to redirect visitors of trusted websites to ones that deliver malware.

Trump Signs Executive Order That Invites Vetting of Top AI Models for National Security Risks

www.securityweek.com · a month ago

The order establishes a framework for the federal government to vet the national security risks of the most advanced AI systems for up to a month before their public release.

AI-built ransomware toolkit automates EDR evasion, AD discovery

www.bleepingcomputer.com · a month ago

A threat actor is using an AI-built ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and response (EDR) solutions.

China Uses Dual-Method Cyberattack on Czech Orgs

www.darkreading.com · a month ago

China is stealing data from high-value targets via a sneaky, double-layer spear-phishing campaign that includes the Azureveil malware.

Cisco Live 2026: New Security Tools Target AI Threats

www.techrepublic.com · a month ago

At Cisco Live 2026, the company unveiled Cloud Control, Live Protect, and Hybrid Mesh Firewall to help enterprises manage security operations in the AI era. The platform unifies monitoring across compute, networking, and security domains, connecting to over 50 third-party tools via ModelContext Protocol.

Securing AI Agents Before They Go Rogue Is Next to Impossible

www.darkreading.com · a month ago

High-autonomy agents with broad permissions and unfettered access are a recipe for disaster, and enterprises need to act now before they become the next horror story.

Four coordinated npm supply chain campaigns active in May–June 2026 — TTPs, IOCs, and detection notes

www.sonatype.com · a month ago

Sonatype researchers documented a campaign involving 176 malicious npm packages exploiting dependency confusion using high version numbers like 99.99.99. The attacker-controlled packages execute postinstall scripts to download platform-specific payloads, which then steal sensitive data including credentials and CI/CD secrets from developer environments.

Trump revives parts of canceled AI order with cybersecurity-focused directive

www.csoonline.com · a month ago

Donald Trump signed an executive order called Promoting Artificial Intelligence Innovation and Security. This directive strengthens cybersecurity defenses by directing federal agencies to accelerate AI deployment for cyber capabilities. Furthermore, the order establishes a voluntary government-industry vulnerability-sharing initiative and creates evaluation processes for frontier AI models.

Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited

thehackernews.com · a month ago

Google on Monday released patches for 124 security vulnerabilities impacting its Android operating system for the month of June 2026, including one high-severity flaw in the Framework component that has come under active exploitation. Tracked as CVE-2025-48595 (CVSS score: 8.4), the security flaw has been described as a case of privilege escalation without requiring any user interaction. The

Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine

thehackernews.com · a month ago

The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multiple malware families aimed at data theft and propagation. Per Sekoia, the activity involves the weaponization of CVE-2025-8088, a path traversal flaw in WinRAR, to launch an HTML Application payload dubbed GammaPhish, which is then used to retrieve an

Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation

thehackernews.com · a month ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The vulnerability, CVE-2024-21182 (CVSS score: 7.5), allows an unauthenticated attacker with network access to take control of susceptible servers. It was

We Added a Detection Rule. We Were Not Expecting This.

profero.io · a month ago

An analysis revealed a critical attack chain in AI agents utilizing the dangerous --allow-dangerously-skip-permissions flag. Researchers caution that merely blocking the shell fails to prevent data theft; an agent can still read SSH private keys, AWS credentials, and browser session databases. The flaw allows writing to critical files like ~/.

Anthropic Files to Go Public, Setting Stage for Huge I.P.O.

www.nytimes.com · a month ago

The artificial intelligence company has seen explosive growth over the last year thanks largely to new technology that can automatically write computer code.

The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2)

unit42.paloaltonetworks.com · a month ago

Security researchers have identified a sophisticated series of supply chain attacks within the npm ecosystem, initially dubbed "Shai-Hulud." The malware propagates through compromised packages, steals credentials from cloud environments like AWS, Azure, and Google Cloud, and exfiltrates data to command and control servers and public GitHub repositories. Attackers use wormable propagation, persistent CI/CD pipeline access, and obfuscated payloads to evade detection. The recent attack involved a malicious version of the @bitwarden/cli package, highlighting the need for enhanced security practices and vigilance.

Microsoft Build 2026: Securing code, agents, and models across the development lifecycle

www.microsoft.com · a month ago

Discover how Microsoft enables fast, secure AI development with MDASH and new security capabilities.