Blahalla

Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities

sec.cloudapps.cisco.com · a month ago

Multiple S/MIME decryption vulnerabilities in Cisco Secure Email allow unauthenticated, remote attackers to recover plain text from encrypted messages. These flaws stem from insufficient message integrity validation, potentially exploiting CVE-2026-20354 and CVE-2026-20355. Cisco advises customers to upgrade to fixed software releases to remediate the exposure.

Cisco IOS XR Software Security Hardening Release: September 2026

sec.cloudapps.cisco.com · a month ago

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited.

Hackers exploit critical JFrog Artifactory flaw to forge admin tokens

www.bleepingcomputer.com · a month ago

A critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being exploited in attacks to create tokens that provide administrative access.

UK Moves to Block High-Risk Tech Suppliers From Critical Infrastructure

www.securityweek.com · a month ago

Late amendments to the Cyber Security and Resilience Bill would give ministers new powers to restrict risky technology providers as supply chain attacks intensify.

Dyson’s $500 toothbrush puts a high-tech camera in your mouth

www.washingtonpost.com · a month ago

The vacuum brand's new toothbrush has a 100,000-pixel macro lens camera, which allows users to view a live feed while blasting plaque away.

Revolut scam wave steals £180,000 from Jersey residents in just four weeks

www.bitdefender.com · a month ago

Jersey police warn residents of rampant scamming targeting Revolut accounts. Over a four-week period, these fraudulent incidents comprised 75% of all reported scam crime, resulting in victims losing £180,000. Scammers call victims, impersonating bank staff, and claim suspicious transactions to persuade them into transferring funds or handing over account details.

Federal Judge Declines to Break Up Google’s Ad Technology Business

www.nytimes.com · a month ago

In a long awaited ruling, the judge said Google must make some changes to its ad tech business to handle antitrust issues, but did not disclose the measures publicly.

Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

thehackernews.com · a month ago

Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command that the agent runs on the developer's machine, four of them still unpatched at publication.

Ransomware protection for MSPs: A 6-point checklist for faster recovery

www.bleepingcomputer.com · a month ago

Ransomware resilience requires more than backups or endpoint detection alone. Acronis outlines six capabilities MSPs should test across client environments, from reducing exposure and detecting attacks to preserving recovery points and restoring operations quickly.

Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

thehackernews.com · a month ago

A Chinese-speaking cybercrime cluster known as Gambling Goblin has been observed installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, and using them to divert visitors to attacker-controlled pages promoting online gambling and sports betting. Check Point Research said it has tracked the campaign since mid-2025.

255 Fake Accounts Used to Send Malicious Excel Files to 80,000 Freelancers

gbhackers.com · a month ago

A Russian national has been extradited to the United States to face charges over an alleged phishing operation that used 255 fake accounts on a freelance employment platform to distribute malicious Microsoft Excel files to roughly 80,000 users.

BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access

thehackernews.com · a month ago

Virtualizor said hackers used a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic. The hackers then used the diverted update traffic to deliver a malicious Virtualizor package to some installations. A hosting-provider account separately said 5 of its 34 checked Virtualizor hypervisors sustained root-level compromise.

Singularity Rootkit Bypasses Elastic Defend eBPF Module Load Detection

gbhackers.com · a month ago

Security researcher has disclosed a technique used by the Singularity Linux rootkit to evade Elastic Defend by suppressing module-load telemetry to avoid detection across multiple layers. This research highlights how trusted-process exclusions in endpoint eBPF monitoring can become significant targets for advanced kernel-level threats.

Claude AI Develops Working RCE Exploit Against WAGO PLC With Researcher Assistance

gbhackers.com · a month ago

Researchers have demonstrated that Anthropic’s Claude AI can assist in porting a remote code execution exploit between vulnerable models of WAGO programmable logic controllers (PLCs). However, this process requires significant human guidance, lengthy analysis sessions, and more than $500 in API usage.

Anthropic introduces zero-retention AI safety monitoring for enterprises

www.csoonline.com · a month ago

Anthropic is introducing a new framework aimed at helping enterprises monitor AI misuse without ceding control over sensitive data, as organizations struggle to balance security visibility with strict compliance requirements.

Rockwell Automation Patches Over a Dozen Vulnerabilities Across Products

www.securityweek.com · a month ago

The industrial giant has released advisories for its RSLinx Classic, ArmorStart, ControlFLASH, FactoryTalk, and other products.

Dropbox accounts breached through Lenovo email verification flaw

www.bleepingcomputer.com · a month ago

Dropbox is warning some users that an unauthorized party accessed their accounts by exploiting a flaw in Lenovo's email verification process to register fraudulent Lenovo IDs.

Exploited JFrog Artifactory bug puts software supply chain on alert

www.csoonline.com · a month ago

A critical authentication bypass in JFrog Artifactory is now being exploited in the wild, with attackers observed generating administrator tokens and probing the software supply-chain platform’s sensitive data.

Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control

thehackernews.com · a month ago

Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete control of infected devices.

Exploit Published for Fresh Cleo Harmony Vulnerability

www.securityweek.com · a month ago

The security defect allows remote attackers to bypass authentication through argument bearer manipulation.

Anthropic Details Response to Security Incidents, Unveils Enterprise Safeguards

www.securityweek.com · a month ago

Anthropic addressed Claude model unauthorized access and sandbox escape tests. They introduced Enterprise Frontier Safeguards (EFS) with zero data retention and automated misuse monitoring. EFS lets customers store/review data on controlled infrastructure.

Hackers Exploit LiteLLM Admin API Flaw to Turn Read-Only Access Into Full Server Takeover

gbhackers.com · a month ago

CVE-2026-35029 flaws in LiteLLM's API let read-only users gain admin rights. Low-privilege accounts can change proxy settings via /config/update, risking secrets. Zenity Labs tracked thousands of attacks on these endpoints (Feb-Jun 2026).

Malicious Virtualizor Update Served via BGP Hijacking

www.securityweek.com · a month ago

An attacker used a BGP hijack and a valid TLS certificate to divert traffic to Softaculous' domains, targeting software updates. Between August 28 and August 30, this attack delivered a malicious Virtualizor update package to some installations. Softaculous advises all Virtualizor operators to check for potential compromises, noting the malicious traffic never reached their internal logs.

How to Secure Enterprise AI: From Adoption to Incident Readiness

thehackernews.com · a month ago

The debate about whether AI delivers business value is over. The challenge now is implementing it at scale and securely across every function while meeting board-level pressure to move fast. Organizations must focus on adopting AI at business speed without losing control of cyber risk. Download the full eBook here.

Palo Alto Networks Acquires Console to Add Agentic AI Workflows to Cortex

gbhackers.com · a month ago

Palo Alto Networks bought Console, an AI platform, for Cortex. This enables agentic workflows, letting teams use natural language prompts for complex tasks. Cortex can now correlate, assess risk, and remediate automatically.

The Gentlemen Ransomware Hackers Use TukTuk C2 to Steal Credentials and Disable EDR Security

gbhackers.com · a month ago

The Gentlemen linked to TukTuk C2 framework. Found on a Finland server, it disables EDR and steals credentials via spoofed Windows dialogs. It targets tech and healthcare firms on Windows/Linux.

FreeRDP 3.31.0 Fixes 22 Security Flaws Including Heap Overflow and Pre-Auth DoS Bugs

gbhackers.com · a month ago

FreeRDP 3.31.0 addresses 22 vulnerabilities, including heap overflows and pre-auth DoS bugs. The update improves memory hygiene and expands hardware support.

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

thehackernews.com · a month ago

SonicWall released security updates for its SMA 1000 series VPN appliances to address two zero-day flaws. Internal researchers William Perry and Adam Babis discovered the vulnerabilities, including CVE-2026-83548. This critical pre-authentication SSRF flaw carries a CVSS score of 10.0 and impacts the appliance.

OpenAI’s Astra Becomes First Model to Cross Critical Cybersecurity Threshold

www.securityweek.com · a month ago

OpenAI designated its Astra model as reaching the 'Critical' cybersecurity level, enabling independent zero-day exploitation across systems. Testing showed Astra found two zero-day vulnerabilities and gained root access by chaining flaws and breaking out of a browser sandbox. Furthermore, Astra declined 91.5% of cyber-related jailbreak attempts, improving its security over its predecessor.

Microsoft Defender flags legitimate Google search links as malicious

www.bleepingcomputer.com · a month ago

Microsoft Defender for Office 365 flagged legitimate Google search links as malicious due to an inaccurate security classification. The company confirmed the incident and cautioned that the "Opening this website might not be safe" warning cannot be bypassed by copying and pasting the links. Microsoft is currently working to correct the misclassification and remediate the impact on affected users.

Wireless Routers as Motion Detectors

www.schneier.com · a month ago

Comcast integrated motion detection into Xfinity wireless routers, which alerts users via push notifications when motion occurs near connected devices like TVs or printers. While the system offers customizable modes, users must note that Comcast may disclose the generated data to third parties for law enforcement, disputes, or court orders.

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

unit42.paloaltonetworks.com · a month ago

Unit 42 found AI-assisted breach using over 50 MITRE ATT&CK techniques to conduct a ransomware attack. Attackers mapped architecture and seized root credentials via custom AI workflows.

Critical SonicWall SMA 1000 Vulnerabilities Actively Exploited in the Wild

gbhackers.com · a month ago

SonicWall warns of 2 exploited flaws on SMA 1000: CVE-2026-83548 (SSRF) allows unauth remote attacks on the Workplace interface, and CVE-2026-83549 allows RCE with admin credentials. Patch immediately.

GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

thehackernews.com · a month ago

Two vulnerabilities in GeoNetwork, an open-source geospatial metadata catalog, can chain to achieve unauthenticated remote code execution (RCE). The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026. GeoNetwork published details of the flaws on August 31, advising users of the open-source system.

Chrome and Firefox Updates Patch Dozens of Vulnerabilities

www.securityweek.com · a month ago

Google released Chrome 152 updates that patch 26 bugs, including critical use-after-free issues CVE-2026-84353 and CVE-2026-84352. Separately, Mozilla deployed Firefox 155, addressing 29 security defects like sandbox escapes and use-after-free flaws across multiple components. Both browser vendors issued these patches to mitigate severe memory corruption and privilege escalation weaknesses.

Hackers Breach Brazilian Financial Firms and Execute Hundreds of Fraudulent Transactions

gbhackers.com · a month ago

BREEZE COMET breached Brazilian finance/retail orgs via payment platforms. They use voice phishing and AnyDesk for fraud, targeting Pix/STR for transfers to the National Financial System Network.

Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands

thehackernews.com · a month ago

The U.S. Department of Justice charged Russian national Searzhudin Tamirlanovich Aktulaev with large-scale malware distribution. Aktulaev used roughly 255 fake freelance accounts to send malware-laced Excel attachments. These actions targeted about 80,000 users in 2016 and 2017.

US charges Russian for infecting 80,000 freelancers with malware

www.bleepingcomputer.com · a month ago

A California grand jury indicted Searzhudin Tamirlanovich Aktulaev, a Russian national, for executing a large-scale phishing campaign. Between 2016 and 2017, Aktulaev used fake accounts to distribute malicious Excel attachments to 80,000 freelancers. These attacks infected victim devices with TVRAT and DarkVNC malware, enabling him to steal credentials and PII for criminal activity.

Get to Know Your Phone’s Built-In Emergency Kit

www.nytimes.com · a month ago

In times of natural disasters and other dangers, special features tucked away on your iPhone or Android device could help make a difference.

When the patch tsunami meets the maintenance window

www.csoonline.com · a month ago

AI from Anthropic/OpenAI now finds software flaws in hours. This rapid discovery strains OT environments, creating a "patch tsunami" gap between machine speed and slow physical maintenance. The industry must manage these vulnerable assets.

Critical HPE Fabric Composer Flaw Lets Unauthenticated Attackers Execute Commands as Privileged User

gbhackers.com · a month ago

Hewlett Packard Enterprise (HPE) released updates addressing 52 vulnerabilities in HPE Networking Fabric Composer, affecting versions 7.3.3 and earlier. Two critical flaws, CVE-2026-76658 and CVE-2026-76657, permit unauthenticated remote attackers to gain administrative control. The advisory also cites other high-risk CVEs, including CVE-2026-19766, CVE-2026-73700, and CVE-2026-73701.

23-Year-Old Sality P2P Botnet Disrupted

www.securityweek.com · a month ago

Law enforcement and CrowdStrike disrupted the 23-year Sality P2P botnet, which used file infectors. CrowdStrike isolated machines via protocol manipulation. US, Bulgaria, Hungary, and Romania law enforcement took down Sality payload URLs.

Google Patches 26 Chrome Vulnerabilities, Including Critical WebGL and Shared Tab Groups Flaws

gbhackers.com · a month ago

Chrome updated on desktop fixes 26 vulns. Patches include CVE-2026-84353 (Shared Tab Groups) and CVE-2026-84352 (WebGL). It also resolves CVE-2026-84323, CVE-2026-84333, and CVE-2026-84359 in FileSystem and V8.

Hugging Face Transformers Flaw Writes Malicious Python Code to Disk Before User Consent

gbhackers.com · a month ago

A vulnerability tracked as CVE-2026-80047 impacts Hugging Face Transformers versions 4.49.0 through 5.8.1. The flaw allows an attacker to write unauthorized Python files to a victim's local system cache through the GenerativePreTrainedModel.loadcustomgenerate() function. This process writes malicious code before the library can verify user consent, bypassing intended security protections.

How China industrialized the infrastructure behind state hacking

www.csoonline.com · a month ago

The US Justice Department and FBI seized domains essential to QScan and QTRouter, hacking platforms utilized by the PRC state-sponsored group QTFY. QTFY targeted multiple US sectors, including the Department of Energy and the Department of Health and Human Services. The group offered these services to the People’s Liberation Army and the Ministry of State Security.

Hackers Hide Reverse Shell Traffic Behind Signed Apps and AWS API Gateway

gbhackers.com · a month ago

Bad guys use social engineering via fake IT support on Microsoft Teams to gain remote access. They deploy malicious MSI packages and employ DLL sideloading against signed applications to execute hidden code. This setup establishes command-and-control through AWS API Gateway and uses WMI to spawn a separate reverse-shell agent, effectively fragmenting the attack chain to evade detection.

Sality botnet infrastructure dismantled in joint global takedown

www.bleepingcomputer.com · a month ago

International law enforcement and CrowdStrike dismantled the Sality P2P botnet, which has operated since 2003. The joint takedown seized Sality-linked domains in the US, Bulgaria, Hungary, and Romania. This operation disrupted the botnet, which previously distributed payloads like EggJagger for crypto wallet theft.

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

thehackernews.com · a month ago

Vedere Labs used Claude to port an RCE exploit for CVE-2021-31886. The flaw is a stack overflow in Nucleus FTP handling the USER command. Researchers hit WAGO controllers, running ARM shellcode on live hardware.

Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials

thehackernews.com · a month ago

Exploit CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3. This flaw allows attackers to achieve unauthenticated remote code execution. The vulnerability impacts the enterprise VoIP platform.

Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads

thehackernews.com · a month ago

The U.S. Department of Justice announced the takedown of the Sality P2P botnet. Authorities from the U.S., Bulgaria, Hungary, and Romania executed this coordinated operation on August 31, 2026. The effort involved collaboration with private partners CrowdStrike and the Shadowserver Foundation.