Blahalla

PHANTOMPULSE RAT Uses UAC Bypass to Hijack Windows Systems

gbhackers.com · a month ago

PHANTOMPULSE RAT achieves persistent access on Windows systems using process injection and a UAC bypass mechanism. The malware evades detection by utilizing direct system calls and hardware breakpoints to disable security features like AMSI or ETW.

TP-Link Router Security Bug Enables Remote Command Execution Attacks

gbhackers.com · a month ago

TP-Link disclosed CVE-2026-5509, a high-severity authenticated command injection flaw affecting Archer BE450 and BE7200 routers. Attackers logging in can exploit this vulnerability through the web management interface to execute arbitrary commands with elevated privileges. Users must upgrade firmware immediately to version 1.3.0 Build 20260416 or later to eliminate this risk.

Meta’s AI Bot Misused by Hackers to Take Over Instagram Accounts

gbhackers.com · a month ago

Hackers exploited Meta’s AI support chatbot using natural language requests to hijack Instagram accounts, bypassing two-factor authentication without needing passwords. This flaw allowed attackers to compel the bot backend to change emails without verifying user identity.

Nimbus Manticore APT Uses Fake Jobs to Deliver Custom Malware

gbhackers.com · a month ago

The Nimbus Manticore APT targets aerospace organizations using social engineering via fake job postings on platforms like LinkedIn. Attackers lure victims to fraudulent portals where they download an "two-factor authentication" application zip archive. The resulting malware hijacks AppDomain through ServiceHub.VSDetouredHost.exe to load TOTPGuard.

Red Hat Cloud Services npm Packages Hijacked in Credential-Theft Malware Campaign

gbhackers.com · a month ago

Security researchers discovered a major supply chain attack compromising multiple redhat-cloud-services npm packages. Attackers utilized the Miasma malware variant to exploit GitHub Actions' OIDC mechanism, injecting malicious CI workflows into Red Hat developer repositories.

Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded

thehackernews.com · a month ago

Password manager Dashlane has disclosed that "fewer than" 20 users on the personal subscription plan had their encrypted vaults downloaded following a brute-force attack launched by an unknown party. On May 31, 2026, the company said an "external" threat actor launched a brute-force attack against certain Dashlane user accounts with the aim of breaking two-factor authentication (2FA)

NuGet Code Execution As A Service

tierzerosecurity.co.nz · a month ago

There are concerns regarding NuGet packages executing code during development processes. The automatic running of dependencies and the ability for custom package files to add build targets present risks. Specifically, MSBuild tasks can execute arbitrary programs or commands through a built-in task. This potential allows attackers to compromise builds via manipulated package content.

CVE-2026-0251 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM)

security.paloaltonetworks.com · a month ago

There are multiple local privilege escalation vulnerabilities tracked as CVE-2026-0251 in the Palo Alto Networks GlobalProtect app that allow a non administrative local user to execute arbitrary commands as the NT AUTHORITY SYSTEM account on Windows and as root on macOS and Linux. No special configuration is required to be affected, the issues are rated medium severity with a CVSS score of 5.9, and Palo Alto Networks reports no known active exploitation. Affected desktop releases include GlobalProtect 6.0, 6.2, and 6.3 with fixed updates available such as 6.0.13, 6.2.8 h10, and 6.3.3 h9 or later, while iOS, Android, Chrome OS, and UWP builds are not affected. There are no known workarounds and administrators are advised to upgrade impacted clients to the published fixed versions to mitigate the vulnerability.

Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks

www.bleepingcomputer.com · a month ago

A threat actor tracked as DriveSurge has been operating large-scale malware distribution campaigns using ClickFix and FakeUpdates techniques on compromised sites.

Red Hat npm packages compromised to steal developer credentials

www.bleepingcomputer.com · a month ago

More than 30 npm packages under Red Hat's '@redhat-cloud-services' namespace were compromised in a supply-chain attack that distributed a new variant of the Shai-Hulud credential-stealing malware, dubbed "Miasma."

Spain arrests doxer leaking sensitive data of govt employees

www.bleepingcomputer.com · a month ago

The Spanish National Police has arrested an individual for leaking sensitive information related to members of various key state organizations, including the National Cybersecurity Institute (INCIBE).

Anthropic to Open Mythos AI to EU's ENISA

www.darkreading.com · a month ago

The European security agency's entry to Project Glasswing is the result of "strong bilateral cooperation" between the European Commission and Anthropic.

Blind POST SSRF in phpBB 4.0.0-alhpa1 Web Push (CVD with phpBB)

syntetisk.tech · a month ago

A medium severity flaw exists in the web push notification subsystem of phpBB 4.0.0-alpha1, allowing unvalidated user input to be stored as a server endpoint. This vulnerability enables a registered user to trick the system into sending notifications via an attacker controlled or internal host upon any subsequent forum event. The issue stems from the lack of URL validation when persisting the push endpoint after a user subscribes. A fix was implemented in phpBB 4.0.0-a2 by requiring an allowlist of known push service HTTPS endpoints.

How Box Created 13 New Types of Jobs Because of A.I.

www.nytimes.com · a month ago

Box, a Silicon Valley software maker, expects to have more employees, not fewer, as it hires A.I. architects, A.I. solutions managers and other new A.I.-related positions.

Microsoft's Zero-Day Legal Threats Spark Backlash

www.darkreading.com · a month ago

After a disgruntled security researcher published several zero-day exploits in recent weeks, Microsoft seemingly indicated criminal charges were in order.

Florida Sues OpenAI Over Chatbot Safety Concerns

www.nytimes.com · a month ago

The state became the first to sue the ChatGPT maker over claims that its technology posed a risk to children and that the company had failed to warn the public of dangers.

WP Maps Pro Vulnerability Exploited to Take Over WordPress Sites

www.securityweek.com · a month ago

Attackers exploited CVE-2026-8732, a critical vulnerability in the WP Maps Pro plugin, to take over WordPress sites. The flaw permitted unauthenticated users to generate new administrator accounts and gain full site control without requiring passwords or capability checks. Defiant highlighted this risk, noting that developers released version 6.1.

Dashlane password manager users locked out by brute force attacks

www.bleepingcomputer.com · a month ago

Multiple Dashlane users have been locked out of their accounts following brute-force attacks that attempted logins from distant locations and unknown devices.

Oracle’s first monthly patch release fixes 35 flaws, including 11 rated ‘critical’

www.csoonline.com · a month ago

Oracle released its first monthly Critical Security Patch Update (CSPU), addressing 35 flaws including 11 critical vulnerabilities across various products. The update prioritizes severe issues like CVE-2026-46840, a CVSS 10 flaw in REST Data Services allowing unauthenticated gateway takeover.

Dutch Police Dismantle Massive 17-Million-Device Botnet

www.securityweek.com · a month ago

Dutch police dismantled a botnet compromising 17 million consumer devices, including computers and smartphones. Authorities seized 200 control servers during the operation after receiving reports from a security researcher to NCSC-NL. The network enabled cybercriminals to execute large-scale attacks through spam, phishing, and DDoS campaigns.

Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm

thehackernews.com · a month ago

A new Mini Shai-Hulud supply chain attack campaign, codenamed Miasma, has compromised @redhat-cloud-services packages to steal credentials and secrets from developer machines and deliver a self-propagating worm. "This is effectively a Mini Shai-Hulud campaign: it uses the same core tactics of install-time execution, credential harvesting, CI/CD targeting, encrypted exfiltration, and potential

Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts

krebsonsecurity.com · a month ago

The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta's "AI support assistant" bot into resetting account passwords.

RaccoonLine Publishes a Breakdown of 7 Structural Differences Between dVPNs and Traditional VPNs

gbhackers.com · a month ago

RaccoonLine published a breakdown comparing decentralized (dVPN) and traditional VPN architectures for enhanced privacy. The report explains that dVPNs avoid single points of failure by routing traffic through numerous independent nodes rather than company-owned servers. These systems use P2P residential IP addresses and VLESS protocols, improving resistance to deep packet inspection systems.

WordPress malware campaign hides payloads in Steam profiles

www.bleepingcomputer.com · a month ago

Nearly 2,000 WordPress websites were infected with malware that relies on Steam Community profile comments to hide command-and-control (C2) data.

Vulnerability Disclosure in the Age of AI

www.schneier.com · a month ago

AI models can now find exploitable software flaws quickly, reshaping security. Responsible disclosure must become a joint national and international effort. Governments and vendors must speed up patching and fund automatic vulnerability repair to meet rising risks.

Google Chrome’s New Feature Takes Aim at Cookie Theft, Account Hijacking

www.techrepublic.com · a month ago

Google Chrome implemented Device Bound Session Credentials (DBSC) to curb account hijacking through cookie theft. This security feature binds user sessions to the specific device, limiting the utility of stolen session cookies.

Critical Windows Netlogon Vulnerability in Attackers’ Crosshairs

www.securityweek.com · a month ago

Centre for Cybersecurity Belgium warns that bad actors exploit CVE-2026-41089, a critical stack-based buffer overflow in Windows Netlogon. Unauthenticated attackers can target domain controllers using this flaw to execute remote code with System privileges. Organizations must patch the service immediately, as exploitation risks compromise core domain authentication functions.

Microsoft investigates Office Apps, Teams file access issues

www.bleepingcomputer.com · a month ago

Microsoft says an ongoing incident is preventing users of its Teams collaboration platform and free Office for the web cloud-based productivity suite from opening files.

Patch Now: Another Palo Alto Auth Bypass Bug Under Active Exploit

www.darkreading.com · a month ago

Exploiting the PAN-OS GlobalProtect VPN vulnerability requires certain conditions, but adversaries have done so in two attack waves that started in mid-May.

Is A.I. Replacing Tech Workers or Providing an Excuse for Job Cuts?

www.nytimes.com · a month ago

Tech industry layoffs are accelerating, and executives have been quick to say it’s because their companies are doing more with artificial intelligence, even when there may be more to it.

Is A.I. Replacing Tech Workers or Providing an Excuse for Job Cuts?

www.nytimes.com · a month ago

Tech industry layoffs are accelerating, and executives have been quick to say it’s because their companies are doing more with artificial intelligence, even when there may be more to it.

China Aims A.I. at Predicting Who Could Pose a Political Risk

www.nytimes.com · a month ago

New research examines how a Chinese company struggled to develop its predictive surveillance technology while U.S. restrictions were in place.

Chinese Military Sought Nvidia Chips for Years, Report Says

www.nytimes.com · a month ago

An analysis of six years of procurement records suggests that the People’s Liberation Army has openly tried to acquire restricted U.S. technology.

Nvidia Has a Plan to Put Its Chips in Personal Computers

www.nytimes.com · a month ago

The world’s most valuable company is chasing Intel and Apple as it tries to bring A.I. agents to laptops and desktops.

Race Against Time: Why Faster Vulnerability Alerts Matter

www.bleepingcomputer.com · a month ago

Attackers are exploiting vulnerabilities faster than many organizations can identify and patch them. SecAlerts explains why faster vulnerability alerts can help reduce exposure and improve response times.

⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More

thehackernews.com · a month ago

Monday hit like a cron job with anger issues. A busted auth path here, a repo-side faceplant there, some "patched-ish" thing already getting chewed on in the wild, and then the usual bonus round: poisoned dev tools, sketchy forum chatter, phishing kits pretending to be productivity, and AI lowering the bar for people who already thought 'curl | sh' had a personality. The vibe is simple: old

Dutch Police and NCSC dismantle 17-million-device botnet running on 200 servers seized from local hosting provider

www.technadu.com · a month ago

The Police and the National Cyber Security Center successfully dismantled a massive botnet controlling seventeen million compromised devices via two hundred servers in the Netherlands. This illicit network infected various hardware to conduct cyberattacks, prompting a joint investigation. To prevent future compromises, security professionals recommend prompt patching, implementing two-factor authentication, and securing network perimeters. Users should also ensure they use strong passwords and only install software from trusted sources.

Attackers Exploit Docker, Kubernetes Misconfigs to Breach Hosts

gbhackers.com · a month ago

Attackers exploit Docker and Kubernetes misconfigurations by targeting weak isolation boundaries and insecure APIs to breach host systems. A recent campaign linked to APT TeamPCP used a supply chain compromise, embedding stealer malware in a Docker Hub repository to steal credentials.

Poisoning Claude Code: One GitHub Issue to Break the Supply Chain

flatt.tech · a month ago

A vulnerability exists in a GitHub Actions workflow provided by Anthropic for integrating Claude Code into CI/CD pipelines. This flaw allows an attacker to bypass permission controls and feed untrusted input into workflows intended only for trusted data. Since the action has broad read and write access, attackers could inject malicious code or steal sensitive repository information. Anthropic acknowledged these issues and addressed them in version v1.0.94.

Critical Magento Cache Plugin Vulnerability Enables Remote Code Execution Attacks

gbhackers.com · a month ago

A critical vulnerability, CVE-2026-45247, affects the Mirasvit Cache Warmer plugin for Magento, enabling unauthenticated Remote Code Execution. Attackers exploit improper input handling within the cache warming cookie when the application uses PHP’s unserialize() function. Users running versions prior to 1.11.12 must update immediately to patch this object injection vulnerability.

Dragos Acquires xIoT Security Firm Phosphorus

www.securityweek.com · a month ago

Cybersecurity firm Dragos acquired IoT specialist Phosphorus to improve security for operational technology infrastructure. This action boosts asset visibility by providing organizations integrated device intelligence across connected networks. Phosphorus’s platform lets companies automate fixes, such as firmware updates and password changes, on many devices.

Stealing Passwords via HTML Injection Under a Strict CSP

afine.com · a month ago

Attackers use methods to steal passwords even when a website implements a strict Content Security Policy. Researchers show HTML injection techniques can bypass CSP protections designed to secure user credentials. This analysis advises developers to implement defense-in-depth strategies beyond simple CSP enforcement.

Critical Windows Netlogon RCE flaw now exploited in attacks

www.bleepingcomputer.com · a month ago

The Centre for Cybersecurity Belgium (CCB), the country's national authority for cybersecurity, warned on Friday that threat actors are now exploiting a recently patched critical Windows Netlogon vulnerability in attacks.

Critical Plesk Vulnerability Lets Users Execute Server Commands

gbhackers.com · a month ago

Researchers identified critical vulnerability CVE-2026-44962 in Plesk for Linux, which permits low-privileged users to execute arbitrary server commands via XPath Injection in the APS Application Catalog search function. This flaw facilitates local privilege escalation by allowing unauthorized manipulation of backend queries. Organizations must upgrade immediately to fixed versions 18.0.76.

Webinar tomorrow: From alert to resolution in network incident response

www.bleepingcomputer.com · a month ago

Network incidents are often detected quickly, but investigations and coordination can delay resolution. Join our webinar tomorrow to learn how automation and AI-assisted workflows can help IT teams accelerate incident response.

Flowise’s MCP implementation can run ghost commands

www.csoonline.com · a month ago

Obsidian Security found a high-severity Remote Code Execution vulnerability (CVE-2026-40933) in Flowise's MCP stdio implementation affecting self-hosted deployments. Attackers can exploit this sandboxing failure via a single malicious chatflow import, executing arbitrary commands with the privileges of the Flowise process.

China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan

thehackernews.com · a month ago

A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic and Taiwan to deliver an AdaptixC2 agent. According to Seqrite Labs, targets of the campaign include government, research, academic, technology, and financial services sectors. The activity entails distributing spear-phishing emails containing ZIP attachments

As the Pentagon Pushes for Battlefield AI, Some Military Leaders Urge Caution

www.securityweek.com · a month ago

The Pentagon advances AI integration into battlefield tools to rapidly identify targets and accelerate strikes. However, leaders like USSOCOM's Admin. Frank Bradley caution that humans must maintain control over all decisions involving lethal force. Furthermore, Special Operations Command personnel suggest leveraging AI mainly for reducing administrative tasks and lowering operator workload.

Microsoft confirms outage affecting MFA, My Sign-Ins platform

www.bleepingcomputer.com · a month ago

Microsoft is working to address an ongoing incident preventing customers from setting up multi-factor authentication (MFA) or accessing the My Sign-Ins platform.

Microsoft fixes outage affecting MFA setup, MySignIn service

www.bleepingcomputer.com · a month ago

Microsoft is working to address an ongoing incident preventing customers from setting up multi-factor authentication (MFA) or accessing the My Sign-Ins platform.